• 25Jan

    Survey reveals widespread vulnerability to email outages

    Today, January 25, 2008, 9:55:20 AMGo to full article
    But many companies fail to implement high availability solutions or develop disaster recovery plans.

    Majority of malicious websites are now legitimate sites compromised by attackers

    Today, January 25, 2008, 9:55:20 AMGo to full article
    According to Websense Security Labs report.

    Risk Management d/b/a Business Continuity

    Originally posted by John Glenn in Untagged - DRJ.com

     

    I’ve been telling people for years that I am a Business Continuity practitioner.

    The typical response is: "What’s that?"

    I then go into my spiel. Sometimes I hold their attention, sometimes not.

    But I was talking with a Business Continuity planner the other day who got me to thinking maybe I should list "Risk Management" on my businesscard in lieu of Business Continuity.

    That is, after all, what Business Continuity is all about: risk management.

    No fancy terms people have difficulty grasping. No buzz words du jour such as "Resiliency Planning," which, were it not for spell check, I probably would misspell every time I wrote it.

    Nope. Risk Management. Gets to the point and most people understand both words, singularly and together.

    As an old reporter, I should have paid closer attention to my audience and addressed the audience’s "Business Continuity" comprehension level.

    There is nothing wrong with "Business Continuity" other than the only ones who think they understand the term are in the business.

    Practitioners still can stick modifiers in front of the term: Enterprise Risk Management, IT Risk Management, Profit Center Risk Management.

    What do we do, after all?

    Having identified processes, we look for risks to those processes.

    Then we seek ways to avoid or mitigate (manage) the risks.

    Finally, we train people to respond to (manage) those risks.

    We still can have process re-engineering, and succession planning, and personnel safety & awareness, and employee retention, and . . . And all the other functions which go into a comprehensive Business Continuity plan since, one way or another, overlooking any of the functions constitutes - would you believe - a risk.

    I still am a Business Continuity practitioner, and I’ll still accept Business Continuity engagement offers, but I think I’ll get back to the basics and promote myself for what I really am - and what prospects will understand - a risk manager.

    Here’s a thought. Billing ourselves as "Business Continuity" practitioners is a risk - a risk that the people we’re addressing won’t understand Business Continuity and how it benefits them. Manage that risk by either re-titling ourselves or explaining in a sub-head that Business Continuity is "Risk Management."

    jg

    Business Continuity Practitioner
    (Risk Management Practitioner) 

  • 24Jan

    Reboot Your Records Retention Strategy

    1.15 Under the Federal Rules of Civil Procedure (FRCP), organizations must demonstrate that their electronic information is complete, accessible, and reliable. As a result, companies must formalize their retention management strategy and rapidly put in place the organizational and technological changes required to retrieve any given record. more…

    US National Response Framework released

    Yesterday, January 23, 2008, 8:53:28 AMGo to full article
    Mixed response to National Response Plan successor.
     

    IT-related business continuity threats on the increase

    Yesterday, January 23, 2008, 8:53:28 AMGo to full article
    According to latest SteelEye Business Continuity Index survey.
     

    E-Z Data Receives ISO 27001 Certification

    Monday, January 21, 2008, 12:00:00 AMGo to full article
    Data, provider of front-office systems for insurance companies, general agents, banks, Investment dealers, agents, and financial advisors, announced that it has received ISO 27001 certification. ISO, the International Standards Organization, creates standards that specify worldwide requirements for products, services, processes, materials and systems. ISO 27001 is the new international standard created specifically for Information Security Management Systems. In our industry, independent agents and financial advisors must be assured of the security of their client data, said Scott Weber, Assistant Vice President of Operations Technology for PartnersFinancial/NFP in Austin, TX. E-Z Data?s ISO 27001 certification gives us even greater confidence in the fact that our member firms? data is as secure as it can possibly be.
     

    IT and Compliance: 10 Big Predictions for 2008

    Wednesday, January 02, 2008, 2:00:00 AMGo to full article
    Service-oriented IT processes and technologies will help managers bring the enterprise into line in 2008—perhaps not a moment too soon. We can’t shake the feeling that something big and very bad is lurking ’round the corner. Grab a security blanket and carefully read on for the hopes and horrors of 2008.
  • 23Jan

    PL 110 – 53 Title IX

    On Aug 3, 2007, President Bush signed into law ‘PL110 – 53 Implementing Recommendations of the 9/11 Commission Act of 2007’. One of the provisions of the law – Title IX - was to call for businesses of all sizes to voluntarily plan for and be prepared for a disaster or emergency.

    A key provision to Title IX, directs the Department of Homeland Security (DHS) to create a voluntary certification program for private sector preparedness. This program should be developed with mutual cooperation between DHS and qualified private sector entities.

     To this end a number of initiatives have begun including a national forum sponsored by the Sloan Foundation. Their findings were published in the last couple of weeks and can be found at http://www.nyu.edu/intercep.

    Having recently participated in BSI’s October launch of BS25999- Business Continuity Management System, I whole-heartedly agree that a standard is needed that is developed by knowledgeable parties and allows for accreditation of the company, and not the continuity professional who developed a company’s plan. It is through this type of company accreditation that businesses large and small can build plans based on a common framework. This consistency of framework, then allows companies to speak a consistent language and address continuity issues throughout the supple chain.

    BS25999 which places emphasis on the creation of a management system which provides for continuous improvement and also provides an auditable standard for a companies Business Continuity Management effort, is a good example of a standard that allows companies flexibility to develop their plans and yet provides a common guide to those plans. Another benefit of the standard is that it provides a company focus to move the plan from a project to an integrated part of the companies overall management system.

     Its an exciting time to be part of the Business Continuity Community with the legislative and private sectors moving closer to an understanding that businesses need BC Management in order ‘Expect the Unexpected’ and respond appropriately.