Evaluation of emergency plans

Introduction

A contingency plan is a management instrument for the management of Information and Communications Technologies in the domain of support and performance (delivery and support, see ITIL).

This plan contains the technical, human and organizational measures necessary to guarantee the continuity of the business and operations of a company or organization. A contingency plan is a particular case of a business continuity plan applied to the IT or technology department. Other departments may have continuity plans that pursue the same objective from another point of view. However, given the importance of technologies in modern organizations, the contingency plan is the most relevant.

The backup plan is used to bring one or more damaged computers to full performance.

PDCA cycle

The contingency plan follows the well-known PDCA iterative life cycle (plan-do-check-act, that is, plan-do-check-act). It is born from a risk analysis where, among many threats, those that affect business continuity are identified.

On this basis, the most appropriate countermeasures are selected among different alternatives,

being reflected in the contingency plan along with the necessary resources to implement it.

The plan must be reviewed periodically. Generally, the review will be a consequence of a new risk analysis.

In any case, the contingency plan is always questioned when a threat materializes, acting as follows:

• - If the threat was foreseen and the countermeasures were effective: only minor aspects of the plan are corrected to improve efficiency.

• - If the threat was foreseen but the countermeasures were ineffective: the cause of the failure must be analyzed and new countermeasures proposed.

• - If the threat was not foreseen: a new risk analysis must be promoted. It is possible that the countermeasures adopted were effective against an unforeseen threat. However, this is no excuse to avoid analyzing what happened on a team.

Content

The contingency plan includes three subplans. Each plan determines the necessary countermeasures at each moment in time regarding the materialization of any threat:

Evaluation of emergency plans

Introduction

A contingency plan is a management instrument for the management of Information and Communications Technologies in the domain of support and performance (delivery and support, see ITIL).

The backup plan is used to bring one or more damaged computers to full performance.

PDCA cycle

On this basis, the most appropriate countermeasures are selected among different alternatives,

being reflected in the contingency plan along with the necessary resources to implement it.

The plan must be reviewed periodically. Generally, the review will be a consequence of a new risk analysis.

In any case, the contingency plan is always questioned when a threat materializes, acting as follows:

• - If the threat was foreseen and the countermeasures were effective: only minor aspects of the plan are corrected to improve efficiency.

• - If the threat was foreseen but the countermeasures were ineffective: the cause of the failure must be analyzed and new countermeasures proposed.

Example

This example is by no means exhaustive. Let's assume a small company that is dedicated to the production of textile garments. A risk analysis would identify (among other things) the following:.

Assets and interdependencies: Headquarters → Data processing center → Computers and storage → Order and billing information → Sales business process → Corporate image.

This analysis shows that a threat that materializes in the headquarters could affect the business process dedicated to the sale. Although this does not prevent the company from continuing to market products, it would mean a temporary interruption in sales. Furthermore, it would negatively affect the corporate image, causing the loss of customers.

Thus, the following threat and its impact would be evaluated:

Threat: Fire. (the affected assets are previous and future ones).

Impact: (this is a fictitious example).

• - Loss of 10% of clients.

• - Impossibility of billing for a month.

• - Inability to accept orders for one month.

• - Manual reconstruction of orders and invoices from other sources.

• - Penalties for work accidents.

• - Investments in equipment and furniture.

• - Rehabilitation of the premises.

All these consequences can be valued in monetary terms, which together with the probability of materialization offer an estimate of the risk.

The contingency plan would briefly contain the following countermeasures:

• - Technical measures:

Fire extinguishers.

Smoke detectors.

Emergency exits.

Backup computer equipment.

• - Organizational measures:

Fire insurance.

Pre-contract for rental of computer equipment and alternative location.

Backup procedure.

Procedure for action in case of fire.

Hiring an occupational risk audit service.

• - Human measurements:

Training to act in case of fire.

Designation of a room manager.

Assignment of roles and responsibilities for backup.

(Etc.).

The subplans would contain the following provisions:

• - Backup plan:

Review of fire extinguishers.

Fire drills.

Making backup copies.

Custody of backup copies (for example, in a bank safe deposit box).

Review of backup copies.

• - Emergency plan:

Activation of the pre-contract for the rental of computer equipment.

Restoration of backup copies.

Resumption of activity.

• - Recovery plan:

Damage assessment.

Transfer of data from the emergency location to the usual one.

Resumption of activity.

Deactivation of the pre-rental contract.

Claims to the insurance company.

Example

This example is by no means exhaustive. Let's assume a small company that is dedicated to the production of textile garments. A risk analysis would identify (among other things) the following:.

Assets and interdependencies: Headquarters → Data processing center → Computers and storage → Order and billing information → Sales business process → Corporate image.

Thus, the following threat and its impact would be evaluated:

Threat: Fire. (the affected assets are previous and future ones).

Impact: (this is a fictitious example).

• - Loss of 10% of clients.

• - Impossibility of billing for a month.

• - Inability to accept orders for one month.

• - Manual reconstruction of orders and invoices from other sources.

• - Penalties for work accidents.

• - Investments in equipment and furniture.

• - Rehabilitation of the premises.

All these consequences can be valued in monetary terms, which together with the probability of materialization offer an estimate of the risk.

The contingency plan would briefly contain the following countermeasures:

• - Technical measures:

Fire extinguishers.

Smoke detectors.

Emergency exits.

Backup computer equipment.

• - Organizational measures:

Fire insurance.

Pre-contract for rental of computer equipment and alternative location.

Backup procedure.

Procedure for action in case of fire.

Hiring an occupational risk audit service.

• - Human measurements:

Training to act in case of fire.

Designation of a room manager.

Assignment of roles and responsibilities for backup.

(Etc.).

The subplans would contain the following provisions:

• - Backup plan:

Review of fire extinguishers.

Fire drills.

Making backup copies.

Custody of backup copies (for example, in a bank safe deposit box).

Review of backup copies.

• - Emergency plan:

Activation of the pre-contract for the rental of computer equipment.

Restoration of backup copies.

Resumption of activity.

• - Recovery plan:

Damage assessment.

Transfer of data from the emergency location to the usual one.

Resumption of activity.

Deactivation of the pre-rental contract.

Claims to the insurance company.

Navegación

Evaluation of emergency plans

Introduction

PDCA cycle

Content

Evaluation of emergency plans

Introduction

PDCA cycle

Example

References

Content

Example

References