Business Continuity

This book is a guide to implementation of World-Class Business Continuity Management within an enterprise. It may be used as a step-by-step guide by those new to Business Continuity Management or dipped into by the more seasoned professional for ideas and updates on specific topics.

There is no absolute "right way" to perform business continuity management - although there are plenty of wrong ways. Business Continuity is not rocket science: it is applied common sense. Yes, experience helps, but it is no mystic art. This book makes the processes transparent and provide the reader with everything necessary to do the job.

Many examples are provided throughout this guide: these all have their roots in real cases and real organizations, and come heavily laden with pragmatism. Over fifteen years of business continuity experience in environments large and small, public and private, has gone into developing the methods described. Your own "right way" for business continuity management means picking, matching and tailoring from the cases and examples provided and combining these with existing best practice within your organization.

EXCERPT FROM THE PREFACE
Melvyn Musson, FBCI, CBCP, CISSP

I was very pleased to be asked to write a preface to this much-needed book. There are many books that have been written covering various aspects of hazard control, emergency response, disaster recovery and business continuity, but not one that pulls all areas together under the auspices of the individual sections of the BCI and DRII Professional Practices.

Why my interest? To quote from a letter I wrote to the National Fire Protection Association (NFPA) in 1991 when they were considering the establishment of a Technical Committee to develop a Standard on Disaster Management:

"Disaster Management, or Business Continuation Planning as we prefer to call it, is a natural progression from Hazard/Loss Control through Emergency Response to the recovery process.

"The best hazard/loss control programs cannot prevent emergency or catastrophic situations occurring. The emergency response procedures that most companies have developed or which may be required by law, deal with such aspects as initial fire fighting, evacuation, life safety, etc. - what one might term the stabilization of the situation. They cover the first hours of the emergency. They do not deal with the long-term recovery, which could take several months.

"Disaster Management, or some other similarly named program, is needed to enable the company to institute procedures to return to normal operations as soon as possible.

That standard is now available as NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. Within that standard are details of the BCI/DRII Professional Practices, albeit as part of the various sections of the standard and not as an individual, specific section.

In addition to NFPA 1600, other standards and guides such as BS7779 in Great Britain and the recent...