text: Phase 1 Phase 2

text: Select Risk Critical Assets Profile Identification

text: Phase 3 Phase 4

text: Controls Implementation Plan Implementation Controls and Selection Management Business Continuity Plan

text: Asset Control Org. Control Cards Asset Control Org. Control Cards Cards Org. Control Cards Cards Organizational Asset Based Continuity Controls Continuity Controls

text: High HN.1.1.1 - HN.1.1.2 HN.1.2.1 - HN.1.2.2 HN.1.3.1 - HN.1.3.2

text: HN.1.1.3 - HN.1.1.4 HN.1.2.3 - HN.1.2.4 HN.1.3.3

text: HN.1.1.5 - HN.1.1.6 HN.1.2.5

text: ty HN.1.1.7

text: P Medium HN.1.1.1 - HN.1.1.2 HN.1.2.1 - HN.1.2.2 HN.1.3.1 - HN.1.3.3

text: ve HN.1.1.5 - HN.1.1.6 HN.1.2.5

text: R HN.1.1.7

text: Low HN.1.1.1 - HN.1.1.7 HN.1.2.1 HN.1.3.3

text: Recovery Actions RA.1.1.2 – RA.1.1.5 RA.1.2.1 - RA.1.2.4 RA.1.3.1 - RA.1.3.2

text: Areas Use Risk Profile Evaluation Table to mark applicable risk areas (Legal and Regulatory, Productivity, Financial Stability, Marketing) and risk levels (high, medium, low)

text: Identify Business Risk Profile. Typically highest risk is taken for the overall business risk profile.

text: Business Function In this step the critical business Selection functions are identified. Business Continuity Plan will focus on the protection of these critical functions to avoid a break in business continuity

text: Select Asset Key driver is the business function decomposition, in terms of the

text: underpinning assets that each function requires in order to be delivered. Asset Continuity This step is concerned with the Requirement analysis of the continuity Analysis requirements of the identified assets used to provide the organization’s business functions

text: Control Cards Select Organizational Organizational Controls cards contain Control Cards controls applicable to the organization horizontally and are concerned with practices and management procedures.

text: Asset Based Control Cards that focus on Critical Assets and are Asset Category Specific

text: Document List of Documentation of selected controls and rationale for selecting each

text: control for future reference during phase 4

text: High HN.1.1.1 - HN.1.1.7 HN.1.2.1 - HN.1.2.5 HN.1.3.3

text: ve HN.1.1.1 HN.1.2.1 -

text: Low HN.1.1.1 HN.1.2.1 -

text: High A.1.1.1 - A.1.1.3 - A.1.1.4 A.1.2.1 - A.1.2.2

text: ori A.1.1.6

text: Medium A.1.1.1 - A.1.1.4 A.1.2.1 - A.1.2.2

text: Low A.1.1.1 A.1.2.1 - A.1.2.2

text: Recovery Actions RA.1.1.3 - RA.1.1.6 RA.1.2.1

text: ty High D.1.1.1 - D.1.1.5 D.1.2.1 - D.1.2.3 - D.1.2.5

text: ry Medium D.1.1.5 D.1.2.1 - D.1.2.5

text: e D.1.1.5 D.1.2.1

text: Recovery Actions RA.1.1.1 - RA.1.1.5 RA.1.2.5

text: High F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.4 - F.1.3.5

text: F.1.1.3 - F.1.1.4 F.1.2.4 F.1.3.6

text: P Medium F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.5 - F.1.3.6

text: ve F.1.1.3 - F.1.1.4

text: Low F.1.1.2 - F.1.1.3 F.1.2.2 - F.1.2.3 -

text: Perform Gap Analysis Evaluate your organization's current business continuity practices against the catalogue of controls as these are depicted from the control cards

text: Controls Based on the output of gap analysis Implementation Plan decide which controls will be implemented and prioritize their integration

text: Deliver Business Based on the output of the previous phases Continuity Plan and steps deliver the organization’s Business Continuity Plan determining the recovery strategy for each identified critical business function

text: HN.1.1.5 - HN.1.1.6 HN.1.2.5

text: ty HN.1.1.7

text: ve HN.1.1.5 - HN.1.1.6 HN.1.2.5

text: R HN.1.1.7

text: High A.1.1.1 - A.1.1.2 - A.1.1.3 A.1.2.1 - A.1.2.2

text: A.1.1.4 - A.1.1.5 - A.1.1.6

text: A.1.1.7 - A.1.1.8

text: ry Medium A.1.1.1 - A.1.1.2 - A.1.1.3 A.1.2.1 - A.1.2.2

text: A.1.1.4 - A.1.1.5 - A.1.1.6

text: Low A.1.1.1 - A.1.1.3 - A.1.1.4 A.1.2.1 - A.1.2.2

text: High D.1.1.1 - D.1.1.2 -D.1.1.3 D.1.2.1 - D.1.2.2 - D.1.2.3 -

text: ori D.1.1.4 - D.1.1.5 D.1.2.5

text: Medium D.1.1.1 - D.1.1.2 - D.1.1.5 D.1.2.1 - D.1.2.3 - D.1.2.5

text: R D.1.1.1 - D.1.1.5 D.1.2.1 - D.1.2.3 - D.1.2.5

text: Recovery Actions RA.1.1.1 - RA.1.1.2 - RA.1.1.3 – RA.1.2.1 - RA.1.2.2 - RA.1.2.3 - RA.1.1.4 - RA.1.1.5 RA.1.2.4 - RA.1.2.5

text: High P.1.1.1- P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.2 – P.1.2.3 – P.1.2.4

text: ori Medium P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.2 - P.1.2.3 – P.1.2.4

text: Low P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.4

text: High F.1.1.1 - F.1.1.2 F.1.2.1 - F.1.2.2 F.1.3.1 - F.1.3.2

text: F.1.1.3 - F.1.1.4 F.1.2.3 - F.1.2.4 F.1.3.3 - F.1.3.4

text: F.1.1.5 - F.1.1.6 F.1.2.5 F.1.3.5 - F.1.3.6

text: F.1.1.7 - F.1.1.8

text: ori Medium F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.2 - F.1.3.3

text: ry F.1.1.3 - F.1.1.5 F.1.2.4 - F.1.2.5 F.1.3.4 - F.1.3.5

text: co F.1.1.5 - F.1.1.6 F.1.3.6

text: R F.1.1.7

text: Low F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.4 - F.1.3.5

text: F.1.1.3 - F.1.1.4 F.1.2.4 F.1.3.6

text: Recovery Actions RA.1.1.1 – RA.1.1.2 - RA.1.2.1 RA.1.3.2 – RA.1.3.3 RA.1.1.3 – RA.1.1.4 - RA.1.1.5 – RA.1.1.6 - RA.1.1.7 – RA.1.1.8

text: High HN.1.1.1 - HN.1.1.2 HN.1.2.1 - HN.1.2.2 HN.1.3.1 - HN.1.3.3

text: HN.1.1.5 - HN.1.1.6 HN.1.2.5

text: ori HN.1.1.7

text: Medium HN.1.1.1 - HN.1.1.2 HN.1.2.1 - HN.1.2.5 HN.1.3.3

text: e HN.1.1.7

text: Low HN.1.1.1 - HN.1.1.2 HN.1.2.1 HN.1.3.3

text: Recovery Actions RA.1.1.2 RA.1.2.1 - RA.1.2.2 RA.1.3.1 - RA.1.3.2

text: High A.1.1.1 - A.1.1.2 - A.1.1.3 A.1.2.1 - A.1.2.2 ty A.1.1.4 - A.1.1.5 - A.1.1.6

text: Medium A.1.1.1 - A.1.1.3 - A.1.1.4 A.1.2.1 - A.1.2.2

text: Low A.1.1.1 - A.1.1.4 - A.1.1.6 A.1.2.1 - A.1.2.2

text: High D.1.1.1 - D.1.1.2 - D.1.1.5 D.1.2.1 - D.1.2.3 - D.1.2.5

text: ori Medium D.1.1.1 - D.1.1.5 D.1.2.1 - D.1.2.5

text: Low D.1.1.1 - D.1.1.5 D.1.2.1 – D.1.2.5

text: Recovery Actions RA.1.1.1 - RA.1.1.2 - RA.1.1.5 RA.1.2.5

text: High P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.2 – P.1.2.3 – P.1.2.4

text: ori Medium P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.2 - P.1.2.4

text: Low P.1.1.3 P.1.2.4

text: High F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.2 - F.1.3.3

text: F.1.1.3 - F.1.1.5 F.1.2.4 - F.1.2.5 F.1.3.4 - F.1.3.6

text: F.1.1.4 - F.1.1.6

text: ri F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.3 - F.1.3.4

text: ve F.1.1.3 – F.1.1.4 F.1.2.4

text: e F.1.1.7

text: Low F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.4

text: F.1.1.3 - F.1.1.4

text: ty High HN.1.1.1 – HN.1.1.5 HN.1.2.1 - HN.1.2.5 HN.1.3.3 ori HN.1.1.7

text: ry HN.1.1.1 HN.1.2.1 -

text: R Low HN.1.1.1 HN.1.2.1 -

text: ori A.1.1.6

text: R A.1.1.1 A.1.2.1 - A.1.2.2

text: High D.1.1.1 - D.1.1.5 D.1.2.1 - D.1.2.3 - D.1.2.4 - D.1.2.5

text: ori Medium D.1.1.5 D.1.2.1 - D.1.2.4 - D.1.2.5

text: Low D.1.1.5 D.1.2.1 - D.1.2.4 - D.1.2.5

text: High P.1.1.2 – P.1.1.3 P.1.2.1- P.1.2.2 - P.1.2.3 - P.1.2.4

text: ori Medium P.1.1.3 P.1.2.4

text: Low P.1.1.3 -

text: High F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.4

text: F.1.1.3 - F.1.1.4 F.1.2.4

text: ry Medium F.1.1.1 - F.1.1.2 F.1.2.2 - F.1.2.3 F.1.3.4

text: F.1.1.3 - F.1.1.4

identifier: Business Continuity for SMEs

nummer: business-continuity-for-smes

title: Business Continuity for SMEs

text: IT Business Continuity Management

text: January 10 An approach for Small Medium Sized Organizations About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors. Contact details: For contacting ENISA or for general enquiries on BCP for SMEs, please use the following details: e-mail: Dr. L. Marinos, Senior Expert — louis.marinos@enisa.europa.eu, Charalambos Koutsouris, Seconded National Expert, charalampos.koutsouris@enisa.europa.eu Internet: http://www.enisa.europa.eu/ Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. © European Network and Information Security Agency (ENISA), 2010 Document Revision: 1.0 This publication is intended for educational and information purposes only. Neither ENISA nor any person acting BCM: An approach for SMEs

text: Executive Summary

text: This document is an ENISA deliverable aiming at facilitating a knowledge transfer of key IT security issues to Small Medium Enterprises (SMEs). This deliverable has been developed outside the ENISA work program and is based on the identified need of SMEs for a simplified approach to IT Business Continuity. After the simplified approach to Risk Management, this document is the second one that comes to cover basic IT security needs of SMEs. The aim of this document is to provide a simplified and comprehensive view of IT Continuity/Business Continuity Management (BCM) for use within small and medium sized enterprises (SMEs). To achieve this goal, the present document has been structured in a modular way. It is made up of various parts each devoted to particular needs of stakeholders involved in the process of establishing a Business Continuity Plan (BCP) as part of their Business Continuity Management process. The philosophy behind the generation of this material was to shield (non-expert) users from the complexity of the activities of BCM. In doing so, some complex security matters have been simplified to the minimum needed to achieve an acceptable level of business continuity. There is no doubt that if a high level of availability is needed the full complexity of Business Continuity Management must be taken into account including a plunge into the fine details of corresponding measures and technology. In this regard, the ideas and approach presented here are thought to cover an acceptable level of availability for small organisations with reduced security budgets. More advanced forms of availability (e.g. such needed for critical infrastructure components) would require a more thorough treatment that is beyond the scope of this document. The present material has been generated by anticipating the whole range of skills of different stakeholders involved in continuity management. The proposed Business Continuity Management process is structured by means of a simplified four-phase assessment approach. We do not assume any advanced knowledge of continuity and availability issues on the part of users of this material. Where this knowledge would be necessary, the present approach represents a “black box” offering a limited number of comprehensive choices. Another criterion that has been taken into account is the cost effectiveness in all phases of Business Continuity Management. The present material can help decision makers to decide which approach is most suitable to their organisation for the assessment of availability risks, based on cost and performance indicators. Furthermore, in the case where self assessment has been selected, this document provides the necessary tools to perform same, without requiring previous experience in this area. The simplified Business Continuity Management approach presented in this document is one example of good practice for assessing availability risks. It is assumed that other similar approaches/good practices exist which could be used instead. In this way the present approach is neither an attempt to replace existing standards nor to redefine good practices. Rather, it is designed to give interested SMEs a tool which they could not easily find elsewhere. The application of the ideas presented here has been demonstrated using an example. The example is presented within the framework of the proposed simplified Business Continuity approach. It is worth mentioning that this document is the second in a series of material that has been released by ENISA to generate awareness about Business Continuity for SMEs. In 2007, ENISA has developed a simplified approach to Risk Assessment / Risk Management for SMEs. The present document follows a similar approach and is compatible to the one of the simplified Risk Management approach. The later has been validated in a series of pilots with multiplier organisations and SMEs with significant success. In a similar way, ENISA activities that will follow in the future embrace the validation of this material via pilot projects in SMEs, evaluation/review through expert teams, dissemination via professional and/or training associations, etc. Final objective is to have a version of this document that can be used by SMEs “as is”, that is, without further improvements/explanations/adaptations. For this reason, we refer to the present document as “beta version” meaning that additional improvements and adjustments will follow after various pilots, deployments and disseminations, leading thus in the middle term to the maturity of the presented material. This document has been developed by the Risk Management Section of the Technical Competence Department of ENISA in cooperation with Obrela Security Industires (OSI).

text: BCM: An approach for SMEs

text: 1. Introduction

text: 1.1 Scope

text: Small and Medium Enterprises (SMEs) are a priority focus area for government economic policy and are considered to be of key importance to socio-economic growth in European Union. SMEs are usually born out of entrepreneurial passion and limited funding, with business systems that are often heterogeneous and independent. Moreover, tangible and intangible business assets of SMEs are rudimentarily defined, and the value of their availability is often only partially known. Business Continuity Management (BCM) is a process that provides a framework ensuring the continuity or uninterrupted provision of critical business functions and operations. It provides a basis for planning to ensure an organization’s long-term survivability following a disruptive event towards the SME “business as usual” functions and services. BCM can be considered as a risk treatment

text: method, complementary of a wider Risk Management method, explicitly focused on the management and containment of continuity risks, introduced by certain natural or man-made threats that, if realized, can cause unavailability of services.

text: Usually, due to the dynamic and ad hoc development of many SMEs, integration of business continuity issues is not systematically addressed in the building-up phase. Thus, policies and frameworks regarding business continuity planning are usually very rudimentary or even non-existent. It is often the case that the basic understanding of business continuity risk in SMEs does not extend much beyond environmental controls to safeguard from natural disasters such as power supply, fire, flood etc. Inadvertent threats pose some of the highest continuity risks to SMEs, and yet personnel training and awareness programmes are often neglected. Far from blaming SME executives for not understanding the critical issue surrounding business continuity, research concludes that SME leadership needs to engage, understand and implement formal business continuity processes, including technical and organizational measures. Without such measures, their organizations may be severely impacted by inadvertent threats / deliberate attacks on their information systems, which could ultimately lead to business failure.

text: 1.2 Purpose

text: Through the presented approach, SMEs will be able to define the appropriate activities towards the successful development, establishment and maintenance of a BCM framework within their business environment. The outcome of this document will be a

text: self-developed Business Continuity Plan (BCP) that SMEs could follow in order to ensure the continuity of their core business functions.

text: The proposed business continuity management approach leads to a quick and encompassing identification and mitigation of continuity risks. This tailored model shall consist the foundation of SMEs business continuity planning, based upon the: □ Special needs and capacities of SMEs in terms of human, IT and budget resources □ Common continuity risk levels typically faced by SMEs. The proposed BCM model focuses explicitly on ensuring and protecting the availability of the core IT assets used to support and provide the organization’s critical business functions (i.e. production, customer relationship, human resource). It should be noted that confidentiality and integrity security requirements of the aforementioned IT assets are not in focus as the latter should be covered under a Risk Management / Risk Assessment process.

text: 1.3 Related disciplines

text: Business Continuity Management is complementary to a broader Risk Management (RM) Framework aiming at the identification of the risks connected to the businesses and the consequences from their occurrence. Risk management embraces the need to manage risk around all the activities that enable an organization to survive, encompassing thus both internal processes and externally offered services. Business Continuity Management encompasses the identification and risk mitigation for those activities upon which the organization depends for its survival, i.e. retain credibility and continue towards the fulfilment of business goals. Through BCM, an organization can recognize what needs to be done before an incident occurs, ensuring that its people, reputation, assets, systems and information are secure and available.

text: BCM: An approach for SMEs

text: As Business Continuity is considered to be an integral part of an overall Risk Management, the proposed BCM approach for SMEs goes along the lines of the necessary RA / RM activities as described in the ENISA deliverable “Information Package for SMEs”. This compatibility seemed to be necessary in order to retain the possibility of integrating the Management of Continuity Risks with a Risk Management/ Risk Assessment approach, leading thus to a modular design of these ENISA deliverables.

text: 2. Structure of Document

text: A modular structure has been given to this document in order to cover the diverse needs of various SME types. Depending on the needs of a particular SME and the extent to which it seeks to cope with business continuity, different parts of the document can be used. For SMEs requiring an overview of business continuity management, for example, the generic part of this document will be useful (see Chapter 3, Guidance for the Decision Maker and Chapter 4, A simplified Approach: Overview). Should an SME decide to implement its Business Continuity Management on its own, the parts of this document containing the detailed description of the business continuity method and the example will be relevant (see Chapter 5. Self Assessment Guidelines with one Example). In the case of a self-assessment, the detailed material found in the annexes will be necessary in order to implement the proposed measures in the organization (see Annex A. organizational Continuity Control cards, Annex B. Asset based Continuity Control Cards and Annex F. Business continuity Plan Template). To give a better view on how this document can be used, we provide some use cases based on the various target groups of this document: □ People with managerial background may consider chapter three targeting decision makers. It provides information about business continuity, while referring to the decision making process required for the establishment of a Business Continuity Plan. Interested managers may like to understand some of the details of the business continuity process as presented in Chapter 4. □ Non-experienced members of an Assessment Team will need to understand the proposed simplified business continuity management approach. They will need to consider some details and go through the developed example presented in Chapter 5. □ Expert members of an Assessment Team will need to read the entire approach and understand all relevant details. They will also need to be in the position to cope with the material presented in the annexes (e.g. presented measures, structure of the BCP, detailed tables for the BCP development, etc.).

text: 3. Guidance for the Decision Maker

text: 3.1 What a decision maker needs to consider

text: Today, the information created, processed, and used by an organization is one of its most valuable assets. The unavailability, loss or destruction of this asset can severely impact an organization, can lead to breach of laws and regulations and negatively affect its brand name. Next to high availability of delivered services/products, main management responsibility is the protection of human life and valuable company assets. Proprietors and decision makers understand the current status of the environment within they operate in order to make well-founded judgments and investments. However, the achievement of an acceptable level of mitigation of continuity risks is often neglected. Such risks might lead to critical situations when extrapolated to vital business, such as legal issues, customer dissatisfaction and negative overall impact on the organization. Thus, continuity risks may lead to more generic and more critical risk categories, such as:

text: BCM: An approach for SMEs

text: □ Legal / Compliance Risks arising from violations of compliance with laws and regulations (i.e. data retention). Legal or compliance risks can expose an organization to negative publicity, fines, penalties, payment of damages and annulations of contracts. Loss or destruction of customer information (i.e. personal data) such as credit card information, financial information and health information can also raise potential risks from third party claims. In addition, failure to meet SLAs requirements with customers regarding data service availability may result to significant lawsuits. □ Productivity Risk resulting from operational losses and poor customer service delivery. Such risks may emerge from unavailability of basic production services and operation functions. Such risks may be relevant to all production activities that contribute in some way to the overall delivery of a product or service. Productivity Risks are not confined only to the use of technology; they can be the result of organizational activities. The risks arising from inadequate or poorly controlled information systems used to support core business functions such as front office, accounting, or other units are also captured in this risk category. Inadequate management may result in high productivity risks including high operating costs, operational failures, poor management decisions, lackof privacy and disruption of service to customers. □ Financial Stability Risks arise through unavailability of delivered products and services towards the organization’s customers. Such risks may lead to major financial losses having impact directly or indirectly on the financial stability of the organization, causing thus a failure to achieve stated goals and financial objectives. □ Reputation and Loss of Customer Confidence are the most difficult and yet one of the most important risks to quantify and mitigate. Such risks lead to the damage to the organization’s reputation, an intangible but important asset. Will customers and / or other companies cooperate with a company once they read in the paper that a company’s service quality is low or service delivery is regularly interrupted? Will top employees remain at a company so reputably damaged? And, what will be the reaction of the company’s shareholders? What is the expected loss of future business revenue? What is the expected loss of market capitalization? SMEs, due to their nature,inherit certain advantages and disadvantages in the field of business continuity management. The great disadvantage of SMEs is that the potential impact of the risks they face is likely to be more destructive since the majority operate in specialised markets where even a short interruption to normal business can have a disproportionate effect – totally halting output and letting customers down. In addition, due to shortages in resources (e.g. staff, financial, locations, etc.) it is more difficult for small firms to absorb the impact of business interruption, than it is in the case of bigger organisations. On the other hand, due to their nature, SMEs have two significant advantages towards the planning of Business Continuity efforts: □ No one knows their own business better than SMEs, as they often rely on limited resources. In this regard, they are in the best position to know how their business would cope without supporting infrastructures (e.g. IT systems) for a given period of time (e.g. morning, a day, or a week). □ Due to the fact that SMEs are usually servicing a niche market, they are able to know if their customer base would be affected (e.g. go elsewhere or return) if customers’ ability to do business with the SMEs is temporarily unavailable. Spending time developing a Business Continuity Management Framework and defining the organization’s Business Continuity Plan (BCP) will not only increase the likelihood of the organization’s survival from a crisis or business interruption, but will also ensure the safety and protection of the SME most critical asset, its people.

text: 3.2 What a decision maker needs to know

text: Protecting the future of a business, whatever its size, has to be one of the primary priorities for every business leader. BS25999, BSI’s

text: standard in the field of Business Continuity Management, states that the Continuity Management is a holistic management

text: process that identifies in advance the potential impacts of a wide variety of disruptions to the organization’s availability. This includes all necessary activities allowing the organization to tolerate the loss of part or all of its operational capability. BCM is a business-owned, business-driven process that establishes a fit-for-purpose strategic and operational framework that: □ Proactively improves an organization’s resilience against the disruption or interruption of its ability to supply its products or services;

text: BCM: An approach for SMEs

text: □ Provides a tried and proven method of restoring an organization’s ability to supply its critical products and services to an agreed level, and □ Delivers a proven capability to manage a business interruption (incident) and protect the organization’s reputation and brand. In this regard BCM can help decision makers to: □ Understand the overall risk context within which the organization operates; □ Identify/document the critical business functions that the organization has to deliver □ Identify what barriers or interruptions can be encountered in trying to deliver these critical business functions; □ Understand how the organization can continue to deliver these functions should interruptions occur; □ Understand the likely range of outcomes when continuity controls and other mitigation strategies are implemented; □ Ensure that all staff understand their roles and responsibilities when a major disruption occurs; □ Build consensus and commitment to the implementation, deployment and exercising of business continuity; □ Integrate business continuity as part of routine “business as usual”. The main artefact of a BCM framework used to achieve business contingency is the organization’s BCP. The objective of a BCP is to recover all critical business functions and minimize the impact for SME employees, customers and delivery. A BCP is not one document but rather a whole suite of coherent documents that form the organisation’s response to an incident, from the moment of impact, to the resumption of the normal operations. The smaller the business is, the more important it is to have a Business Continuity Plan in place. Any incident, no matter how small, is capable of causing impacts on the business and consequently the SME profitability. The size of any BCP will depend on the risks faced by each business. Organisations that have a business continuity plan are far more likely to survive the effects of a major incident than those that don’t. Further, depending on the sector, customers may be obliged to use suppliers who comply with certain security/continuity standards. Thus, for certain sectors there might be a commercial benefit to consider, as companies with business continuity plans are more attractive to do business with. For example, large businesses that rely on the outsourced services of third parties will prefer to work with suppliers who have a Business Continuity Plan in place. A BCP requires careful preparation and planning. As a best practice, often followed, is appointing a person responsible for business continuity who will ensure that a Business Continuity Plan will be created, developed and maintained. The complexity of this plan must be synchronised with the risk exposure, size and value of the organisation’s services, providing thus a practical and realistic ground.

text: 3.3 Personnel health & safety

text: An organization’s people are the most valuable asset. The unavailability of key people and injury to employees are risks that cannot be overlooked. The fundamental factor towards the success of any BCP is determined by the emergency framework established by the organization in order to protect and safeguard people’s health and safety. It should be noted that due to the concentration on IT issues, the proposed BCM approach does not provide detailed guidelines or actions that an SME should carry out in order to protect personnel health and safety. However, due to the sensitive nature and importance of the topic some generic guidance is provided hereby. Prior to developing a BCP the organization should have in place a set of emergency procedures describing the general measures that will be taken to protect employees, customers, visitors, etc. from the direct, indirect or potential effects of any incident or emergency (i.e. evacuation, shelter-in-place, area of refuge). Such precautions should eliminate or reduce further danger to personnel health and safety. In this respect, emergency procedures should as a minimum meet the following requirements: □ Employees understand the evacuation procedures; □ Employees know what to do if a fire breaks out; □ Employees know what to do if colleagues suffer an injury;

text: BCM: An approach for SMEs

text: □ Roles and responsibilities have been assigned for evacuation and first aid; □ All staff have been trained in their roles; □ Alternate sites / evacuation Points for the personnel have been determined if it is not considered safe to remain close to the building and □ An indoor emergency site has been identified, so staff can remain together safe, warm and dry while the next steps are decided. The emergency procedures include protection of people in the first place, containment of the emergency comes second, and assessment of the situation comes next. Regardless of the type of the BCP the organization creates, the development of emergency procedures is the highest priority. Although it seems intuitive that people’s health and safety is addressed first, it is not always the first thing that comes to mind when an emergency strikes. In addition to the emergency procedures the organizations should prepare a set of one-page emergency checklists describing simple but life-saving tips and guidelines that employees should undertake prior, during and after a natural or man-made disaster. Indicatively, the following checklists should be developed and distributed to ALL personnel of the organization: □ Flood Safety Checklist □ Lighting Safety Checklist □ Extreme Heat Safety Checklist □ Fire Fighting Checklist □ Fire Safety Checklist □ Power Service Disruption Checklist □ Handling Suspicious Parcels and Letters Checklist □ Prevention and Response to Workplace Violence Checklist In order to provide a guideline for the emergency checklists development, Annex E includes a sample of a Fire Fighting Checklist which describes engagement rules and safety methods for fighting a potential fire within the organization’s premises. Concluding, it has to be mentioned that EU legislation obliges organizations -operating within EU member states- to ensure employees’ health and safety through a specific Legal Framework. Specifically, OJ L 393,

text: Council Directive 89/391/EEC

text: includes the minimum requirements for the workplace, obliging employers to provide certain health and safety protection

text: measures. This includes first-aid and fire-fighting equipment, evacuation of workers training and information provisioning to workers. Annex E provides additional information regarding the aforementioned Directive since the latter has been further expanded to individual Directives in order cover certain issues regarding personnel health and safety.

text: BCM: An approach for SMEs

text: 4. A Simplified Approach: Overview

text: The present chapter presents the contents of a simplified Business Continuity Management (BCM) approach that can be used by SMEs for self-assessment leading to the development of the organization’s Business Continuity Plan (BCP). Both BCM and BCP

text: form the strategy of the organisation towards Business Continuity.

text: The BCP to be generated will address the following issues: □ Set the scope of the plan by identifying the critical business functions of the organization to be protected by the plan. □ Link to emergency management procedures and plans to ensure personnel safety. □ Identify critical ICT assets required to recover and sustain the minimum operating levels of the critical business functions in scope. □ Define the resource requirements (people, work area, IT, telecommunications) for the plan implementation □ Set the structure of the business continuity response with a focus on ICT. o Establish roles and responsibilities during an incident. o Disaster recovery plan: How to recover operations in a case of a disaster. o Per ICT asset contingency plan: How to recover a specific ICT asset. □ Define the controls used to safeguard the continuity of the functions in scope. □ Provide contact list(s) with business continuity responsible employees / teams / managers □ Provide contact details of vendors / suppliers committed to supporting the recovery efforts □ Provide contact list of Governmental authorities / bodies □ Define activities for Testing, Reassessing and Maintaining the organization’s Business Continuity Plan The proposed approach is self-directed, meaning that people from an organization assume responsibility for assessing the continuity requirements, selecting controls and thus setting the organization’s continuity strategy. This technique combines predefined continuity risk profiles with a set of good practices and relevant continuity controls while leveraging people’s knowledge of their organization to: □ Identify the continuity risk profile that matches their organization; □ Identify critical business functions that are necessary to sustain the viability of the organization; □ Identify the critical ICT assets to be protected; □ Capture the current state of business continuity practices within the organization; □ Decide on the priority of implementation for the proposed continuity controls and □ Develop a Business Continuity Plan setting the continuity strategy for the organization. The main advantage of this SME BCM approach is that it can provide an acceptable (i.e. baseline) business continuity level with a low assessment and management effort. This is due to the following aspects that enhance practicability: □ The risk profile of the organization can be easily identified, through qualitative descriptions of profiles in four risk areas (Legal and Regulatory, Productivity, Financial stability, Reputation and Loss of Customer Confidence); □ Hints regarding the business functions which are likely to be critical are provided; □ The typical ICT assets for small organizations are given; □ Continuity requirements of the critical assets are automatically derived by the organization’s risk profile and the recovery priority of the supported critical business function; □ Control options sufficient to meet the assets’ continuity requirements are available through predefined control cards;

text: BCM: An approach for SMEs

text: □ The BCP is gradually developed while the phases of the proposed BCM approach are executed and □ Guidance for handling incidents and escalating up to the invocation point of BCP is provided. These advantages can lead to a low cost self-assessment by teams with low expertise in the field of business continuity. If done carefully, an acceptable level of business contingency will result.

text: The proposed BCM approach could be further enhanced by integrating the aforementioned self-assessment business continuity

text: management process within an automated tool. This will significantly simplify the necessary steps that an SME needs to undertake in order to initially run and establish a BCM.

text: 4.2 Proposed BCM approach resourse requirements

text: The presented BCM approach is based on some elements from the OCTAVE ALLEGRO Risk Assessment Methodology and is modular to the ENISA deliverable “Information Package for SMEs” describing a simplified Risk Management approach. In this regard, the BCM approach is well-suited for SMEs who desire to follow a BCM model without extensive organizational involvement, expertise,

text: or input.

text: However, in order to execute the proposed model an SME should be able to provide the required manpower for establishing an Assessment Team, responsible for utilizing the present BCM approach. Depending on the SME size, the Assessment Team is expected to engage three (3) to five (5) people with both business and IT skills. Specifically, the presented BCM approach requires an Assessment Team incorporating a broad understanding of the organization, together with the following skills: □ Ability to understand the implemented business processes; □ Knowledge in IT Systems and Networks used by the organization for the provisioning of critical business functions; □ Knowledge on the dependencies between the business processes and IT; □ Problem-solving skills; □ Analytical skills; □ Ability to work in a team; □ Leadership / project management skills; □ Availability of few days for the necessary assessment and BCP development. In case that an SME is not able to utilize an Assessment Team with the aforementioned skills, the involvement of a specialized third party / contractor should be considered instead. The contractor can provide the missing required expertise (i.e. BCP and IT expertise and project management skills) required for the execution of the proposed BCM approach. The execution of the proposed BCM by the SME without the involvement of a third party offers many advantages such as the

text: development of internal organization know-how and competence in the field of BCM. Moreover, depending on consulting prices in the security market, this approach may result in reduced expenses.

text: On the other hand, in case of an external third party involvement in the BCP creation, the organization must actively participate in the self-assessment process by using a third party as a facilitator/advisor. Moreover, the assessment must be based on a BCM approach that can be understood by the organization prior to its usage. On the long run, this is a necessary precondition in order to achieve know-how transfer between the third party and the organization that will allow the maintenance of the BCP and the sustainment of the entire BCM process.

text: 4.3 Working assumptions

text: Lack of specialised personnel in several areas such as Risk Management, Business Impact Assessment, Business Continuity or Information Technology is one of the problems faced by SMEs. In addition, acquiring all the required skills through external contractors may not be possible or economically feasible. At the same time, most existing approaches to the assessment and management of continuity risks generally focus on the needs of large organizations. A simple approach designed for small

text: BCM: An approach for SMEs

text: organizations does not exist today, at least not in the form of publicly available guidelines. Some consulting firms have developed good practices for that purpose, but they use them in the context of customer projects. Although claiming to be appropriate, other approaches for SMEs are often too complex for self assessments. The ENISA deliverable “Business and IT Continuity: Overview and Implementation Principles” describes a six-step process to implementing Business Continuity Management. It focuses on the items to be considered for the delivery of the BCP and it is an overview of BCM derived by the contents of existing standards (i.e. BS25999-1 and BS25999-2). Furthermore, in that deliverable a graphical representation of the interfaces between BCM and Risk Management/Risks Assessment is provided. The present document uses the ENISA six-step BCM approach as the basis to produce a tailored, yet simplified approach to BCM implementation, so that it can be utilized by SMEs. It is worth mentioning, that parts of the presented material have also been influenced by OCTAVE ALLEGRO principles. Our intent is to provide those organizations with a simple, efficient and inexpensive approach to identifying and managing their continuity risks. Further, the presented simplified approach provides small organizations with a means to perform self-

text: assessments.

text: In addition, some considerations/assumptions have been made for the development of this material: □ Due to limited resource availability SMEs are not in the position to implement a fully fledged BCM. Rather, a BCM has to be tailored in order to meet SMEs’ capacities in terms of human and monetary resources; □ Even if an SME’s staff have special knowledge of information systems, they might not possess special know-how on IT security and business continuity matters. Lack of specialized personnel in several areas such as Risk Management, Business Impact Assessment, Incident and Crisis Management is a typical problem faced by SMEs; □ Small sized companies are using standardized data-processing environments which are important for the business. They use off-the-shelf products and are connected for their business to the Internet and are thus exposed to numerous threats that might affect their business continuity; □ The establishment of BCM through SME trade bodies and associations will help promote understanding of continuity issues by those with little background in business continuity planning; □ SMEs are usually born out of entrepreneurial passion and limited funding, with business systems that are often ‘patched together’ and thus are heterogeneous and independent; □ Most SME business managers barely understand highly technical and complex terminology related to IT business continuity and □ In cases that SMEs are not even interested in business continuity planning they may benefit from access to awareness, training and guidance material.

text: 4.4 A four-phased approach

text: In this chapter the contents of a simplified BCM approach that can be used by SMEs for the development and implementation of a BCP are presented. The proposed BCM approach uses four phases towards the development and delivery of a BCP for SMEs. An overview of the four phases is given in the following Figure.

text: OCTAVE Allegro is an assessment methodology to streamline and optimize the process of assessing information security risks so that an organization can obtain sufficient results with a small investment in time, people, and other limited resources. OCTAVE is a service mark of Carnegie Mellon University. OCTAVE was developed at the CERT Coordination Centre (CERT/CC). BCM: An approach for SMEs Figure 1: The four phases underlying the proposed BCM approach

text: In the rest of this chapter we deliver an overview of each phase, we describe the main elements processed and the generated outputs. This chapter is foreseen as an overview of the approach. More detailed information about the elements and the execution of each phase is given in chapter 5.

text: BCM: An approach for SMEs

text: 4.4.1 Phase 1 – Select Risk Profile

text: During this phase the Assessment Team evaluates their business risk profile by using a predefined set of qualitative criteria. By using the risk profile evaluation table (see below), Assessment Teams are in a position to identify their risk context. The risk context is derived from the business, the internal and external environment of an organization and can be divided into four risk areas: Legal

text: and Regulatory, Reputation and Customer Confidence, Productivity, and Financial Stability .

text: Risk Areas High Medium Low

text: Legal and The organization handles The organization handles personal The organization does not Regulatory sensitive/personal customer customer information as defined handle personal data of information as defined by the EU by the EU Data Protection Law. individuals other than those Data Protection Law. Loss and / or destruction of the employed by the organization. Retention of the aforementioned aforementioned data will lead to Retention of the data is mandatory by Government legal fines from Regulatory Bodies. aforementioned data is not Regulations. Loss and / or Failure to meet agreed SLAs with mandatory by Government destruction of this data will lead to corporate customers regarding Regulations. Loss and / or significant legal fines from availability of product and / or destruction of the data will not Regulatory Bodies. service offerings may result in non- lead to legal fines from Failure to meet agreed SLAs with frivolous lawsuits. Regulatory Bodies. corporate customers regarding Failure to meet agreed SLAs availability of product and / or with corporate customers service offerings will result in non- regarding availability of product frivolous lawsuits. and / or service offerings may result in frivolous lawsuits.

text: Productivity Services and operational processes Services and operational processes Services and operational are highly dependent on are highly dependent on processes are not directly information systems, applications information systems, applications dependent on information and third party services. and third party services. systems, applications and third Interruptions to the provisioning of Interruptions to the provisioning of party services. these services or to operational these services or to operational Interruptions to the provisioning processes will generate intolerable processes have severe impact. of these services or to direct or indirect impact to However the organization can operational processes is productivity. Significant expenses continue operations by switching tolerable since the organization and effort are required to resume to backup (e.g. manual) is performing most critical business and recover from market procedures for a limited period of operations with other means loss. time without significantly affecting (e.g. manually) or can continue Provision of these services with its productivity. operations by switching to manual procedures at the agreed manual procedures for a period quality is not possible. of time without affecting its productivity.

text: The risk areas mentioned here are indicative. Additional risk areas might be introduced when applying the approach to particular sectors. The risk areas taken in this approach have (i.e. Legal and Regulatory, Reputation and Customer Confidence, Productivity, and Financial Stability) have been adopted from the OCTAVE ALLEGRO Risk Assessment Methodology. BCM: An approach for SMEs

text: Financial Unavailability of products and Unavailability of products and Unavailability of products and Stability services of less than one day lead services of less than one day lead services of less than one day to a major one time financial loss to a significant one time financial lead to no or marginal one time and cannot be tolerated. loss. financial loss. Yearly revenues are directly Yearly revenues are indirectly Yearly revenues are not directly related to the continuous and related to the continuous and or indirectly related to the uninterrupted provision of on-line uninterrupted provision of online continuous and uninterrupted services (i.e. sales are performed services (i.e. products and Services provision of on-line services. online). are supported with on-line Unavailability of online presence Unavailability of online presence services). will not lead to direct or indirect will lead to direct financial loss as Unavailability of online presence financial loss as services major services are provided by will not lead to direct financial loss provided online can be provided using e-business applications. as services provided on-line can be by using alternative means (e.g. Fines that may incur due to non- provided by using alternative semi-automated, manually, compliance with legal and means (e.g. semi-automated, etc.). regulatory requirements may lead manually, etc.). No or marginal fines will incur to intolerable financial loss. Fines that may incur due to non- due to non-compliance with compliance with legal and legal and regulatory regulatory requirements are requirements. If any, they possible but will not affect financial cannot affect financial stability. stability.

text: Reputation and Unavailability of service has direct Unavailability of service has direct Unavailability of service cannot Loss of impact on reputation, resulting impact on reputation, resulting have impact on reputation, Customer thus in significant loss of thus in considerable loss of remaining thus unnoticed or Confidence customers using products and customers using products and marginally noticed by services though automated services though automated customers. interfaces. interfaces.

text: Table 1: Risk Profile Evaluation Table

text: Each area is classified in three classes: High, Medium and Low. These classes express qualitative criteria for the organization in question with regard to the risk area and help identify a risk level. The team evaluates risks identified for every area in order to produce the organization risk profile. As a rule of thumb the highest risk identified in any of the risk areas characterizes the overall business risk profile. A high risk carried in the financial risk area marks a high risk profile. Equally, a medium risk leads to a medium risk profile and low risks to low risk profiles. For example a low risk carried in the reputation and confidence, in legal and regulatory compliance and productivity but a high risk in financial stability risk class concludes to a high organization risk profile. Risk profile selection should be considered as a very important decision which subsequently leads to the risk-related selection of organizational continuity controls (see Annex C and Annex D).

text: BCM: An approach for SMEs

text: 4.4.2 Phase 2 – Critical Asset Identification

text: During this phase, the Assessment Team selects critical business functions based on their relative importance to the organization. Critical business functions are these functions whose interruption will lead to an SME’s suffering from serious financial, legal, and/or other damages or penalties. It should be noted that the earliest possible recovery of such functions after a disruption is the main

text: objective of a Business Continuity Plan.

text: Typically, an organization’s management knows what its business key processes are and how they can use their limited resources to protect them. The Assessment Team determines what is important to the organization and selects those key business processes as the most important to the organization, (also referred to as critical business functions). Together with the assessed Risk Profile, critical business functions are the essential parameter for the BCP (i.e. complexity, required effort, recovery costs, etc.). The Assessment Team selects one or more of the following business functions categories (here indicatively): □ Production; □ Customer Relationship; □ Human Resource; □ Finance and □ New Product Acquisition / Development. Together with the selection of critical business functions the Assessment Team defines their recovery priority, referred to as business

text: function recovery priority.

text: The business function recovery priority determines the absolute maximum time within which the function can be unavailable and the SME can remain viable, that is, it can avoid intolerable consequences. In other words it is the maximum period of time in which the function can be down before severe damage has been caused to the organization. In this regard, the organization should restore the business function within this timeframe in order to remain viable. The recovery priority can be assigned with three distinct values; High, Medium and Low. Each value implies a different timeframe for the business function recovery; less than 1 day, 1 to 3 days and up to 5 days respectively . The business function recovery priority will be later used to determine the asset based continuity controls selection (see Annex B and Annex D). After identification of critical business functions the Assessment Team will associate the dependencies of the critical business functions with the supporting assets used for their provision. This activity reveals the dependencies between the various assets and the organization’s business functions. This will help the SME to focus its Business Continuity Plan on the assets that each business function relies on. The assets supporting critical business functions are called critical assets. In security management, the identification of critical assets is a fundamental activity for the determination of the required protection level. The following table depicts predefined categories of assets and types that can be considered by the Assessment Team during the critical asset identification. It should be noted that asset types may be composed of other asset types. For instance components of an application might be servers, workstations, routers, network segments etc. During this step seeking the contribution of people that have an understanding of the deployed IT systems is essential.

text: Business functions categories can be further expanded by the Assessment Teams with respect to the organization’s operating environment and the critical business functions used to fulfil the organization’s business goals and objectives. It is worth mentioning that these recovery priorities have been selected as indicative. According to the sector/requirements of an SME, these values may be adapted appropriately. For example a SME providing Value-Added Services (VAS) (i.e. call management services, mobile data services) may not be able to tolerate service unavailability more than few hours, as this could result in a major one-time financial loss affecting significantly business financial stability. BCM: An approach for SMEs

text: Asset Category Description Asset (types)

text: Hardware Information systems that process and store information. Server Systems are a combination of information, software, and Laptop hardware assets. Any host, client, server, or network can be Workstation considered a system. Critical systems are those identified as essential for the continuous provision of the business service Storage and product offerings, those that store critical business Security Devices (firewall, IDS / IPS, antiinformation (customer or business proprietary) or those that spam etc) are exposed to the outside world for business functions or services. Network Devices important to the organization’s networks. Routers, Routers switches, and modems are all examples of this class of Gateways component. Wireless components/devices, such as cell phones and wireless access points that staff members use to access Switches information (for example, email). Typically, critical networks Wireless Access Points are those that are used to support essential critical applications or systems or those that are shared with third party and usually Network Segment (e.g. cabling and non trusted networks. equipment between two computers) Other (SAT, Laser)

text: People People in the organization, including business, administration, Chief Technology / Information Director HR and IT. Critical people are those that play a key role for the delivery of product and operational processes. Importance Information Technology Manager should be given to critical roles that are considered irreplaceable or constitute a single point of failure. Database Development & Administration (manager, analyst, architect, administrator etc.)

text: Programming / Software Engineering (manager, engineer, programmer, tester etc.) Technical Support (Help Desk Operator, technician etc.)

text: Systems Analysis & Integration (manager, analyst, integrator, specialist etc.)

text: Technical Writing (manager, writer, publication specialist etc.) Network Design & Administration (manager, analyst, architect, administrator, technician etc.)

text: WEB Development & Administration (manager, developer, designer, administrator etc.)

text: Back office Applications that are key to or part of daily business Financial Control Applications operations. Disruption of such applications typically results in Customer Care severe hindering or even unavailability of all dependent Logistics business processes. ERP CRM

text: Email

text: BCM: An approach for SMEs

text: Internet Custom Application Intranet Industry Application Instant messaging Security Software (antivirus, proxy, IDS) Document Management System Client Facing Applications that are key to or part of the product and service E-commerce Applications offerings. Disruption of such applications typically results in severe hindering or even unavailability of all dependent Internet Service Provisioning – Static, customer facing (i.e. front office) business services. Public IP addresses, DNS service registration and management. Email Service Provisioning Web Portal Web Site

text: Application / Data Hosting FAX (including incoming call numbers) Incoming telephone numbers and DDIs Telecommunication Services (i.e. Phone over IP, Mobile telephony, SMS / MMS) Data Data used by the organization in order to perform its business Customer Personal Data operations, generated within the organization or imported by Customer Financial Data third parties and/or customers. Corporate Employee Personal Data Corporate Employee Financial Data Corporate Financial Data Corporate Marketing Data Corporate Sales Data System Technical / Transaction Data System manuals Facilities All physical venues/locations including buildings, offices and Headquarters rooms that the organization uses in order to provide its Secondary Premises service/product offerings. Branch Offices Offices Data Canter

text: Table 2: Asset List BCM: An approach for SMEs

text: Finally, the Assessment Team will analyze the continuity requirements of the identified assets. The analysis is performed via Asset Identification Cards which are distributed to organization's key personnel (asset owners). The cards will be used to select the appropriate controls in order to ensure their continuity in the case of an unlikely event.

text: Asset Identification Card is derived by OCTAVE ALLEGRO Risk Assessment Methodology. BCM: An approach for SMEs

text: 4.4.3 Phase 3 – Controls Selection

text: During Phase 3 the Assessment Team selects appropriate controls based on the risk profile selected for every risk category and the list of identified critical assets. Continuity Control Cards are predefined and can be selected by the Assessment Team. Controls are separated in two categories, that is, organizational continuity controls and the asset-based continuity controls, bothare available as control cards: □ Organizational controls cards that contain controls applicable to the organization horizontally and are concerned with practices and management procedures and □ Asset control cards that are applicable to categories of critical assets. Control cards are essentially pre-selected and grouped according to risk profiles and asset recovery priority. Table 3 lists the categories of controls, their structure and their name as they are considered in this approach.

text: Controls Category Control No. Name of the control

text: Organizational SP1 Business Continuity ManagementOrganization SP2 Business Continuity Policy, Plans and Procedures SP3 Test Business Continuity Plan SP4 Sustain Business Continuity Management SP5 Service Providers / Third Parties Business Continuity Management Asset Based HN1.1 Information System Resilience HN1.2 Information System Backup HN1.3 Information System Redundancy A1.1 Application resilience A1.2 Application Backup D1.1 Data Storage D2.2 Data Backup P1.1 Physical Security P1.2 Awareness and Training F1.1 IT Site F1.2 Environmental Security F1.3 Physical Security

text: Table 3: Continuity Controls used in the approach presented

text: Accordingly, phase 3 of the proposed assessment approach consists of two separate but equally important steps leading to the selection of organizational continuity controls and the selection of asset-based continuity controls. The selection of the organizational control cards is performed in a fairly straightforward manner. The Assessment Team uses the Risk Profile Evaluation Table and the Organizational Continuity Controls Table (table 4) to select organizational continuity control cards for the risk areas identified during phase 1 (select Risk Profile), thereby defining the direction for the organization’s business continuity. A detailed description of the controls is included in Annex C.

text: Organizational controls assigned to risk areas vary according to their classification. BCM: An approach for SMEs

text: Risk Areas High Medium Low

text: Legal and Regulatory

text: (SP1) SP1.1 SP1.1 (SP2) (SP2) SP3.4 SP3.4 (SP4) (SP4) SP2.3 SP5.1

text: Productivity

text: (SP1) (SP2) SP2.1 (SP2) SP3.4 (SP3) SP2.2 (SP4) (SP4) SP5.2 (SP5)

text: Financial Stability

text: (SP1) (SP2) SP2.1 (SP2) (SP4) SP5.2 (SP4)

text: Reputation and Loss of Customer

text: (SP1) SP2.2 SP2.7

text: Confidence

text: (SP2) SP2.3 (SP4) (SP4) SP3.4

text: Table 4: Organizational Continuity Controls

text: Based on the risk profile and the business function recovery priority the Assessment Team can use asset continuity control cards table (see Table 5) to identify the controls appropriate for the protection of critical assets.

text: Asset Continuity Control Cards

text: Asset Category High Risk Medium Risk Low Risk

text: Hardware & Network CCC-1HN CCC-2HN CCC-3HN Application CCC-1A CCC-2A CCC-3A

text: (Back Office – Client Facing)

text: People CCC-1P CCC-2P CCC-3P Data CCC-1D CCC-2D CCC-3D Facilities CCC-1F CCC-2F CCC-3F

text: Table 5: Asset based Continuity Control Cards BCM: An approach for SMEs

text: Asset control cards are essentially grouped in two categories, corresponding to asset category and risk profile. It is worth mentioning that the recovery priority is also a factor that determines the necessary continuity control. Recovery priority is considered within each asset based control card, as can be seen in Table 6 below. For the sake of this presentation, we add at this point the control card CCC-1HN. As indicated in Table 6, this card is appropriate for the protection of a hardware and / or a network component- in a high risk scenario (high risk profile). As shown below, different control assignments can be found for the various recovery priorities.

text: Asset Based Continuity Control Card ID CCC-1HN

text: Risk Profile High

text: Asset Category Hardware and Network

text: Continuity Controls Category Resilience Back up Redundancy

text: ori ri

text: ry

text: co e

text: Table 6: CCC-1HN Asset based control card

text: Finally, the Assessment Team will have the opportunity to document the selected controls (both organizational and asset-based ones) along with the rationale for selecting each control. The output of this activity will facilitate the next steps of the Assessment Team towards the definition of the actions plans.

text: 4.4.4 Phase 4 – Implementation and Management

text: In Phase 4 the Assessment Team is occupied with the evaluation of the organization's current business continuity practices using the control cards as the “continuity requirements” and assessing the gaps between these and current business continuity practices both at an organizational and critical asset level. The output from this process forms the basis for the planning activity that follows next. It might be the case that due to limited resources SMEs will not be able to implement all identified controls for all business functions and all the involved assets at once. Therefore, as an initial activity in the plan for implementation, prioritization has to take place. The Assessment Team needs yet to plan the implementation of the selected controls and generate the corresponding BCP. SMEs will likely have limited funds and staff members available to implement the necessary controls. After the evaluation, the Assessment Team prioritizes the activities and then focuses on implementing the highest-priority activities

text: BCM: An approach for SMEs

text: The prioritization of the asset based controls implementation is derived by the recovery priority of the critical asset -identified in phase 2- and the respective asset category. As a rule of thumb the recovery priority of an asset characterizes the priority of the controls implementation. An asset with a high recovery priority requires its controls to be implemented with a high priority. Equally, an asset with medium recovery priority leads to medium prioritization of the corresponding controls. However, Facilities asset category sets a high priority for the controls implementation irrespective to the assigned recovery priority. This is due to the fact that the corresponding continuity controls for this asset category (Annex B) involves the physical and environmental protection of an SME facilities (rooms, offices etc) which consequently protect personnel’s health and safety. The table below presents an indicative assignment of the controls’ implementation with respect to the recovery priority and the available asset categories:

text: Asset Based Controls Prioritization Matrix

text: Asset Hardware & Applications Data People Facilities Categories Network ty ri Low Low Low Medium Medium High o ri P ry Medium Medium Medium Medium Medium High ve o ec High High High High High High R

text: Table 7: Asset Based Controls Prioritization Matrix

text: The asset based controls prioritization can be assigned with three distinct values; High, Medium and Low. Each value implies a different timeframe for the control implementation; high priority controls should be implemented first, medium next and low last. On the contrary, the implementation priority of organizational controls is performed in accordance with the risk level (high, medium, low) assigned to the predefined risk areas during phase 1. For example an organization with a low risk level in the legal and regulatory risk area will assign a low implementation priority for the controls dictated to this risk area. Likewise, the same organization may have a high risk level in the productivity risk area, selecting a high priority for the implementation of the organizational controls assigned to productivity risk area. In addition, a set of criteria have been developed in order to assist the Assessment Team for prioritizing the implementation of the identified controls. Following the output of all the previous phases, that is, risk profile definition, critical functions/assets identification and controls selection, the Assessment Team ends up with the organization’s Business Continuity Plan (BCP). Once the plan has been agreed it should be communicated to the organization’s personnel. This will expose any flaws in the plan and will also ensure that all the roles and responsibilities are understood. The Business Continuity Plan will address all requirements essential to keep the business running and includes processes to keep disruption to customers and employees to a minimum ensuring that a crisis is managed effectively before it escalates to a disaster. The plan will focus on addressing the following business continuity aspects: □ Plans, measures and arrangements to ensure the continuous delivery of critical services and products, which permit the organization to recover its facility, data and assets. □ Identification of necessary resources to support Business Continuity Management on the long run, including personnel, information, equipment, financial allocations, infrastructure protection and accommodations.

text: BCM: An approach for SMEs

text: 5. Self Assessment Guidelines with one example

text: Most existing approaches to the assessment and management of continuity risks generally focus on the needs of large organizations. A simple approach designed for small organizations does not exist today, at least not in the form of publicly available guidelines. The purpose of the present document is to produce a tailored model to BCM implementation that can be utilized by SMEs, including Micro-Enterprises. The intent of the proposed BCM approach is to provide those organizations with a simple, efficient and inexpensive approach to identifying and managing their continuity risks. The resulting simplified approach provides small organizations with a means to

text: perform self-assessments.

text: In this chapter, a more detailed breakdown of the four phases, described in section 4.4, of the proposed self-assessment BCM approach is presented in detail. Particularly the following phases along with the corresponding steps are described: □ Phase 1: Select Risk Profile o Step 1: Identify Risk Areas o Step 2: Risk Profile Selection □ Phase 2: Critical Asset Identification o Step 1: Business Function Selection o Step 2: Select Asset Types o Step 3: Asset Continuity Requirements Analysis □ Phase 3: Controls Selection o Step 1: Select Organizational Control Cards o Step 2: Select Asset-Based Control Cards o Step 3: Document List of Selected Controls □ Phase 4: Implementation and Management o Step 1: Perform Gap Analysis o Step 2: Controls Implementation Plan o Step 3: Deliver Business Continuity Plan By performing the above phases and steps, an SME will: □ identify the risk profile of the organization with respect to the environment within which the company operates, (phase 1) □ identify the critical assets of the organization along with the dependant business functions, (phase 2) □ select continuity controls and solutions in order to achieve business continuity (phase 3) and finally, □ develop a BCP and a strategy for business continuity implementation and management (phase 4). As mentioned above, the chapter is structured with phases and steps as the building blocks. One example is provided for every phase. The example uses the following company scenario: Company Size: Micro Enterprise, Number of Employees: 8 + 2 externals, Type: Dental Equipment supplier, Short Description: The company of the example is a dental equipment supplier based in north England. The company supplies both the equipment as well as their maintenance. Most of the customers have contracts of annual maintenance. In addition a significant percentage of the customers have special contracts for expedited repair in case of equipment breakdown. These special contracts guarantee a repair of the equipment within the next business day of filing the request when no spare parts replacement is required.

text: BCM: An approach for SMEs

text: In the case where spare parts need to be replaced then the required maximum time to repair is four business days to allow for the shipment of spare parts from the manufacturer. In general no other special limitations and hard requirements exist for this company. The company employs 8 persons full time including the owner. Financial matters are handled by the owner with the support of the secretary and an external accountant. In addition the IT needs of the company are covered with external support from a local IT expert who is engaged on-demand to resolve problems that may arise or implement new solutions upon request.

text: Company Personnel Employee Responsibilities

text: 1. Company-Owner Owns and runs the company, takes major decisions. Takes care of financial matters, customer relations, new products acquisition and dentist equipment technology updates 2. Secretary Supports the owner in financial matters. Receives orders for spare parts and equipment from other colleagues and sees to their fulfilment from the suppliers. In addition receives calls from new /prospective customers and assigns them to a salesman. 3. Salesman1 Customer relationship agent that handles customer requests and sees to their fulfilment. His responsibilities also include the scheduling of expedited equipment repair under the special contract. 4. Salesman2 Customer relationship agent that handles customer requests and sees to their fulfilment. His responsibilities also include the scheduling of expedited equipment repair under the special contract. 5. Technician1 A senior technician responsible for new installations and training clients on equipment use, perform scheduled maintenance and repairs. He understands issues of technology and in many cases co-ordinates the executiom of IT related projects.

text: 6. Technician2 A junior technician supporting the senior for new installations and training clients on equipment use, perform scheduled maintenance and repairs. He is experienced enough to act independently in most situations and requires the support of the senior only in complex cases. Through his technical experience he can deal with some of the IT matters, but will always consult with the company’s external IT expert.

text: 7. Van driver Sees to the delivery of equipment and supplies to the customers

text: 8. Warehouseman In charge of organising the company’s supplies stock in the small ware house located on the basement of the office building. Occasionally may assist the van driver in delivering heavy or large equipment.

text: 9. Accountant Keeps financial records, handles taxation issues, and has responsibility for the issuing of financial (external) reports. His is present at the premises a few times a month. Otherwise available on-call within business hours.

text: 10. IT expert (External) On-call IT support within business hours, design and implementation of IT systems.

text: Table 8: Tabular information about involved roles in the example company

text: In the following discussion, figures (workflow diagrams) for every phase are also supplied; implementation hints for every step are provided in the dotted boxes for each of the forthcoming phase descriptions.

text: BCM: An approach for SMEs Phase 1 – Select Risk Profile

text: In phase 1, the Assessment Team considers a set of qualitative criteria from the business environment of the company to identify its risk context. The risk context is derived from the business, the internal and external environment of an organization and can be divided into four risk areas: Legal and Regulatory, Reputation and Customer Confidence, Productivity, and Financial Stability. The Assessment Team selects an appropriate risk level for each risk area using a predefined risk profile evaluation table. Finally the Assessment Team selects the organization’s overall risk profile. As shown in figure 2, the phase involves two steps.

text: Phase 1 Select Risk Profile Identify Risk Risk Profile Selection Figure 2: Phase 1 – Select Risk Profile Workflow Step 1. Identify Risk Areas

text: During this step the Assessment Team determines the organization’s business risk profile. This task is achieved through the Risk Profile Evaluation Table (Table 8) by selecting risk areas that can (a) directly or indirectly affect or damage reputation and customer confidence, (b) result in legal and regulatory non-compliance, (c) create financial loss and (d) decrease productivity. The team evaluates risks identified for every area in order to produce the organization risk profile. Each area is classified in three classes: High, Medium and Low. These classes represent qualitative criteria for the organization with respect to each risk area and help identify a risk level. In order to identify the current or potential risk level, Assessment Team members highlight the risk area and read the description in each column of the table. Risk areas that are closer to their business profile are chosen. The process is followed for every risk area. At the end there should be a Matrix highlighting the applicable risk level in each risk area.

text: Step 2. Risk Profile Selection

text: Based on the output of the previous step, the Assessment Team selects the organization’s overall risk profile. The risk profile selection is performed via the highlighted Risk Profile Evaluation Table in a fairly straightforward manner: The highest risk level identified in a risk area characterizes the overall business risk profile. The identified risk levels in the predefined risk areas illustrate where the organization should focus its efforts to apply appropriate continuity controls and for setting implementation priorities.

text: Example (Micro Enterprise - Risk Profile: Low – Phase 1)

text: [Step 1] The Assessment Team uses the Risk Profile Evaluation Table to identify the risk context of the company. The Assessment Team proceeds by identifying:

text: BCM: An approach for SMEs

text: □ a low risk level in the legal and regulatory area since the company does not handle personal data other than those of the people employed by the organization, □ a low risk level in productivity since the business functions are not highly dependent on the information systems. Business workflows utilise information systems in a simple manner that is easy to perform manually □ a low risk level in financial stability since unavailability products will introduce no or marginal financial loss. This assessment is based on the average delivery time required by the customers and the low rate of occurrence of expedited service requests. □ a low risk level in reputation and loss of customer confidence is expected since currently information systems are not heavily used for customer interfaces. The selected areas and level are shown in the following risk profile evaluation table.

text: Risk Areas High Medium Low

text: BCM: An approach for SMEs

text: Reputation and Unavailability or service has direct Unavailability or service has direct Unavailability or service cannot Loss of impact on reputation, resulting impact on reputation, resulting have impact on reputation, Customer thus in significant loss of thus in considerable loss of remaining thus unnoticed or Confidence customers using products and customers using products and marginally noticed by services though automated services though automated customers. interfaces. interfaces.

text: Table 9: Risk Profile Evaluation Table - Example

text: [Step 2] Next, the Business Risk Profile is calculated. Risk areas signify the overall business continuity risk context. As a rule of thumb

text: the highest risk identified in a risk class defines the overall business risk profile.

text: Risk Areas Risk Level Risk Profile

text: Legal and Regulatory Low Low

text: Productivity Low

text: Financial Stability Low

text: Reputation and Loss of Customer Confidence Low

text: Table 10: Risk Profile Selection - Example BCM: An approach for SMEs Phase 2 – Critical Asset Identification

text: During this phase, the Assessment Team selects critical business functions based on relative importance to the organization. Critical business functions are these functions whose interruption will lead to an SME’s suffering from serious financial, legal, or other damages or penalties. It should be noted that the earliest possible recovery of such functions after a disruption is the main

text: Following the selection of the critical business functions, the organization will determine their dependencies in terms of the supporting assets used to provide each identified business function. Finally, based on the output of the previous steps the Assessment Team will analyze the continuity requirements of the identified critical assets.

text: Phase 2 Critical Asset Identification Types Figure 3: Phase 2 – Critical Assets Identification Workflow Step 1. Business Function Selection

text: During the selection process of critical business functions, Assessment Team members should consider which functions will result in a large adverse impact on the organization in one of the following scenarios; (a) Loss or destruction of the business function or (b) Interrupted access to the function or to the information stored. The Assessment Team selects one or more of the following business

text: functions categories (here indicatively):

text: □ Production.

text: □ Customer Relationship.

text: □ Human Resource.

text: Business functions categories can be further expanded or specialised by the Assessment Teams with respect to the organization’s operating environment and the critical business functions used to fulfil the organization’s business goals and objectives. BCM: An approach for SMEs

text: □ Finance. □ New Product Acquisition / Development. In cases where the critical business functions are difficult to identify, teams should consider the assets inside the organization, as these are described in Table 2-Asset List. Understanding why a function is critical can better enable the definition of the continuity requirements and consequently the recovery priority of the function. Capturing of this important information is facilitated by completing the critical business function profile card. □ Critical business function Profile Card. For each critical function, the following questions should be considered and answers recorded in the corresponding table: o Why is the business function critical to meeting the mission of the organization? o Who controls it? o Who is responsible for it? o Who uses it? o How is it used? These questions focus on how business functions are used and why they are important. If answers to all of these questions cannot be provided, people in the organization that can provide the answers must be located and included in the Assessment Team. After defining the business functions that need to be secured the next step is to analyse and agree on the final list of critical business functions and the corresponding required recovery priorities. The outcome of this process will be documented using the “Critical Business Function List and Business Continuity Scope” form. With the completion of this step the scope of this business continuity assessment and of the resulting business continuity plan is set. The form requires filling the following information. □ Rationale for selecting the business function. While selecting critical business functions, a number of issues related to these functions are discussed. In this regard the rationale for selecting each critical function is documented for future reference during the decision making process. □ The business function Recovery Priority (High: less than 1 day, Medium: 1 to 3 days, Low: up to 5 days). The business function recovery priority is the absolute maximum time that the function can be unavailable and the SME remain viable in order to avoid unacceptable consequences associated with a break in business continuity. In other words is the maximum period of time within which the function can be down before severe damage to the organization results. In this regard the

text: organization should restore the business function within this timeframe in order to remain viable.

text: Step 2. Select Asset Types

text: Once the critical business functions are selected, the Assessment Team will identify their dependencies in terms of the assets used to provide and / or support the corporate business function. This activity reveals the dependencies between the various assets and the organization’s business functions, identifying alternative methods for service delivery. This will help the SME to focus its business continuity plan on the availability of the assets supporting critical business functions. As an output, the Assessment Team should have a number of tables (one for each identified business function) listing all the assets used to provide / support the organization’s business functions.

text: It is worth mentioning that these recovery priorities have been selected as indicative. According to the sector/requirements of an SME, these values may be adapted appropriately. For example a SME providing Value-Added Services (VAS) (i.e. call management services, mobile data services) may not be able to tolerate service unavailability more than few hours, as this could result in a major one-time financial loss affecting significantly business financial stability. BCM: An approach for SMEs Step 3. Asset Continuity Requirement Analysis

text: In Step 3 Assessment Teams are occupied with data gathering and analysis of the output produced in Steps 1 and 2 in order to define the continuity requirements of each identified asset. The data gathering and analysis is facilitated by the Asset Identification Cards which are distributed to organization's key personnel (asset owners). Answers to the following questions are required: □ What is the critical asset? □ Which critical business functions rely upon this asset? □ What is the agreed-upon description of this information asset? □ Who owns this asset ? □ What is the recovery priority of this asset ? The Assessment Team will end up with an asset identification card for each identified asset. The cards will be used, later to select the appropriate asset-based controls.

text: Example (Micro Enterprise - Risk Profile: Low - Critical Business Function: Finance – Phase 2)

text: [Step 1] In our example the Assessment Team selects three functions: Finance - Medium priority, Customer Relationships - Medium priority and Expedited service contracts fulfilment – High priority. For this example we will follow closer the assessment process of the Finance function. As such detailed profiles and forms corresponding to the other functions will not be given, but the summary tables will include the output of the implied BCM processing. The outcome of the discussion and selection of the recovery priorities is documented using the “Critical Business Function Identification and Business Continuity Scope” shown below. Now the team has a common understanding of what needs to be protected and what needs to be achieved in terms of recovery priorities. The agreed recovery priorities have to be updated in the corresponding critical business function profile cards.

text: Critical Business FunctionList – Business Continuity Scope Critical Business Rationale for Selection Recovery Priority Function (High, Medium, Low) Production / Provides expedited equipment repair to customers that have purchased the High Expedited service expedited repair service. The repairs must be performed next business day contracts when no spare parts are required. When spare parts need to be ordered then fulfilment four business days is the defined maximum time to repair. The expedited repair service should be available for the customers in 1 day or less to maintain the agreed SLA. Customer Receive communication and fulfil service requests of existing and new Medium relationships customers. The requests may range from new product information, equipment demonstrations, and requests for maintenance or repair at normal service level. Communication with our customers is important. Because of the many different means of communication we have (phone,

text: A business unit or individual being accountable and primary responsible for setting the requirements for the maintenance and physical and logical security of the asset as well assuring the requirements are met. Most often than not, the responsibility for the maintenance and security is delegated. Adapted from CMU/SEI-2005-TN-021 It should be noted that assets inherit the recovery priority assigned to the critical business function during step 1. BCM: An approach for SMEs

text: email, fax, mobile phones) customers can be informed and postpone their service requiests for at least two days.

text: Finance This function is used to manage, store and process financial data generated by Medium the commerce of medical equipment and services. The function is essential for the business as it represents the most important element of accounting information regarding purchase, invoicing and delivery of medical equipment. Most of the functions activities can be performed manually or delayed until information systems are available. Ordering spare parts required for the expedited service contracts fulfilment is the most time critical activity that must be recovered first.

text: Table 11: Critical Business Functions of example organisation

text: The assessment team completes the profiles of the identified functions and uses the information to finalise the selection and agree on the recovery priorities. The table below indicates the detail for the critical function “Finance”.

text: Critical Business Function Profile Card

text: Critical Business Function Finance Recovery Medium Priority Who controls the function Company owner

text: Who is responsible for delivering the Company owner : funds management function? Secretary : orders & invoicing / scheduling of product deliveries Accountant : legal accounting obligations Who is the user? (Who benefits / This is a core function of the company used by almost every other function. The needs this function? / why is it most demanding user is the Expedited service contracts fulfilment function that critical?) requires timely delivery of spare parts. Customer Relationship Management is also using the services of this function to fulfil customer orders. In addition prolonged unavailability of this function can starve the business from working capital.

text: How is it used? Orders are placed from customers through salesmen or technicians in the case of spare parts used for repairs. Currently internal emails are exchanged for placing orders. When prior arrangements (including credit) exist with suppliers the order is prepared and sent to the suppliers by the secretary without any further processing. The Orders depending on the supplier may need to be dispatched via FAX or Email and sometimes further details are worked out through phone calls. In other cases the company owner needs to secure a deal and supply adequate cash funds to support the order. The accountant updates/verifies the company records on a weekly basis and is available on call for urgent matters during business hours.

text: Table 12: Detailsof the critical Business Function “Finance”

text: [Step 2] During step 2 the Assessment Team selects the dependant assets used to support / provide the selected critical business function. The team uses the Asset list hints provided here in combination with the business function profile created in the previous step. For each asset identified an asset identification card is created and populated with information in step 3. In this example the

text: BCM: An approach for SMEs

text: team selects fifteen asset types from the respective Asset Categories: (a) Hardware, (b) Network, (c) Back-office Applications, (d) People and (e) Facilities.

text: Hardware Information systems that process and store information. Server Systems are a combination of information, software, and Laptop hardware assets. Any host, client, server, or network can Workstation be considered a system. Critical systems are those identified as essential for the continuous provision of the Storage business service and product offerings, those that store Security Devices (firewall, IDS / IPS, anticritical business information (customer or business spam etc) proprietary) or these that are exposed to the outside world for business functions or services.

text: Network Devices important to the organization’s networks. Routers Routers, switches, and modems are all examples of this Gateways class of component. Wireless components/devices, such as cell phones and wireless access points that staff Switches members use to access information (for example, email). Wireless Access Points Typically, critical networks are those that are used to support essential critical applications or systems or Network Segment (e.g. cabling and those that are shared with third party and usually non equipment between two computers) trusted networks. Other (SAT, Laser)

text: People People in the organization, including business, Chief Technology / Information Director administration, HR and IT. Critical people are those that play a key role the delivery of product and operational Information Technology Manager processes. Importance should be given to critical roles that are considered irreplaceable or constitute a single Database Development & Administration point of failure. (manager, analyst, architect, administrator etc.)

text: Programming / Software Engineering (manager, engineer, programmer, tester etc.) Technical Support (Help Desk Operator, technician etc.) Systems Analysis & Integration (manager, analyst, integrator, specialist etc.)

text: Back office Applications that are key to or part of daily business Financial Control Applications operations. Disruption of such applications typically Customer Care results in severe hindering or even unavailability of all Logistics

text: BCM: An approach for SMEs

text: dependent business processes. ERP CRM Email Internet Custom Application Intranet Industry Application Instant messaging Security Software (antivirus, proxy, IDS) Document Management System Client Facing Applications that are key to or part of the product and E-commerce Applications service offerings. Disruption of such applications Internet Service Provisioning – Static, typically results in severe hindering or even unavailability of all dependent customer facing (i.e. front Public IP addresses, DNS service office) business services. registration and management. Email Service Provisioning Web Portal Web Site

text: Application / Data Hosting FAX (including incoming call numbers) Incoming telephone numbers and DDIs Telecommunication Services (i.e. Phone over IP, Mobile telephony, SMS / MMS) Data Data used by the organization in order to perform its Customer Personal Data business operations, generated within the organization or imported by third parties and/or customers. Customer Financial Data Corporate Employee Personal Data Corporate Employee Financial Data Corporate Financial Data Corporate Marketing Data Corporate Sales Data System Technical / Transaction Data System manuals Facilities All physical venues/locations including buildings, offices Headquarters and rooms that the organization uses in order to provide its service/product offerings. Secondary Premises Branch Offices Offices

text: BCM: An approach for SMEs

text: Data Canter

text: Table 13: Asset List - Example

text: As an output of this step the Assessment Team will fill the following form, identifying the supporting assets used to provide the organization’s finance business function:

text: Critical Business Function Supporting IT Assets Critical Business Function Finance Supporting IT Assets Hardware Secretary Desktop PC, Owner Laptop, Accountant Computer(in accountants office premises), Financial control application server Network Office Ethernet switch, Internet router Back Office Application Financial control, Email, office productivity applications, Client Facing Applications Internet Service provisioning, FAX, Company fixed-line phone People /Contractors Technician2, Company-Owner, Tecnician1, Secretary, warehouseman, External IT expert, Financial control software supplier

text: Data Corporate Financial Data, supplier agreements and contact information, funding agreements, order progress tracking Facilities Company offices

text: Table 14: Business Function Supporting Assets – Example

text: Identifying Key Personnel and Contractors is one of the most important tasks if an effective response and recovery to an incident is to be prepared and executed. The owner of the critical business function has the overall responsibility to co-ordinate the restoration ans is in charge of key personnel. Personell involved in asset maintenance has also a role to play in when asset need to be recovered. For this reason even external contractors that have an operational responsibility (i.e. preferably a contractual obligation) for maintaining an asset must be included in this category. In the case of assets maintained by contractors, the asset owner is also important in the management of the recovery activities and has to be included in the list of critical people.

text: [Step 3] In Step 3 the Assessment Team continues with data gathering and analysis of the output produced in Steps 1 and 2. In our example the asset identification exercise revealed that the finance function depends on nineteen assets (Table 12). Thus, as an output of this step the Assessment Team will end up with nineteen asset identification cards, one for each asset. For this example only 7 cards will be presented. Eventually no new assets will be discovered and the identification cards will contain all important information for the assets. The business function supporting IT assets card shown in table 12 needs to be amended accordingly to list any extra assets identified during this step.

text: Asset Identification Card Card Creation/Update Date 18/12/2009

text: BCM: An approach for SMEs

text: Asset Category Hardware Asset Name Financial control application server Asset Description This server holds the financial data and transactions. It hosts the financial control applications and allows the application’s users to access /update the warehouse stock and issue invoices (If relevant include brand/model and vendor / supplier.) Asset Owner Company owner Asset Location Owner’s office Asset Maintainer External IT Expert Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Provides the platform for the Financial control Application Recovery Priority Requirement Medium Asset users Company Owner, Accountant, Secretary. It is most of the time used remotely from their own computers. Supported Business Func#2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Table 15: Financial control application server Asset Identification Card – Example

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Financial control application Asset Description The application that holds the financial data and transactions. Allows client to access /update the warehouse stock and issue invoices Asset Owner Company owner Asset Location Financial control application server Asset Maintainer Financial control software supplier Aggregated Recovery Priority Medium Supported Business Func #1 Finance Assets role /usage in function Provides automation for the Finance function

text: BCM: An approach for SMEs

text: Recovery Priority Requirement Medium Asset users Company Owner, Accountant, Secretary. It is most of the time used remotely from their own computers. Supported Business Func #2 - Assets role /usage in function Recovery Priority Requirement Asset users

text: Table 16: Financial Control Application Asset Identification Card – Example

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Email Service Asset Description Internet Email used for internal workflows and communication with customers, vendors, suppliers, Etc. Asset Owner Technician1 Asset Location The Internet, Email Hosting Services LTD. Asset Maintainer Email Hosting Services LTD Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Exchange documents, including spare part requests, service reports. Document exchanges are not time critical. When rapid action is required then phone communication is preceding the document exchange. Recovery Priority Requirement HIGH Asset users Technician1, Technician2 Supported Business Func#3 Finance Assets role /usage in function Supports internal workflow and external communication Recovery Priority Requirement Medium Asset users All function’s users Supported Business Func#3 Customer Relationship Management Assets role /usage in function Supports internal workflow and external communication Recovery Priority Requirement Medium Asset users All function’s users

text: BCM: An approach for SMEs Table 17: Email Service Asset Identification Card – Example

text: Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Application Asset Name Company fixed-line phone numbers Asset Description Company fixed-line phones 0044 (0) 1223 234234 0044 (0) 1223 234235 Asset Owner Secretary Asset Location The phone numbers are assigned to the Company-PBX Asset Maintainer The telephone company Aggregated Recovery Priority HIGH Supported Business Func#1 Expedited Service Contract Fulfilment Assets role /usage in function Customers call to register their expedited support request Recovery Priority Requirement HIGH Asset users Customers, Salesman1, Salesman2 Supported Business Func#2 Finance Assets role /usage in function Same as office PBX Recovery Priority Requirement Asset users Supported Business Func#3 Customer Relationship management Assets role /usage in function Same as office PBX Recovery Priority Requirement Asset users

text: Table 18: fixed-line phone numbers, Asset Identification Card – Example

text: Data Asset Identification Card Card Creation/Update Date 18/12/2009 Asset Category Data Asset Name Order Progress Tracking Asset Description A spreadsheet for tracking the state of supplies and equipment requests placed by technicians and salesman.

text: BCM: An approach for SMEs

text: Asset Owner Company Owner Asset Storage Location Desktop-Secretary – C:\MyDocuments\ Asset Maintainer Secretary Aggregated Recovery Priority Medium Supported Business Func#1 Finance Assets role /usage in function Required for tracking order status for spare parts, supplies and equipment. Recovery Priority Requirement Medium Asset users Secretary

text: Table 19: Order Progress tracking, Asset Identification Card – Example

text: People / Suppliers Identification Card Card Creation/Update Date 18/12/2009 Name External IT Expert Organization and address (if not a IT Valued Ltd. company employee) Department - Title (Role) - Key BCM Responsibilities (If contractual obligations exist, put a reference to the contract) Office Telephone +44 4556 445545 FAX +44 4556 445546 Mobile +44 4556 445547 Home Telephone E-mail expert@itvalue.co.uk

text: Table 20: External IT Expert, Identification Card – Example

text: Facilities Identification Card Card Creation/Update Date 18/12/2009 Asset Category Facilities Asset Name Company Offices Asset Description The operating location of the company. Includes offices, IT and warehouse

text: BCM: An approach for SMEs

text: Asset Owner Warehouse Man Asset Location 12, Lisle st., Newcastle, UK Asset Maintainer Warehouse Man Aggregated Recovery Priority High (inherited by other critical functions) Supported Business Func#1 Expedited Service Contract Fulfilment Supported Business Func#2 Finance Supported Business Func#3 Customer Relationship Management Supported Business Func#4 Supported Business Func#5

text: Table 21: Offices Asset Identification Card – Example

text: When the Asset Identification cards are populated with information the Assessment Team can start analysing the recovery requirements for each asset based on how this is used by each critical function. If there is evidence that a different recovery priority than the one inherited by the supported business function is needed, then the Assessment team may document the reasons and assign the new priority. In addition, the Assessment Team might be willing to set more concrete recovery objectives, i.e. based on hours/days. This is a feasible option and will allow setting more clear requirements for the implementation of the controls that will be identified in the next phase. For example defining a recovery objective of 6 hours for an asset of High priority or 2 days for an asset of Medium priority will yield a more profound recovery order and more accurate implementation requirements. The overview of the analysis results for the assets requirements for all critical business functions is summarized in the table given below. The Aggregated recovery priority will be used in the next phase to identify the appropriate control card for each asset.

text: IT Asset Function#1 Function#2 Function#3 Aggregated Expedited Finance Customer Recovery Service Relationship Priority Contract Management Fulfilment Hardware

text: Tech-Laptop1 (identical 2 tech-laptop2) H H Tech-Laptop2 (identical 2 tech-laptop1) H H Desktop-Sales1 H M H Desktop-Sales2 H M H Secretary Desktop PC M M Owner Laptop, M M M Accountant Computer(in accountants office M M premises) Financial control application server M M Office Ethernet switch H M M H Internet Router H M M H Office-PBX H M M H

text: BCM: An approach for SMEs

text: IT Asset Function#1 Function#2 Function#3 Aggregated Expedited Finance Customer Recovery Service Relationship Priority Contract Management Fulfilment

text: Back office Application Financial control App M M Email H M M H H M M H office productivity applications H H Medical-Equipment-problem-diagnosisapplication-vendor1 H H Medical-Equipment-problem-diagnosisapplication-vendor2

text: Client Facing Application

text: Company fixed-line phone H M M H FAX M M Technician Mobile phones H H Salesmen mobile phones H M H Internet Service provisioning H M M H web site M M

text: People / Suppliers

text: External IT expert H M M H Financial control software supplier M M Technician2 H M M H PBX Supplier H M M H Technician1 H M M H Secretary H M M H Warehouseman H M M H Company-Owner M M M

text: Data

text: Corporate Financial Data M M supplier agreements and contact information M M funding agreements M M order progress tracking M M H H Expedited Service Customer database Technicians work Planning H M H Expedited Support/repair request reports H H Medical equipment service manuals H H Customer Request tracking database M M

text: BCM: An approach for SMEs

text: Normal Support/repair request reports M M Spare part requests H M H Medical equipment brochures and technical M M specifications

text: Facilities

text: Company offices H M M M

text: Table 22: Asset Requirements Analysis Summary - Example BCM: An approach for SMEs Phase 3 – Controls Selection

text: During Phase 3 the Assessment Team selects appropriate controls based on the risk profile selected for every risk category and the list of identified critical assets. Controls are separated in two Categories –(a) organizational continuity controls and (b) asset-based continuity controls. Controls are further grouped in control cards. Two types of Continuity Control Cards are available for selection by the teams that carry the assessment of an SME: □ Controls cards that contain controls applicable to the organization horizontally and are concerned with practices and management procedures and □ Control cards that are applicable to critical assets and are asset-category-specific. Control cards are essentially preselected – grouped controls according to risk profiles and the asset recovery priority.

text: Phase 3 Controls Selection Organizational Continuity Asset Based Continuity Control Cards Select Asset Based Control Cards Selected Controls Figure 4: Phase 3 – Controls Selection Workflow Step 1. Select Organization Continuity Controls

text: During this step, the Assessment Team selects organizational continuity control cards for the risk areas identified during phase 1 (Select Risk Profile) and thereby defines the direction for business continuity efforts in the organization. However, practical considerations will prevent SMEs from immediately implementing all of the initiatives after the evaluation. Organizations will likely have limited funds and staff members available to implement the protection strategy. After the evaluation, the Assessment Team prioritizes the activities in the protection strategy and then focuses on implementing the highest-priority activities (Phase 4: Implementation and Management). Organization Continuity Controls are available for every risk profile as defined in the Risk Profile Evaluation Matrix.

text: Step 2. Select Asset-Based Continuity Controls

text: Based on the organization’s risk profile and the asset recovery priority (inherited by the respective critical business function) the Assessment Team shall use Asset Continuity Control Cards Table to identify the appropriate asset controls (see Annex B. Asset Based Continuity Control Cards). Asset control cards are essentially grouped in two categories, corresponding to asset category and risk

text: BCM: An approach for SMEs

text: profile. For example Assessment Teams facing a high risk organization profile will have different business continuity requirements than medium or low risk profiles. Equally, controls cards will include more controls to address a higher range of risks and business continuity requirements. Each asset-based control card involves a number of continuity controls to address the complete range of continuity risks for that asset, as needed for the particular risk profile. Furthermore, by taking into account the selected recovery priority, different control assignments are made. In addition, the asset control cards include the recovery actions that the organization should execute (after the disaster occurrence) in order to recover and resume critical business functions. The recovery actions selection is driven from the continuity control category and the respective continuity control.

text: Step 3. Document List of Selected Controls

text: While selecting control cards of critical assets in step 2, the Assessment Team will have to discuss issues related to these controls (e.g. rationale for selection, current implementation level, possible options for costs of control, etc.). In this step the team compiles a list including the selected controls and documents the rationale for selecting each control. By understanding controls, the team will be better able to define the appropriate action plans towards the development of the controls implementation plan during phase 4.

text: Example (Micro Enterprise - Risk Profile: Low - Critical Business Function: Finance – Phase 3)

text: [Step 1] In our example the organizational controls for a Low Legal and Regulatory risk level introduce continuity controls that are dictated by SP1.1 and SP2.3 organizational controls. In the same way, a low risk in productivity risk class imposes a need for countermeasures and practices implied by SP2.1, SP2.2 and SP5.2, organizational controls. For low risk level in Financial Stability, SP2.1 and SP5.2, is dictated, and for Low risk level of Reputation and Loss Customer Confidence, SP2.7.

text: Risk Areas High Medium Low

text: Legal and Regulatory

text: Productivity

text: Financial Stability

text: Reputation and Loss of Customer

text: (SP1) SP2.2 SP2.7

text: Confidence

text: (SP2) SP2.3

text: BCM: An approach for SMEs

text: (SP4) (SP4) SP3.4

text: Table 23: Organizational Continuity Controls - Example

text: [Step 2] In step 2 the Assessment Team selects asset-based control card(s) using the asset-based continuity control cards table (table 22). In our example given the low risk profile of the organization identified in phase 1 and the critical asset types identified in Phase 2, step 2, they select card CCC-3HN for low profile hardware and network assets, CCC-3A card for low profile applications, and cards CCC-3D and CCC-3F for data and locations low profile assets respectively.

text: Asset Continuity Control Cards

text: Asset Category High Risk Cards Medium Risk Cards Low Risk Cards

text: (Back Office – Client Facing)

text: Table 24: Asset Continuity Control Cards - Example

text: The cards selected (see Annex B) display the necessary controls for Hardware, Network, Application, Data and Facilities Assets operating at an organization with a low risk profile. The team identifies the controls that address the recovery priority identified in phase 2. In the example, Finance function has a medium recovery priority; thus the assets providing the function inherit the function’s recovery priority. The following asset controls HN.1.1.1 and HN.1.2.1 are selected for hardware and network assets addressing resilience and backup continuity requirements for these assets (Table 23). In accordance with the selected continuity controls the respective recovery action RA.1.2.1 is selected, to achieve the recovery of the organization’s assets. Equally, the Assessment Team selects the appropriate asset controls and recovery actions for Application, Data and Facilities assets as these are depicted into tables 24, 25 and 26.

text: Asset Based Continuity Control Card ID CCC-3HN

text: Risk Profile Low

text: Asset Category Hardware and Network

text: ry ty

text: ori Medium co ri e P R

text: Recovery Actions - RA.1.2.1

text: Table 25: CCC-3HN Asset based control card - Example BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-3A

text: Risk Profile Low

text: Asset Category Application

text: Continuity Controls Application Resilience Application Back up Category

text: ty

text: ri P ry

text: ve co e R

text: Table 26: CCC-3A Asset based control card - Example

text: Asset Based Continuity Control Card ID CCC-3D

text: Risk Profile Low

text: Asset Category Data

text: Continuity Controls Data Storage Data back up

text: Category

text: ori ri P

text: ve co

text: R Low

text: Table 27: CCC-3D Asset based control card - Example

text: Asset Based Continuity Control Card ID CCC-3F

text: Risk Profile Low

text: Asset Category Facilities

text: Continuity Controls Category IT Site Environmental Physical Security Security

text: BCM: An approach for SMEs

text: ty ori ri

text: ry

text: co e R

text: Recovery Actions - - -

text: Table 28: CCC-3F Asset based control card – Example

text: The full listing of assets and the corresponding assect based control cards is summarisied in the following table.

text: IT Asset Aggregated Recovery Selected Asset Based Control Priority Cards

text: Hardware Tech-Laptop1 (identical 2 tech-laptop2) H CCC-3HN CCC-3HN Tech-Laptop2 (identical 2 tech-laptop2) H Desktop-Sales1 H CCC-3HN Desktop-Sales2 H CCC-3HN Secretary Desktop PC M CCC-3HN Owner Laptop, M CCC-3HN Accountant Computer(in accountants office M CCC-3HN premises) Financial control application server M CCC-3HN Office Ethernet switch H CCC-3HN Internet Router M CCC-3HN Office-PBX H CCC-3HN Back office Application Financial control M CCC-3A Email H CCC-3A office productivity applications H CCC-3A Medical-Equipment-problem-diagnosis- H CCC-3A application-vendor1

text: BCM: An approach for SMEs

text: Medical-Equipment-problem-diagnosis- H CCC-3A application-vendor2 Client Facing Application Company fixed-line phone H CCC-3A FAX M CCC-3A Technician Mobile phones H CCC-3A Salesmen mobile phones H CCC-3A Internet Service provisioning M CCC-3A web site M CCC-3A People / Suppliers External IT expert H CCC-3P Financial control software supplier M CCC-3P Technician2 H CCC-3P PBX Suppplier H CCC-3P Technician1 H CCC-3P Secretary H CCC-3P Warehouseman H CCC-3P Company-Owner M CCC-3P Data Corporate Financial Data M CCC-3D supplier agreements and contact information M CCC-3D CCC-3D funding agreements M CCC-3D order progress tracking M H CCC-3D Expedited Service Customer database H CCC-3D Technicians work Planning H CCC-3D Expedited Support/repair request reports H CCC-3D Spare part requests H CCC-3D Medical equipment service manuals M CCC-3D Customer Request tracking database M CCC-3D Normal Support/repair request reports

text: BCM: An approach for SMEs

text: Medical equipment brochures and technical M CCC-3D specifications

text: Facilities Company offices M CCC-3F

text: Table 29: Asset Based Control Card Summary

text: [Step 3] In this step Assessment Teams are occupied with data gathering and analysis of the output produced in Steps 1 and 2. Documenting the output of previous steps, both the selected asset-based controls and the organizational controls are then listed in the tables below.

text: Hardware Asset Based Continuity Controls

text: Control Asset & Priority Rationale for Selection

text: IT Infrastructure Documentation HN.1.1.1 Tech-Laptop1 H There is an up-to-date and detailed IT infrastructure diagram including network Desktop-Sales1 H and hardware components.

text: Office PBX H

text: Secretary Desktop PC M

text: Accountant Computer M

text: Financial control M application server Disaster Recovery Cross Training HN.1.1.5 Tech-Laptop1 H No critical hardware or network component depends on an individual person for Desktop-Sales1 H restoration in a disaster.

text: Office PBX H Information Systems Hardening HN.1.1.7 Tech-Laptop1 H Control requires that all systems are up to date with respect to revisions, patches, Desktop-Sales1 H and recommendations in security advisories.

text: Office PBX H Information Systems Backup HN.1.2.1 Tech-Laptop1 H Control requires that there is a documented backup procedure and backup plan Desktop-Sales1 H that is: routinely updated, periodically tested, that calls for regularly scheduled backups of software and configurations and requires periodic testing and verification of the ability to restore from backups. The control requires that the Office PBX H organization performs via the procedure a full Backup (image) of the information Secretary Desktop PC M systems / network equipment operating system, configuration files and any other modules provided by the information system / network component. More than Accountant Computer M one past backup sets is archived to make possible reverting to a well known working setup in case a system failure is also present in the most recent back. If a combination of full and incremental backups is used then the latest full backup Financial control M and all the later incremental backups must be stored as a one backup set and

text: BCM: An approach for SMEs

text: application server must be retained in good working condition.

text: Staff Training HN.1.2.5 Tech-Laptop1 H Control requires that all staff understand and is able to carry out their Desktop-Sales1 H responsibilities under the backup plans.

text: Office PBX H Vendors SLAs HN.1.3.3 Tech-Laptop1 H The control requires that the organization maintains a list which includes Desktop-Sales1 H hardware and network components vendors / suppliers and that a documented agreement exists between the two parties for the urgent provisioning of the Office PBX H required equipment within a predefined timeframe.

text: Table 30: List of Hardware Selected Controls – Example

text: Applications Asset Based Continuity Controls

text: Application Documentation. A.1.1.1 Email Service H The control requires the organization to document the required environment (OS version, external libraries, etc) for the execution of the application. This Company fixed-line phone H documentation has to be verified and updated at every maintenance cycle of Salesmen mobile phones H the BCP.Furthermore, if the application is custom the application code should be documented. The criticality of the application will dictate the level of Financial control M documentation required.

text: Internet Service M provisioning Application Configuration Management A.1.1.3 Email Service H A well defined configuration management procedure should be maintained, and changes to the application, its configuration and the running Company fixed-line phone H environment should be documented appropriately. Salesmen mobile phones H Application Maintenance and Patching A.1.1.4 Email Service H Vendor patches are applied via a documented patch management procedure and backups of critical systems are performed before and after updating the Company fixed-line phone H application. Salesmen mobile phones H

text: Financial control M

text: Internet Service M provisioning Application Vendors & SLAs. A.1.1.6 Email Service H The control requires that the organization maintains a list which includes the applications vendors / suppliers and that a documented agreement exists fixed-line phone H between the two parties for technical support provisioning when required. Salesmen mobile phones H Application Backup A.1.2.1 Email Service H

text: BCM: An approach for SMEs

text: Control requires that there is a documented backup procedure that is fixed-line phone H routinely updated, periodically tested, that calls for regularly scheduled backups of application software and requires periodic testing and verification Salesmen mobile phones H of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup of the application files, Financial control M database and any other available application modules. When this control is applied to a service (such as email or internet provisioning) then establishing Internet Service M an alternate backup service is required in addition to backing up any relevant provisioning data. When considering backup of services that produce or store data the ability to have a usable local copy of the data or to transfer existing data to the backup service has to be considered and evaluated.

text: Table 31: List of Application Selected Controls – Example

text: Data - Asset Based Continuity Controls

text: Data Mirroring D.1.1.1 Spare part requests H The control requires thatall critical data are mirrored to additional storage media ensuring that data is written to two or more different disks (disk mirroring / raid array configuration) to ensure that two valid copies of the data are available. Store Backup Media Offsite D.1.1.5 Spare part requests H Backup media should be labelled, logged, and stored offsite in a secure, environmentally controlled facility. The storage facility should be located far Corporate Financial Data M enough away from the original site to reduce the likelihood that both sites would be affected by the same event. A documented procedure should exist order progress tracking M (part of the backup plan) to obtain the offsite backup media when required. Data storage continuity arrangements must assure the proper security levels (confidentiality, integrity, availability), while data are stored, in transit or at an off-site location. Backup Rotation Schedules D.1.2.1 Spare part requests H The control requires the enforcement of data backup via a documented, well-known backup rotation scheme such as Grand-Father-Son, Round Robin Corporate Financial Data M and Tower of Hanoi. order progress tracking M

text: Backup System Flexibility D.1.2.3 Spare part requests H The backup system should allow quick and flexible restoration of files, folders, partitions, mailboxes/messages and databases/tables. It should be possible to schedule restoration of data according to the pre-determined recovery priority. This is to be utilised when the time to restore the full datasets exceeds the target recovery times. Design your backup plan to meet the precise restoration time objectives. Order the backup sequence according to your recovery sequence to avoid time costly seeks on tapes. Create a precise map of the contents of each tape. If possible clone the backup sets to a hard disk storage to increase the speed of restoration. Internet Backup D.1.2.4 Spare part requests H The control requires that workstation users (personnel) are allowed to back up data to a remote location over the Internet. Formal authorisation is Corporate Financial Data M required prior to the execution of this backup method. order progress tracking M

text: BCM: An approach for SMEs

text: Data - Asset Based Continuity Controls

text: Data Backup D.1.2.5 Spare part requests H Control requires that there is a documented data backup plan that is routinely updated, periodically tested, that calls for regularly scheduled Corporate Financial Data M backups of data and requires periodic testing and verification of the ability to restore from backups. order progress tracking M

text: Table 32: List of Data Selected Controls – Example

text: People - Asset Based Continuity Controls

text: Physical Access Control P.1.1.2 External IT expert H Control requires that there are documented procedures for authorizing and Technician2 overseeing those who work with sensitive information or who work in PBX Suppplier locations where such information is stored. This includes employees, contractors, partners, collaborators, and personnel from third-party Technician1 organizations, systems maintenance personnel, or facilities maintenance Secretary personnel. WarehouseMan Clean Desk Policy P.1.1.3 External IT expert H A clean desk policy is in operation followed by all personnel, contactors and Technician2 third parties PBX Suppplier Technician1 Secretary WarehouseMan Business Continuity Tool Set P.1.2.1 External IT expert H The control requires that staff has access and is trained to use a business Technician2 continuity tool set which includes the appropriate material (software / hardware, documented guidelines and procedures) for responding after a PBX Suppplier security or business continuity incident. Technician1 Secretary WarehouseMan Business Continuity Tests P.1.2.2 External IT expert H Staff, have been trained and involved in business continuity tests. Technician2 PBX Suppplier Technician1 Secretary WarehouseMan Key Personnel Deputies P.1.2.3 External IT expert H All executives, managers and designated critical staff participating into Technician2 business continuity teams have trained deputies who can fulfil their duties / responsibilities. PBX Suppplier Technician1 Secretary

text: BCM: An approach for SMEs

text: WarehouseMan

text: Key IT Personnel Training P.1.2.4 External IT expert H The control requires that key IT personnel assigned with a key role into Technician2 business continuity plans and procedures, are trained on a “business as usual” basis. The training ensures that such key position employees are fully PBX Suppplier capable of executing efficiently business continuity plans or procedures Technician1 Secretary WarehouseMan

text: Financial control software M supplier Company-Owner

text: Table 33: List of People Selected Controls – Example

text: Facilities - Asset Based Continuity Controls

text: IT Site Physical Access F.1.1.1 Company offices H Physical access to IT Site is restricted by lock / combination lock and / or swiped cards or similar physical access control technologies.

text: IT Site Power Supply F.1.1.2 Company offices H The power supply of the site equipment is protected with UPS and / or generators. IT Site Air-Conditioning F.1.1.3 Company offices H IT site humidity, ventilation and air-conditioning are controlled.

text: IT Site Anti-fire Systems F.1.1.4 Company offices H Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within the IT site. IT Site Recovery Plan F.1.1.7 Company offices H Detailed recovery plans exist for the redirection of all feeds from each primary site to respective recovery sites. Fire Fighting Equipment F.1.2.2 Company offices H Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within corporate facilities Air-conditioning F.1.2.3 Company offices H The air-conditioning system installed into the corporate facilities has autoshut-off if there is a fire, smoke detection or alert. Anti-flood Equipment F.1.2.4 Company offices H There are water detection systems and anti-flood techniques (raised floors, drop ceilings) in all vulnerable or high flood-risk areas of the corporate facilities. Rooms and Areas Secure Access F.1.3.4 Company offices H Physical access to critical areas and floors is restricted by guards’ presence and /or individual swiped card or locked doors with keys only available to

text: BCM: An approach for SMEs

text: authorised personnel.

text: Table 34: List of Facilities Selected Controls – Example

text: Organizational Continuity Controls

text: SP.1.1 Dental Equipment A policy should be developed which will set a framework towards business continuity.

text: Company

text: SP2.1 Dental Equipment A business continuity plan should exist for the management of business continuity incidents.

text: Company

text: SP2.2 Dental Equipment An incident response procedure should exist for the proper handling of security incidents.

text: Company

text: SP2.3 Dental Equipment Emergency procedures will be developed for the health & safety of the organization’s Company personnel. SP2.7 Dental Equipment The organisation has established diverse communication channels that clients and third Company parties can use to contact the organisation, request service or report a problem. These arrangements are part of the business as usual and no special actions are needed for their activation. Such communication channels may be land line phone numbers, mobile phone numbers, voice mailboxes, email and FAX from diverse providers to avoid single points of failure. SP5.2 Dental Equipment The organization has verified that outsourced security services, mechanisms, and technologies Company meet its business continuity needs and requirements. Business continuity requirements on providers are included in formal terms in the contract.

text: Table 35: List of Selected Organizational Controls – Example BCM: An approach for SMEs Phase 4 – Implementation & Management

text: During Phase 4 the Assessment Team performs a gap analysis exercise in order to evaluate the organization’s current state against the selected continuity controls, both organizational and asset grouped within the respective control cards. Following this, the Assessment Team develops the controls Implementation Plan which includes the controls that will be implemented, as well as the prioritization for their integration into the organization. Finally the Assessment Team based on the information collected and assessed during the execution of the previous phases and steps, creates the Business Continuity Plan to address the continuity risks.

text: Phase 4 Implementation and Management Figure 5: Phase 3 – Controls Selection Workflow Step 1. Perform Gap Analysis

text: In this step Assessment Teams are occupied with the evaluation of the organization's current business continuity practices compared to controls described on the selected control cards. Assessment Teams carefully read controls that apply to their profile (as depicted from the selected control cards - Phase 3, Step 3) and elicit detailed information about the organization's current continuity policies, procedures, and practices, thus providing a starting point for improvement. During the Gap Analysis process teams use the control cards as the “continuity requirements” and assess the gaps between these and current business continuity practices both at an organizational and critical asset level. The output from this process can form the basis for the planning activity that follows next. It is separated into two categories: (a) Organizational Continuity Controls, where the Assessment Teams should identify the suggested practices that are already implemented and the ones not implemented. Then actions for improvement at an organizational level can be defined and (b) Asset Based Continuity Controls where Assessment Teams assess existing protection measures for the identified critical assets.

text: BCM: An approach for SMEs Step 2. Controls Implementation Plan

text: In this step the Assessment Team considers whether the organization will implement or not the continuity controls found missing during the gap analysis exercise. This task is achieved by the Assessment Team recording its answer to this question: What is required in terms of resources and changes in order to implement the selected controls? The team discusses the operational aspects of each control considering the following questions for each one. □ Who should implement it? □ Who should be responsible for it? □ Who should benefit from it? □ How should it be implemented? These questions focus on how continuity controls should be used and why they are important. If the team can't answer all of these questions, it may need to ask people in the organization who can answer them. The information that will be identified by answering these questions will be useful later on when the implementation plan of the controls will be developed. The output of this activity is the continuity controls Action List which leads to a series of actions that an organization should undertake to improve its existing level of business continuity. Since specific actions / steps have been identified, the team develops the controls Implementation Plan assigning responsibility for completing them as well as a completion date and the implementation priority. The following questions should be answered for each action item on the list and record the results: □ Who will be responsible for each action item? □ By what date does the action item need to be addressed? □ What can management do to facilitate the completion of this action item? □ How much will it cost? □ How long will it take? □ Can we do it ourselves? □ Do we need external assistance? The actions prioritization for the implementation of organizational continuity controls is performed in accordance with the risk level (high, medium, low) assigned to the predefined risk areas during phase 1. For example an organization with a low risk level in the legal and regulatory risk area will assign a low implementation priority for the actions that should be executed towards the implementation of the controls dictated to this risk area. Likewise, the same organization may have a high risk level in the productivity risk area, assigning a high priority for the actions implementation. On the contrary, the prioritization of the asset based controls implementation is derived by the recovery priority of the critical asset identified in phase 2- and the respective asset category. The asset based controls prioritization can be assigned with three distinct values: High, Medium and Low. Each value implies a different timeframe for the control implementation; high priority controls should be implemented first, medium next and low last. It should be noted that the SME should implement all the controls (both organizational and asset based) as soon as possible. The aforementioned prioritization methods should be followed in case that the SME is not able to implement all the controls at once due to limited resources (manpower, budget etc). It is worth mentioning that the implementation priority of the controls may be influenced by a number of key factors / criteria. These criteria should be counted in by the Assessment Team during the controls prioritization since they can significantly change the controls implementation priority derived by the method presented above. Bellow some additional criteria for prioritizing actions for implementing identified controls can be found:

text: BCM: An approach for SMEs

text: □ Personnel life health and safety: People are the most valuable assets within an organization. In this regard health and safety the personnel should be ensured assigning high priority to the implementation of controls referring to environmental and physical security issues. □ Strategic alignment with organization goals: Does this business function directly support documented organization and/or divisional work plan goals? What goals and/or work plan objectives will be supported and how? □ Legal and Regulatory requirements: If a business function is necessary to meet legal and regulatory requirements, this will be reflected in setting priorities. The organization should also consider Health and Safety legal requirements as these are established by the Legal and Regulatory Framework of the country in which the SME operates. □ System-wide benefits: System-wide benefits include improved customer service for several customer groups. A higher priority will be given to customer groups that are considered critical, but the larger the customer group affected the greater the benefit. □ Cost/Time Savings: Estimates of cost and/or time savings include staff time, customer time savings, revenue generation, and direct budget/cost reductions. □ Continuity Risk Reduction: As result of a project, information and/or services will prevent lost revenues and/or noncompliance with policies, legal, and audit requirements.

text: Step 3. Deliver Business Continuity Plan

text: As an output of the above phases and steps the Assessment Team will derive with the organization’s Business Continuity Plan (BCP). The BCP will include the following sections: (1) BCP Governance, (2) The results of Self-Assessment Approach from all performed phases, (3) Plans, processes, measures, and arrangements for business continuity, (4) Quality assurance techniques (change management, exercises, maintenance and auditing). (5) Annexes with documentation and usage Instructions for the implemented controls. The Assessment Team fills in the template’s sections based on the output of the previous phases and steps deriving with the organization’s Business Continuity Plan. The plan will form the organization’s strategy regarding business continuity addressing the following business continuity requirements: □ Business continuity processes and plans (.i.e. Disaster Recovery Plan, Incident Management Procedure) □ Contact List(s) with business continuity responsible employees / teams / managers □ Business Continuity Team roles and responsibilities. □ List of Critical Business Functions □ The continuity controls that the organization uses in order to protect the continuity of the critical business functions / assets □ Activities for Testing Reassessing and Maintaining Business Continuity Plan □ Contact details of vendors / suppliers committed to supporting the recovery efforts □ Resource requirements (people, work area, IT, telecommunications) □ Contact List of Governmental authorities / bodies

text: Example (Micro Enterprise - Risk Profile: Low - Critical Business Function: Finance – Phase 4)

text: [Step 1] In this step Assessment Teams are occupied with the evaluation of the organization's current business continuity practices compared to controls described on control cards. Assessment Teams carefully read controls that apply to their profile (as depicted from the selected control cards - Phase 3, Step 3) and elicit detailed information about the organization's current continuity policies, procedures, and practices, thus providing a starting point for improvement.

text: BCM: An approach for SMEs

text: The following Table refers to the Example:

text: Organizational Continuity Controls

text: Control Asset Control Description Do we currently follow the controls included in the control cards?

text: SP.1.1 Dental A policy should be developed which will set a framework No Equipment towards business continuity.

text: Company

text: SP2.1 Dental A business continuity plan should exist for the No Equipment management of business continuity incidents.

text: Company

text: SP2.2 Dental An incident response procedure should exist for the No Equipment proper handling of security incidents.

text: Company

text: SP2.3 Dental Emergency procedures will be developed for the health Yes. We must align our plans with the upcoming Equipment & safety of the organization’s personnel. business continuity plan

text: Company

text: SP2.7 Dental The organisation has established diverse communication Partially yes. We have diverse means of Equipment channels that clients and third parties can use to contact communication. Mobiles, land line, FAX, email. Company the organisation, request service or report a problem. We are at present unsure about the diversity of These arrangements are part of the business as usual suppliers for these services. It might be we are and no special actions are needed for their activation. getting all the services from a single supplier or a Such communication channels may be land line phone subsidiary. numbers, mobile phone numbers, voice mailboxes, email and FAX from diverse providers to avoid single points of failure. SP5.2 Dental The organization has verified that outsourced security No Equipment services, mechanisms, and technologies meet its Company business continuity needs and requirements. Business continuity requirements on providers are included in formal terms in the contract.

text: Table 36: Organizational Controls Gap Analysis List – Example

text: Control Asset & Priority Do we currently follow the controls included in the control cards?

text: HN.1.1.1 Tech-Laptop1 H No

text: Desktop-Sales1 H

text: Office PBX H

text: Secretary Desktop PC M

text: Accountant Computer M

text: Financial control M application server

text: BCM: An approach for SMEs

text: HN.1.1.5 Tech-Laptop1 H No Desktop-Sales1 H Office PBX H HN.1.1.7 Tech-Laptop1 H Partially. In some systems automatic updates are used. Desktop-Sales1 H Office PBX H HN.1.2.1 Tech-Laptop1 H No Desktop-Sales1 H Office PBX H Secretary Desktop PC M Accountant Computer M Financial control M application server HN.1.2.5 Tech-Laptop1 H No Desktop-Sales1 H Office PBX H Partially. We have an SLA for next business day laptop repair. HN.1.3.3 Tech-Laptop1 H The office-PBX is under a three business days repair contract. Desktop-Sales1 H Office PBX H

text: Table 37: Hardware Gap Analysis List – Example

text: Partially, No custom application code is developed in the company. In general A.1.1.1 Email Service H environment documentation for the applications is available in the vendor Company fixed-line phone H documents. But the information is not updated with new versions or patches of the software. Salesmen mobile phones H Financial control M Internet Service M provisioning

text: BCM: An approach for SMEs

text: Not Applicable. The specs of the service availability are handled in the contract. A.1.1.3 Email Service H Not Applicable. The specs of the service availability are handled in the contract. Company fixed-line phone H No. Mobile phones are configured and applications can be installed by their users. Salesmen mobile phones H Not Applicable. The specs of the service availability are handled in the contract. A.1.1.4 Email Service H Not Applicable. The specs of the service availability are handled in the contract. Company fixed-line phone H No. Mobile phones are configured and applications can be installed by their users. Salesmen mobile phones H Yes. Maintenance and patching is responsibility of the application vendor under Financial control M the maintenance contract No. Internet Service M provisioning Yes A.1.1.6 Email Service H Partially. We have the standard level support of the telephone company fixed-line phone H No Salesmen mobile phones H Yes backup of emails is part of the service A.1.2.1 Email Service H No fixed-line phone H No Salesmen mobile phones H Partially. Backups are performed by the vendor. We have not verified restoration Financial control M though. No backup arrangements exist. Internet Service M provisioning

text: Table 38: Application Gap Analysis List – Example

text: Data - Asset Based Continuity Controls

text: No D.1.1.1 Spare part requests H No. D.1.1.5 Spare part requests H Corporate Financial Data M order progress tracking M Partially. Backups are responsibilities of employees. They are currently encouraged D.1.2.1 Spare part requests H to backup a few times a week using their usb flash disks. Corporate Financial Data M order progress tracking M No. D.1.2.3 Spare part requests H

text: BCM: An approach for SMEs

text: Data - Asset Based Continuity Controls

text: No D.1.2.4 Spare part requests H Corporate Financial Data M order progress tracking M No D.1.2.5 Spare part requests H Corporate Financial Data M order progress tracking M

text: Table 39: Data Gap Analysis List – Example

text: No P.1.1.2 External IT expert H Technician2 PBX Supplier Technician1 Secretary WareHousaMan No P.1.1.3 External IT expert H Technician2 PBX Supplier Technician1 Secretary WareHousaMan No. P.1.2.1 External IT expert H Technician2 PBX Supplier Technician1 Secretary WareHousaMan No P.1.2.2 External IT expert H Technician2 PBX Supplier Technician1 Secretary WareHousaMan No P.1.2.3 External IT expert H Technician2

text: BCM: An approach for SMEs

text: PBX Supplier Technician1 Secretary WareHousaMan No P.1.2.4 External IT expert H Technician2 PBX Supplier Technician1 Secretary WareHousaMan Financial control software M supplier Company Owner

text: Table 40: People Gap Analysis List – Example

text: No. IT systems are dispersed in employee offices. Locking is not possible F.1.1.1 Company offices H Partially. A UPS is installed for most of the IT equipment. F.1.1.2 Company offices H Partially. Air-conditioning is controlled to human comfort levels. F.1.1.3 Company offices H Fire detection is in-place. F.1.1.4 Company offices H No. F.1.1.7 Company offices H Partially. Fire fighting equipment is not selected to avoid damaging technology F.1.2.2 Company offices H equipment. No. Auto shut off is not present. F.1.2.3 Company offices H No. Our location is not prone to flooding. F.1.2.4 Company offices H No. Only the warehouse is kept always locked. F.1.3.4 Company offices H

text: Table 41: Facilities Gap Analysis List – Example

text: [Step 2] Following the gap analysis, Assessment Team reads the controls (Annex A, B) and decides whether the organization will implement or not the continuity controls. The Assessment Team documents the necessary actions towards the implementation of the continuity controls:

text: Organizational Continuity Controls

text: Control Asset Control Description Activity needed, Outcome expected, Deliverable Documentation

text: BCM: An approach for SMEs

text: Organizational Continuity Controls

text: SP.1.1 Dental A policy should be developed which will set a A policy shall be developed. The business continuity Equipment framework towards business continuity. policy document will be made available to all Company employees. Deliverable: Business Continuity Policy

text: Document

text: SP2.1 Dental A business continuity plan should exist for the A business continuity plan will be developed and Equipment management of business continuity incidents. documented. All the individuals with roles in the Company plan will receive their copy. Updates of the document will be distributed on every maintenance cycle of the BCP.

text: Deliverable: Business Continuity Plan Document

text: SP2.2 Dental An incident response procedure should exist for Incident response procedure will be drafted Equipment the proper handling of security incidents. relevant to the know-how and expertise available Company for response within the company.

text: Deliverable: Incident Response Procedure – as a part of BCP document

text: SP2.3 Dental Emergency procedures will be developed for the Yes. We must align our plans with the upcoming Equipment health & safety of the organization’s personnel. business continuity plan. Deliverable: Updated

text: Company Emergency procedures document, attached to BCP

text: SP2.7 Dental The organisation has established diverse Establish a policy of communication channel Equipment communication channels that clients and third diversity. The communication service used by the Company parties can use to contact the organisation, company will be documented including adequate request service or report a problem. These supplier information. The following rules must be arrangements are part of the business as usual and followed: no special actions are needed for their activation. 1) All customers and suppliers are aware of at Such communication channels may be land line least two points of contact with the company. phone numbers, mobile phone numbers, voice These points of contact must be using mailboxes, email and FAX from diverse providers different communication technologies. (e.g.: to avoid single points of failure. mobile phones and email) 2) At least one of the communication channels used as a point of contact must be supplied to the company through an independent supplier having no subsidiary relation to the dominant communications supplier of the company (if any).

text: Deliverable: Communication channel diversity policy (attached to the procurement policies) Deliverable: Communication channel map (attached to the BCP and to the procurement policies)

text: SP5.2 Dental The organization has verified that outsourced The organisation will use the business continuity Equipment security services, mechanisms, and technologies assessment results to identify the terms to be Company meet its business continuity needs and included when procuring relevant services. Where requirements. Business continuity requirements such terms are agreed a relevant business on providers are included in formal terms in the continuity testing capability must also be present. contract. Deliverable: Policy of business continuity

text: requirements in contracts (attached to the procurement policies)

text: Table 42: Organizational Controls Gap Analysis List – Example BCM: An approach for SMEs

text: Control Asset & Priority Activity needed, Outcome expected, Deliverable Documentation

text: HN.1.1.1 Tech-Laptop1 H A detailed documentation of the IT Infrastructure in the form of diagrams will be created. The diagrams will be including the network and hardware components. Desktop-Sales1 H

text: Deliverable: IT Infrastructure Diagrams (to be attached to the BCP)

text: Office PBX H

text: Secretary Desktop PC M

text: Accountant Computer M

text: Financial control M application server HN.1.1.5 Tech-Laptop1 H The company personnel is not adequate to provide for complete disaster recovery cross training. Where practical alternate external contractors will be identified. Desktop-Sales1 H

text: Deliverable: Disaster Recovery Cross Training Matrix (To be attached to the BCP)

text: Office PBX H HN.1.1.7 Tech-Laptop1 H All devices that support automatic security updates will be configured to use this feature by default. Desktop-Sales1 H A list of Systems exposed to the internet that don’t have an automatic update feature Office PBX H will be created. Periodic hardening by our IT expert will be considered as an option, probably with the support of a government or commercial Computer Emergency Response Team.

text: Deliverable: Information Systems Hardening Report, once per BCP maintenance cycle

text: HN.1.2.1 Tech-Laptop1 H Information Systems Backup will be implemented.

text: Deliverable: Backup Plan (to be attached to the BCP)

text: Desktop-Sales1 H

text: Office PBX H

text: Secretary Desktop PC M

text: Accountant Computer M

text: Financial control M application server HN.1.2.5 Tech-Laptop1 H Training will be implemented.

text: Deliverable: Training Schedule and implementation records

text: Desktop-Sales1 H

text: Office PBX H In addition to the existing contracts the following action will be taken: HN.1.3.3 Tech-Laptop1 H Desktop-Sales1 H 1) Maintain a list of suppliers for commodity hardware that can be easily obtained within 1 business day. Office PBX H 2) Sign an expedited provisioning agreement for hardware not widely available

text: BCM: An approach for SMEs

text: or required to be available in less than a day. Existing Contracts: We have an SLA for next business day laptop repair. The office-PBX is under a three business days repair contract.

text: Deliverable: Vendor SLAs for expedited repair or provisioning (attached to the BCP)

text: Table 43: Hardware Actions List – Example

text: Relevant documentation will be identified collected and be available for reference. The A.1.1.1 Email Service H documentation collected will have to be useful in restoring and using the application Company fixed-line phone H during a business continuity incident.

text: Deliverable: Critical Application reference documentation index (attached to the BCP)

text: Salesmen mobile phones H Financial control M Internet Service M provisioning No action A.1.1.3 Email Service H No action Company fixed-line phone H No action Salesmen mobile phones H No action A.1.1.4 Email Service H No action Company fixed-line phone H No action Salesmen mobile phones H No action required. Financial control M No action Internet Service M provisioning Yes. No action required A.1.1.6 Email Service H Due to alternative communication channels no action required. fixed-line phone H Due to alternative communication channels no action required. Salesmen mobile phones H Yes backup of emails is part of the service A.1.2.1 Email Service H No fixed-line phone H No Salesmen mobile phones H

text: BCM: An approach for SMEs

text: The contractor will be requested to perform test restores according to the backup plan Financial control M that will be developed.

text: Deliverable: Backup Plan (attached to the BCP)

text: Backup Internet service provisioning will be investigated as an option (e.g. Mobile Internet Service M Internet 3G/hsdpa, wireless providers, etc). The process for activating the backup service provisioning will be documented and be available with the BCP.

text: Deliverable: Telecommunications Disaster Recover documentation (attached to the BCP)

text: Table 44: Application Actions List – Example

text: Data - Asset Based Continuity Controls

text: Installe a hard disk mirroring solution. Documentation: Mirroring Solution Installation D.1.1.1 Spare part requests H and user guide. Backup media will be stored off-site and the process will be documented in the backup D.1.1.5 Spare part requests H plan.

text: Documentation: Backup plan (attached to the BCP)

text: Corporate Financial Data M

text: order progress tracking M Backup sechedule will be formalised. Our IT expert will propose alternative plans to D.1.2.1 Spare part requests H choose from. It is understood that procurement of media or hardware and software may be required for some options. Corporate Financial Data M

text: Deliverable: backup rotation schedules of the backup plan

text: order progress tracking M

text: Our IT expert will determine the amount of data to be backedup and restored. The D.1.2.3 Spare part requests H time required for the activities with the proposed solution will be calculated. The backup system will be enhanced /replaced with functionality needed to meet the recovery objectives. The backup schedules may also be altered accordingly.

text: Deliverable: Backup system sizing and fine tuning (used for backup system procurement and backup plan fine tuning)

text: When the responsibility of data backup is staying with the individual data owners. D.1.2.4 Spare part requests H They will use the Internet backup solution selected and procured by the company.

text: Deliverable: Internet Backup User Instructions (attached to the backup plan)

text: Corporate Financial Data M Corporate financial data are responsibility of the financial control application contractor and will not be backedup to the internet. order progress tracking M

text: The Backup will be documented. Our IT expert will propose alternative plans to choose D.1.2.5 Spare part requests H from. It is understood that procurement of media or hardware and software may be required for some options. Corporate Financial Data M

text: Deliverable: backup plan (attached to the BCP) Deliverable: Records of backup/restore tests and media content (attached to the

text: order progress tracking M

text: backup plan)

text: Table 45: Data Actions List – Example

text: Due to the small size of our offices. No authorisation process is required. IT systems P.1.1.2 External IT expert H already require a username and password to be accessed.

text: BCM: An approach for SMEs

text: PBX Supplier No Action. Technician2 Technician1 Secretary WareHouseMan A clean desk policy will be applied. P.1.1.3 External IT expert H PBX Supplier Technician2 Technician1 Secretary WareHouseMan A technology business continuity toolset will be developed and further enhanced with P.1.2.1 External IT expert H experience coming from exercises. An appropariate location for easy access will be PBX Supplier identified and documented in the BCP.

text: Deliverable: technology business continuity toolset

text: (software/hardware, documents, guidelines)

text: Technician1 Documentation: Toolset retrieval instructions attached to the BCP) Secretary WareHouseMan Desktop business continuity exercises will be executed. Exercises will be simple and P.1.2.2 External IT expert H will only get more complex once employessunderstand their tasks. PBX Supplier Deliverable: Desktop exercises and exercise schedule Technician2 Technician1 Secretary WareHouseMan Where possible deputies will be identified. P.1.2.3 External IT expert H

text: Deliverable: The BCP will include the identified deputies

text: PBX Supplier Technician2 Technician1 Secretary WareHouseMan IT Personell is mostly outsourced. Training for disaster recovery will be part of the P.1.2.4 External IT expert H exercises. Technician2 Technician2 will be trained to his responsibilities. PBX Supplier Technician1 Secretary WareHouseMan Financial control software M supplier Company Owner

text: Table 46: People Actions List – Example BCM: An approach for SMEs

text: No action. F.1.1.1 Company offices H

text: All systems identified as critical assets will be powered through a UPS. F.1.1.2 Company offices H

text: Deliverable: Asset profiles updated to reflect the existence of UPS.

text: Air-conditioning is controlled to human comfort levels. Employess will be advised to take F.1.1.3 Company offices H not of malfunctions and if required equipment will be placed in a separate room.

text: Deliverable: Employee awareness

text: No further improvement is possible. No action F.1.1.4 Company offices H

text: Arrangements for transferring the telecommunication services, supplies and spare parts F.1.1.7 Company offices H delivery to an alternate (disaster recovery) site will be documented. This will include redirection of internet based services to other providers.

text: Deliverable : IT site recovery plan(attached to the BCP)

text: No further improvement is possible. No action F.1.2.2 Company offices H

text: Auto shut off is not supported. The emergency procedures will be amended to instruct F.1.2.3 Company offices H employess to poweroff airconditions in case of fire.

text: Deliverable: Amend emergency procedures

text: Our location is not prone to flooding. No action F.1.2.4 Company offices H

text: Only the warehouse is kept always locked. Personell will be instructed to challenge F.1.3.4 Company offices H strangers accessing company premises and IT equipment.

text: Deliverable: Employee awareness

text: Table 47: Facilities Actions List - Example

text: Since the necessary actions are determined, the Assessment Team prioritizes them and then focuses on implementing the highestpriority actions. The actions prioritization for the asset based controls implementation (table 46) is determined as medium since the recovery priority of the identified critical assets used to support the critical business function Finance is medium. The actions prioritization regarding the implementation of organizational controls is performed according to the Risk Profile Selection Table (table 9). In this regard, the Assessment Team assigns a low implementation priority.

text: Controls Prioritization Matrix

text: Asset Hardware & Applications Data People Facilities Categories Network

text: ty ri Low Low Low Medium Medium High o ri P ry Medium Medium Medium Medium Medium High ve o ec High High High High High High R

text: Table 48: Controls Prioritization Matrix - Example

text: The team decides high priority actions to be implemented within the next quarter, medium priority actions within the next six months and low priority actions until the end of the current year. The output of the implementation plan is summarized in the table below:

text: BCM: An approach for SMEs

text: BC Controls Implementation Plan

text: Control Responsible External support Milestones Implementation required Mm/Dd Priority

text: SP.1.1 Company Owner No Low SP2.1 Technician1 External IT Expert Low and the Assessment team SP2.2 Technician1 External IT Expert Low SP2.3 WarehouseMan No Low SP2.7 SalesMan1 External IT Expert Medium SP5.2 SalesMan1 External IT Expert Medium HN.1.1.1 Technician1 External IT Expert HN.1.1.5 Technician1 No HN.1.1.7 Technician1 External IT Expert HN.1.2.1 Technician1 External IT Expert HN.1.2.5 Technician1 HN.1.3.3 SalesMan2 A.1.1.1 Technician1 External IT Expert, Technician2 A.1.2.1 Technician1 External IT Expert D.1.1.1 Technician2 External IT Expert Medium D.1.1.5 WarehouseMan External IT Expert High D.1.2.1 Technician1 External IT Expert Medium D.1.2.3 Technician1 External IT Expert Medium D.1.2.4 Technician2 Medium D.1.2.5 Technician1 External IT Expert High P.1.1.3 Company Owner Low P.1.2.1 Technician2 External IT Expert P.1.2.2 Company Owner P.1.2.3 Company Owner External IT Expert P.1.2.4 Technician1 External IT Expert Medium F.1.1.2 Technician2 High

text: BCM: An approach for SMEs

text: F.1.1.3 Company Owner High F.1.1.7 Technician1 External IT Expert F.1.2.3 WarehouseMan High F.1.3.4 WarehouseMan High

text: Table 49: Implementation plan – Example

text: [Step 3] As an output of the above phases and steps the Assessment Team will derive the organization’s Business Continuity Plan (BCP). The following tasks will be required to complete the BCP Document: □ The Business Continuity Team members must be appointed. □ A primary and a secondary emergency command centre have to be selected for the BC Team to meet and organize their actions. □ The Business Continuity Team Responsibility matrix has to be reviewed and tasks/responsibilities should be added or modified as needed for the specific BCP. □ Create an Annex with Contact List of Governmental authorities / bodies that may help in a Business Continuity incident □ When the Business Continuity Controls are implemented their documentation and usage instructions have to be added as an annex to the plan. □ The full set of Critical Business Function Profile Cards and Asset Identification Cards have to be included in an annex of the BCP. □ Implementation of the recovery controls for each individual critical business function have to be clearly indicated □ A date for the first walkthrough/desktop exercise of the plan must be set. □ A date for the first review of the BC Assessement and BCP must be set. □ The BCP must be approved and signed of by a manager with appropriate authority (i.e. the owner of the company), □ The BCP must be distributed among the involved personnel.

text: The BCP for the example company is a separate document is being made available together with the present BCM approach documentation.

text: BCM: An approach for SMEs

text: Annex A– Organizational Continuity Control Card

text: The organisational based controls cards are selected in Phase 3: Controls Selection. The selection of the organizational control cards is performed in a fairly straightforward manner. The Assessment Team marks with a circle the organisational controls applicable for the risk profile of each individual risk area by consulting the Risk Profile Selection Table that was generated in Phase 1. A detailed description of the

text: controls is included in Annex C.

text: Organizational Continuity Controls Card

text: Risk Areas High Medium Low

text: Legal and Regulatory

text: Productivity

text: Financial Stability

text: Reputation and Loss of Customer

text: (SP1) SP2.2 SP2.7

text: Confidence

text: (SP2) SP2.3 (SP4) (SP4) SP3.4

text: BCM: An approach for SMEs

text: Annex B– Asset Based Continuity Control Cards

text: The asset based controls cards are selected in Phase 3: Controls Selection. The control cards, except for the proactive continuity controls (prior to the disaster occurrence), also include the immediate recovery actions (after the disaster occurrence) in order to achieve business recovery. The recovery actions selection is driven from the continuity control category and the respective continuity control, where the latter implies / requires an action for its implementation.

text: It should be noted that the recovery actions are indicative; specific recovery actions for business recovery should be designed and documented within the relative recovery plans (i.e. Business Continuity Plan).

text: The objective of the recovery actions is to eliminate the impact of the continuity threats after their occurrence. The controls will be categorized according to their nature continuing on the ground and reflecting the aforementioned Organizational Continuity Controls.

text: High Risk Cards

text: Risk Profile High

text: Asset Category Hardware and Network

text: ori ri

text: ry

text: co e

text: The assignment of controls to the asset control cards throughout this annex has been performed in a way that a good degree of protection can be achieved. In case of assets with very high security requirements, additional controls might be considered. Nevertheless, by using these assets control cards a good average protection can be achieved which seems to be appropriate for the majority of SMEs. In the middle term, ENISA plans to validate the assumptions made herein by means of pilot projects. The recovery actions presented into this section are indicative revealing an integrated approach towards business continuity management within SME environments. An SME could expand the recovery actions in order to indicate specifically the steps required for the implementation of the selected continuity controls BCM: An approach for SMEs

text: A high risk profile implies threats that occur in hardware and network components unavailability leading to interruption of critical business functions. Systems are unable to host business back office and client facing applications or may cause loss of critical information. Threat source can be the instability of the system due to mechanical malfunction or improper installation and use. Essential Controls for the safeguard of availability in critical assets are the following: HN.1.1.1: IT Infrastructure Documentation. There is an up-to-date and detailed IT infrastructure diagram including network and hardware components.

text: HN.1.1.2: IT Equipment Documentation. The organization maintains detailed records of hardware and network components configuration / parameterization.

text: HN.1.1.3: Information Systems Monitoring. Network and system availability figures are monitored for trends as well as threshold exception basis and the information is used to identify points of throughput weakness (bottlenecks).

text: HN.1.1.4: Information Systems Resilience. The control requires the implementation of technologies such as clustering and load balancing for the resilience of hardware and network components.

text: HN.1.1.5: Disaster Recovery Cross Training. No critical hardware or network component depends on an individual person for restoration in a disaster.

text: HN.1.1.6: Information Systems Distribution. Critical IT hardware / network components are spread across diverse locations within the organization’s premises.

text: HN.1.1.7: Information Systems Hardening. Control requires that all systems are up to date with respect to revisions, patches, and recommendations in security advisories.

text: HN.1.2.1: Information Systems Backup. Control requires that there is a documented backup procedure and backup plan that is: routinely updated, periodically tested, that calls for regularly scheduled backups of software and configurations and requires periodic testing and verification of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup (image) of the information systems / network equipment operating system, configuration files and any other modules provided by the information system / network component. More than one past backup sets is archived to make possible reverting to a well known working setup in case a system failure is also present in the most recent back. If a combination of full and incremental backups is used then the latest full backup and all the later incremental backups must be stored as a one backup set and must be retained in good working condition.

text: HN.1.2.2: Backup Restoration. Appropriate procedures are present to assure the ability to restore from backup media under the following conditions: (a) changes of backup software version (b) changes of backup device hardware/firmware (including mechanical maintenance/service) (c) changes in the hardware configuration of the backed up system.

text: HN.1.2.3: Backup Media Redundancy. Backup clones are available to safeguard against damage of the original backup media. The cloned backup set is stored in a different location than the original.

text: HN.1.2.4: Backup Fail-Over. Where redundant systems are used, backup devices and software are in place to manage backups from a single, secondary system when the primary has failed. Care is taken to maintain compatibility of hardware, media types, software versions between the primary and the secondary system.

text: HN.1.2.5: Staff Training. Control requires that all staff understand and is able to carry out their responsibilities under the backup plans.

text: HN.1.3.1: Information Systems Redundancy. Network equipment and hardware modules are designed to be fully redundant with no single points of failure.

text: HN.1.3.2: Information Systems Replication. Alternative, stand-by equipment is in place to mirror the production systems in the case of a disaster. The equipment should be capable of replacing the primary equipment after loading the necessary data from the backup media.

text: BCM: An approach for SMEs

text: HN.1.3.3: Vendors SLAs. The control requires that the organization maintains a list which includes hardware and network components vendors / suppliers and that a documented agreement exists between the two parties for the urgent provisioning of the required equipment within a predefined timeframe. RA.1.1.2: Consult the configuration records to restore hardware / network component. RA.1.1.5: Establish the availability of the individuals or their backups, responsible for the disaster recovery of the individual components RA.1.2.1: Initiate backup procedure to restore hardware and / or network component operating system / configuration file / software modules RA.1.2.4: Use the secondary backup system to manage backups, if the primary has failed. RA.1.3.1: Switch to manual procedures and restore hardware / software failure RA.1.3.2: Use alternative, mirrored equipment to replicate the production system RA.1.3.3: Switch to manual procedures and contact the equipment vendor / suppliers to provide the required equipment

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-1A

text: Risk Profile High

text: Asset Category Application

text: ty

text: ori ri P

text: ve

text: co e R

text: Application-based availability controls for a high risk organizational profile typically address high availability requirements on an application level to safeguard application’s accessibility by internal and external authorized users. Controls are selected to protect information assets from unavailability to authorized entities whether external or internal to the organization’s environment. Essential Controls for the protection of availability in critical assets are the following: A.1.1.1: Application Documentation. The control requires the organization to identify and collect documents required to install and operate the application. This includes information on the environment (OS version, external libraries, etc) for the execution of the application. This documentation has to be verified and updated at least at every maintenance cycle of the BCP.Furthermore, if the application is custom the application code should be documented. The criticality of the application will dictate the level of documentation required.

text: A.1.1.2: Application Staging. The control requires that the application should undergo thorough testing on test servers before allowing it for production usage.

text: A.1.1.3: Application Configuration Management. A well defined configuration management procedure should be maintained, and changes to the application, its configuration and the running environment should be documented appropriately.

text: A.1.1.4: Application Maintenance and Patching. Vendor patches are applied via a documented patch management procedure and backups of critical systems are performed before and after updating the application.

text: A.1.1.5: Application Hardening. Control requires that there is a documented set of procedures for managing vulnerabilities, including selecting vulnerability evaluation tools, checklists, and scripts, keeping up to date with known vulnerability types and attack methods, reviewing sources of information on vulnerability announcements, security alerts, and notices, identifying infrastructure components to be evaluated, scheduling of vulnerability evaluations, interpreting and responding to the results, maintaining secure storage and disposition of vulnerability data.

text: A.1.1.6: Application Vendors & SLAs.. The control requires that the organization maintains a list which includes the applications vendors / suppliers and that a documented agreement exists between the two parties for technical support provisioning when required.

text: A.1.1.7: Application Clustering.. The control requires the implementation of clustering technologies for the resilience of the application. The application is scaled out across multiple compute nodes to provide application’s high availability and performance

text: BCM: An approach for SMEs

text: A.1.1.8: Application Monitoring. Application availability figures are monitored for trends as well as threshold exception basis and the information is used to identify points of throughput weakness (bottlenecks).

text: A.1.2.1: Application Backup. Control requires that there is a documented backup procedure that is routinely updated, periodically tested, that calls for regularly scheduled backups of application software and requires periodic testing and verification of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup of the application files, database and any other available application modules. When this control is applied to a service (such as email or internet provisioning) then establishing an alternate backup service is required in addition to backing up any relevant data.When considering backup of services that produce or store data the ability to have a usable local copy of the data or to transfer existing data to the backup service has to be considered and evaluated.

text: A.1.2.2: Staff Training. Control requires that all staff understand and are able to carry out their responsibilities under the backup plans.

text: RA.1.1.3: Consult the application’s configuration records to repair / reinstall the application

text: RA.1.1.6: Switch to manual procedures and contact the application vendor to provide the required technical support in order to restore the application.

text: RA.1.2.1: Initiate backup procedure to restore the application software modules or Initiate the processof switching to the backup service provider.

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-1D

text: Risk Profile High

text: Asset Category Data

text: Category

text: ty

text: ri P ry

text: ve co e

text: Low

text: A high risk profile implies storage and backup of internal proprietary or external information that would typically incur a generic threat profile involving external malicious entities intending to violate information availability. Data-based continuity controls for a high risk organizational profile define the level of accuracy of information while availability refers to the level of accessibility. Essential Controls for the protection of data availability are the following: D.1.1.1: Data Mirroring. The control requires that all critical data are mirrored to additional storage media ensuring that data is written to two or more different disks (disk mirroring / raid array configuration) to ensure that two valid copies of the data are available. Ensure adequate monitoring is in place (prefferably with a persistent sound notification too) to avoid a failure of one of the storage media goes unnoticed until all copies have failed.

text: D.1.1.2: Network Storage. Data stored on end user devices (Laptops, workstations, etc) must be periodically synced to a networked disk (a single server with data storage capacity) or a networked storage device (network-attached storage (NAS) or storage area network (SAN)). In addition, the most recent backup of critical data or systems can be kept on the network storage for high speed restoration.

text: D.1.1.3: Secure Remote Storage. The control requires that on a daily basis, after imaging the servers to which it is attached, the Network Attached Storage (NAS) device creates an independent encrypted tunnel and transmits the imaged data to a secure offsite location where it resides in an encrypted, compressed format, creating a total of two copies of the data in two geographically distinct regions.

text: D.1.1.4: Data Replication. The control requires that all critical data are replicated to additional storage locations to ensure that two valid copies of the data are available. The second location can be a different branch office of the organization or a remote data center. Depending on the amount of data loss that can be tolerated and the cost of the technical solution a zero data loss or point in time implementation should be selected.

text: D.1.1.5: Store Backup Media Offsite. Backup media should be labelled, logged, and stored offsite in a secure, environmentally controlled facility. The storage facility should be located far enough away from the original site to reduce the likelihood that both sites would be affected by the same event. A documented procedure should exist (part of the backup plan) to obtain the offsite backup media when required. Data storage continuity arrangements must assure the proper security levels (confidentiality, integrity, availability), while data are stored, in transit or at an off-site location.

text: D.1.2.1: Backup Rotation Schedules. The control requires the enforcement of data backup via a documented, well-known backup rotation scheme such as Grand-Father-Son, Round Robin and Tower of Hanoi.

text: BCM: An approach for SMEs

text: D.1.2.2: Near Real-Time Backups. The control requires an incremental methodology which captures all changes to the initial image in increments within minutes. The Incremental methodology not only backs up recent datasets but also allows end users to reconstruct the state of their data as it stood at the end of various minute-based restoration points.

text: D.1.2.3: Backup System Flexibility. The backup system should allow quick and flexible restoration of files, folders, partitions, mailboxes/messages and databases/tables. It should be possible to schedule restoration of data according to the pre-determined recovery priority. This is to be utilised when the time to restore the full datasets exceeds the target recovery times. Design your backup plan to meet the precise restoration time objectives. Order the backup sequence according to your recovery sequence to avoid time costly seeks on tapes. Create a precise map of the contents of each tape. If possible clone the backup sets to a hard disk storage to increase the speed of restoration.

text: D.1.2.5: Data Backup. Control requires that there is a documented data backup plan that is routinely updated, periodically tested, that calls for regularly scheduled backups of data and requires periodic testing and verification of the ability to restore from backups.

text: RA.1.1.1: If the mirrored set failes and cannot recover automatically revert to backup restration on new storage media. If data call a recovery expert. In any case make sure data salavage operation is performed on a copy and not on the original media, if possible.

text: RA.1.1.2: Restore data to the required information systems via the NAS / SAN

text: RA.1.1.3: Load backup data to the required information systems via the NAS / SAN. If the data are corrupted or irretrievable obtain data from the secondary site.

text: RA.1.1.4: Select one of the recovery strategies: a) Transfer IT operations to the location of the data. B) transport the replicated data to the designated recovery site c) Arrange for sufficient network BW and Q.o.S. (latency and delay) for the remote access of the data.

text: RA.1.1.5: Initiate the procedure for obtaining the offsite backup media from the designated site and load backup data to the organization’s production information systems.

text: RA.1.2.1: Identify the backup sets needed for effective restore. These may be the latest backup set available or some older copy if restoring to an older point in time is required.

text: RA.1.2.2: Assess your ability to salavage near real-time backups if they are located at the incident site.

text: RA.1.2.3: If time limits are tight schedule the restoration of data according to the pre-determined recovery priority. Use a precompiled restoration sequence.

text: RA.1.2.5: Initiate the backup plan to restore the damaged / lost data

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-1P

text: Risk Profile High

text: Asset Category People

text: Continuity Controls Physical Security Awareness & Training

text: Category

text: ry ty ve

text: co ri e P R

text: Recovery Actions RA.1.2.3

text: A high risk profile implies threats that occur in people health / safety and in human resources in general. The level of staff commitment on using the appropriate continuity controls determines level of protection that can be achieved. Awareness and training of staff on emergency and incident management procedures ensures the protection of human resources and the availability of information. Essential Controls for securing and protecting people from continuity threats that could put in human life into danger are the following: P.1.1.1: Actions Accountability. Control requires that an individual’s or group’s actions -- with respect to all physically controlled media -- can be accounted for

text: P.1.1.2: Physical Access Control. Control requires that there are documented procedures for authorizing and overseeing those who work with sensitive information or who work in locations where such information is stored. This includes employees, contractors, partners, collaborators, and personnel from third-party organizations, systems maintenance personnel, or facilities maintenance personnel.

text: P.1.1.3: Clean Desk Policy. A clean desk policy is in operation followed by all personnel, contactors and third parties

text: P.1.2.1: Business Continuity Tool Set. The control requires that staff has access and is trained to use a business continuity tool set which includes the appropriate material (software / hardware, documented guidelines and procedures) for responding after a security or business continuity incident.

text: P.1.2.2: Business Continuity Tests. Staff, have been trained and involved in business continuity tests.

text: P.1.2.3: Key Personnel Deputies. All executives, managers and designated critical staff participating into business continuity teams have trained deputies who can fulfil their duties / responsibilities.

text: P.1.2.4: Key IT Personnel Training. The control requires that key IT personnel assigned with a key role into business continuity plans and procedures, are trained on a “business as usual” basis. The training ensures that such key position employees are fully capable of executing efficiently business continuity plans or procedures

text: RA.1.2.3: Business Continuity Deputies take over the duties of the staff responsible with business continuity responsibilities.

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-1F

text: Risk Profile High

text: Asset Category Facilities

text: ty

text: ri P

text: ve

text: e

text: A High risk profile implies high environmental and physical continuity controls to safeguard the organization’s facilities from natural and man-made disasters. Furthermore, these controls will also protect the corporate people and information as well as the IT equipment which operate within the organization’s facilities. Essential Controls for securing and protecting corporate facilities from continuity threats are the following: F.1.1.1: IT Site Physical Access. Physical access to IT Site is restricted by lock / combination lock and / or swiped cards or similarphysical access control technologies. F.1.1.2: IT Site Power Supply. The power supply of the site equipment is protected with UPS and / or generators. F.1.1.3: IT Site Air-Conditioning. IT site humidity, ventilation and air-conditioning are controlled. F.1.1.4: IT Site Anti-fire Systems. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within the IT site. F.1.1.5: IT Site Anti-flood Systems. IT Site is equipped with water detection systems and anti-flood mechanisms (raised floors, drop ceilings) F.1.1.6: IT Disaster Recovery Site. There is an alternate dedicated site where IT is restored following a disaster. F.1.1.7: IT Site Recovery Plan. Detailed recovery plans exist for the redirection of all feeds from each primary site to respective recovery sites. F.1.1.8: Secondary Disaster Recovery Site. There is an additional secondary site with certain mechanisms in place for invoking it if the primary recovery site is not available.

text: BCM: An approach for SMEs

text: F.1.2.1: Electrical Power Mechanisms. All critical business functions are protected by uninterruptible power supply (UPS) or similar battery backup. In addition all areas and systems of the corporate facilities have their power supply backed up by generators. Power can be provided by generato F.1.2.2: Fire Fighting Equipment. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within corporate facilities F.1.2.3: Air-conditioning. The air-conditioning system installed into the corporate facilities has auto-shut-off if there is a fire, smoke detection or alert. F.1.2.4: Anti-flood Equipment. There are water detection systems and anti-flood techniques (raised floors, drop ceilings) in all vulnerable or high flood-risk areas of the corporate facilities. F.1.2.5: Electrical Power Protection. Corporate facilities are protected against electrical spikes and surges (e.g. lightning strikes). In addition the control requires the proper grounding and shielding of the cables used to supply electrical power. F.1.3.1: Battle Boxes. Sites use ‘battle boxes’ containing a variety of equipment selected to assist with the management and control of a business continuity incident. Alternatively, the organization keeps and maintains the materials required to help the recovery of business op F.1.3.2: Secure Delivery and Loading Area. The control requires a documented policy for controlling introduction of packages or items within a dedicated post room which systematically inspects for threatening objects received by couriers and visitors. F.1.3.3: Facilities Access Control. All critical sites have security guards (24 hours a day, 7 days a week), and / or internal / external CCTVs, access control systems and a standard access management security procedure. F.1.3.4: Rooms and Areas Secure Access. Physical access to critical areas and floors is restricted by guards’ presence and /or individual swiped card or locked doors with keys only available to authorised personnel. F.1.3.5: Visitors Escort. Control requires that there are documented policies and procedures for managing visitors, including sign in, escort, access logs, reception and hosting. F.1.3.6: ID Badges. Permanent and temporary staff, contract staff and visitors required to wear visible id badges. RA.1.1.1: Once the emergency/incident is contained provide arrangements for the physical security of the incident site. RA.1.1.2: Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.1.3: Verify air-conditioning operates normally. Make sure you can contact qualified technicians in case of failure. RA.1.1.4: If the anti-fire systems were engaged, make sure the site is safe for personell(engage the fire department) before attempting to salvage any equipment.C23 RA.1.1.5: Be aware of the risk of electrical shock due to exposed wires to the water. Refresh the operating procedures and operate any anti-flood systems you might have in place or seek support from the emergency services. Monitor closely the condition as you might RA.1.1.6: Evaluate the need to activate the disaster recovery site. Check site availability and announce the DR site location to be activated. Follow the activation plan RA.1.1.7: On DR site activation implement the site recovery plan. RA.1.1.8: Evaluate the need to activate the disaster recovery site. Check site availability and announce the DR site location to be activated. Follow the activation plan

text: BCM: An approach for SMEs

text: RA.1.2.1: Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.3.2: Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter. RA.1.3.3: Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter.

text: BCM: An approach for SMEs Medium Risk Cards

text: Asset Based Continuity Control Card ID CCC-2HN

text: Risk Profile Medium

text: Asset Category Hardware and Network

text: ty

text: ri P ry

text: ve co

text: R

text: A medium risk profile implies moderate level threats that occur in system or network equipment instabilities leading to unavailability of business service for a short period of time. Systems and / or network components are unable to support applications or functions properly. System based controls for medium risk organizational profiles involve methods that ensure proper configuration and functionality of the system and network components to ensure their availability. Essential Control for the protection of confidentiality, integrity and availability in systems is the following: HN.1.1.1: IT Infrastructure Documentation. There is an up-to-date and detailed IT infrastructure diagram including network andhardware components.

text: BCM: An approach for SMEs

text: HN.1.2.2: Backup Restoration. Appropriate procedures are present to assure the ability to restore from backup media under the following conditions: (a) changes of backup software version (b) changes of backup device hardware/firmware (including mechanical maintenance/service) (c) changes in the hardware configuration of the backed up system. HN.1.2.5: Staff Training. Control requires that all staff understand and is able to carry out their responsibilities under the backup plans. HN.1.3.1: Information Systems Redundancy. Network equipment and hardware modules are designed to be fully redundant with no single points of failure. HN.1.3.3: Vendors SLAs. The control requires that the organization maintains a list which includes hardware and network components vendors / suppliers and that a documented agreement exists between the two parties for the urgent provisioning of the required equipment within a predefined timeframe. RA.1.1.2: Consult the configuration records to restore hardware / network component. RA.1.1.5: Establish the availability of the individuals or their backups, responsible for the disaster recovery of the individual components RA.1.2.1: Initiate backup procedure to restore hardware and / or network component operating system / configuration file / software modules RA.1.3.1: Switch to manual procedures and restore hardware / software failure RA.1.3.3: Switch to manual procedures and contact the equipment vendor / suppliers to provide the required equipment

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-2A

text: Risk Profile Medium

text: Asset Category Application

text: ori ri P

text: ry ve

text: co e R

text: A medium risk profile implies storage and backup activities of moderate-value applications that would typically incur a generic threat profile involving external malicious entities intending to violate moderate-value application availability. Essential Controls for the protection of availability in applications are the following: A.1.1.1: Application Documentation. The control requires the organization to document the application code (if the application is custom) and the required environment (OS version, external libraries, etc) for the execution of the application. A.1.1.2: Application Staging. The control requires that the application should undergo thorough testing on test servers before allowing it for production usage A.1.1.3: Application Configuration Management. A well defined configuration management procedure should be maintained, and changes to the application, its configuration and the running environment should be documented appropriately. A.1.1.4: Application Maintenance and Patching. Vendor patches are applied via a documented patch management procedure and backups of critical systems are performed before and after updating the application. A.1.1.5: Application Hardening. Control requires that there is a documented set of procedures for managing vulnerabilities, including selecting vulnerability evaluation tools, checklists, and scripts, keeping up to date with known vulnerability types and attack methods, reviewing sources of information on vulnerability announcements, security alerts, and notices, identifying infrastructure components to be evaluated, scheduling of vulnerability evaluations, interpreting and responding to the results, maintaining secure storage and disposition of vulnerability data. A.1.1.6: Application Vendors & SLAs. The control requires that the organization maintains a list which includes the applications vendors / suppliers and that a documented agreement exists between the two parties for technical support provisioning when required. A.1.2.1: Application Backup. Control requires that there is a documented backup procedure that is routinely updated, periodically tested, that calls for regularly scheduled backups of application software and requires periodic testing and verification of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup of the application files, database and any other available application modules. A.1.2.2: Staff Training. Control requires that all staff understand and are able to carry out their responsibilities under the backup plans.

text: The recovery actions that the organization with medium risk profile should undertake in order to achieve critical assets recovery are the following:

text: BCM: An approach for SMEs

text: RA.1.1.3: Consult the application’s configuration records to restore the application RA.1.1.6: Switch to manual procedures and contact the application vendor to provide the required technical support in order to restore the application. RA.1.2.1: Initiate backup procedure to restore the application software modules

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-2D

text: Risk Profile Medium

text: Asset Category Data

text: Category

text: ry ty ve

text: co ri e P R

text: A medium risk profile implies storage and backup of internal proprietary or external information that would typically incur a generic threat profile involving external malicious entities intending to violate or information availability. Data-based continuity controls for a medium risk organizational profile define the level of accuracy of information while availability refers to the level of accessibility. Essential Controls for the protection of data availability are the following: D.1.1.1: Data Mirroring. The control requires that all critical data are mirrored to additional storage media ensuring that data is written to two or more different disks (disk mirroring / raid array configuration) to ensure that two valid copies of the data are available. Ensure adequate monitoring is in place (prefferably with a persistent sound notification too) to avoid a failure of one of the storage media goes unnoticed until all copies have failed.

text: BCM: An approach for SMEs

text: RA.1.1.5: Initiate the procedure for obtaining the offsite backup media from the designated site and load backup data to the organization’s production information systems. RA.1.2.1: Identify the backup sets needed for effective restore. These may be the latest backup set available or some older copy if restoring to an older point in time is required. RA.1.2.3: If time limits are tight schedule the restoration of data according to the pre-determined recovery priority. Use a precompiled restoration sequence. RA.1.2.5: Initiate the backup plan to restore the damaged / lost data

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-2P

text: Risk Profile Medium

text: Asset Category People

text: Category

text: ry ty ve

text: co ri e P R

text: Recovery Actions - -

text: A high risk profile implies threats that occur in people health / safety and in human resources in general. The level of staff commitment on using the appropriate continuity controls determines level of protection that can be achieved. Awareness and training of staff on emergency and incident management procedures ensures the protection of human resources and the availability of information. Essential Controls for securing and protecting people from continuity threats that could put in human life into danger are the following: P.1.1.2: Physical Access Control. Control requires that there are documented procedures for authorizing and overseeing those who work with sensitive information or who work in locations where such information is stored. This includes employees, contractors, partners, collaborators, and personnel from third-party organizations, systems maintenance personnel, or facilities maintenance personnel.

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-2F

text: Risk Profile Medium

text: Asset Category Facilities

text: ty ori

text: P Medium ry

text: co

text: R

text: Recovery Actions - - -

text: A medium risk profile implies medium-level environmental and physical continuity controls to safeguard the organization’s facilities from natural and man-made disasters. Furthermore, these controls will also protect the corporate people and information as well as the IT equipment which operate within the organization’s facilities. Essential Controls for securing and protecting corporate facilities from continuity threats are the following: F.1.1.1: IT Site Physical Access. Physical access to IT Site is restricted by lock / combination lock and / or swiped cards or similar physical access control technologies. F.1.1.2: IT Site Power Supply. The power supply of the site equipment is protected with UPS and / or generators. F.1.1.3: IT Site Air-Conditioning. IT site humidity, ventilation and air-conditioning are controlled. F.1.1.4: IT Site Anti-fire Systems. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within the IT site. F.1.1.5: IT Site Anti-flood Systems. IT Site is equipped with water detection systems and anti-flood mechanisms (raised floors, drop ceilings) F.1.1.6: IT Disaster Recovery Site. There is an alternate dedicated site where IT is restored following a disaster. F.1.1.7: IT Site Recovery Plan. Detailed recovery plans exist for the redirection of all feeds from each primary site to respective recovery sites. F.1.2.2: Fire Fighting Equipment. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within corporate facilities F.1.2.3: Air-conditioning. The air-conditioning system installed into the corporate facilities has auto-shut-off if there is a fire, smoke detection or alert.

text: BCM: An approach for SMEs

text: F.1.2.4: Anti-flood Equipment. There are water detection systems and anti-flood techniques (raised floors, drop ceilings) in all vulnerable or high flood-risk areas of the corporate facilities. F.1.3.2: Secure Delivery and Loading Area. The control requires a documented policy for controlling introduction of packages or items within a dedicated post room which systematically inspects for threatening objects received by couriers and visitors. F.1.3.3: Facilities Access Control. All critical sites have security guards (24 hours a day, 7 days a week), and / or internal / external CCTVs, access control systems and a standard access management security procedure. F.1.3.4: Rooms and Areas Secure Access. Physical access to critical areas and floors is restricted by guards’ presence and /or individual swiped card or locked doors with keys only available to authorised personnel. F.1.3.6: ID Badges. Permanent and temporary staff, contract staff and visitors required to wear visible id badges. RA.1.1.1: Once the emergency/incident is contained provide arrangements for the physical security of the incident site. RA.1.1.2: Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.1.3: Verify air-conditioning operates normally. Make sure you can contact qualified technicians in case of failure. RA.1.1.4: If the anti-fire systems were engaged, make sure the site is safe for personell(engage the fire department) before attempting to salvage any equipment.C23 RA.1.1.5: Be aware of the risk of electrical shock due to exposed wires to the water. Refresh the operating procedures and operate any anti-flood systems you might have in place or seek support from the emergency services. Monitor closely the condition as you might RA.1.1.6: Evaluate the need to activate the disaster recovery site. Check site availability and announce the DR site location to be activated. Follow the activation plan RA.1.1.7: On DR site activation implement the site recovery plan. RA.1.3.2: Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter. RA.1.3.3: Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter.

text: BCM: An approach for SMEs Low Risk Cards

text: Risk Profile Low

text: Asset Category Hardware and Network

text: ri P

text: Medium ve co e

text: Recovery Actions - RA.1.2.1 -

text: A low risk profile implies minimum level threats that entail potential system or network components instabilities leading to unavailability of business service for a short period of time. System and network based controls for minimum risk organizational profiles involve methods that ensure proper configuration and functionality of the system and network component to ensure their availability. Impact of system and / or network component unavailability does not affect organization reputation as information is neither private nor critical to the organization. Unavailability of system and / or network component does not affect quality of service or product. Essential Control for the protection of availability in systems and network components are the following: HN.1.1.1: IT Infrastructure Documentation. There is an up-to-date and detailed IT infrastructure diagram including network and hardware components.

text: HN.1.3.3: Vendors SLAs. The control requires that the organization maintains a list which includes hardware and network components vendors / suppliers and that a documented agreement exists between the two parties for the urgent provisioning of the required equipment within a predefined timeframe.

text: BCM: An approach for SMEs

text: RA.1.1.5: Establish the availability of the individuals or their backups, responsible for the disaster recovery of the individual components RA.1.2.1: Initiate backup procedure to restore hardware and / or network component operating system / configuration file / software modules RA.1.3.3: Switch to manual procedures and contact the equipment vendor / suppliers to provide the required equipment

text: BCM: An approach for SMEs

text: Risk Profile Low

text: Asset Category Application

text: ty

text: ri P ry

text: ve co e

text: Low

text: A low risk profile implies storage and backup of applications but with no critical level of importance that would entail minimal finance loss. Organization reputation is not at stake. However, controls that would prevent even that kind of application unavailability and that can secure the application accessibility should be applied. Furthermore, even if there is no high unavailability impact, application availability to every authorized user must be secured. Essential controls for availability of the application asset are the following: A.1.1.1: Application Documentation.. The control requires the organization to identify and collect documents required to install and operate the application. This includes information on the environment (OS version, external libraries, etc) for the execution of the application. This documentation has to be verified and updated at least at every maintenance cycle of the BCP.Furthermore, if the application is custom the application code should be documented. The criticality of the application will dictate the level of documentation required.

text: BCM: An approach for SMEs

text: RA.1.1.6: Switch to manual procedures and contact the application vendor to provide the required technical support in order to restore the application. RA.1.2.1: Initiate backup procedure to restore the application software modules or Initiate the processof switching to the backup service provider.

text: BCM: An approach for SMEs

text: Risk Profile Low

text: Asset Category Data

text: Category

text: ry ty ve

text: co ri e P R

text: A low risk profile implies storage and processing of public or internal information but with no critical level of importance that would entail more than a minimal loss of money. Organization reputation is not at stake. However, controls that would prevent even that kind of information unavailability and that can secure the information life-cycle should be applied. Furthermore, even if there is no major unavailability impact, information accessibility to every authorized user must be secured. Essential controls for information availability are the following: D.1.1.1: Data Mirroring. The control requires that all critical data are mirrored to additional storage media ensuring that data is written to two or more different disks (disk mirroring / raid array configuration) to ensure that two valid copies of the data are available. Ensure adequate monitoring is in place (prefferably with a persistent sound notification too) to avoid a failure of one of the storage media goes unnoticed until all copies have failed.

text: D.1.2.4: Internet Backup. The control requires that workstation users (personnel) are allowed to back up data to a remote location over the Internet. Formal authorisation is required prior to the execution of this backup method.

text: BCM: An approach for SMEs

text: RA.1.1.1: . If the mirrored set failes and cannot recover automatically revert to backup restration on new storage media. If data call a recovery expert. In any case make sure data salavage operation is performed on a copy and not on the original media, if possible. RA.1.1.2: Restore data to the required information systems via the NAS / SAN RA.1.1.5: Initiate the procedure for obtaining the offsite backup media from the designated site and load backup data to the organization’s production information systems. RA.1.2.1: Identify the backup sets needed for effective restore. These may be the latest backup set available or some older copy if restoring to an older point in time is required. RA.1.2.3: If time limits are tight schedule the restoration of data according to the pre-determined recovery priority. Use a precompiled restoration sequence. RA.1.2.4: Start retrieving Internet backups as soon as possible from a location providing good bandwidth and stable internet connection. Keep in mind internet speeds vary and BW bottlenecks may impose a critical delay to the download. Prioritise your downloads according to your needs. RA.1.2.5: Initiate the backup plan to restore the damaged / lost data

text: BCM: An approach for SMEs

text: Asset Based Continuity Control Card ID CCC-3P

text: Risk Profile Low

text: Asset Category People

text: Category

text: ry ty ve

text: co ri e P R

text: Recovery Actions - -

text: A high risk profile implies threats that occur in people health / safety and in human resources in general. The level of staff commitment on using the appropriate continuity controls determines level of protection that can be achieved. Awareness and training of staff on emergency and incident management procedures ensures the protection of human resources and the availability of information. Essential Controls for securing and protecting people from continuity threats that could put in human life into danger are the following: P.1.1.2: Physical Access Control. Control requires that there are documented procedures for authorizing and overseeing thosewho work with sensitive information or who work in locations where such information is stored. This includes employees, contractors, partners, collaborators, and personnel from third-party organizations, systems maintenance personnel, or facilities maintenance personnel.

text: BCM: An approach for SMEs

text: Risk Profile Low

text: Asset Category Facilities

text: y it or ri P

text: ve

text: co e R

text: Recovery Actions - - -

text: A low risk profile implies low-level environmental and physical continuity controls to safeguard the organization’s facilities from natural and man-made disasters. Furthermore, these controls will also protect the corporate people and information as well as the IT equipment which operate within the organization’s facilities. Essential Controls for securing and protecting corporate facilities from continuity threats are the following: F.1.1.1: IT Site Physical Access. Physical access to IT Site is restricted by lock / combination lock and / or swiped cards or similar physical access control technologies.

text: F.1.1.2: IT Site Power Supply. The power supply of the site equipment is protected with UPS and / or generators.

text: F.1.1.3: IT Site Air-Conditioning. IT site humidity, ventilation and air-conditioning are controlled.

text: F.1.1.4: IT Site Anti-fire Systems. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within the IT site.

text: F.1.1.7: IT Site Recovery Plan. Detailed recovery plans exist for the redirection of all feeds from each primary site to respective recovery sites.

text: F.1.2.2: Fire Fighting Equipment. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within corporate facilities

text: F.1.2.3: Air-conditioning. The air-conditioning system installed into the corporate facilities has auto-shut-off if there is a fire, smoke detection or alert.

text: F.1.2.4: Anti-flood Equipment. There are water detection systems and anti-flood techniques (raised floors, drop ceilings) in all vulnerable or high flood-risk areas of the corporate facilities. F.1.3.4: Rooms and Areas Secure Access. Physical access to critical areas and floors is restricted by guards’ presence and /or individual swiped card or locked doors with keys only available to authorised personnel.

text: RA.1.1.1: Once the emergency/incident is contained provide arrangements for the physical security of the incident site.

text: BCM: An approach for SMEs

text: RA.1.1.2: Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.1.3: Verify air-conditioning operates normally. Make sure you can contact qualified technicians in case of failure. RA.1.1.4: If the anti-fire systems were engaged, make sure the site is safe for personell(engage the fire department) before attempting to salvage any equipment.C23 RA.1.1.7: On DR site activation implement the site recovery plan.

text: BCM: An approach for SMEs

text: Annex C – Organizational Continuity Controls

text: Business Continuity Management Organization (SP1) SP1 Business Continuity Management Organization Control Card includes controls that require the organization’s business strategies to routinely incorporate business continuity considerations. Equally, business continuity strategies and policies must take into consideration the organization’s business strategies and goals. Business Continuity Policy, Plans and Procedures (SP2) SP2 The Control Card requires an organization to have a comprehensive set of documented, current Business Continuity Policies, Plans and Procedures that are periodically reviewed and updated. Test Business Continuity Plan (SP3) SP3 Continuity Planning/Disaster Recovery Control Card incorporates security controls in order to complete a test simulation of the continuity plan to ensure its smooth running if the time comes to implement it. Sustain Business Continuity Management (SP4) SP4 Security Awareness and Training Control Card includes controls that require staff members to understand their security roles and responsibilities. Security awareness, training, and periodic reminders should be provided for all personnel. Staff understanding and roles should be clearly documented and conformance should be periodically verified. Business Continuity Framework should be routinely reviewed, updated, and communicated to the organization. Service Providers / Third Parties Business Continuity Management (SP5) SP5 Service Providers / Third Parties Business Continuity Management Control Cards include security controls that enforce documented, monitored, and enforced procedures for protecting the organization’s information when working with external organizations (e.g. third parties, collaborators, subcontractors, or partners).

text: BCM: An approach for SMEs

text: Business Continuity Management Organization (SP1) SP1.1 The organization has a documented business continuity policy outlining the fundamental / driving factors that the business continuity framework is designed and built on. The policy should address, but not limited to, the following issues: - Business Continuity Goals and Objectives - Business Continuity teams, roles and responsibilities - Management Responsibilities & Commitment regarding organizational efforts for Business Continuity - The requirement of periodic Business Impact Assessments horizontally to the organization - Business Continuity Threats with respect to the organization’s operating environment - Service agreements with third parties ensuring the continuity of the outsourced IT services SP1.2 The organization’s business strategies routinely incorporate business continuity considerations. SP1.3 Business continuity strategies and policies take into consideration the organization’s structure, business strategies and goals. SP1.4 Business continuity strategies, goals, and objectives are documented and are routinely reviewed, updated, and communicated to the organization. SP1.5 Business continuity policy, plans and procedures reflect consultation of local emergency services’ response plans and include reference materials. SP1.6 The organization ensures that staff are fully aware and stay vigilant with respect to business continuity. Staff realises that business continuity is not a choice, but a legal, ethical and operational requirement that could mean the difference between business continuance and failure. SP1.7 Business continuity is included in induction programmes for new employees. The induction pack should include the organization’s business continuity strategy and of the roles, responsibilities and organization of the business continuity teams. SP1.8 The organization has assigned business continuity roles and incident responsibilities, including the following business continuity and incident teams: - Business Continuity Steering Committee. The team is consisted of upper management personnel and is responsible for the critical decision making during a business continuity incident. - Business Continuity Team. The team is concerned with the handling of business continuity incidents through the organization’s Business Continuity Plan - Security Incident Response Team. The team is responsible for handling undesirable security events undertaking the required actions to minimize the damage to organization’s critical business functions and consequently restore them to the desired operational mode. Another critical responsibility of the team is to trigger the organization’s Business Continuity Plan in the case that the “security incident” escalates to a “business continuity incident” - Emergency Response Team. The team is responsible for executing the organization’s emergency procedures in the case of a natural or manmade physical disaster (fire, earthquake, flood etc) SP1.9 A fully detailed impact analysis on loss of IT is performed on an annual basis to identify which of the organisation’s IT systems, data and infrastructure are the most business critical. The business impact assessment includes the following steps:

text: BCM: An approach for SMEs

text: - Gathering information; - Performing a vulnerability assessment; - Analyzing the information; - Documenting the results and presenting the recommendations. - Firewalls are deployed at external network entry points - Anti-virus products are deployed on mail servers and on all desktops and laptops. Anti-virus products are automatically updated when released by vendor. SP.1.10 Management allocates sufficient funds and resources to establish a Business Continuity Programme.

text: BCM: An approach for SMEs

text: Business Continuity Policy, Plans and Procedures (SP2) SP2.1 The organization has a comprehensive business continuity plan which is periodically reviewed and updated. The plan address key business continuity topic areas, including: - Critical Business Functions Priority List - Critical Business Functions IT infrastructure dependencies - Contact List(s) with business continuity manager / team - Critical Business Functions protection & recovery strategy - Business continuity relative procedures (incident response, emergency etc) - Testing Reassessing and Maintaining Business Continuity Plan - Critical Suppliers List & Contact Details SP2.2 There is a documented procedure for incident response covering in detail the following topics: - Incident Detection. The topic should provide the necessary steps for detecting and reporting an incident to the responsible parties. - Incident Containment & Eradication. Activities required by the security incident response team for the effective containment and eradication of the security event. - Incident Follow up. The steps that the involved parties should carry out for evaluating the effectiveness of the incident response procedure SP2.3 The organization has a set of documented emergency procedures for ensuring staff health when a physical disaster (fire, flood, earthquake) occurs. These procedures should address the following health & safety issues : A designated trained senior manager or its deputy is assigned to take responsibility for managing evacuation of the organizations premises in the case of a natural disaster (fire, flood, earthquake etc). Evacuation points are identified and clearly marked for all staff. In addition there is a clear demonstrable way of ensuring the building is clear (e.g. electronic records, roll call). - Emergency team contact details (name/surname, phone number, email etc) - Maintenance of emergency toolkits including water, food, first aid kit, torches, radio and batteries, pay-as-you go mobile phone and charger tarpaulins, cleaning supplies, gloves, plastic bags, duct tapes and blankets. All staff should be aware of the location that the emergency kits are stored. Emergency drills -without staff awareness- in order to test the emergency procedures efficiency and staff training. SP2.4 There is a clearly defined procedure for dealing with the media (media communication procedure) and public relations during a crisis. SP2.5 The organization makes use of security products in order to protect its critical assets from undesirable security events that may lead to a break into business continuity. The following products are in place: - Firewalls are deployed at external network entry points - All computers are using personal firewalls and antivirus software. Daily automatic updates are activated, especially for laptops. SP2.6 All executives, managers and designated critical staff have trained deputies who can fulfil their duties. SP2.7 The organisation has established diverse communication channels that clients and third parties can use to contact

text: BCM: An approach for SMEs

text: the organisation, request service or report a problem. These arrangements are part of the business as usual and no special actions are needed for their activation. Such communication channels may be land line phone numbers, mobile phone numbers, voice mailboxes, email and FAX from diverse providers to avoid single points of failure.

text: SP2.8 There is a well known point of contact and designated backups to report incidents and alternate means of communication.

text: BCM: An approach for SMEs

text: Test Business Continuity Plan (SP3) SP3.1 IT recovery tests are performed to realistically reflect the worst case scenario where all critical systems must be restored concurrently. These tests include, but not limited to, the following: - Critical business functions recovery is tested every six months. - Where a test environment is used, it is very similar to the live environment. - Where some IT functions are outsourced, critical IT outsource companies participate individually in tests. SP3.2 If certain IT aspects are outsourced, a policy to test outsourcers’ IT disaster recovery capability exists. SP3.3 The organization follows a business continuity test plan in order to assess the effectiveness of its Business Continuity Programme. The following elements are tested: - Identified critical application or hardware and/or software - Rebuilding of client or desktop environment. - Remote home working recovery capability to the alternate (disaster recovery) site and adequate capability is evidenced. - Restoration of critical business functions - If mirrored systems are used, the operation of each secondary system with the primary switched off is tested. - If critical backups are needed, they are restore-tested every month. - Individual restoration tests suggest that all critical business functions can be recovered in the required timeframes. - Power generators and UPS are full-load tested. SP3.4 Full fire and earthquake evacuation tests are required annually.

text: BCM: An approach for SMEs

text: Sustain Business Continuity Management (SP4) SP4.1 Staff members understand their security business continuity roles and responsibilities. This is documented and verified. Staff understanding is documented and conformance is periodically verified. SP4.2 Security awareness, training, and periodic reminders are provided for all personnel. Training includes these topics: - Business continuity strategies, goals, and objectives - Business continuity , polices, plans and procedures - Business continuity policies and procedures for working with third parties - Emergency procedures - Health and safety issues - Physical security requirements - Incident management - General staff practices - Enforcement, sanctions, and disciplinary actions for environmental and safety violations of health and safety controls SP4.3 Business continuity is included in induction programmes for new employees. SP4.4 Staff members are trained to recognize report and respond to incidents events (manmade or natural) that may impact the organization causing a break to business continuity. SP4.5 Staff is aware of the organization’s business continuity strategy and of the roles, responsibilities and organization of the business continuity team. SP4.6 All changes to Business Continuity Framework go through an agreed and signed-off procedure. SP4.7 The organization has a documented change management procedure ensuring that any changes (internal or external) which impact the organisation are reviewed in relation to Business Continuity Documents. The changes triggering an adjustment to the business continuity plan include but not limited to the following: - Regulatory changes - Resources or organizational structures change - Funding or budget level changes - When changes to the threat environment occur; - When substantive changes to the organization’s IT infrastructure take place - After an exercise to incorporate findings. SP4.8 The organization uniformly enforces its business continuity policy, plans and procedures. SP4.9 Business Continuity Plans and Procedures are subject to internal audit. SP4.10 Business Continuity Plans and Procedures are subject to external audit.

text: BCM: An approach for SMEs

text: Service Providers / Third Parties Business Continuity Management (SP5) SP5.1 The organization has documented, monitored, and enforced procedures for ensuring the availability and recovery of outsourced services to external organizations (e.g., third parties, collaborators, subcontractors, or partners) SP5.2 The organization has verified that outsourced security services, mechanisms, and technologies meet its business continuity needs and requirements. Business continuity requirements on providers are included in formal terms in the contract. SP5.3 The organization documents, monitors, and enforces protection strategies for information belonging to external organizations that is accessed from its own infrastructure components or is used by its own personnel. SP5.4 The organization provides and verifies awareness and training on applicable external organizations’ business continuity policies and procedures for personnel who are involved with those external organizations. SP5.5 Procedures as to how the disaster recovery providers will manage a multiple invocation of their sites is known, documented and agreed; SP5.6 The organization uses more than one telecom providers for voice and data. The following interactions take place with providers: - Planned formal meetings take place to plan resilience of the communications network; - Planned verification takes place to check the resilience of telecoms providers’ network architecture and of the connectivity and routing within it; - Verification of IT third party suppliers’ disaster recovery capability. SP5.7 Where outsourcing is used, critical IT outsourcing companies’ business continuity management capabilities are audited.

text: BCM: An approach for SMEs

text: Annex D – Asset Based Continuity Controls

text: Hardware and Network (HN)

text: Resilience (HN.1.1)

text: HN.1.1.1 IT Infrastructure Documentation. There is an up-to-date and detailed IT infrastructure diagram including network and hardware components.

text: HN.1.1.2 IT Equipment Documentation. The organization maintains detailed records of hardware and network components configuration / parameterization.

text: HN.1.1.3 Information Systems Monitoring. Network and system availability figures are monitored for trends as well as threshold exception basis and the information is used to identify points of throughput weakness (bottlenecks).

text: HN.1.1.4 Information Systems Resilience. The control requires the implementation of technologies such as clustering and load balancing for the resilience of hardware and network components.

text: HN.1.1.5 Disaster Recovery Cross Training. No critical hardware or network component depends on an individual person for restoration in a disaster. HN.1.1.6 Information Systems Distribution. Critical IT hardware / network components are spread across diverse locations within the organization’s premises.

text: HN.1.1.7 Information Systems Hardening. Control requires that all systems are up to date with respect to revisions, patches, and recommendations in security advisories.

text: Back up (HN.1.2)

text: HN.1.2.1 Information Systems Backup. Control requires that there is a documented backup procedure and backup plan that is: routinely updated, periodically tested, that calls for regularly scheduled backups of software and configurations and requires periodic testing and verification of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup (image) of the information systems / network equipment operating system, configuration files and any other modules provided by the information system / network component. More than one past backup sets is archived to make possible reverting to a well known working setup in case a system failure is also present in the most recent back. If a combination of full and incremental backups is used then the latest full backup and all the later incremental backups must be stored as a one backup set and must be retained in good working condition.

text: HN.1.2.2 Backup Restoration. Appropriate procedures are present to assure the ability to restore from backup media under the following conditions: (a) changes of backup software version (b) changes of backup device hardware/firmware (including mechanical maintenance/service) (c) changes in the hardware configuration of the backed up system.

text: HN.1.2.3 Backup Media Redundancy. Backup clones are available to safeguard against damage of the original backup media. The cloned backup set is stored in a different location than the original.

text: HN.1.2.4 Backup Fail-Over. Where redundant systems are used, backup devices and software are in place to manage backups from a single, secondary system when the primary has failed. Care is taken to maintain compatibility of hardware, media types, software versions between the primary and the secondary system.

text: HN.1.2.5 Staff Training. Control requires that all staff understand and is able to carry out their responsibilities under the backup plans.

text: Redundancy (HN.1.3)

text: BCM: An approach for SMEs

text: HN.1.3.1 Information Systems Redundancy. Network equipment and hardware modules are designed to be fully redundant with no single points of failure. HN.1.3.2 Information Systems Replication. Alternative, stand-by equipment is in place to mirror the production systems in the case of a disaster. The equipment should be capable of replacing the primary equipment after loading the necessary data from the backup media. HN.1.3.3 Vendors SLAs. The control requires that the organization maintains a list which includes hardware and network components vendors / suppliers and that a documented agreement exists between the two parties for the urgent provisioning of the required equipment within a predefined timeframe. Recovery Actions RA.1.1.2 Consult the configuration records to restore hardware / network component. RA.1.1.5 Establish the availability of the individuals or their backups, responsible for the disaster recovery of the individual components RA.1.2.1 Initiate backup procedure to restore hardware and / or network component operating system / configuration file / software modules RA.1.2.4 Use the secondary backup system to manage backups, if the primary has failed. RA.1.3.1 Switch to manual procedures and restore hardware / software failure RA.1.3.2 Use alternative, mirrored equipment to replicate the production system RA.1.3.3 Switch to manual procedures and contact the equipment vendor / suppliers to provide the required equipment

text: Application (A) Application Resilience (A.1.1) A.1.1.1 Application Documentation.. The control requires the organization to identify and collect documents required to install and operate the application. This includes information on the environment (OS version, external libraries, etc) for the execution of the application. This documentation has to be verified and updated at least at every maintenance cycle of the BCP.Furthermore, if the application is custom the application code should be documented. The criticality of the application will dictate the level of documentation required. A.1.1.2 Application Staging. The control requires that the application should undergo thorough testing on test servers before allowing it for production usage. A.1.1.3 Application Configuration Management. A well defined configuration management procedure should be maintained, and changes to the application, its configuration and the running environment should be documented appropriately. A.1.1.4 Application Maintenance and Patching. Vendor patches are applied via a documented patch management procedure and backups of critical systems are performed before and after updating the application. A.1.1.5 Application Hardening. Control requires that there is a documented set of procedures for managing vulnerabilities, including selecting vulnerability evaluation tools, checklists, and scripts, keeping up to date with known vulnerability types and attack methods, reviewing sources of information on vulnerability announcements, security alerts, and notices, identifying infrastructure components to be evaluated, scheduling of vulnerability evaluations, interpreting and responding to the results, maintaining secure storage and disposition of vulnerability data.

text: BCM: An approach for SMEs

text: A.1.1.6 Application Vendors & SLAs.. The control requires that the organization maintains a list which includes the applications vendors / suppliers and that a documented agreement exists between the two parties for technical support provisioning when required. A.1.1.7 Application Clustering.. The control requires the implementation of clustering technologies for the resilience of the application. The application is scaled out across multiple compute nodes to provide application’s high availability and performance

text: A.1.1.8 Application Monitoring. Application availability figures are monitored for trends as well as threshold exception basis and the information is used to identify points of throughput weakness (bottlenecks).

text: Application Back up (A.1.2)

text: A.1.2.1 Application Backup. Control requires that there is a documented backup procedure that is routinely updated, periodically tested, that calls for regularly scheduled backups of application software and requires periodic testing and verification of the ability to restore from backups. The control requires that the organization performs via the procedure a full Backup of the application files, database and any other available application modules. When this control is applied to a service (such as email or internet provisioning) then establishing an alternate backup service is required in addition to backing up any relevant data.When considering backup of services that produce or store data the ability to have a usable local copy of the data or to transfer existing data to the backup service has to be considered and evaluated.

text: A.1.2.2 Staff Training. Control requires that all staff understand and are able to carry out their responsibilities under the backup plans.

text: Recovery Actions

text: RA.1.1.3 Consult the application’s configuration records to repair / reinstall the application

text: RA.1.1.6 Switch to manual procedures and contact the application vendor to provide the required technical support in order to restore the application.

text: RA.1.2.1 Initiate backup procedure to restore the application software modules or Initiate the processof switching to the backup service provider.

text: Data (D)

text: Data Storage (D.1.1)

text: D.1.1.1 Data Mirroring. The control requires that all critical data are mirrored to additional storage media ensuring that data is written to two or more different disks (disk mirroring / raid array configuration) to ensure that two valid copies of the data are available. Ensure adequate monitoring is in place (prefferably with a persistent sound notification too) to avoid a failure of one of the storage media goes unnoticed until all copies have failed.

text: D.1.1.2 Network Storage. Data stored on end user devices (Laptops, workstations, etc) must be periodically synced to a networked disk (a single server with data storage capacity) or a networked storage device (network-attached storage (NAS) or storage area network (SAN)). In addition, the most recent backup of critical data or systems can be kept on the network storage for high speed restoration.

text: D.1.1.3 Secure Remote Storage. The control requires that on a daily basis, after imaging the servers to which it is attached, the Network Attached Storage (NAS) device creates an independent encrypted tunnel and transmits the imaged data to a secure offsite location where it resides in an encrypted, compressed format, creating a total of two copies of the data in two geographically distinct regions.

text: BCM: An approach for SMEs

text: D.1.1.4 Data Replication. The control requires that all critical data are replicated to additional storage locations to ensure that two valid copies of the data are available. The second location can be a different branch office of the organization or a remote data center. Depending on the amount of data loss that can be tolerated and the cost of the technical solution a zero data loss or point in time implementation should be selected.

text: D.1.1.5 Store Backup Media Offsite. Backup media should be labelled, logged, and stored offsite in a secure, environmentally controlled facility. The storage facility should be located far enough away from the original site to reduce the likelihood that both sites would be affected by the same event. A documented procedure should exist (part of the backup plan) to obtain the offsite backup media when required. Data storage continuity arrangements must assure the proper security levels (confidentiality, integrity, availability), while data are stored, in transit or at an off-site location.

text: Data Backup (D.1.2)

text: D.1.2.1 Backup Rotation Schedules. The control requires the enforcement of data backup via a documented, well-known backup rotation scheme such as Grand-Father-Son, Round Robin and Tower of Hanoi.

text: D.1.2.2 Near Real-Time Backups. The control requires an incremental methodology which captures all changes to the initial image in increments within minutes. The Incremental methodology not only backs up recent datasets but also allows end users to reconstruct the state of their data as it stood at the end of various minute-based restoration points.

text: D.1.2.3 Backup System Flexibility. The backup system should allow quick and flexible restoration of files, folders, partitions, mailboxes/messages and databases/tables. It should be possible to schedule restoration of data according to the pre-determined recovery priority. This is to be utilised when the time to restore the full datasets exceeds the target recovery times. Design your backup plan to meet the precise restoration time objectives. Order the backup sequence according to your recovery sequence to avoid time costly seeks on tapes. Create a precise map of the contents of each tape. If possible clone the backup sets to a hard disk storage to increase the speed of restoration.

text: D.1.2.4 Internet Backup. The control requires that workstation users (personnel) are allowed to back up data to a remote location over the Internet. Formal authorisation is required prior to the execution of this backup method.

text: D.1.2.5 Data Backup. Control requires that there is a documented data backup plan that is routinely updated, periodically tested, that calls for regularly scheduled backups of data and requires periodic testing and verification of the ability to restore from backups.

text: Recovery Actions

text: RA.1.1.1 If the mirrored set failes and cannot recover automatically revert to backup restration on new storage media. If data call a recovery expert. In any case make sure data salavage operation is performed on a copy and not on the original media, if possible.

text: RA.1.1.2 Restore data to the required information systems via the NAS / SAN

text: RA.1.1.3 Load backup data to the required information systems via the NAS / SAN. If the data are corrupted or irretrievable obtain data from the secondary site.

text: RA.1.1.4 Select one of the recovery strategies: a) Transfer IT operations to the location of the data. B) transport the replicated data to the designated recovery site c) Arrange for sufficient network BW and Q.o.S. (latency and delay) for the remote access of the data.

text: RA.1.1.5 Initiate the procedure for obtaining the offsite backup media from the designated site and load backup data to the organization’s production information systems.

text: BCM: An approach for SMEs

text: RA.1.2.1 Identify the backup sets needed for effective restore. These may be the latest backup set available or some older copy if restoring to an older point in time is required. RA.1.2.2 Assess your ability to salavage near real-time backups if they are located at the incident site. RA.1.2.3 If time limits are tight schedule the restoration of data according to the pre-determined recovery priority. Use a pre-compiled restoration sequence. RA.1.2.4 Start retrieving Internet backups as soon as possible from a location providing good bandwidth and stable internet connection. Keep in mind internet speeds vary and BW bottlenecks may impose a critical delay to the download. Prioritise your downloads according to your needs. RA.1.2.5 Initiate the backup plan to restore the damaged / lost data

text: People (P) Physical Security (P.1.1) P.1.1.1 Actions Accountability. Control requires that an individual’s or group’s actions -- with respect to all physically controlled media -- can be accounted for P.1.1.2 Physical Access Control. Control requires that there are documented procedures for authorizing and overseeing those who work with sensitive information or who work in locations where such information is stored. This includes employees, contractors, partners, collaborators, and personnel from third-party organizations, systems maintenance personnel, or facilities maintenance personnel. P.1.1.3 Clean Desk Policy. A clean desk policy is in operation followed by all personnel, contactors and third parties Awareness & Training (P.1.2) P.1.2.1 Business Continuity Tool Set. The control requires that staff has access and is trained to use a business continuity tool set which includes the appropriate material (software / hardware, documented guidelines and procedures) for responding after a security or business continuity incident. P.1.2.2 Business Continuity Tests. Staff, have been trained and involved in business continuity tests. P.1.2.3 Key Personnel Deputies. All executives, managers and designated critical staff participating into business continuity teams have trained deputies who can fulfil their duties / responsibilities. P.1.2.4 Key IT Personnel Training. The control requires that key IT personnel assigned with a key role into business continuity plans and procedures, are trained on a “business as usual” basis. The training ensures that such key position employees are fully capable of executing efficiently business continuity plans or procedures Recovery Actions RA.1.2.3 Business Continuity Deputies take over the duties of the staff responsible with business continuity responsibilities.

text: Facilities (F) IT Site (F.1.1) F.1.1.1 IT Site Physical Access. Physical access to IT Site is restricted by lock / combination lock and / or swiped cards or

text: BCM: An approach for SMEs

text: similar physical access control technologies. F.1.1.2 IT Site Power Supply. The power supply of the site equipment is protected with UPS and / or generators. F.1.1.3 IT Site Air-Conditioning. IT site humidity, ventilation and air-conditioning are controlled. F.1.1.4 IT Site Anti-fire Systems. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within the IT site. F.1.1.5 IT Site Anti-flood Systems. IT Site is equipped with water detection systems and anti-flood mechanisms (raised floors, drop ceilings) F.1.1.6 IT Disaster Recovery Site. There is an alternate dedicated site where IT is restored following a disaster. F.1.1.7 IT Site Recovery Plan. Detailed recovery plans exist for the redirection of all feeds from each primary site to respective recovery sites. F.1.1.8 Secondary Disaster Recovery Site. There is an additional secondary site with certain mechanisms in place for invoking it if the primary recovery site is not available. Environmental Security (F.1.2) F.1.2.1 Electrical Power Mechanisms. All critical business functions are protected by uninterruptible power supply (UPS) or similar battery backup. In addition all areas and systems of the corporate facilities have their power supply backed up by generators. Power can be provided by generato F.1.2.2 Fire Fighting Equipment. Fire detection (Fire Alarm Sensors) and suppression systems (water or gas suppression system, fire extinguishers) are installed within corporate facilities F.1.2.3 Air-conditioning. The air-conditioning system installed into the corporate facilities has auto-shut-off if there is a fire, smoke detection or alert. F.1.2.4 Anti-flood Equipment. There are water detection systems and anti-flood techniques (raised floors, drop ceilings) in all vulnerable or high flood-risk areas of the corporate facilities. F.1.2.5 Electrical Power Protection. Corporate facilities are protected against electrical spikes and surges (e.g. lightning strikes). In addition the control requires the proper grounding and shielding of the cables used to supply electrical power. Physical Security (F.1.3) F.1.3.1 Battle Boxes. Sites use ‘battle boxes’ containing a variety of equipment selected to assist with the management and control of a business continuity incident. Alternatively, the organization keeps and maintains the materials required to help the recovery of business op F.1.3.2 Secure Delivery and Loading Area. The control requires a documented policy for controlling introduction of packages or items within a dedicated post room which systematically inspects for threatening objects received by couriers and visitors. F.1.3.3 Facilities Access Control. All critical sites have security guards (24 hours a day, 7 days a week), and / or internal / external CCTVs, access control systems and a standard access management security procedure. F.1.3.4 Rooms and Areas Secure Access. Physical access to critical areas and floors is restricted by guards’ presence and /or individual swiped card or locked doors with keys only available to authorised personnel. F.1.3.5 Visitors Escort. Control requires that there are documented policies and procedures for managing visitors, including sign in, escort, access logs, reception and hosting. F.1.3.6 ID Badges. Permanent and temporary staff, contract staff and visitors required to wear visible id badges.

text: BCM: An approach for SMEs

text: Recovery Actions RA.1.1.1 Once the emergency/incident is contained provide arrangements for the physical security of the incident site. RA.1.1.2 Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.1.3 Verify air-conditioning operates normally. Make sure you can contact qualified technicians in case of failure. RA.1.1.4 If the anti-fire systems were engaged, make sure the site is safe for personell(engage the fire department) before attempting to salvage any equipment.C23 RA.1.1.5 Be aware of the risk of electrical shock due to exposed wires to the water. Refresh the operating procedures and operate any anti-flood systems you might have in place or seek support from the emergency services. Monitor closely the condition as you might RA.1.1.6 Evaluate the need to activate the disaster recovery site. Check site availability and announce the DR site location to be activated. Follow the activation plan RA.1.1.7 On DR site activation implement the site recovery plan. RA.1.1.8 Evaluate the need to activate the disaster recovery site. Check site availability and announce the DR site location to be activated. Follow the activation plan RA.1.2.1 Verify UPS / generators operate correctly and safely. Arrange adequate fuel supply. Extend you power autonomy by shutting down unnecessary loads. Communicate with the power company to establish the nature of the problem, coordinated course of action and RA.1.3.2 Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter. RA.1.3.3 Once the emergency/incident is contained arrange for maintenace of a secure physical perimeter.

text: BCM: An approach for SMEs

text: Annex E – Business Continuity Awareness

text: Why Business Continuity Management

text: Business Continuity should become part of the way business is performed. Organizations that have a business continuity capability are far more likely to survive the effects of a major incident than those that don’t. It is better to plan for incidents, which may affect business-as-usual activities, rather than having to "cope with" when a problem occurs. Business Continuity Management (BCM) ensures that the organization is able to respond to major disruptions that threaten its survival. BCM develops organization-wide resilience allowing an organization to survive the loss of part or all of its operational capability, providing an effective response that safeguards the interests of its key stakeholders and customers, reputation, brand and value creating activities. Because an organization’s BCM resilience depends on its management and operational staff as well as technology and geographical diversity, this resilience must be developed throughout the organization from senior management across all sites and the supply chain.

text: Business Continuity Threats

text: Unplanned events can have catastrophic effects and the disruptive incidents can come from accidents, criminal activity or natural disasters. This section of the report provides an indicative list of continuity threats which could lead to an undesirable event, causing a negative impact to an asset in terms of asset interruption or loss/destruction. The nature of the potential threats has been categorized into three distinct types with respect to the source that triggers the actual threat. Specifically: □ Natural Disasters □ System Problems / Cyber Attacks □ Man Made Disasters

text: Natural Disasters

text: □ Accidental Fire. Catching fire through an external event or internal accident e.g. lightning, waste-paper bin fire, short circuit.

text: Output: Interruption, Loss/Destruction

text: □ Climatic Phenomenon. Destruction or temporary shutdown of equipment, located in a geographical area prone to extreme heat, cold, humidity, wind or drought.

text: Output: Interruption, Loss/Destruction

text: □ Meteorological Phenomenon. Isolated atmospheric disturbance causing extreme climatic conditions such as storms, hail, lightning, avalanche etc

text: Output: Interruption, Loss/Destruction

text: □ Seismic Phenomenon. Earth tremor or earthquake causing extreme vibration or triggering a disaster (tidal wave) leading to temporal unavailability or permanent destruction of equipment.

text: Output: Interruption, Loss/Destruction

text: □ Accidental Flood. Flood due to pipe leakage from air-conditioning equipment, leakage from a water room on the floor above, fire nozzle open.

text: Output: Interruption, Loss/Destruction

text: □ Accidental Failure of Air-Conditioning. Failure, shutdown or inadequacy of the air-conditioning service may cause assets requiring cooling or ventilation to shut down, malfunction or fail completely

text: BCM: An approach for SMEs

text: Output: Interruption, Loss/Destruction

text: □ Electromagnetic Radiation. Accidental: Electromagnetic interference from an internal or external device such as radar, radio antenna, electricity generating station etc. Deliberate: Person using stray radiation to jam or saturate communications or disturb the operation of an appliance

text: Output: Interruption

text: □ Loss of Power Supply. Failure, shutdown or incorrect sizing of the power supply to the assets arising either from the supplier’s service or from the internal distribution system

text: Output: Interruption, Loss/Destruction

text: System Problems / Cyber Attacks

text: □ Software Malfunction. Design error, installation error or operating error committed during modification causing incorrect execution

text: Output: Interruption, Loss/Destruction

text: □ Equipment Malfunction / Failure. A logical or physical event causing an equipment item to malfunction and / or failure due to failure to follow equipment qualification procedures after updates/upgrades or use of equipment under conditions outside its operating limits (temperature, humidity).

text: Output: Interruption, Loss/Destruction

text: □ Breach of Information System Maintainability. Lack of expertise in the system making retrofitting and upgrading impossible; for example, inability to correct an operating problem on respond to new needs; failure of external software and hardware maintenance companies, termination of support contract leaving a lack of competency or resources for system upgrading.

text: Output: Interruption

text: □ Saturation of the System (Denial of Service). Accidental: Hardware, software or network resource inadequate for meeting users’ needs due to overworking the machine (too many requests processed simultaneously). Deliberate: An attacker simulates an intense demand on resources by setting up continuous bombardment.

text: Output: Interruption

text: Man-Made Disasters

text: □ Theft of Equipment. Someone inside or outside the organization accessing equipment located on the premises or transported outside.

text: Output: Interruption, Loss/Destruction

text: □ Deliberate Fire. An impostor gaining access to property in order to set light to flammable or explosive materials directly or indirectly (incendiary bombs, tampering with ventilation devices, etc.)

text: Output: Interruption, Loss/Destruction

text: □ Deliberate Flood. An Impostor gaining access to the property to cause flooding in the rooms. Deliberate breakage of pipes, triggering of extinguishing systems or simply spraying the equipment

text: Output: Interruption, Loss/Destruction

text: □ Deliberate Loss Of Power Supply. Sabotage or disturbance of the electrical installation by someone gaining access to the equipment (head-end, low voltage transform inverter, etc.)

text: BCM: An approach for SMEs

text: Output: Interruption, Loss/Destruction

text: □ Deliberate Failure Of Air-Conditioning. A person can sabotage the equipment used to operate the air-conditioning system (cut off the water or power supply, destroy the system).

text: Output: Interruption, Loss/Destruction

text: □ Destruction of Equipment or Media. Accidental Cause: Negligence or accidental event causing destruction of equipment or media. Deliberate Cause: Person gaining access to equipment and causing its destruction.

text: Output: Interruption, Loss/Destruction

text: □ Unauthorized Use of Equipment. A person inside or outside the organization accesses the information system and uses one of its services to penetrate it, run operations or steal information.

text: Output: Interruption, Loss/Destruction

text: Event –Incident Detection & First actions

text: A security incident is a suspected or possible security breach to one or more information resources. It is any adverse event whereby some aspect of information availability could be threatened, for example, by loss / destruction of data, denial of an information system’s service and / or disruption of a business function. Incidents can be divided into two distinct categories: □ Life threatening incident - It affects personnel health and safety: o Fire o Earthquake o A colleague is injured o Other life threatening situation □ Non-life threatening incident – It affects the continuity of the business. o Saturation of system resources o Denial of Service o Loss / Destruction of information o Inability of suppliers to provide the agreed upon / required service level An organization should develop a set of checklists which will include simple instructions / guidelines for the personnel that should be followed when a life or non-life threatening incident occurs. As a starting point the section provides two checklists; a lifethreaten checklist namely Fire Fighting Checklist; and a checklist for the detection of and response to a business continuity incident, namely Incident Detection and Action Checklist.

text: Fire Fighting Checklist

text: All fires can be very dangerous and life-threatening. Personnel safety should always be the primary concern when attempting to fight a fire. □ Before deciding to fight a fire, be certain that: o The fire is small and not spreading. A fire can double in size within two or three minutes. o You have the proper fire extinguisher for what is burning. o The fire won't block your exit if you can't control it. A good way to ensure this is to keep the exit at your back. o You know your fire extinguisher works. Assure the pressure is at the recommended level. On extinguishers equipped with a gauge, the needle should be in the green zone - not too high and not too low.

text: BCM: An approach for SMEs

text: o You know how to use your fire extinguisher. There's not enough time to read instructions when a fire occurs. □ How to Fight a Fire Safely: o Always stand with an exit at your back. o Stand several feet away from the fire, moving closer once the fire starts to diminish. o Use a sweeping motion and aim at the base of the fire. o If possible, use a "buddy system" to have someone back you up or call for help if something goes wrong. o Be sure to watch the area for awhile to ensure it doesn't re-ignite. □ Never Fight A Fire If: o The fire is spreading rapidly. Only use a fire extinguisher when the fire is in its early stages. If the fire is already spreading quickly, evacuate and call the fire department. o You don't know what is burning. Unless you know what is burning, you won't know what type of fire fighting equipment to use; there could be something that will explode or produce highly toxic smoke. o You don't have the proper fire fighting equipment. The wrong type of fire-fighting equipment can be dangerous or life-threatening. o There is too much smoke or you are at risk of inhaling smoke. Seven out of ten fire-related deaths occur from breathing poisonous gases produced by the fire. □ In case that you are not able to evacuate the building / office due to blocked exits: o Seal all gaps under doorways and windows with dry towels and duct tape. o Turn off heating, cooling or ventilation systems. o Protect your breathing, cover your nose and mouth with a dry handkerchief or other cloth folded over several times. o Use any fire-fighting equipment available or any other manual technique in case that you must constrain fire dispersion towards your temporal shelter. □ Note: Any sort of fire will produce some amount of carbon monoxide, the most deadly gas produced by a fire. Materials such as wool, silk, nylon and some plastics can produce other highly toxic gases such as carbon dioxide, hydrogen cyanide, or hydrogen chloride. Beware - all of these can be fatal.

text: Incident Detection and Action Checklist

text: A sample checklist which defines a business continuity incident instructing personnel to carry out specific actions in the case of a non-life threatening incident is the following: □ Do we have an incident? o Is there an indication or evidence that :  Access to facilities / offices will be impossible?  Equipment has or is about to fail?  Telecommunications services have or about to be unavailable for an unacceptable amount of time?  Data could or are lost / destroyed?  IT equipment or applications have a severely degraded performance or totally unavailable?  Evidence of computer hacking or cyber attack?  Absence of an unusually high number of colleagues.  Complaints from clients or third parties for the quality of the offered service or product.

text: BCM: An approach for SMEs

text: □ If you answered yes to any of the above questions then: o Contact the leader of the incident response team or his deputy; keep trying to contact the first available person in the communications tree. o Provide all the known information and support to assist the Incident Response Team to control the incident. o Prepare to take up your pre-defined role in the BCP and / or any other plan / procedure that you may be involved.

text: Personnel Health and Safety EU Legislation

text: EU legislation obliges organizations -operating within EU member states- to ensure employees health and safety. Specifically, OJ L

text: Council Directive 89/391/EEC

text: (12/6/1989) includes the minimum requirements for the workplace, obliging employers to

text: provide certain health and safety protection measures. OJ L 393,

text: Council Directive 89/391/EEC

text: (12/6/1989) has been further expanded to individual Directives in order cover certain health and safety issues within the following topics: □ Work places (OJ L 393,

text: Council Directive 89/654/EEC

text: concerning the minimum safety and health requirements for the workplace - first individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Work equipment (OJ L 393,

text: Council Directive 89/655/EEC

text: concerning the minimum safety and health requirements for the use of work equipment by workers at work - second individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Personal protective equipment (OJ L 393,

text: Council Directive 89/656/EEC

text: minimum health and safety requirements for the use by workers of personal protective equipment at the workplace - third individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Work with visual display units (OJ L 156,

text: Council Directive 90/269/EEC

text: on the minimum health and safety requirements for the manual handling of loads where there is a risk particularly of back injury to workers - fourth individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Handling of heavy loads involving risk of back injury (OJ L 156,

text: Council Directive 90/270/EEC

text: on the minimum safety and health requirements for work with display screen equipment - fifth individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Temporary or mobile work sites (OJ L 196,

text: Council Directive 90/394/EEC

text: on the protection of workers from the risks related to exposure to carcinogens at work - sixth individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: ) □ Fisheries and agriculture (OJ L 391,

text: Council Directive 90/679/EEC

text: on the protection of workers from risks related to exposure to biological agents at work - sixth individual Directive within the meaning of

text: Article 16(1) of Directive 89/391/EEC

text: BCM: An approach for SMEs

text: Annex F – Business Continuity Plan Template

text: The annex presents the Business Continuity Plan Template produced by the execution of the proposed BCM approach described in the current document. The Plan is created gradually as the Assessment Team executes the various steps. The BCP template exists as a separate document for the company used within the example of chapter 5. Self Assessment Guidelines with one example. Available as a separate document: BCM_for_SME_Example_BCP-Template

text: BCM: An approach for SMEs

text: Annex G – Useful Templates

text: Available as a separate document BCM_for_SMEs_Annexes_G-H_Assessment_Templates

text: BCM: An approach for SMEs

text: Annex H – Asset Types List