Implementando seu Programa de Continuidade de Negócios de acordo com a ISO 22301

1
ATENÇÃO: O conteúdo desta apresentação é CONFIDENCIAL. Nada poderá ser divulgado por qualquer
forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil.
Consultoria ı Ferramentas ı Capacitação
Implementing your
BC program
in conformity with
ISO 22301
Sidney Modenesi, MBCI
ISO 22301 BSI Technical Expert
July/2014

2
Sidney R. Modenesi
 25+ years BC/DR experience;
 Certified MBCI in 2006
The Business Continuity Institute;
 ISO 22301 BSI Technical Expert, 2013;
 BS 25999 BSI Technical Expert, 2011;
 The Business Continuity Institute
Area Representative in Brazil;
 Master Degree in Entrepreneurship,
University of São Paulo, Brazil, 1986.
 Bachelor in Computer Sciences,
University of São Paulo, Brazil, 1976;
 br.linkedin.com/in/sidneymodenesimbci/
22

3
Agenda
 Scoping - prioritize locations, products or services to cover the
corporate wide business continuity needs;
 Planning - break the scope in a set of projects;
 Budgeting - estimate CAPEX, OPEX and other needs;
 Implementing - the PDCA life cycle and
Continuously improve and enlarge - your corporate business
continuity program
In conformity with ISO 22301 - Societal security –
Business continuity management systems –
Requirements
3

4
ISO 22301
Societal security – Business continuity management systems – Requirements
4
Scope, References,
Terms &
Definitions
(cap.1, 2 e 3)
Context of the
organization
(cap.4)
Leadership
(cap.5)
Planning
(cap.6)
Support
(cap.7)
Operation
(cap.8)
Performance
Evaluation
(cap.9)
Improvement
(cap.10)

5
SCOPING

6
Potential disruptive interruption scenarios
Main
office 1
ICT service provider
6
Xxx contributors
Bkp. Call center;
Business
departments;
Local data center.
Main
office 2
X X
X
Zzz contributors
Main call center;
Some business
departments;
Logistics .
XX
Supply chain
Each disruptive scenario has
different impacts and
may require different
recovery strategies.
ONE BIA DOES NOT FIT ALL.

7
ISO 22301 - 4.3.2 Scope of the BCMS
The organization shall
a) establish the parts of the organization to be included in the BCMS,
b) establish BCMS requirements, considering the organization’s mission,
goals, internal and external obligations (including those related to
interested parties), and legal and regulatory responsibilities,
c) identify products and services and all related activities within the scope
of the BCMS,
d) take into account interested parties’ needs and interests, such as
customers, investors, shareholders, the supply chain, public and/or
community input and needs, expectations and interests (as
appropriate), and
e) define the scope of the BCMS in terms of and appropriate to the size,
nature and complexity of the organization.
7

8
High level questions to be answered
 Which parts of the organization?
 What are the BCMS requirements?
 What are the critical
products and services?
 What are the needs and
interests of the stakeholders?
 What is the overall scope
of the BCMS?
 What are the Service Levels
to be delivered?
8

9
Strategic BIA
In a strategic BIA, the organization’s
products and services are prioritised
and the organization’s recovery timescales
or Maximum Tolerable Periods’ of Disruption
(MPTD’s) and disruption tolerance levels or
Minimum Business Continuity Objectives
(MBCO’s) are determined.
 3.26 - maximum tolerable period of disruption – MTPD
time it would take for adverse impacts, which might arise as a result of not
providing a product/service or performing an activity, to become unacceptable.
 3.28 - minimum business continuity objective – MBCO
minimum level of services and/or products that is acceptable to the organization
to achieve its business objectives during a disruption.
9

10
Strategic BIA
 Interview and challenge your
Top Management:
 Be objective you may have an hour or less
 Ask closed questions:
1. How do we prioritize our products and
services? By revenue? By profit? By image value? …
2. How long can we support a disruptive interruption in our products
and services? One hour? One day? One week? Why?
3. What are the Service Levels we intend to deliver after a disruptive
interruption? 33% in the first day? 50% in the first 3 days?
BAU? When do we plan to deliver 100%? Why?
4. What about the backlogs, can we afford to see them escalating
over time?
10

11
Strategic BIA
 DO NOT FORGET TO ASK:
 What are the approved and
planned strategic changes in
the organization for the next
12, 24 and 36 months?
 Growth;
 Outsourcing;
 New products and/or services;
 Withdrawn of products and/or services;
 Acquisition, merge, split, public …
 New technologies: cloud services, ERP, CRM …
11

12
Strategic BIA
 Explain to Top Management: the smaller the MTPDs or higher
the MBCOs  higher the BCMS cost (CAPEX and OPEX);
 Make sure these requirements are in line with the Corporate
Risk Appetite (ISO 31000 & 31010 may help).
12

13
Our goals
 To identify the Context of the
organization – Chapter 4
 Main products and services in
Recovery Tiers (1, 2, 3…);
 Service levels to be delivered (MBCOs);
 Maximum outages (MTPDs);
 In line with the Strategic planning and Risk appetite
 All information above will be used during the Operational BIA:
 ISO 22301 - 8.2.2 Business impact analysis
The organization shall establish, implement, and maintain a formal
and documented evaluation process for determining continuity and
recovery priorities, objectives and targets. This process shall
include assessing the impacts of disrupting activities that support
the organization’s products and services.
 BCI GOOD PRACTICE GUIDELINES 2013
13

14
PLANNING

15
High level planning
Plan to develop and implement
the BCMS:
 Vertical or horizontal:
where key products and services
are executed or cross organization?
 Develop a conventional BCM project:
 Operational BIA, Risk Assessment,
Recovery strategy, Plan development and testing …
 Using project management methodologies:
 PMM – http://www.pmi.org;
 Agile – http://agilemethodology.org
 Delivering timely and consistent results,
building credibility.
15

16
High level planning
Assumptions: strategic BIA done
scenarios defined and MTPDs and MBCOs available
Operational BIA – 20 managers – 4 - 6 weeks
using the definitions from the Strategic BIA
Risk Assessment – 4 weeks
aligned with the corporate risk (ISO 31000 and/or 27001)
Recovery Strategy – 2 weeks
Executive decision – Risk Appetite
2 – 3 times
16

17
High level planning
Assumptions: Recovery Strategy approved
Plan development – 4 hours per plan
by product or service, by department, by process?
Plan testing basic – 2 hours per plan
tabletop exercise (ISO 22301 – ch. 9 and ISO 22398)
Corporate or partial exercise or test
each one as a project (ISO 22398)
Post exercise or test review
reviewed objectives (ISO 22301, 22398)
17

18
Warning
 You will need someone else´s time 
shared resources:
 With other important things to do;
 Under pressure to reach their own objectives;
 Eventually requiring some BCM education;
 And with a different view of:
Disruptive interruption durations – MTPDs and/or
Service levels – MBCOs
 Be realistic!!!
18

19
Our goals
 To develop a realistic time schedule
 Planning – Chapter 6 with:
 6.1 Actions to address risks and
opportunities;
 6.2 Business continuity objectives
and plans to achieve them.
19

20
BUDGETING

21
Do you homework
Understand how the organization
operates:
 Financial volumes:
gross and net revenues;
 Operating volumes: per product or service;
 From the purchase order till the purchase delivery -
workflow;
 Where (locations) products, services and activities
(processes) are executed – mapping;
 Controls in place: identify bottlenecks;
 Operating costs and accountability model: how back office
shared services are accounted.
21

22
Do you homework
 Develop a spreadsheet providing
high level figures - averages:
 Number of approved tickets
(products or services) per time
period - day or hour;
 Ticket value (US$) gross and net;
 Current backlog – tickets and amounts (US$);
 Operating costs – product or service + shared services,
including depreciations;
 Add scenarios – Strategic Planning;
 Call vendors and estimate overall costs;
 Draw graphs – C level are visual personas.
22

23
Do you homework
 Have all these information
ready for the strategic BIA;
 Check them first with your CRO – Risk Appetite;
 Know your public:
 CFO – may be very conservative regarding further
investments or expenses;
 CIO – may have a different view of priorities;
 COO (sales) – may not want to loose any sale.
 Use this information when challenging the Top
Management – MTPD & MBCO x Risk Appetite.
23

24
Our goals
To estimate the Resources
needed  Chapter 7.1
The organization shall
determine and provide the
resources needed for the
establishment,
implementation,
maintenance and continual
improvement of the BCMS.
24

25
IMPLEMENTING

26
Implementing
 While developing the
project we already have
a program running;
 Everything is in change;
 It´s mandatory to
capture all relevant
changes;
 To ensure when the
project is delivered it
matches the new reality.
26

27
Implementing
 The end of Phase 1 of the BCMS
project – Tier 1 is the start of
the Program and
 Another project starts - BCMS project
Tier 2 or Main building #2.
 Make sure you have consistent KPIs:
 9.1 Monitoring, measurement,
analysis and evaluation
9.1.1 General - Additionally, the organization shall
take action when necessary to address adverse
trends or results before a nonconformity occurs.
27

28
Implementing
Main
office 1
ICT service provider
28
Xxx contributors
Bkp. Call center;
Business
departments;
Local data center.
Main
office 2
Zzz contributors
Main call center;
Some business
departments;
Logistics . Supply chain
Continuous
improvement
Plan
Do
Check
Act

29
Final remarks
 All information gathered, developed and kept
updated are Documented Information and subject to:
7.5 Documented information
 7.5.1 General
The organization’s BCMS shall include
- documented information required by
this International Standard, and
- documented information determined
by the organization as being
necessary for the effectiveness
of the BCMS.
29

30
Consider an integrated management framework
COBIT
COSO
TOGAF
6 SIGMA
ISO
31xxx
ISO
27xxx
ISO
22xxx
30
•Risk management –
Principles and
guidelines
•Risk management –
Risk assessment
techniques
•Information technology
-- Security techniques --
Information security
management systems –
Requirements
•Information technology
-- Security techniques --
Code of practice for
information security
controls
•Societal security --
Business continuity
management
systems ---
Requirements
•Societal security --
Business continuity
management
systems -- Guidance

31
Which is the right way?
This? Or this?
31
MATURITY - This is a topic for another presentation!

32
Sidney R. Modenesi
MBCI, BSI ISO 22301 Technical Expert
sidney_modenesi@strohlbrasil.com.br
sidneymd@thebci.com.br
+55 11 5583-0033
br.linkedin.com/in/sidneymodenesimbci
32

Implementando seu Programa de Continuidade de Negócios de acordo com a ISO 22301

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Implementando seu Programa de Continuidade de Negócios de acordo com a ISO 22301

Semelhante a Implementando seu Programa de Continuidade de Negócios de acordo com a ISO 22301 (20)

Mais de Sidney Modenesi, MBCI

Mais de Sidney Modenesi, MBCI (20)

Implementando seu Programa de Continuidade de Negócios de acordo com a ISO 22301