This book is a guide to implementation of World-Class Business Continuity Management within an enterprise. It may be used as a step-by-step guide by those new to Business Continuity Management or dipped into by the more seasoned professional for ideas and updates on specific topics.
There is no absolute "right way" to perform business continuity management - although there are plenty of wrong ways. Business Continuity is not rocket science: it is applied common sense. Yes, experience helps, but it is no mystic art. This book makes the processes transparent and provide the reader with everything necessary to do the job.
Many examples are provided throughout this guide: these all have their roots in real cases and real organizations, and come heavily laden with pragmatism. Over fifteen years of business continuity experience in environments large and small, public and private, has gone into developing the methods described. Your own "right way" for business continuity management means picking, matching and tailoring from the cases and examples provided and combining these with existing best practice within your organization.
EXCERPT FROM THE PREFACE
Melvyn Musson, FBCI, CBCP, CISSP
I was very pleased to be asked to write a preface to this much-needed book. There are many books that have been written covering various aspects of hazard control, emergency response, disaster recovery and business continuity, but not one that pulls all areas together under the auspices of the individual sections of the BCI and DRII Professional Practices.
Why my interest? To quote from a letter I wrote to the National Fire Protection Association (NFPA) in 1991 when they were considering the establishment of a Technical Committee to develop a Standard on Disaster Management:
"Disaster Management, or Business Continuation Planning as we prefer to call it, is a natural progression from Hazard/Loss Control through Emergency Response to the recovery process.
"The best hazard/loss control programs cannot prevent emergency or catastrophic situations occurring. The emergency response procedures that most companies have developed or which may be required by law, deal with such aspects as initial fire fighting, evacuation, life safety, etc. - what one might term the stabilization of the situation. They cover the first hours of the emergency. They do not deal with the long-term recovery, which could take several months.
"Disaster Management, or some other similarly named program, is needed to enable the company to institute procedures to return to normal operations as soon as possible.
That standard is now available as NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. Within that standard are details of the BCI/DRII Professional Practices, albeit as part of the various sections of the standard and not as an individual, specific section.
In addition to NFPA 1600, other standards and guides such as BS7779 in Great Britain and the recent Australian Risk Management Standard are incorporating the Professional Practices either by specific reference or wording relating to the practices.
The advent of the Turnbull Report introduces a new consideration and need, which the Professional Practices can support.
This makes it all the more important to have a reference material that can clearly detail what should be considered in each of the ten subject areas, together with appropriate examples and details of not only the benefits but also the problems that can be expected with each of those subject areas. Andrew Hiles has been able to do so in the development of this book. In addition, since Andrew intends to issue periodic updates, this book becomes a living document, which will address both changes in the Professional Practices and developments within the industry.
