DIY Best Practices of business continuity @eryn-tribble - Tumblr Blog

A Case Study in backing up data . . . .

We recently formed a relationship to manage the continuity program for a new client. At the start of the discovery phase, we had a hearty discussion about backup practices. The new client used a well-known and reputable local data backup provider but had not thoroughly fleshed out the agreement or contractual obligations with them. Though our client was very confident in the services they were receiving, after reviewing the contract we were still uncertain how the provider supported testing or recovery of the backup data. With reservations, but in response to our urging, the client contacted their supplier and, after several weeks and many discussions with varying levels of management – leading up to the owner – he found that, while they were backing up a great deal of data, the backup files were wrong for their core processing system to start recovery. In fact, key files they would absolutely need during any recovery procedure were not getting backed up at all because they labeled them as “backup files” – not required for critical processing during usual business. The backup system was simply filtering them out. Clearly we were not concerned with business as usual! Though our client had previously felt very sure of their recovery capabilities and had, for several years, paid a first-class disaster recovery provider to back their data up, the system had never been analyzed to recognize its clear flaws. While the provider was technically holding up their end of the contract, our client would never have been able to recover from any data loss impacting their core system. Because of a few simple questions and conversations with the back up and core process vendors, this client now has a better sense of certainty with evidence to prove his recovery capabilities! See more at: www.diyturnkeycontinuity.com

#vendor risk management #disaster preparedness #continuity of business #small business planning

How Excellent Companies Avoid Dumb Things – 12 Principles

I just finished an excellent book on driving change in business: Neil Smith’s “How Excellent Companies Avoid Dumb Things”

Here’s the 12 principles that cut through the barriers:

The CEO must personally lead and support and change process carried out across the entire organization and a majority of senior management must also support it.

The entire organization must be engaged in the change process.

The project must be guided by “stars” who are willing to change the status quo.

There must be no up-front targets for the company as a whole or the individual departments within it.

Those who will implement the idea must own the idea. It must be easy to put ideas into the change process but hard to remove them.

Consideration of ideas must be based on facts and analysis, not opinion.

Consensus must be built.

There must be a focus on increasing revenue, not just reducing expenses.

The change process must not disrupt normal business.

Implementation must be nothing less than 100 percent.

The change process must be about culture change, not just a completed project.

Smith is right, constructive change that you want to see in your business is going to begin at the top and must be measured and deliberate. Don’t mistake success for luck. It’s not going to come easy!

See more at: www.diyturnkeycontinuity.com

#diy turnkey continuity #call tree #continuity of business threat risk assessment #small business planning

Who knows your bank better than YOU? DIY keeps you compliant!

Because you need simple and reliable solutions for managing your compliance that are also simple and reliable for responding to emergencies, we have developed the DIY Turnkey Continuity product line. Each form takes you step-by-step through the best practices of continuity while making it easy for you to meet compliance requirements or respond to an emergency for which you would otherwise be unprepared. We’re building new forms every day so check back often or contact us to let us know what forms you need.see more at : http://www.diyturnkeycontinuity.com/

Author Bio:

Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business ContinuityManagement (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Call Tree Exercise Kit

Communications are the most fundamental component of emergency response but the communication plan is the most frequently overlooked. Don't subscribe to costly software or over-rely on problematic technology as a solution. Our communications plan is a no nonsense comprehensive plan to getting the team on the same page - regardless of the emergency! see more at : www.diyturnkeycontinuity.com Author Bio:

#diy turnkey continuity #risk assessment key #emergency response kit

Small Business Planning Tool Kit

Small businesses have many operational risks to plan for but they don't need the complications of a bulky contingency system to confront problems or bog them down. Our streamlined all-in-one kit addresses compliance and risk without sacrificing agility and simplicity. Meets PCI requirements.see more at : http://www.diyturnkeycontinuity.com

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business ContinuityManagement (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Pandemic Risk Kit

A pandemic plan is a documented strategy for business continuity in the event of a widespread outbreak of a dangerous infectious disease. This kit lays out how a business will continue to provide essential services through a sustained period with significant employee absenteeism. It also specifies measures for how the business will minimize the risk of contagion among employees, clients and third parties.see more at : http://www.diyturnkeycontinuity.com

Exercise Kit

A plan isn't worth the paper it's been printed on if it hasn't been tested. DCS recommends you build a robust and incrementally progressive exercise plan to test your plans, incorporate updates and learnings and train your employees. This kit helps you design, build and facilitate an effective test that will exercise your disaster business response plan from assembling your team to writing the final reports.see more at : http://www.diyturnkeycontinuity.com

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Information Security Threat Risk Kit

Looking for an incident response compliance solution? Need direction on how to respond to a data breach you’ve experienced? Want to make sure you’ve covered all your bases? You’re at the right place! Our information Security Threat Kit is the solution for professionals who want to be prepared to respond to a data breach. Based on regulatory guidelines and best practices, it’s a simple to use robust form that will walk you through your emergency.see more at : http://www.diyturnkeycontinuity.com/

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Survey on KPMG

The complex environment in which businesses operate today creates the need for sophisticated business continuity management (BCM) program that address a wide range of threats, including natural disasters, technology issues and man made incidents. It is also important that these programs stay in sync with the strategic goals of the organization. The 2011-2012 Continuity Insights & KPMG LLP Global Business Continuity Management Program Benchmarking Study is a comprehensive look at the current state of BCM programs and the drivers for further program development. The online survey conducted by Continutity Insights between November 2011 and January 2012, explores changes to the global risk landscape, supply chain interdependicies, the emergence and increased usage of cloud computing, mobile applications and social media. One of the critical success factors for an organization is the ability to identify and successfully mitigate the risks associated with running its operations. These risks, can be grouped into various categories under the heading “operational risks”, refer to any type of risk that is neither financial nor market related. There are many sources of operational disruptions, all of which can be devastating affects if not sufficiently planned for. The process of planning can begin only when these threats and their impacts have been thoroughly assessed. BCM has emerged as one of the key disciplines that organizations can use to manage operational risk. The discipline continues to evolve from one that is focused on responding to an event or incident to one that adapts to changing market trends and threats. - See more at: http://www.diyturnkeycontinuity.com/

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

2010 Cost of a Data Breach

The Ponemon Institute presents the 2010 U.S. Cost of a Data Breach, the sixth annual study about the cost of data breach incidents for U.S.-based companies sponsored by Symantec Corporation. The average organizational cost of a data breach increased to $7.2 million and cost companies an average of $214 per compromised record, markedly higher when compared to $204 in 2009. The study also found that for the second straight year organizations’ need to respond rapidly to data breaches drove the associated costs higher. The sixth annual Ponemon Cost of a Data Breach report based on the real data breach experiences of 51 U.S. companies from 15 different industry sectors. - See more at:www.diyturnkeycontinuity.com

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Emergency Response Handbook

I’d like to hear what everyone is including in their emergency response handbooks – Let’s make a list we can refer to for updates. Here’s a start. We include basic emergency response items in our handbook: evacuation/ shelter, fire, seismic activity (earthquake), power failure, hurricane, hazardous materials spill, medical emergency (first aid) chemical & bio warfare exposure, suspicious packages and bomb threats, violence (including robbery), pandemic health threat, civil disturbance, wind (tornado), nuclear, wildfire, water contamination, flooding, winter storm, cyberterrorism/ identity theft/ data breach we also include basics around: incident command systems crisis communications We are in OK so there are doubtless more regionally specific threats. We do a high level risk assessment over all, then a more detailed assessment and monitoring for high risks. Response procedures are in a handbook for everyone that is separate from the BCM. This way we can educate and train without concern for strategy leaking or over-education. What are you including? - See more at: www.diyturnkeycontinuity.com

#diy turnkey continuity risk assessment key

BCM & DR Program: Using and Dismantling Assumptions

In all planning, whether it is for projects or programs and regardless of the industry and nature of business, one of the key areas that often gets overlooked is the use and belief in assumptions. Not just overlooked but they tend to become part of the fibre of every project and every BCM/DR program. We assume ‘so-and-so’ knows this ‘action’ and will do that ‘activity,’ when in fact, so-and-so has no idea what they’re responsible for or even that others believe they’re responsible for it. We don’t communicate assumptions often and if we do, it’s once or twice in the initial stages of a BCM/DR project or we make them up within the confines of our own segregated meetings, which aren’t attended by those that the assumptions are based on. We capture the minutes of the meetings and action items but never reach out to those we assigned an assumption to; they’re forgotten and actually become part of the BCM/DR framework – the plans and procedures we expect others to implement at the time of disaster. Assumptions are used to fill a void – an unknown. When we don’t know an answer we plug in what we hope will be proven to be the answer but fail to follow up on it. When it doesn’t occur the way we want, it’s because we put faith in an assumption, as though it was always correct rather than trying to disprove or valid it. By failing to disprove it, we are in the false believe that we’re taking a step forward because we embraced and accepting the assumption and in this way, provide ourselves with a level of comfort and a reason to point the finger of blame when something goes wrong. Assumptions aren’t just found during planning and development but during the implementation stages – or phases – of various program components. Even when an actual disaster occurs assumptions abound, as Crisis Management Teams (CMT) and individuals assume that others are performing the activities required. Even the assumption that people – and everything else – is and will be available when needed. If everything was available when and where it was desired and expected, then we wouldn’t have such diverse plans and processes in place to deal with such disaster situations. Assumptions aren’t always a bad thing. At the beginning of the BCM/DR program development, assumptions help move things forward. You plan up to a specific milestone based on a set of assumptions and then validate them through exercises and tests and conversations, as minute details slowly emerge the more and more planning develops. The results of which (exercises, conversations etc) help fill in the gaps identified that were – originally – assumptions. This way the assumption becomes a positive because it helps move the program forward by challenging those involved and initiating conversations between groups; communicating the expectations various groups and individuals have about plans, processes and procedures. Not revisiting them and validating them will only cause problems. As the organization, changes – plans, processes, resources, locations, lines of business etc – so to must the assumptions. An assumption developed at the outset of the program development can’t be considered valid years later when all the players and everything else associated with it, has changed. That ‘s simply ludicrous and naive. They must be revisited over and over because they may be true under some circumstances but invalid under other circumstances. Since no one ever knows, when or where a disaster occurs or under what circumstances, assumptions must be challenged, communicated and validated on a regular basis…and quite possibly, new ones developed over time. - See more at:www.diyturnkeycontinuity.com

Author Bio: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

The astonishing piece that is often left out of recovery plans

It’s astonishing in it’s simplicity. The business often gets left out of disaster recovery and the resilience picture. Disaster recovery is the continuity of your information systems but you certainly can’t recreate your business with simply a server. That server has to live somewhere, it needs people to love and care for it and it needs a purpose. Your IT manager cannot determine your purpose. It must be held in the core vision of the organization. Your plan needs the core competencies of your organization – how you create value. This is the deliverable for the Business Impact Analysis process. Don’t leave yours out! - See more at:http://www.dcsplanning.com

Author Bio:

Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management (BCM) with a focus on employees as the company’s greatest asset and human management in continuity.see more at: www.diyturnkeycontinuity.com

Yes, for the next year or two your bank examiner may make the mistake of crediting you for exercising your disaster plan when you documented an actual crisis but let’s take a step back and think about this before we consider it a “win”.

Experiencing a crisis or disruption does not meet the standard for exercising your plan and should not be adequate to count as testing your plan for many reasons. Including:

1. Under best practice continuity management guidelines it is clear that establishing and testing an exercise program is not the same as documenting events that threaten or impact the business. These are two separate best practices.

2. FFIEC examination guidelines state “The board and senior management should establish a testing program appropriate for the size, complexity, and risk profile of the organization and its business lines”. Passively experiencing crisis does not demonstrate a testing program has been established and, no matter what the extent of the crisis, will it be appropriate for the size, complexity and risk profile of the organization. In fact, it may be counter productive and make you look unprepared because you didn’t plan a test.

3. Community banks are likely to have experienced 6-12 crises in a year. What makes this one particularly meaningful? Did you document the other ones? What are your standards for documentation?

4. Test objectives were not set or met (no, “survival” does not count) and only one part of your response plan was tested. The “test” was not comprehensive.

5. Since you weren’t planning to experience this problem, exercise controls were not in place when you had it. You can only manage what you measure.

6. Hypothetically, would you consider going to the emergency room because you thought you might be having a heart attack to be an indicator for your ability to deal with stress? Technically the answer is “Yes”. However, that’s certainly no way to live and if this is your common practice then it indicates you don’t really have a good plan for your health. The same is true for your organization. Why have a heart attack to wait to check and see if your blood pressure is too high? It’s easier to use a blood pressure cuff and check your heart rate.

Let’s speak the truth: This is not the attitude of a healthy, mature business and will not, for much longer, meet requirements for safety and soundness.

Now, before you get frustrated, I realize you don’t want to do continuity management this way. You have a LOT on your plate that you’d rather be getting to (call reports anyone?) and you’re just not sure where to get started. So, DCS has set up some fantastic tools to make planning exercising EASY for you! Get excited now and bookmark this for future reference! First, go ahead and log that problem you had on our FREE Crisis Event Log. It’s got a couple of brief questions to help you get down the information you need to learn from and properly document the problem.

Next, use our FREE Strategic Road Mapto get an idea about what a good, well-rounded financial institution can do on to build operational strength. NO, you don’t have to do that big fail-over test right away. We actually recommend against it. Start drilling the little things first. Can you guarantee that you can contact everyone when they’re not at work? Try your call tree out and write down what happens. That’s a great test!

Another quick tip is to see what your IT provider is doing to test regularly. We often find out the IT department regularly tests failover procedures but rarely documents it adequately for oversight or examination requirements. All you have to do is start documenting! It’s easy! You can do that!

We have also started a new product line: DIY Turnkey Continuity. We’re building very strong key kits for your continuity tool case at affordable prices. We’ve started with a data breach kit and will be releasing an exercise kit before the end of the summer. For our BOL friends, we are looking for pilot users to test these at a discounted rate! Private message me if you’re interested. Also let me know what other kits you’re interested in. Pandemic, social media and vendor managementare on our list for 2013.

I hope these ideas help out. We realize you are doing everything you can to keep compliant and the business moving in a positive direction. Please let us know what else we can do to make your job easier!

For more info please visit:-www.diyturnkeycontinuity.com

#diy turnkey continuity risk assessment key emergency response kit disaster recovery disaster recovery testing compliance bank compliance inc

A Few Thoughts Re: Risk Assessment – Defining An “Acceptable Level” of Risk

Good Morning -Recently, a colleague of mine presented the following question with respect to Risk Management:

“How would you define an “acceptable” level of risk?”

For those individuals interested in this field of study, I thought the below listed explanations and sources of reference content might be helpful.

An acceptable level of risk (sometimes referred to as “Risk Acceptance”) occurs where the organizational management ascertains and determines that the control measures in place are sufficient to address the identified risks (of course, being dependent on the available resources).

For more information please visit:- www.diyturnkeycontinuity.com and www.dcsplanning.com

Not just Surviving – THRIVING!

Continuity management has long been tied to disaster planning and crisis response as fundamental to emergency planning but the reality is: If you’re just practicing business continuity to survive you’re never going to get much out of it.

The key to effective value creation from continuity management is a strategy that builds on how the day-to-day business is designed to create value. Today’s global market puts us all in crisis. Corporate directors are in jail. Cyber terrorists can easily hide across borders around world yet still access information kept locked away. States and countries declare bankruptcy. Instability is everywhere. Businesses are so interdependent on one another that supply chain and technology are complex grey zones of value and accountability. The bottom line is the business needs to create value to survive. Maybe value means money, maybe it’s customer satisfaction or maybe it’s serving its nonprofit goal. Regardless, the creation of that value must be the crux of your resilience plans.

One of the most common misconceptions of business continuity planning is that it starts with a disaster and in a lucky world no one would need a plan. Luck favors the prepared. A business with a healthy continuity management program doesn’t just survive crisis; it thrives daily. The reality of the business world is that every day is more complex and risk loaded. In order to work toward corporate maturity and institutionalization of the systems that create value you have to structure and live your plan.

For more information please visit: www.diyturnkeycontinuity.com and www.dcsplanning.com

Technology at the wheel?

Think again! So many companies these days think it’s a good idea to let technology get behind the wheel of business or business recovery. This is not going to move you forward. Business is about people and systems. If you happen to have a computer to help with one of those systems, fine, but don’t let that computer boss you around and don’t EVER start thinking that computer cares about you or your company. It doesn’t and it never will. Likewise, there’s a strong trend to push business decisions on to the people who care for the computer. They are fantastic people and they help you get what you need. You may even get to feeling like they are indispensable because they are always saying things like, “We are working on that now”. Or they make your iPad work after you screamed at it and threatened to throw it out the window. Your tech team may be working miracles but they still can not run your business. Put them back in their car seat and get back to driving! For more information please visit: www.diyturnkeycontinuity.com and www.dcsplaniing.com

Trending Blogs

Recently Viewed Blogs

DIY Best Practices of business continuity