All right, business continuity and disaster recovery activities.
Okay, prevention.
Anything you can do proactively is always
preferential to reactively or correctively.
So, prevention.
Prevention activity involves actions taken to prevent a natural phenomenon or
potential hazard from harming organizations.
Examples, imposing restrictions on processes, restricting organizations from
spending capital on items not listed in DRP or BCP.
You also have alternatives and elimination of single points of failures, etc.
The response, in this process, a set of
activities are implemented after the disaster in order to assess business needs
and reduce and limit the negative impacts of the disaster.
Example, response actions, evacuating
personnel or shutting down systems, and then resumption, pretty self explanatory,
refers to the re commencement of business operations after a disruptive incident.
A robust organizational infrastructure is crucial to the execution of activities,
potential resumption, example of resumption actions.
Continuing operations at a primary or alternate operating location.
We're going to talk about hot sites, warm sites and cold sites.
An alternate site is used in case the
primary location is inaccessible or unusable due to some reason.
Let's talk about hot sites, cold sites, and warm sites for a second.
Okay, subscription sites, meaning you don't own them.
So, an alternate site is typically a
subscription site, at least in normal discussions.
We have a hot site, you have a warm site, and you have a cold site.
Okay, cold sites are ready in days to weeks.
They're generally an empty shell of a
building, and they're minimally configured.
So, you have to add systems, data, and people.
A warm site is ready in hours to days.
It's partially configured, just add data and people.
And it also may allow for some proprietary equipment.
Hot site is ready in minutes to hours.
It's fully configured, just add data and people and go.
The data may already be there.
So, this is the one you're going to spend the most money for.
The warm site, mid-range, and the cold site, less.
So, you have a subscription fee, which is paid on a monthly basis for the
potential of resuming operations at the subscription site.
You have an activation fee and then you have an in-use fee.
So, it's going to cost you money to occupy
this facility, but it's also going to probably cost you a lot more money to buy
a redundant site sitting there doing nothing.
You have a couple of other options around this.
You have mobile
or rolling hot sites, which are prefab buildings or tractor trailers.
You also have service burros, cloud computing.
You've also got dark sites, multiple data centers, things like that.
In these days with cloud solutions, a lot
of the stuff can be relocated to cloud pretty quickly.
A lot of times you have a hybrid
infrastructure anyway between some on premise and cloud environment.
There's also things like reciprocal
agreements, which you are agreeing with potentially even a competitor in the same
industry to potentially move process into their facility and vice versa.
Generally, not the most desirable arrangement, not enforceable.
Again, you've got the possibility of
confidentiality violations, and the company always has the right to prioritize
their business, so they may not even be enforceable.
The recovery and the restoration.
Business continuity recovery includes the actions taken to resume services dependent
on critical business functions, establishing a program, restore the
disaster site and the damaged materials to a stable and usable condition.
Restoration is the process of repairing the old site affected by the disaster,
setting up a completely new alternate site.
Again, in a catastrophe, if the original site is wiped out, you have to set up a
completely new site to resume the business operations.
The phase is concerned with restoring
business operations to normalcy, often involves migration of business functions
from the recovery site to the long-term site.
Sometimes we refer to this as salvage or restoration.
It's based on the assumption that the
mitigation of the most critical business processes from the remote location
precedes the migration of the less critical functions.
You fail over your most critical services
first and you fail them back last just to ensure, because if they're up and running
at the alternate site, you want to keep them running.
They're the last thing to get moved back to the original site.