Business Continuity Management
Provide information to business continuity planning on the data and information that is needed to support various business functions and activities.
Improvement Planning
Practices-Outcomes-Metrics (POM)
Representative POMs are described for Business Continuity Management at each level of maturity.
- 1Initial
- Practice
- Backup data and systems regularly and restore as requested or as necessary.
- Outcome
- Recovery from some limited data loss incidents is possible.
- Metrics
- # Frequency of business continuity submissions.
- # Master data elements covered in BC plans.
- 2Basic
- Practice
- Have IT participate in business continuity planning and test teams.
- Outcome
- Business continuity planning takes the recovery of essential IT systems on-board its plans.
- Metrics
- # Frequency of business continuity submissions.
- # High priority systems included in plan.
- 3Intermediate
- Practices
- Document and provide information on data owners and governance to business continuity planning.
- Complete recovery plan reviews and critiques.
- Test the effectiveness of recovery plans by executing them.
- Outcome
- Business continuity planning is able to develop business recovery strategies while adhering to governance criteria.
- Metrics
- # Frequency of business continuity submissions.
- # High priority systems included in plan.
- # Governance and business priorities encompassed in plans.
- 4Advanced
- Practices
- Use and keep up-to-date sophisticated hardware and software inventory and configuration management systems.
- Design information governance so that it can be managed from any site.
- Invite energy, telecommunications, hardware, and software and other vendors to review and contribute to the recovery planning and testing processes.
- Outcomes
- Plans are more likely to be complete and effective based on complete hardware and software inventories with appropriate configuration information.
- Reviews by peers and vendors improve the quality and likelihood of success.
- Lessons learned while testing improve the next iteration of plan submissions.
- Vendor involvement in testing can be beneficial for both user and supplier and enhances likelihood of success.
- Metrics
- # Frequency of business continuity submissions.
- # High priority systems included in plan.
- # Governance and business priorities encompassed in plans.
- 5Optimized
- Practices
- Design, develop, procure, test and deploy solutions and services that are business continuity plan compliant.
- Use business continuity checks in change management approval and testing.
- Outcome
- The business is confident that on-going changes and improvements will not detract from its ability to recover if necessary.
- Metrics
- # Frequency of business continuity submissions.
- # High priority systems included in plan.
- # Governance and business priorities encompassed in plans.
- # Business continuity test failures.
- # Test the effectiveness of recovery plans (plan was executable as written, time to recovery was achieved, priorities were manageable, etc.).
- # Change induced business continuity test failures.