! Rating: This presentation has been rated
! Stir in ¼ of required DR Budget! Produce one (1) DR Plan for Audit
! Add a dash of Management ambivalence! Place DR Plan on shelf for 1 to 2 years
! Your most important asset is a trained staff.
! Information is required, but without people,
! For information purposes only, the following are the
steps which would be followed for a formal BCPeffort:
– Developing Business Continuity Strategies
– Developing and Implementing Business Continuity Plans
– Maintaining and Exercising Business Continuity Plans
– Public Relations and Crisis Coordination
• Pro-active planning to ensure the continued successful
• Activities planned and prepared to respond to a
significant interruption of business operations.
! A Disaster is any event which adversely
effects your capability to support theBusiness needs of your customers.
! This can range from a three hour isolation
from the internet to the loss of the WorldTrade Center.
! CEO: Require Planning; Approve Budget! Business Unit Heads: Define Requirements to
support customers; Build BCP into Budgets
! Business Operations: Determine viable alternatives
! Support Operations: Define how and where
! Data Content Owners: Specify backup frequency and
! Desktop Computer Users: Schedule backups
! Training and information is available from
– http://www.drii.org/ (Dis. Rec. Inst. Int.)
– http://www.drj.com/ (Dis. Rec. Journal)
! Planning the response to an internal event
will cover most of the external events also.
– Inability to deliver Product to customers
– Inability to identify or contact customers
! Communication is the key to successfully
building, maintaining and using a BC Plan.
! Internal communications are critical.
– Emergency Notification Network (Corporate)
– Business Unit/Department contact lists
– Supervisor contact lists, both direct report and
! Use more than one method of accessing contact lists
(paper, PDA, laptop, website, etc.) and staff contact(cell phone, pager, PDA, web, home phone, etc.).
– Crisis Command Center (Corporate response)
– Local Control Center (Local response)
– Customer contact capability (Business Unit)
– Vendor communication/redirection (Procurement)
– Corporate resource response (Infrastructure Support)
– Employee notification (Alternate work location)
! Suggestion: One web accessible directory.
! Business Units should include worldwide
contacts within their unit (vertical reportingchain).
between Business Units (horizontal, lateral,outsource vendor personnel, etc.).
! The contact numbers must be kept current
and maintained as confidential information.
processing requires quick notification ofmultiple groups.
– IT Processing, to evaluate what needs to be
– Real Estate, if an alternate location is needed
– Data Content Owners, to validate information
! Notification should follow a tested plan.
sufficient resources forBusiness Continuity andDaily Operations.
The Wall Street Journal, Monday, January 29, 2001
“Trial by Fire” by Almar Latour
In March, 2000, a lightning strike at a Philips N.V. semiconductor plant
in New Mexico drastically impacted two companies, 4000 miles away.
Nokia and Ericsson both used the chips produced in their hand-held
phones. Nokia scrambled and met production requirements with no
revenue loss. Ericsson could not respond as effectively. Their
estimated revenue losses from the fire were $400 million. Ericsson
posted a $1.68 billion loss for their mobile phone division last year.
The net effect of the lightning strike: Nokia’s hand-held phone share
of the world market is now 30%, up from 27% last year. Ericsson’s
share has fallen to 9% from last year’s 12%.
Total Sales: $27.7 B
Total Sales: $28.5 B
! A vital record is defined as one that is essential for
preserving, continuing or reconstructing theoperations of the organization and protecting therights of the organization, it’s employees, it’scustomers and it’s stockholders.
! Vital records must be duplicated and moved to a
geographically diverse safe offsite location, one thatis secure from any probable common catastropheoccurring at the location where the original record isstored.
The Recovery Point Objective (RPO) is defined by the Data
Content Owner of an IT application. It is the point intime that the application must be restored to.
The Recovery Time Objective (RTO) is defined by the Data
Content Owner of an IT application. It is the time fromdisaster declaration to the restoration of the application.
The following are used by the Data Content Owners in
How long an outage can the business tolerate before it is injeopardy of going out of business?
How much data can the business afford to lose?
What type of regulations affect how quickly critical businessdata must be restored?
! Due to the integration of IT resources, the
loss of even one application can have adrastic effect on business capabilities.
! Identifying application dependencies, and
the impact on customers, will define therestoration requirements for eachapplication.
! Retention schedule adherence ensures other
copies are available if a problem occursduring data restoration.
! IT BCP should be based on the requirements
of critical application(s) hosted on aprocessor. The application availabilityrequirements will define the processorreplacement time frame. These timerequirements translate into the alternateprocessing location infrastructure availabilityrequirements.
! With adequate funding available, this is the
beginning of an effective IT BC Plan.
! Data storage requirements are moving to
high availability in multitiered, distributedand complex environments, some withmultiterabytes of information.
! Mirror imaging, virtual vaulting, on-line
backups and outsourcing to a securelymanaged offsite facility are options, buteach have IT expertise requirements andbudget impacts.
! The proof of how well your BC plan meets
your business needs is in your test results.
! Testing can be costly, but worthwhile.
! Note: A great test can have many things go
! IT testing can be incorporated into Business
! Virtual, or table top, testing of overall
Business Continuity Plans can identify areasof weakness across multiple levels of thebusiness and support departments.
– Outside assistance is available, if desired
– Checklists developed can ensure weak areas are
! Retention schedules are approved by your
legal department for a reason. Everythingwithin your company is available for legaldiscovery.
! Key personnel may need to work in diverse
! Re-Insurance costs are skyrocketing.
! Outsource contracts, 3rd party vendors, service
contracts: Is BCP required and performed toyour specifications and satisfaction?
! Do your vendors have tested BC Plans?! If you have the capability, have you offered
BCP assistance to your largest customers? Dothey need it?
! Does your infrastructure hide a threat?
Transformers with PCB’s, insulation withasbestos, etc.
perform and maintain an inventory ofequipment, software, access ports and IPaddresses. (Keep a copy offsite)
! Affordable training for internal staff can
balanced against the potential inability tosupport your customers.
! Once a plan has been developed, you may find
other uses for the information gathered.
– The identification of equipment installed can be
used as a strategic tool for contract negotiations,etc.
– Insurance or Re-insurance premiums may be
– Documentation of each business location and the
function(s) performed there may be useful indeveloping alternate recovery strategies.
Bell Labs Innovations
Dwight C. Sawin
600 Mountain AvenueMurray Hill, NJ 07974-0636
Business Continuity Manager
DO FAMILY FIRMS AND NON-FAMILY FIRMS DIFFER IN INVESTING? Evidence on Finnish SMEs Abstract The aim of this study is to examine whether family firms and non-family firms differ in investment behaviour. More precisely, I investigate whether family ownership has an impact on whether a firm rejects investments or not, and whether family ownership has an influence on the amou
PRACTICE GUIDELINES Updated Guidelines for the Diagnosis and Treatment ofGastroesophageal Reflux DiseaseKenneth R. DeVault M.D., F.A.C.G., and Donald O. Castell M.D., M.A.C.G. Departments of Medicine, Mayo Clinic College of Medicine, Jacksonville, Florida; and Medical University ofSouth Carolina, Charleston, South Carolina Guidelines for the diagnosis and treatment of gastroesophageal reflux