Now we're going to move into Section 9 in which we will discuss how to employ the metrics we have just discussed in Section 8 in the building of business continuity and disaster recovery plans. There are many terms that cover the activities that we are about to discuss. Our term is business continuity, or BC. Another term is disaster recovery, or DR. One term often used by the government is continuity of operations planning, or COOP, C-O-O-P. Whichever term you use, whether business continuity or disaster recovery, what you are depicting is two complimentary pieces of the spectrum of activities to preserve a business against various levels and types of adverse events.

The business continuity works throughout normal to abnormal and back to normal operations. Thus, the BC portion of the spectrum will function during all types and levels of operation. Similarly, the DR portion operates only after an adverse event has caused an outage. Taken together, these two are complimentary, to face normal operations and to recover quickly from adverse impacts to restore normal operations.

The BC portion of the plan therefore focuses on the business or operational element in order to keep it running during all of these differing situations and conditions. In complementary fashion, the DR portion focuses on the event and attempts to minimize the effects of the adverse event on the business and recover to normal operations.

We have already discussed the ALE calculation and what it contributes to the BC/DR composition effort. The business impact analysis, or BIA, is the process by which we derive the vast majority of these metrics and values. The primary function then of the BIA is to calculate various scenarios of impact and outage and determine what the actual business effect, whether operationally or financially, will be and to place a value on this.

\By focusing on the business, it helps us understand what the actual operational and monetary impact will be should any form of adverse event occur and take the business out of normal operations for some period of time. It is important to realize that a BIA is not a replacement for a risk assessment. These two assessment processes are, in fact, complimentary.

Risk assessment looks at potential impacts, probabilities of occurrence, and likely values of impact, while the BIA looks at these kinds of scenarios and assesses what the value is going to be of these adverse impacts on the business itself and attempts to calculate those effects and their losses.

From these two different assessment processes, we should derive values, times frames, and criticalities of operational components. Once completed, these timeframes and criticalities will help us determine the priority order in which the operational components will be recovered.

Now, as we described before, the risk analysis process will, without question, be a combination of qualitative and quantitative methods. Qualitative being the way that we construct a scenario, and quantitative being the set of calculations we do to determine financial and other types of impacts.

The BIA is similarly constructed on a qualitative dash quantitative combined form. One of the most important aspects is helping us to understand not only what events are likely to occur, these calculations speak of probable, not possible, events, but what sorts of impacts they will cause in relation to the effects it will have on our business. It is from these then that we will determine what sorts of controls and countermeasures will be employed to effectively mitigate or reduce the amount of adverse impact our business may suffer should any of these events occur.

So our primary goals are to determine and then prioritize component criticality, estimate downtimes as both RTO and MTD, and then identify resource requirements in terms of quantities, qualities, and types of resources that we will required to achieve these goals. From these, we will create the business continuity plan and its companion volume, the disaster recovery plan.

As you see in the graphic, the business continuity plan is organized as a good project. We initiate and manage it as such, performing risk analyses and business impact analyses as necessary, development of a continuity strategy, and produce a final plan. The strategy and the BCP documentation produced in this project phase will then be used as primary inputs to the development of the recovery strategy.

Once again, we organize it as a good project. Our deliverable, in this case, will be a disaster recovery plan, training requirements and methods, training and documentation requirements, at a testing strategy to ensure that the plan is routinely tested and updated whenever needed.

As we have said before, the BCP is considered to be protective in that it is more proactive than reactive, bearing in mind that the BCP portion functions throughout all normal and non-normal operations, focusing on the business to keep it running. In like manner, the DRP portion is considered to be responsive, that is more focused on reaction than proaction.