Talk:Business continuity planning

message: BSI standard 25777:2008 is replaced by ISO 27031:2011 so should reference to that withdrawn standard be removed from the list? I think it causes unnecessary checking for information seekers.
Sohannin (talk) 20:43, 6 March 2012 (UTC)
thread_title:  Withdrawn standard referenced 

message: I raised the following article once before and I believe the current article has addressed all the objection points raised during the first round:
# No references - References Added.
# BCP is not "a methodology to create a manual" - Wording corrected.
# BCP has a lot of overlaps with the risk management process, but this article doesn't even consider that link. - Referenced in the first paragraph, since this is not an article about Risk Management, risk management doesn't need to be explained.
# no examples of BCP in real life. - Added
# No examples of failure of organisations which did not do it and had problems because of it. - Added
# No examples of failures of organisations which did do it. - Added
# no comments on risk acceptance and the impossibility of completely protecting against all disasters.
# extremely focused on small business / office scenario, what about BCP for large factories? Does the BCP methodology not cover that area? - Disagree with this point.  The BCP process is applicable to any type of activity, as long as the organization classifies a non-office function like distribution as "critical".  I think this is clear.
# what about other ways of doing it? - Sorry, there is not other ways of going through a BCP process.  If you bypass the process (or a phase in the process), your plan will stink....
# please add copyright notice to your diagram. - Done
# please add comparison to methodologies used in Japan and Taiwan where a disaster like 9/11 is considered relatively small and massive earthquakes are expected to be handled effectively. - BCP process is the same regardless of the location or the threat!
# please consider linking citations - Added.
Let’s see what the second round turns up.  Please review for featured article status Revmachine21 12:42, 30 Apr 2005 (UTC)
thread_title:  Most recent FAC 

message: Can I make a few comments on the article introduction?
This article is redirected from Business Continuity Management and the terms are largely interchangeable. I actually think management is a better reflection of what actually happens, the word planning assumes never actually doing. Would it be appropriate to mention the fact that the two terms are commonly interchanged.
It is not necessarily a peer mentored process, why is this one in
It does not produce a plan but a capability. This seems to reflect that the whole point of BCP is to create a plan
The aim should be to recover some or all of an organisations processes but critically, and this is not mentioned, to a pre agreed level. It is not about business as usual but getting to an agreed level within a target time
It does seem to be UK centric with no mention in the introduction of other standards such as the North American NFPA 1600, Australian HB292/3 and ISO/PAS 22399. Also not sure what the Civil Contingencies Act in the UK has much to do with the subject.
Prior to the introduction of BS25999 BCM professionals did not have to rely on BS7799 as stated in the article. BS7799 and its subsequent revisions is an Information Security Management standard that includes a section on business continuity. One of the three pillars of information security management is availability. This is obviously relevant but there were other documents that BCM professionals could use including PAS56 (a fore runner of BS25999), earlier versions of NFPA1600, earlier versions of HB292/3 and the various generally accepted practice documents produced by the BCI and DRI
Would it be appropriate and accepted to make some changes based on these observations?  —Preceding unsigned comment added by Samsungjohnny (talk • contribs) 15:13, 13 January 2008 (UTC)
replies: text:  The topic of the page is Business Continuity Planning. It is thus preferable not to over-develop tangental aspects. Equally, not use additional material to place links to your own site.   —Preceding unsigned comment added by 66.84.37.52 (talk) 15:52, 13 January 2008 (UTC)
replies: text:  Change of content for an established page like this should be evolutionary and built upon long term consensus. Radical change, is not required. Previous edits illustrate my concern. 66.84.37.52 (talk) 19:57, 13 January 2008 (UTC)
thread_title: Article Introduction

message: BCP methodology is scalable for an organization of any size and complexity.  Even though the methodology has roots in regulated industries, any type of organization may create a BCP manual, and arguably every organization should have one in order to ensure the organization's longevity.  Evidence that firms do not invest enough time and resources into BCP preparations are evident in disaster survival statistics.  Fires permanently close 44% of the business affected .  In the 1993 World Trade Center bombing, 150 businesses out of 350 affected failed to survive the event.  Conversely, the firms affected by the Sept 11 attacks with well-developed and tested BCP manuals were back in business within days .
A BCP manual for a small organization may be simply a printed manual stored safely away from the primary work location, containing the names, addresses, and phone numbers for crisis management staff, general staff members, clients, and vendors along with the location of the offsite data backup storage media, copies of insurance contracts, and other critical materials necessary for organizational survival.  At its most complex, a BCP manual may outline a secondary work site, technical requirements and readiness, regulatory reporting requirements, work recovery measures, the means to reestablish physical records, the means to establish a new supply chain, or the means to establish new production centers.  Firms should ensure that their BCP manual is realistic and easy to use during a crisis. As such, BCP sits along side crisis management and disaster recovery planning and is a part of an organization's overall risk management.
The development of a BCP manual has five main phases: analysis, solution design, implementation, testing and organization acceptance, and maintenance.
Much of the BCP material on the internet is sponsored by consultancies who offer fee-based services for BCP solution development, however basic tutorials are freely available on the internet for properly motivated organizations .
From reading this it seems that the whole point of BCP is to produce a manual. This is not the case at all. It is to produce an ongoing capability and changes with the organisation and its goals and resources.
It also defines the BIA process in rather prescriptive terms. A BIA can and should be suitable for the organisation not following the defined zones as described here
The description about BCP post Y2K and post the 9/11 attacks are extremely US focussed. The UK, which has experienced 30 odd years of Northern Irish terrorism has developed arguably the most mature BCP capabilities precisely because of it.
The various standards and accepted best practice guidelines from various public and private sector organisations seek to promote BCP so that organisations are not compelled to seek third party consultants
The main area of concern I have for this section though is the concentration on producing a BC Manual
Samsungjohnny (talk) 21:32, 13 January 2008 (UTC)
thread_title:  Introduction 

message: The analysis phase in the development of a BCP manual consists of an impact analysis, threat analysis, and impact scenarios with the resulting BCP plan requirement documentation.
=== Impact analysis ===
An impact analysis results in the differentiation between critical and non-critical organization functions.  A function may be considered critical if the implications for stakeholders of damage to the organization resulting are regarded as unacceptable. Perceptions of the acceptability of disruption may be modified by the cost of establishing and maintaining appropriate business or technical recovery solutions.  A function may also be considered critical if dictated by law.  Next, the impact analysis results in the recovery requirements for each critical function.  Recovery requirements consist of the following information:
* The time frame in which the critical function must be resumed after the disaster
* The business requirements for recovery of the critical function, and/or
* The technical requirements for recovery of the critical function
=== Threat analysis ===
After defining recovery requirements, documenting potential threats is recommended to detail a specific disaster’s unique recovery steps.  Some common threats include the following:
* Disease 
* Earthquake 
* Fire
* Flood 
* Cyber attack
* Hurricane 
* Utility outage 
* Terrorism 
All threats in the examples above share a common impact - the potential of damage to organizational infrastructure - except one (disease).  The impact of diseases is initially purely human, and may be alleviated with technical and business solutions.  During the 2002-2003 SARS outbreak, some organizations grouped staff into separate teams, and rotated the teams between the primary and secondary work sites, with a rotation frequency equal to the incubation period of the disease.  The organizations also banned face-to-face contact between opposing team members during business and non-business hours.  With such a split, organizations increased their resiliency against the threat of government-ordered quarantine measures if one person in a team contracted or was exposed to the disease .  Damage from flooding also has a unique characteristic. If an office environment is flooded with non-salinated and contamination-free water (e.g.m, in the event of a pipe burst), equipment can be thoroughly dried and may still be functional.
: I added some more to the article (such as random failure of mission critical systems), but I also think "Terrorism" should be removed.   Loss of Confidentiality (or theft), Availability, or Integrity of critical information or material, or loss of mission critical functionality is the goal of any attacker - terrorist, hacker, or Other.   I see no difference between a Terrorist and and Insider intend to do the same damage (sabotoge or other forms).   I suggest simply the introduction of an internal or external threat entity.--74.107.74.39 (talk) 23:50, 26 March 2011 (UTC)
thread_title:  Analysis 

message: After defining recovery requirements, documenting potential threats is recommended to detail a specific disaster’s unique recovery steps.  Some common threats include the following:
* Disease 
* Earthquake 
* Fire
* Flood 
* Cyber attack
* Hurricane 
* Utility outage 
* Terrorism 
All threats in the examples above share a common impact - the potential of damage to organizational infrastructure - except one (disease).  The impact of diseases is initially purely human, and may be alleviated with technical and business solutions.  During the 2002-2003 SARS outbreak, some organizations grouped staff into separate teams, and rotated the teams between the primary and secondary work sites, with a rotation frequency equal to the incubation period of the disease.  The organizations also banned face-to-face contact between opposing team members during business and non-business hours.  With such a split, organizations increased their resiliency against the threat of government-ordered quarantine measures if one person in a team contracted or was exposed to the disease .  Damage from flooding also has a unique characteristic. If an office environment is flooded with non-salinated and contamination-free water (e.g.m, in the event of a pipe burst), equipment can be thoroughly dried and may still be functional.
: I added some more to the article (such as random failure of mission critical systems), but I also think "Terrorism" should be removed.   Loss of Confidentiality (or theft), Availability, or Integrity of critical information or material, or loss of mission critical functionality is the goal of any attacker - terrorist, hacker, or Other.   I see no difference between a Terrorist and and Insider intend to do the same damage (sabotoge or other forms).   I suggest simply the introduction of an internal or external threat entity.--74.107.74.39 (talk) 23:50, 26 March 2011 (UTC)
thread_title:  Threat analysis 

message: Maintenance of a BCP manual is broken down into three periodic activities.  The first activity is the confirmation of information in the manual.  The second activity is the testing and verification of technical solutions established for recovery operations.  The third activity is the testing and verification of documented organization recovery procedures.  A biannual or annual maintenance cycle is typical.
=== Information update and testing ===
All organizations change over time, therefore a BCP manual must change to stay relevant to the organization.  Once data accuracy is verified, normally a call tree test is conducted to evaluate the notification plan's efficiency as well as the accuracy of the contact data.  Some types of changes that should be identified and updated in the manual include:
* Staffing changes
* Staffing persona
* Changes to important clients and their contact details
* Changes to important vendors/suppliers and their contact details
* Departmental changes like new, closed or fundamentally changed departments.
=== Testing and verification of technical solutions ===
As a part of ongoing maintenance, any specialized technical deployments must be checked for functionality.  Some checks include:
* Virus definition distribution
* Application security and service patch distribution
* Hardware operability check
* Application operability check
* Data verification
=== Testing and verification of organization recovery procedures ===
As work processes change over time, the previously documented organizational recovery procedures may no longer be suitable.  Some checks include:
* Are all work processes for critical functions documented?
* Have the systems used in the execution of critical functions changed?
* Are the documented work checklists meaningful and accurate for staff?
* Do the documented work process recovery tasks and supporting disaster recovery infrastructure allow staff to recover within the predetermined recovery time objective?
=== Treatment of test failures ===
As suggested by the diagram included in this article, there is a direct relationship between the test and maintenance phases and the impact phase.  When establishing a BCP manual and recovery infrastructure from scratch, issues found during the testing phase often must be reintroduced to the analysis phase.
:-- 66.45.145.191 13:22, 26 October 2006 (UTC)
thread_title:  Maintenance 

message: As suggested by the diagram included in this article, there is a direct relationship between the test and maintenance phases and the impact phase.  When establishing a BCP manual and recovery infrastructure from scratch, issues found during the testing phase often must be reintroduced to the analysis phase.
:-- 66.45.145.191 13:22, 26 October 2006 (UTC)
thread_title:  Treatment of test failures 

message: Please explain the addition of this descriptor to the introductory image?  I certainly did not have 'managing collaborative groups' in mind when I created the image.  When looking at the wikilink to the MCG outine, nothing particularly jumped out at me to indicate why MCG had any relevance to BCP or the planning process.  Please explain your reasoning.  Thanks in advance. P.S.  Some of the recent changes are quite nice additions. Revmachine21 10:48, 10 December 2006 (UTC)
replies: text: Repeat request for clarification... otherwise I'm deleting the text.  Revmachine21 02:15, 24 March 2007 (UTC)
thread_title: Managing collaborative groups

message: The Intro paragraph grew (in a good way from an information standpoint) and got clunky.  Let's be more careful from a style perspective when editing!  The Introduction section has been expanded with materials moved out of first paragraph.  IMO, the Intro section needs more work.  I will do what I can but request collaboration from those other Wikipedian's monitoring this page.  Revmachine21 01:40, 24 March 2007 (UTC)
thread_title:  Exercising care developing the first paragraph & first section 

message: BCP is more than recovery from disasters: fire, flood, earthquake and/or pandemics.  BCP is a plan to handle all of the bumps thrown at a business: competitive price drops, worker strikes, increased minimum wage etc....  The data on this page is good, but it seems to be excessively focused on the DRP side of BCP (and the DRP page is lacking much of this material).  Maybe this could be refocused in the future? Iam.the.Unkn0wn1 4:28, 18 July 2007 (UTC)
thread_title:  Slightly expanded view of BCP 

message: I would suggest that the author of this fine article consider adding comments regarding NFPA 1600 to the standards discussion.  As it stands now, readers will assume that the only BCP standard that exists is BS25999, which is used primarily in the UK.  In the U.S., the predominant standard is NFPA 1600, and I believe it deserves equal attention.
--MJKuras 18:38, 13 December 2007 (UTC)
thread_title:  Comment on section regarding BCP Standards 

message: I removed the link to a standards purchase site, standardsdirect.org. See Wikipedia talk:WikiProject Spam#StandardsDirect.org for more about this site. As I see it, Wikipedia is not a directory and we're not here to help people sell things. Most of these standardsdirect.org links have been added by single purpose accounts who likely have a conflict of interest. See:
*Conflict of Interest Guideline
*What Wikipedia is Not Policy
*External Links Guideline
*Spam Guideline
If an established, high-volume editor wants to add it back to the article, by all means go ahead. Otherwise, it stays out pending resolution at the spam discussion link above. --A. B. (talk •  contribs)  00:43, 23 October 2008 (UTC)
thread_title: StandardsDirect.org

message: The standard provides a best practice framework to minimize disruption and maximize recovery time
Excuse me, could somebody explain me in a sentence, why a long recovery time is better than a short one? If I were a company, I would maximize recovery speed or minimize recovery time.--Kifo (talk) 10:24, 12 July 2013 (UTC)
replies: text: I agree. Seems the entire phrase doesn't belong there. Removing it........ My name is Mercy11 (talk) 02:25, 13 July 2013 (UTC)
thread_title:  Maximize what? 

message: This article does not really discuss business continuity planning, but almost exclusively the subset of it that is disaster recovery, and indeed primarily only with reference to natural disasters, rather than collapsing and needing to be recovered.
The fundamental goal of business continuity planning is assurance of resilience so that business continues to operate in the face of incidents. This point is so fundamental I'm amazed it has been omitted by the authors of this article.
212.159.59.5 (talk) 10:51, 27 August 2014 (UTC)
thread_title:  Title and content as a whole 

message: Hello fellow Wikipedians,
I have just modified  on Business continuity planning. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20060810074640/http://www.fema.gov:80/business/bc.shtm to http://www.fema.gov/business/bc.shtm
*Added archive https://web.archive.org/web/20130513081920/http://www.nfpa.org/assets/files//PDF/Research/RFLithiumIonBatteriesHazard.pdf to http://www.nfpa.org/assets/files/
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—InternetArchiveBot (Report bug) 07:39, 11 November 2016 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Business continuity planning. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20160303224604/http://www.virtualdcs.co.uk/blog/business-continuity-planning-rpo-and-rto.html to http://www.virtualdcs.co.uk/blog/business-continuity-planning-rpo-and-rto.html
*Corrected formatting/usage for http://www.fema.gov/business/bc.shtm
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 08:44, 27 July 2017 (UTC)
thread_title:  External links modified 

message: X Xkxjxjx02 (talk) 12:15, 23 March 2019 (UTC)
thread_title:  X 

message: Others have noted there's an overemphasis on IT in the article.
What specifically about the continuity of relationships - for example, if the company should go out of business, there may need to be a plan for customers to be serviced (or records retained) by a designated alternate entity. I think this type of continuity setup is common in the Accounting world for instance. 
DouglasHeld (talk) 10:00, 10 August 2022 (UTC)
thread_title:  Relationships and Entities