Introduction

Business Continuity Management System (BCMS)

 2

Agenda

1 Introduction to Business Continuity

2 BCMS Lifecycle
 3

Introduction to Business Continuity (BC)

ISO 22301:2012 Societal Security – Business Continuity Management Systems – Requirements, defines the following:

Business Continuity Business Continuity Business Continuity

Management System Management
“Capability of the organization “Part of the overall management
“Holistic management
process that identifies
to continue delivery of key system that establishes,
potential threats to an
products and/or services at an implements, operates, monitors,
organization and the impacts
acceptable predefined levels reviews, maintains and improves
to business operations that
following a disruptive incident” business continuity”
those threats, if realized,
might cause and which
provides a framework for
building organizational
resilience with the capability
for an effective response that
safeguards the interests of its
key stakeholders, reputation,
brand and value-creating
activities”
 4

Introduction to Business Continuity - PDCA

Continual improvement of BCMS

Interested Interested
parties parties
Establish (Plan)

Maintain and Implement and

improve (Act) operate (Do)

Requirements Monitor and Managed

review (Check)
for business business
continuity continuity

Plan – Do – Check – Act (PDCA)

 5

Introduction to Business Continuity - Key Benefits

1
Identifies the impacts of an
business disruption
7 2
Develops an effective
Helps to improve the response to disruptions,
overall brand of the which minimizes the
organization impact on the organization

6
Key 3
Ensures delivery of Benefits Enables appropriate &
timely actions based on
CIL’s key products
BC policy

5 4
Helps build an ability to
Builds resiliency within the
identify, analyze and
organization
manage risks
 6

Introduction to Business Continuity - BCMS Lifecycle

Minimum Business Continuity Objective (MBCO): Minimum level of services and/or products that is acceptable to the organization to achieve its
business objectives during a disruption

Maximum Acceptable Outage (MAO): Time after which unavailability of the process starts having an unacceptable impact to the organization

Recovery Time Objective (RTO): Target time set for resumption of process after an incident, to an acceptable level of recovery referred to as
MBCO

Pre Crisis During Crisis Post Crisis

Normal operations
Level of Business Operations

Return to
‘Business
tX As Usual’
t0 Incident +t5

100% Operations
MAO

RTO

MBCO

Incident Response &

Emergency +t1 +t2 +t3 Time
+t4 Services operate at partial
Management
level
Crisis Management Invoke Business Continuity
 7

BCMS Framework

Business Continuity Management System (BCMS)

BC Policy

BCMS Governance Framework

Business Process Business Impact Analysis Recovery Strategy and Exercising and
Understanding and Risk Assessment Plan Documentation Maintenance

Phase I Phase II Phase III Phase IV

Crisis Management and Business Recovery

Training and Awareness

Continual Improvement
 8

Overview of BC Policy

“To build organizational capabilities, develop effective response against key

Business
threats that can adversely business continuity and safeguard interest of key
Continuity
stakeholders with the objective of creating sustainable value and reputation for
Policy
Organisation”

Business Continuity Management System

▪ Ensure delivery of key products and / or services at a predefined acceptable

Business level
Continuity ▪ Ensure compliance with applicable legal, regulatory and contractual
Objectives requirements
▪ Increase organizational capabilities
▪ Protect and enhance reputation
▪ Ensure human and environmental safety
 9

BCMS Governance Framework

Crisis Management Team

Emergency Business Continuity

Management Team Management Team

Emergency Business Continuity

Response Team* Working Group

Incident Response
Core Team
Team
 10

BCMT Roles and Responsibilities

➢ Provide strategic direction for BCMS and resolve conflicting interests and priorities
➢ Validate Organisation’s recovery requirements, and define the organization’s risk
appetite
➢ Ensure implementation, monitoring, management and continuous improvement of
organization-wide BCMS
➢ Ensure that BCMS roles are defined and assigned at all levels (as applicable)
➢ Ensure that all employees and third parties are aware of their roles and responsibilities
during a business continuity situation
➢ Ensure appointment of Business Continuity Working Group and Core Team personnel
➢ Review and approve all BCMS work products
➢ Consider business continuity and resiliency risk issues and their plans for mitigation
➢ Review and approve changes in the BCMS
➢ Conduct Management Review and approve Monitoring Performance results
➢ Upon Crisis declaration, the Business Continuity Leader identified by Organisation to
communicate business continuity execution to the respective BCWG member of the
affected site
 11

BCWG Roles and Responsibilities

➢ Ensure effective implementation of Business Continuity Plans at respective locations
➢ Ensure periodic review, update and approval of the BCMS documents, and execution of
activities as defined in the approved BCMS Program Calendar
➢ Monitor the incidents and crisis to determine action to address impact on operations
➢ Define the budget requirements to implement the Recovery Strategies
➢ Review unscheduled changes in the BCMS (including associated documents) and
recommend necessary changes to the BCMT ( Business Continuity Management
Targets)
➢ Drive BCMS training and awareness programs with support from the Corporate
Communications, Human Resources personnel and Core Team Members
➢ Ensure that the Business Continuity Plans are implemented and that the Recovery
Strategies are current and suited to the business needs at any point in time
➢ Gather BCMS improvement requests from all the departments and forward the same to
the Management at least once a year
➢ Coordinate and manage reviews by Management
➢ Upon information by identified SPOC from BCMT, BCWG member to inform Core Team
Member at the affected site to execute BCP
 12

CTMs Roles and Responsibilities

➢ Deliver complete BCMS documentation for their respective site/department
➢ Provide information specific to their site/department during a business continuity situation
and execute the activities as mentioned in the respective Business Continuity Plan
➢ Implement identified Recovery Strategies
➢ Communicate site specific risks and unscheduled changes of the BCMS in a timely
manner
➢ Assist in conducting BCMS training and awareness sessions within their site/department
as per the BCMS Training and Awareness Schedule as part of overall BCMS Program
Calendar
➢ Ensure periodic exercising and testing of the BCMS arrangements as per the Exercising
and Testing Procedure and BCMS Program Calendar
➢ Review and update the BCMS documentation for their respective site/department
 13

BCMS Lifecycle: Business Process Understanding

Why this activity? Key Activities

➢ To gain an in-depth understanding of business ➢ Understand the business processes, supporting
operations resources and process interdependencies
➢ To identify key business processes and ➢ Ascertain the organization structure, current
understand their interdependencies business and IT environments

Business Process
Understanding
➢ Process Maps entailing ➢ Document Mega Process,
understanding of the business Process and Activities within
each department
environment and operations
➢ Ascertain Resources supporting these
➢ Clear understanding of the existing resources
processes
supporting business processes
➢ Review existing process documentation and
current BC practices in place

Outcomes Methodology
 14

BCMS Lifecycle: Business Impact Analysis (BIA)

Why this activity? Key Activities

➢ To assist in analysis of business impact due to ➢ Ascertain impact of unavailability of processes
unavailability of a business process over a time-scale
➢ To identify Critical Process and corresponding ➢ Prioritize Critical Processes
activities

Business Impact
Analysis
➢ Business Impact Analysis results
➢ Conduct BIA workshops to
with the following outcomes: identify the following:
➢ Process MAOs ➢ Financial, Operational, Reputation and HSE
➢ Prioritized list of Critical Processes impacts
➢ Maximum Acceptable Outage (MAO) timeframes
for processes

Outcomes Methodology
 15

Introduction – Site Risk Assessment

Identify Threat
Develop Threat Ascertain Top
Likelihood and
Library Threats
Impact

Calculate current Assess status of Conduct Site

Risk Levels current controls Walkthrough

Identify relevant Management Develop Risk

Risks to the Discussion / Treatment
business Moderation Strategies
 16

BCMS Lifecycle: Threat Assessment

Why this activity? Key Activities

➢ To identify threats applicable at different site / ➢ Develop a Threat Library
location ➢ Conduct Threat Workshop to systematically
➢ To identify Top Threats which act as an input to assess threats
the Site Risk Assessment activity

Threat Assessment
➢ Listing of top threats basis
➢ Develop a Threat Library
which the Site Risk Assessment
➢ Determine Threat Likelihood
would be conducted
➢ Ascertain the Impact Potential (on
materialization of the threat)
➢ Identify Top Threats

Outcomes Methodology
 17

BCMS Lifecycle: Site Risk Assessment

Why this activity? Key Activities

➢ To identify existing vulnerabilities for ➢ Review effectiveness of current controls
corresponding Top Threats implemented
➢ To develop Risk Treatment strategies to ensure ➢ Develop strategies to mitigate risks
risks can be mitigated

Site Risk Assessment

➢ Risk Assessment Report ➢ Develop Vulnerability
Assessment questionnaire
highlighting risks and providing
➢ Conduct site - walkthroughs
recommendations for implementation of
➢ Conduct discussions with respective personnel
necessary controls/ measures for mitigating
to ascertain the current controls’ effectiveness
these risks
➢ Obtain Risk Treatment responses

Outcomes Methodology
 18

BCMS Lifecycle: Resource Risk Assessment

Why this activity? Key Activities

➢ To determine risks associated with ➢ Analyze the impact and likelihood of
unavailability of resources supporting Critical unavailability of a resource supporting a Critical
Processes Process
➢ To ascertain effectiveness of current controls ➢ Identify Risk Treatment Options
implemented

Resource Risk
Assessment
➢ Risk Assessment Report ➢ Assess effectiveness of
highlighting risks and providing preventive, detective and
corrective controls implemented
recommendations for implementation of
➢ Identify risk(s) applicable to resources and
necessary controls/ measures for mitigating
current mitigation steps
these risks
➢ Obtain Risk Treatment responses

Outcomes Methodology
 19

BCMS Lifecycle: BC Plan Documentation

Why this activity? Key Activities

➢ To identify Recovery Strategy options which are ➢ Determine strategies which are best suited for
feasible and strategically-fit resumption of Critical Processes
➢ To develop Business Continuity Plan(s) ➢ Identify action steps and resources required to
ensure execution of Recovery Strategies

BC Plan Documentation

➢ Develop Pre Crisis and During

Crisis action steps
➢ Business Continuity Plan including the
recovery strategies for resumption of Critical ➢ Ascertain Business Continuity Requirements
Processes ➢ Document Call Trees, Contact Lists and External
Communication contact details

Outcomes Methodology
 20

Program Calendar

➢ Defines the timing of BCMS activities for all sites / locations

➢ Assists in providing updates to the BCWG

➢ Helps in allocating resources to conduct specific activities

➢ Showcases PDCA and effective BCMS implementation

➢ Describes the business case behind provision of resources and services

➢ Helps in keeping BCMS related documentation up-to-date

Thank you