UNIVERSITY OF SINDH

JAMSHORO

INSTITUTE OF COMMERCE

Submitted By:
 JALIL AHMED 2K14/COM/144

Assignment Topic:

Business Resumption Plan

Submitted To:
Sir Arz Muhammad Brohi
Introduction:
 When we think of Disaster Recovery we often think of occurrences such as a server crashing, a router
going down, or a virus or worm damaging our data. More often than not we are ready for these
situations with backups, a replacement drive, or the ability to divert traffic to another machine. But
implicit in the Disaster Recovery Plan is a critical, although often discounted component – the
Business Resumption or Business Continuity Plan. After all, the key reason for preplanning for
Disaster Recovery is to get up, running, and back to business as soon as possible.
 An effective, workable, and successful Business Resumption Plan is wholly dependent on a
comprehensive Disaster Recovery Plan. Your Disaster Recovery Plan should encompass issues
 The business resumption plan, or BRP, is necessary for your company to get back to business after an
emergency.

Definition:
 The business resumption plan addresses restoration of your business after an emergency.
 The Business Resumption plan deals with how, where, when, and who will be responsible and what
they will do when a significant event occurs. This very well may be a situation where you are starting
from scratch, up to and including the loss of the use and access to your primary location, either
temporarily or long term, but it also encompasses many other degrees of disaster. The disaster could
be the result of incidents such as floods, fires, explosion, contamination, storms, terrorist activities,
political unrest, war and many others whose impact may not be clearly evident. Any one or a
combination of these can result in you needing to reconstruct your critical infrastructure, possibly in
a new location, in the shortest period of time possible.
 The BRP does not contain continuity procedures used during an emergency; instead it focuses on
preventative measures and after the dust settles.
 The BRP helps you get your business back into full running order.
 This is where your Business Resumption plan, entirely dependent upon your Disaster Recovery plan
for its success, comes in. If you have taken the time to think things through, effectively planned,
implemented, and tested your Disaster Recovery Plan you are on your way to getting back to
business.

A good Business Resumption Plan

• Identifies the pre-set arrangements you need to have on "stand-by" in order to get vital functions
operating again with as little delay as possible
• ensures the availability of necessary resources including personnel, information, equipment,
financial arrangements, services and accommodations
• helps an operation to survive an unplanned interruption by making sure essential clients needs can
be met until normal operations are resumed

Goals

 The BRP should reduce loss of life, potential for injury, facility damage and loss of assets and records.
To accomplish this, assess each department to ensure all the appropriate steps are taken. By
simultaneously implementing the BRP, disaster recovery and business contingency plans you should
stabilize your company after a disaster. Make sure to implement the procedures with the correct
priority: employees, customers, facilities, assets then records
Why Prepare?

We all want to be successful in our personal lives and our careers. Our ability to be successful is closely tied
to the degree of success of the organization that we work for. One of the keys to success for any organization
is it’s ability to provide continuity of services to it's clients.

Unfortunately we live in a world of risks that threaten our ability to provide continuity of service. Despite
ongoing improvements to risk management tools such as hazard prevention and emergency preparedness
disasters, both natural and human caused, are occurring with increasing regularity around the world.
Manitoba is no exception: floods, major transportation accidents, fires, windstorms, blizzards and electrical
disruptions are all relatively common and may effect an organization itself and / or the community or region
in which it operates.

Consider the possible impacts of any of these hazardous events on an organization:

• A permanent or temporary loss of personnel due to death or injury.
• Damage to, or total loss of facilities, equipment or information.
• Unavailability of facilities, equipment, information, raw materials or other resources for an extended
period of time.

The likely result of such consequences is an inability to conduct normal operations and provide goods or
services to customers. This may lead to the following ramifications:
• Economic: Loss of customers (market share), revenues (sales) and/or reputation.
• Liability: Resulting from a failure to meet contract obligations, or to take reasonable precautions to protect
people.

Floods, like many other hazards have farther reaching implications than one might normally appreciate.
Consider not only the direct and damaging impacts of this event but also a few of the secondary implications
such as restricted access to resources due to a compromised transportation network as well as the longer
term problems such as contamination of sites by pollutants.

How well do most organizations fare after such events? Not well: The Financial Times of Canada estimates
that between 70 - 90% of all businesses fail to reopen their doors to the public after being struck by disaster.
In addition to loss of services, the inability of organizations to survive also adds to the amount of stress on a
community through such factors as increased unemployment.
This situation is largely due to the fact that very few organizations think about, much less plan or otherwise
prepare for, disaster. As a result, in the attempt to rebuild and resume business in unfamiliar, difficult and
often confusing circumstances, lack of coordination results in costly delays and errors.

There are several key areas you must deal with

1. Establish a Business Resumption Planning Committee
Project Leader
Project Plan/Control
Committee Selection
Assign Responsibilities
 Regular Committee Meetings
Periodic Management Briefings

2. Perform a Business Resumption Capability Assessment

- if a disruption were to occur today, how quickly and fully could you resume
Business/services?
Security Check List
Recovery Analysis
Task Assignments

1. Perform a Risk Analysis

Risk Assessment
Risk Management
Evaluate Threats
Establish Controls
Review Security Measures

2. Analyze and Define Requirements for Recovery

Hardware
Software - system and application software
Communications
Back-up Data
Physical Facility
Vendor Support
Inter-Campus or Commonwealth Agency (MITC) Support
Personnel
Security
Office Equipment
Forms/Paper Supplies
Logistics
Storage
Funding/Purchase Orders

3. Design and Document the BRP for Recovery Operations

Organization
Damage Assessment Team
User Liaison Team (if needed)
Communications
Team Operations
Team Security/Back-up Team
System Software Team
Procurement Team
Facilities Team
Identify Processes Required
Develop Procedures (by team)
Risk Manager or University Audit Review and Approval
Where to Start
1) Some prerequisites for successful Business Resumption Planning
 Senior management must be actively involved in the development of the business resumption plan.
 They must:
• agree to the need for such a plan
• assign the necessary resources for plan development
• concur in the selection of essential activities and priority for recovery
• agree to back-up arrangements and the costs involved
• be prepared to authorize activation of the plan, should the need arise

2) A large organization should have a project coordinator to develop the plan. The plan should be
developed with input from managers and employees at all levels who will be involved in
implementing the plan

3) Personnel
 Have key employees seen the business plan and are all employees aware that there is such a plan?
 Have employees been told their specific roles and responsibilities if the business resumption plan is
put into effect?
 Have information sessions on business resumption plan been held?
 Does your business resumption plan include home/ pager/ cellular/ numbers of personnel
with key roles in the implementation of the plan, and are they available on a 7 X 24 basis if
necessary, (vacation, etc.)?
 Do designated employees know who does what in the event of an emergency?
 Have people with special needs been identified and provisions made for them?
 Does your business resumption plan provide a means for replacement staff when necessary?

4) Building Premises

Consider the condition of your buildings, old, recently retrofitted or new and the impact this may have on
some details of your business resumption plan.

• Do you have access to a building engineer who can inspect the building and facilities soon
after a disaster so that damage can be identified and repaired to make the premises safe for
the return of employees as soon as possible?
• Is there a plan for the regular inspection of the buildings and facilities, with an inspection
checklist?
• Are there hazards in neighboring and adjacent buildings that could endanger life or your
business / organization?
• Do you have plans for alternative shelter, if needed?
• Do employees know where the alternative facilities are located?
• What is the risk of failure of such systems as electrical power, natural gas, toxic chemical
containers, and pipes?
• Are toxic materials safely stored?
• If public or general transportation is disrupted, will that affect your operations? Has this
been considered in your business resumption plan?
5) Information Technology

• What arrangements exist for emergency telecommunications?

• Have provisions been made so that employees can communicate with their families without
overloading telephone circuits?
• Is there a plan for alternative means of data transmission if the computer network is
interrupted? Is the plan in writing? Are key staff aware of it? Has the security of alternative
means of transmission been considered?
• How frequently do you test your recovery plan for electronic data processing? For
communications during an emergency?
• Does your business resumption plan incorporate a review of computer operations and
analyze networking and interdependent systems?
• Are computers protected from leakage from fire sprinklers and pipes on upper floors?
• Does your business resumption plan consider accessibility to a back up power generator?
Power conditioning?

 6) Administrative procedures
• Does your business resumption plan cover administrative and management aspects in
addition to operations? Is there a management plan to maintain operations if your
headquarters is severely damaged or if access is denied or limited for an extended period of
time?
• If some or all of senior management are unable to work, does your business resumption plan
have procedures that will enable others to assume these responsibilities? (Is there an
executive succession plan?)
• Is there a designated emergency operations center where incident management teams can
co-ordinate response and recovery?
• Have essential records been identified? Do you have a duplicate set of essential records
stored in a secure and approved location?
• Are essential records separated for easy retrieval from those that will not be needed
immediately? • Does your business resumption plan include the names and numbers of
suppliers of essential equipment and other material?
• Is there a procedure to check the protective and emergency devices in offices? (alarm
systems, security procedures)

7) Contracts

• Do any of your contractors provide a service or deliver goods that are essential to the
continued operation of your business and if so do these contractors have business
resumption plans in case they are also affected by the same disruption that has interrupted
the functioning of your business? • Have alternative sources of supply been established?
Although these are only an outline of the prerequisites for a BRP, they provide an excellent
starting point for our discussion. As you can see significantly more than just computers and
technology is involved. We will now expand on some of the primary points, and try to bring
them into the context of the overall Business Resumption Planning process.
Development Phases
1. The first phase requires obtaining senior management commitment; developing and
communicating, a BRP policy and assembling a team to develop the plan.
2. The plan is based on information from a review of the business activities that support the
organizations products and services. The results of this step are a determination of the order
of restoration of business functions and the resources required to support each of these
functions.
3. The third phase is the actual writing of the business resumption plan. This involves using the
information from the previous step to develop a recovery structure that meets the needs of
the organization, staffing the structure, assigning planning responsibilities one of which is the
development of activity sheets for all key players which is the backbone of the BRP.
4. The fourth phase includes writing other components of the plan and combining these with
the activity sheets into a plan.
5. The fifth and final phase is the implementation and maintenance of the BRP. Implementation
includes gaining management approval and training staff in the content and their roles in the
plan. Maintenance requires that the plan be properly stored, tested and updated so that it is
a current and effective tool for responding to the effects s of a disaster.

Conclusion

The inability of an organization to recover its ability to deliver goods and services in a timely and cost
effective manner typically results in significant financial stress and often leads to the failure of the
organization. Business Resumption planning as demonstrated is an effective tool in maintaining continuity of
services and substantially increasing the odds of an organization surviving a disaster