Radian Compliance Management Services

As business continuity professionals we know that periodic reviews of our plans are critical. Plans can become as stale as last week’s croissants very quickly.

The environments we work in are very volatile. New technologies appear almost on a daily basis. There is more pressure to roll out new lines of business and applications, new threats emerge and resources continue to shrink. The roles of the players who might be involved in recovery change almost constantly.
All of these changes may impact our plans, and our ability to recover, in some fashion. Plans may have to be reviewed, and possibly updated, out of their normal cycles.

This article offers a list of some changes that may occur in the business or infrastructure/technical environments that should be kept in mind as plans are reviewed, as well as some suggestions on tracking changes. These changes might trigger plan reviews and possible plan updates. This article is also intended to raise awareness of change as it impacts business continuity.

Most of us have regular cycles for plan reviews and exercises. But, the timing of changes almost certainly will not follow these cycles. A plan that is reviewed yearly may become out of date within a few weeks or months because of new business functions, reorganizations or new technologies. Tracking the changes that have occurred can give us some indication whether or not a plan should be reviewed and possibly updated out of its normal cycle. Tracking the changes can also help us in carrying out more effective reviews, and holding more effective exercises. The changes that have occurred may point to areas of the plan that should have closer attention, or may help in developing scenarios for exercises.

A thorough review of a business resumption plan can involve some time and effort. For purposes of this article, “review” means at least sitting down with the plan, and any supporting documentation, and reading the plan to check that it is still valid. If the plan is for the recovery of a single unit, the review should include some of the key staff of that unit. If the plan is for the recovery of multiple units, some staff from those units could be involved in the review process. People from units that might support recovery may also be included. Each organization will have its own guidelines for what constitutes a review and who should be involved. A review could lead to updates to the plan, as well as a walkthrough, tabletop exercise, or even a more robust exercise to validate the plan.

>>>>>> Click Here to Read the Entire Article <<<<<<