1 1 00:00:00,210 --> 00:00:01,740 In this lesson, we're going to talk 2 2 00:00:01,740 --> 00:00:05,130 about your business continuity plan, or BCP. 3 3 00:00:05,130 --> 00:00:06,690 Now, business continuity planning 4 4 00:00:06,690 --> 00:00:09,120 or the creation of your business continuity plan 5 5 00:00:09,120 --> 00:00:10,830 is going to ensure that the organization 6 6 00:00:10,830 --> 00:00:14,130 is able to recover from a disruptive event or a disaster. 7 7 00:00:14,130 --> 00:00:16,860 This is a specialized field within an organization, 8 8 00:00:16,860 --> 00:00:19,080 one which takes a lot of planning and forethought 9 9 00:00:19,080 --> 00:00:20,910 to keep the organization running smoothly 10 10 00:00:20,910 --> 00:00:22,560 during an event or incident. 11 11 00:00:22,560 --> 00:00:23,910 Now, there are two major terms 12 12 00:00:23,910 --> 00:00:26,040 associated with business continuity planning. 13 13 00:00:26,040 --> 00:00:27,960 The first is business continuity planning 14 14 00:00:27,960 --> 00:00:30,030 or the business continuity plan itself. 15 15 00:00:30,030 --> 00:00:32,340 This refers to the plans and processes used 16 16 00:00:32,340 --> 00:00:34,740 for your response to a disruptive event. 17 17 00:00:34,740 --> 00:00:38,310 Now, the second is a disaster recovery plan, or DRP. 18 18 00:00:38,310 --> 00:00:40,770 This refers specifically to plans and processes 19 19 00:00:40,770 --> 00:00:42,720 that are used during a disaster. 20 20 00:00:42,720 --> 00:00:44,160 Now, the disaster recovery plan 21 21 00:00:44,160 --> 00:00:45,840 usually is going to be considered a subset 22 22 00:00:45,840 --> 00:00:48,390 of a more complete business continuity plan. 23 23 00:00:48,390 --> 00:00:50,220 When you think about a BCP, 24 24 00:00:50,220 --> 00:00:52,680 this is a plan that's used for any disruptive event 25 25 00:00:52,680 --> 00:00:54,930 or any response to any kind of threat. 26 26 00:00:54,930 --> 00:00:56,670 Now, for example, what will you do 27 27 00:00:56,670 --> 00:00:58,200 if your domain controller falls victim 28 28 00:00:58,200 --> 00:00:59,280 to a ransomware attack 29 29 00:00:59,280 --> 00:01:01,980 and all your users can no longer log into the network? 30 30 00:01:01,980 --> 00:01:03,930 Well, this would be a disruptive incident 31 31 00:01:03,930 --> 00:01:06,690 and it might activate not only your incident response plans, 32 32 00:01:06,690 --> 00:01:08,880 but also your business continuity plans. 33 33 00:01:08,880 --> 00:01:10,650 That's what we're talking about here. 34 34 00:01:10,650 --> 00:01:12,780 Your business continuity plans are all about creating 35 35 00:01:12,780 --> 00:01:15,450 a system of preventative actions and recovery steps 36 36 00:01:15,450 --> 00:01:17,610 in response to threats that could materialize 37 37 00:01:17,610 --> 00:01:19,260 and disrupt your business. 38 38 00:01:19,260 --> 00:01:22,590 Now, your BCP may also cover your non-IT things 39 39 00:01:22,590 --> 00:01:24,150 that could disrupt your businesses. 40 40 00:01:24,150 --> 00:01:26,610 For example, in my business, we rely heavily 41 41 00:01:26,610 --> 00:01:28,950 on our ability to take credit card payments online 42 42 00:01:28,950 --> 00:01:30,060 from our students. 43 43 00:01:30,060 --> 00:01:32,490 So if a merchant processing account was going to be canceled 44 44 00:01:32,490 --> 00:01:33,360 for some reason, 45 45 00:01:33,360 --> 00:01:35,280 this would affect our ability to take payments 46 46 00:01:35,280 --> 00:01:36,570 from all of our students, 47 47 00:01:36,570 --> 00:01:38,970 that would have a major issue for our company. 48 48 00:01:38,970 --> 00:01:40,980 So as part of our BCP, 49 49 00:01:40,980 --> 00:01:42,900 we discuss how we're going to immediately switch 50 50 00:01:42,900 --> 00:01:44,730 to our backup credit card processor 51 51 00:01:44,730 --> 00:01:46,710 so we can continue our business operations 52 52 00:01:46,710 --> 00:01:47,820 and simultaneously work 53 53 00:01:47,820 --> 00:01:49,560 with our primary credit card processor 54 54 00:01:49,560 --> 00:01:52,650 to get them back online again and get our cards going. 55 55 00:01:52,650 --> 00:01:54,960 Now, if our primary processor can't get us back online 56 56 00:01:54,960 --> 00:01:57,180 within X number of days, where are they going to shift 57 57 00:01:57,180 --> 00:01:59,100 to a tertiary contract that we have set up 58 58 00:01:59,100 --> 00:02:01,650 that will allow us to continue operations indefinitely, 59 59 00:02:01,650 --> 00:02:03,420 even though that tertiary processor 60 60 00:02:03,420 --> 00:02:06,330 may charge us more for each processing transaction. 61 61 00:02:06,330 --> 00:02:08,190 This is the basis of a BCP. 62 62 00:02:08,190 --> 00:02:11,400 You plan for your primary, secondary, and tertiary actions 63 63 00:02:11,400 --> 00:02:13,620 as you want to continue your business operations. 64 64 00:02:13,620 --> 00:02:16,110 Now, another example I saw in a previous organization 65 65 00:02:16,110 --> 00:02:17,670 was focused on what they would do 66 66 00:02:17,670 --> 00:02:19,560 if there was protests in the streets. 67 67 00:02:19,560 --> 00:02:21,270 Now, this was an IT organization 68 68 00:02:21,270 --> 00:02:22,860 and it may seem kind of weird to you, 69 69 00:02:22,860 --> 00:02:24,870 but their headquarters was actually located 70 70 00:02:24,870 --> 00:02:26,550 near a major American city. 71 71 00:02:26,550 --> 00:02:28,890 Now, when there was protests and riots in that city, 72 72 00:02:28,890 --> 00:02:30,000 it disrupted their business 73 73 00:02:30,000 --> 00:02:31,980 because their employees couldn't get to the headquarters 74 74 00:02:31,980 --> 00:02:33,390 to go do their jobs. 75 75 00:02:33,390 --> 00:02:35,670 Now, this was because the streets started getting barricade 76 76 00:02:35,670 --> 00:02:37,740 either by the protestors trying to make a point 77 77 00:02:37,740 --> 00:02:40,440 or the police trying to hold back the rioters. 78 78 00:02:40,440 --> 00:02:42,180 After that incident, the company learned 79 79 00:02:42,180 --> 00:02:43,590 that they needed to have a backup plan 80 80 00:02:43,590 --> 00:02:45,480 for how they're going to keep their operations running 81 81 00:02:45,480 --> 00:02:46,530 all the time 82 82 00:02:46,530 --> 00:02:49,290 even if they can't get people physically into the office. 83 83 00:02:49,290 --> 00:02:50,940 Now, we just spent a little bit of time 84 84 00:02:50,940 --> 00:02:53,610 talking about the basic idea of a BCP, 85 85 00:02:53,610 --> 00:02:56,430 but let's touch on the concept of a DRP as well. 86 86 00:02:56,430 --> 00:02:59,010 Now, a DRP is your disaster recovery plan, 87 87 00:02:59,010 --> 00:03:01,950 and these are a subset of your business continuity plans. 88 88 00:03:01,950 --> 00:03:05,280 It's going to focus on disruptive events just like a BCP would, 89 89 00:03:05,280 --> 00:03:08,940 but it focuses specifically on how to resume more quickly 90 90 00:03:08,940 --> 00:03:10,710 after you have a disaster. 91 91 00:03:10,710 --> 00:03:13,560 For example, my offices are located in Puerto Rico, 92 92 00:03:13,560 --> 00:03:15,450 which is very likely to suffer from hurricanes 93 93 00:03:15,450 --> 00:03:18,480 and earthquakes because of its location in the Caribbean. 94 94 00:03:18,480 --> 00:03:21,090 Now, our BCP contains a DRP portion 95 95 00:03:21,090 --> 00:03:22,770 that's focused on our response actions 96 96 00:03:22,770 --> 00:03:24,150 for both of those things. 97 97 00:03:24,150 --> 00:03:25,590 So if we have a hurricane, 98 98 00:03:25,590 --> 00:03:28,080 how can we keep our offices open and our servers online 99 99 00:03:28,080 --> 00:03:30,210 24 hours a day, seven days a week? 100 100 00:03:30,210 --> 00:03:32,850 And if we can't, what are we going to do in response to that? 101 101 00:03:32,850 --> 00:03:34,350 What are we going to do if there's an earthquake, 102 102 00:03:34,350 --> 00:03:36,930 a fire, a flood, or another disaster? 103 103 00:03:36,930 --> 00:03:39,330 All of those things are things we have to think about. 104 104 00:03:39,330 --> 00:03:42,090 For example, when we did our risk management analysis, 105 105 00:03:42,090 --> 00:03:43,410 we determined it was too risky 106 106 00:03:43,410 --> 00:03:45,540 to host our servers within Puerto Rico 107 107 00:03:45,540 --> 00:03:47,070 because we have a threat of power losses 108 108 00:03:47,070 --> 00:03:48,270 because of hurricanes. 109 109 00:03:48,270 --> 00:03:51,330 So we instead built our entire backend infrastructure 110 110 00:03:51,330 --> 00:03:54,240 in the cloud, and we use AWS and Google Cloud. 111 111 00:03:54,240 --> 00:03:57,000 That way, even if we have a severe disaster in Puerto Rico, 112 112 00:03:57,000 --> 00:03:59,040 our operations could continue on. 113 113 00:03:59,040 --> 00:04:00,900 Another thing we did is we split our staff 114 114 00:04:00,900 --> 00:04:04,020 across multiple locations, both within Puerto Rico 115 115 00:04:04,020 --> 00:04:06,390 and in a few other locations around the world. 116 116 00:04:06,390 --> 00:04:09,180 For example, my student success team is split evenly 117 117 00:04:09,180 --> 00:04:11,280 between Puerto Rico and the Philippines. 118 118 00:04:11,280 --> 00:04:12,960 When there's power averages in Puerto Rico, 119 119 00:04:12,960 --> 00:04:15,000 the Philippines team takes over operations 120 120 00:04:15,000 --> 00:04:16,230 and continues to work to make sure 121 121 00:04:16,230 --> 00:04:17,610 students are taken care of. 122 122 00:04:17,610 --> 00:04:19,590 Similarly, we've had floods in recent years 123 123 00:04:19,590 --> 00:04:20,640 over in the Philippines, 124 124 00:04:20,640 --> 00:04:22,260 and our Puerto Rico team had to step up 125 125 00:04:22,260 --> 00:04:23,730 and cover for the Philippines team 126 126 00:04:23,730 --> 00:04:26,070 because the Philippines team couldn't get to work. 127 127 00:04:26,070 --> 00:04:28,320 Now, this way, we can continue our operations 128 128 00:04:28,320 --> 00:04:30,300 even in the face of these disasters. 129 129 00:04:30,300 --> 00:04:31,830 So now that we've covered the differences 130 130 00:04:31,830 --> 00:04:34,380 between a BCP and the DRP it contains, 131 131 00:04:34,380 --> 00:04:35,640 for the rest of the section, 132 132 00:04:35,640 --> 00:04:38,070 I'm only going to refer to the business continuity plan, 133 133 00:04:38,070 --> 00:04:39,570 but when I do, remember, 134 134 00:04:39,570 --> 00:04:43,260 I'm referring equally to the BCP and the DRP it contains 135 135 00:04:43,260 --> 00:04:44,640 because the only real difference 136 136 00:04:44,640 --> 00:04:46,500 is the type of event you're responding to. 137 137 00:04:46,500 --> 00:04:49,110 Is it an incident or is it a disaster? 138 138 00:04:49,110 --> 00:04:51,480 Now, the development of your business continuity plan 139 139 00:04:51,480 --> 00:04:53,490 is the responsibility of the senior managers 140 140 00:04:53,490 --> 00:04:54,960 within your organization. 141 141 00:04:54,960 --> 00:04:56,880 It's really up to them to drive this effort 142 142 00:04:56,880 --> 00:04:58,410 and ensure it's done properly. 143 143 00:04:58,410 --> 00:04:59,550 Without their support 144 144 00:04:59,550 --> 00:05:02,880 the BCP development is going to certainly stall out and fail. 145 145 00:05:02,880 --> 00:05:04,650 For this reason, it is the responsibility 146 146 00:05:04,650 --> 00:05:06,390 of senior management to set goals 147 147 00:05:06,390 --> 00:05:09,150 for the business continuity and disaster recovery efforts. 148 148 00:05:09,150 --> 00:05:10,380 Under senior management, 149 149 00:05:10,380 --> 00:05:12,930 a business continuity coordinator is going to be appointed 150 150 00:05:12,930 --> 00:05:15,450 and they're going to lead the business continuity committee. 151 151 00:05:15,450 --> 00:05:17,010 This committee should have representatives 152 152 00:05:17,010 --> 00:05:19,440 from different departments across the organization, 153 153 00:05:19,440 --> 00:05:22,590 from IT, legal, security and communications, 154 154 00:05:22,590 --> 00:05:23,760 just to name a few. 155 155 00:05:23,760 --> 00:05:26,670 This should not just be the IT people doing this thing. 156 156 00:05:26,670 --> 00:05:28,440 We all need to work together. 157 157 00:05:28,440 --> 00:05:29,460 This committee is going to work 158 158 00:05:29,460 --> 00:05:30,960 to determine the recovery priorities 159 159 00:05:30,960 --> 00:05:33,120 for the different types of events that may occur 160 160 00:05:33,120 --> 00:05:34,410 whether they're disruptive, 161 161 00:05:34,410 --> 00:05:36,030 and they're going to be covered by the BCP, 162 162 00:05:36,030 --> 00:05:38,640 or a disaster, covered by our DRP. 163 163 00:05:38,640 --> 00:05:40,650 This committee is also going to seek to identify 164 164 00:05:40,650 --> 00:05:43,560 and prioritize all of our systems that we need to support 165 165 00:05:43,560 --> 00:05:45,330 for the continuity of the business, 166 166 00:05:45,330 --> 00:05:48,210 and then they report that back to senior management. 167 167 00:05:48,210 --> 00:05:50,760 Now, another key part of a good business continuity plan 168 168 00:05:50,760 --> 00:05:52,950 is defining the scope of the plan itself. 169 169 00:05:52,950 --> 00:05:55,290 Otherwise, you may face scope creep. 170 170 00:05:55,290 --> 00:05:57,780 Again, this is a job for senior management 171 171 00:05:57,780 --> 00:05:59,580 because they need to determine the level of risk 172 172 00:05:59,580 --> 00:06:00,780 they're willing to accept 173 173 00:06:00,780 --> 00:06:02,610 based on the organization's risk appetite 174 174 00:06:02,610 --> 00:06:03,960 and risk tolerance. 175 175 00:06:03,960 --> 00:06:05,310 The BCP can be broken down 176 176 00:06:05,310 --> 00:06:07,980 by business function or by geographical area 177 177 00:06:07,980 --> 00:06:10,320 if you're working in a very large organization. 178 178 00:06:10,320 --> 00:06:12,960 But again, all the pieces must be coherent 179 179 00:06:12,960 --> 00:06:14,550 and they must be able to operate together, 180 180 00:06:14,550 --> 00:06:16,740 especially during times of crisis. 181 181 00:06:16,740 --> 00:06:19,170 While you don't need to create a BCP for the exam, 182 182 00:06:19,170 --> 00:06:21,570 you should know the seven major steps to perform 183 183 00:06:21,570 --> 00:06:25,500 as outlined in the NIST Special Publication 800-34. 184 184 00:06:25,500 --> 00:06:27,150 The first step is to develop a policy 185 185 00:06:27,150 --> 00:06:28,740 for contingency planning. 186 186 00:06:28,740 --> 00:06:31,950 The second step is to conduct a business impact analysis. 187 187 00:06:31,950 --> 00:06:35,040 Your third step is to identify preventative controls. 188 188 00:06:35,040 --> 00:06:37,860 The fourth step is to create recovery strategies. 189 189 00:06:37,860 --> 00:06:40,890 The fifth step is to develop the business continuity plan. 190 190 00:06:40,890 --> 00:06:44,490 The sixth step is to test, train, and exercise that BCP 191 191 00:06:44,490 --> 00:06:47,190 and the seventh step is to maintain the BCP. 192 192 00:06:47,190 --> 00:06:49,080 Now, we're going to talk more about some of these steps 193 193 00:06:49,080 --> 00:06:50,850 as we move through the course. 194 194 00:06:50,850 --> 00:06:54,150 Finally, when you're creating your BCP and your DRP, 195 195 00:06:54,150 --> 00:06:56,040 you need to consider what type of continuity 196 196 00:06:56,040 --> 00:06:58,620 you need to create using these different plans. 197 197 00:06:58,620 --> 00:07:00,960 From a technical perspective, we're going to break this down 198 198 00:07:00,960 --> 00:07:03,990 into four categories or types of continuity locations. 199 199 00:07:03,990 --> 00:07:07,710 Hot sites, warm sites, cold sites, and mobile sites. 200 200 00:07:07,710 --> 00:07:09,120 All right, let's take a look at each of these 201 201 00:07:09,120 --> 00:07:11,190 and we're going to start with my favorite type of backup site, 202 202 00:07:11,190 --> 00:07:12,300 a hot site. 203 203 00:07:12,300 --> 00:07:13,500 Now, a hot site is defined 204 204 00:07:13,500 --> 00:07:15,870 as a site that is up and running continuously. 205 205 00:07:15,870 --> 00:07:17,700 Essentially, at a moment's notice, 206 206 00:07:17,700 --> 00:07:19,830 we can switch our operations from our main site 207 207 00:07:19,830 --> 00:07:23,370 to our backup site with almost no downtime and no issues. 208 208 00:07:23,370 --> 00:07:24,960 Now, this is my favorite type of setup 209 209 00:07:24,960 --> 00:07:27,270 because it means you always are up and ready to go 210 210 00:07:27,270 --> 00:07:29,160 and you can keep your business moving forward 211 211 00:07:29,160 --> 00:07:30,690 even when disaster strikes. 212 212 00:07:30,690 --> 00:07:32,220 But the drawback is, 213 213 00:07:32,220 --> 00:07:35,160 it's very expensive to have this kind of redundant site. 214 214 00:07:35,160 --> 00:07:37,260 For example, to truly have an on-demand 215 215 00:07:37,260 --> 00:07:38,550 and ready to go hot site, 216 216 00:07:38,550 --> 00:07:40,380 you're going to need to have two of everything. 217 217 00:07:40,380 --> 00:07:41,940 If I have a file server in the main office, 218 218 00:07:41,940 --> 00:07:44,310 I need to have another file server at the hot site. 219 219 00:07:44,310 --> 00:07:46,140 You're going to need to constantly update and communicate 220 220 00:07:46,140 --> 00:07:48,150 and mirror the data between both sites 221 221 00:07:48,150 --> 00:07:50,550 so you have an update copy at all times. 222 222 00:07:50,550 --> 00:07:52,710 Now, in the old days, this was extremely difficult 223 223 00:07:52,710 --> 00:07:55,110 and expensive to do, but the good news is, 224 224 00:07:55,110 --> 00:07:58,200 with cloud computing, this has become much, much easier 225 225 00:07:58,200 --> 00:08:00,540 because you can now have your servers hosted online 226 226 00:08:00,540 --> 00:08:04,110 at multiple locations simultaneously using AWS, Azure, 227 227 00:08:04,110 --> 00:08:05,970 or the Google Cloud platform. 228 228 00:08:05,970 --> 00:08:08,550 Now, while this type of hot site for your servers is great, 229 229 00:08:08,550 --> 00:08:10,620 it doesn't fully consider everything you need 230 230 00:08:10,620 --> 00:08:12,180 in terms of a hot site. 231 231 00:08:12,180 --> 00:08:14,070 Again, what about your office building 232 232 00:08:14,070 --> 00:08:16,410 where your employees are actually going to do their work? 233 233 00:08:16,410 --> 00:08:18,300 For example, let's say there's a fire 234 234 00:08:18,300 --> 00:08:20,370 and your entire headquarters got affected. 235 235 00:08:20,370 --> 00:08:22,140 You have smoked damage and water damage now 236 236 00:08:22,140 --> 00:08:24,690 because of this fire, and now it's going to take six months 237 237 00:08:24,690 --> 00:08:26,280 to rebuild your headquarters. 238 238 00:08:26,280 --> 00:08:28,620 Well, if you have a fully redundant cloud-based model 239 239 00:08:28,620 --> 00:08:30,540 for your hot site, this means all your data 240 240 00:08:30,540 --> 00:08:32,910 is up and running instantly and ready to go. 241 241 00:08:32,910 --> 00:08:36,150 But you had 500 people working in that office building 242 242 00:08:36,150 --> 00:08:40,170 and now you need to find 500 desks, 500 chairs, 500 phones, 243 243 00:08:40,170 --> 00:08:43,110 500 computers, all that stuff to get ready to go 244 244 00:08:43,110 --> 00:08:44,460 so people can go to work 245 245 00:08:44,460 --> 00:08:47,040 because everything else was destroyed in the fire. 246 246 00:08:47,040 --> 00:08:49,920 This is why a hot site is usually not used by most companies 247 247 00:08:49,920 --> 00:08:52,110 for their entire business, but instead, 248 248 00:08:52,110 --> 00:08:53,910 they use it just for mission critical things 249 249 00:08:53,910 --> 00:08:55,680 that have to be up 24 hours a day, 250 250 00:08:55,680 --> 00:08:57,570 seven days a week, continuously. 251 251 00:08:57,570 --> 00:09:00,840 Now, this brings us to our second category, a warm site. 252 252 00:09:00,840 --> 00:09:03,630 A warm site is not fully equipped like a hot site is. 253 253 00:09:03,630 --> 00:09:07,080 So remember, in a hot site, we have desks, we have chairs, 254 254 00:09:07,080 --> 00:09:09,210 we have network connectivity, we have computers 255 255 00:09:09,210 --> 00:09:11,910 and phones and software and everything we need 256 256 00:09:11,910 --> 00:09:14,670 so an employee can simply walk in and start working. 257 257 00:09:14,670 --> 00:09:15,990 Well, with a warm site, 258 258 00:09:15,990 --> 00:09:17,910 we're not ready for an immediate switchover, 259 259 00:09:17,910 --> 00:09:20,940 but we can get up and running in just a few days. 260 260 00:09:20,940 --> 00:09:23,640 A warm site will already have the fundamentals in place. 261 261 00:09:23,640 --> 00:09:26,760 For example, the building has power, it has phone lines, 262 262 00:09:26,760 --> 00:09:28,230 and we have network connectivity. 263 263 00:09:28,230 --> 00:09:30,450 We may have some desks, but there may not be any phones 264 264 00:09:30,450 --> 00:09:32,250 or computers already installed. 265 265 00:09:32,250 --> 00:09:33,840 Now, if a disaster happens, 266 266 00:09:33,840 --> 00:09:35,790 we can then start installing this technology 267 267 00:09:35,790 --> 00:09:37,860 and get people up and running within a few days 268 268 00:09:37,860 --> 00:09:39,390 'cause we just need to buy some laptops 269 269 00:09:39,390 --> 00:09:41,490 and some monitors and some phones. 270 270 00:09:41,490 --> 00:09:44,370 Now, the benefit of a hot site is that instant availability, 271 271 00:09:44,370 --> 00:09:46,680 but it comes with a very high price tag. 272 272 00:09:46,680 --> 00:09:48,780 Now, a warm site is a little bit cheaper, 273 273 00:09:48,780 --> 00:09:50,610 but you're giving up some response time 274 274 00:09:50,610 --> 00:09:51,660 because you have to wait a few days 275 275 00:09:51,660 --> 00:09:52,890 to get it up and running. 276 276 00:09:52,890 --> 00:09:54,840 That's the difference as you look at these things. 277 277 00:09:54,840 --> 00:09:57,630 The third category we have is known as a cold site. 278 278 00:09:57,630 --> 00:10:00,240 Now, this again, is going to add more time to our recovery, 279 279 00:10:00,240 --> 00:10:02,610 but it is cheaper than using a warm site. 280 280 00:10:02,610 --> 00:10:04,710 A cold site contains even fewer facilities 281 281 00:10:04,710 --> 00:10:06,000 than a warm site does. 282 282 00:10:06,000 --> 00:10:08,610 For example, one organization I worked with in the past 283 283 00:10:08,610 --> 00:10:10,140 had a cold site that was essentially 284 284 00:10:10,140 --> 00:10:12,300 just an empty building they had a lease on. 285 285 00:10:12,300 --> 00:10:13,860 They paid a monthly rent for this building 286 286 00:10:13,860 --> 00:10:15,180 and nobody worked there. 287 287 00:10:15,180 --> 00:10:17,070 The cold site had a few basic facilities 288 288 00:10:17,070 --> 00:10:19,320 like the bathrooms and the tables and the chairs, 289 289 00:10:19,320 --> 00:10:20,820 but there was no network connectivity, 290 290 00:10:20,820 --> 00:10:23,160 there was no phone lines and there was no computers. 291 291 00:10:23,160 --> 00:10:25,020 Essentially, it was an empty shell, 292 292 00:10:25,020 --> 00:10:27,480 and in the event of a serious disaster of their headquarters 293 293 00:10:27,480 --> 00:10:29,820 they could turn this cold site into a new headquarters 294 294 00:10:29,820 --> 00:10:31,830 in about one to two months. 295 295 00:10:31,830 --> 00:10:34,860 Now, the final category we have is known as a mobile site. 296 296 00:10:34,860 --> 00:10:36,750 Now, a mobile site can be a hot site, 297 297 00:10:36,750 --> 00:10:38,400 a warm site, or a cold site. 298 298 00:10:38,400 --> 00:10:39,870 Basically, up to this point, 299 299 00:10:39,870 --> 00:10:42,690 I was discussing how you can go from one building to another 300 300 00:10:42,690 --> 00:10:44,580 with a hot, warmer, cold site. 301 301 00:10:44,580 --> 00:10:47,160 But with a mobile site, we don't even need buildings. 302 302 00:10:47,160 --> 00:10:48,720 Instead, we use independent 303 303 00:10:48,720 --> 00:10:51,180 and portable units to provide our recovery. 304 304 00:10:51,180 --> 00:10:54,090 Most often, this takes the form of trailers or tents. 305 305 00:10:54,090 --> 00:10:55,500 They're delivered to your location 306 306 00:10:55,500 --> 00:10:57,240 and connected to your power and internet, 307 307 00:10:57,240 --> 00:11:00,000 and that way you can get up and running pretty quickly. 308 308 00:11:00,000 --> 00:11:02,310 For example, the US military has something known 309 309 00:11:02,310 --> 00:11:04,050 as the DJC2. 310 310 00:11:04,050 --> 00:11:06,780 This is the Deployable Joint Command and Control system. 311 311 00:11:06,780 --> 00:11:09,450 This thing is an integrated command and control headquarters 312 312 00:11:09,450 --> 00:11:11,010 that can be delivered anywhere in the world 313 313 00:11:11,010 --> 00:11:12,840 within about 72 hours. 314 314 00:11:12,840 --> 00:11:14,820 Now, once it gets on the ground, it takes 'em around 315 315 00:11:14,820 --> 00:11:18,510 24 hours to start providing some functionality and service. 316 316 00:11:18,510 --> 00:11:20,700 This system is made up of a series of tents 317 317 00:11:20,700 --> 00:11:22,410 and they have generators for power, 318 318 00:11:22,410 --> 00:11:24,870 they have air conditioning, they have tables and chairs, 319 319 00:11:24,870 --> 00:11:26,610 they have phones and network connectivity, 320 320 00:11:26,610 --> 00:11:28,230 and they can support up to 200 people 321 321 00:11:28,230 --> 00:11:29,940 inside one of these things. 322 322 00:11:29,940 --> 00:11:33,450 For example, after a major earthquake in Haiti back in 2010, 323 323 00:11:33,450 --> 00:11:36,120 the US military deployed one of these DJC2s there 324 324 00:11:36,120 --> 00:11:37,800 to act as the mobile command center 325 325 00:11:37,800 --> 00:11:39,480 and run the recovery operations. 326 326 00:11:39,480 --> 00:11:40,313 Now, the great thing 327 327 00:11:40,313 --> 00:11:41,820 about this type of mobile recovery site 328 328 00:11:41,820 --> 00:11:43,410 is that they are fully contained. 329 329 00:11:43,410 --> 00:11:45,630 They come with everything you need, including power, 330 330 00:11:45,630 --> 00:11:48,060 connectivity, and technicians to run the whole thing. 331 331 00:11:48,060 --> 00:11:50,220 So which of these sites should you use? 332 332 00:11:50,220 --> 00:11:52,770 Well, this is why senior managers need to be involved 333 333 00:11:52,770 --> 00:11:54,930 in the BCP creation process. 334 334 00:11:54,930 --> 00:11:56,910 Sometimes you're going to choose one of these 335 335 00:11:56,910 --> 00:11:58,560 or you might choose multiple of these, 336 336 00:11:58,560 --> 00:12:00,780 breaking them out across different business functions, 337 337 00:12:00,780 --> 00:12:02,970 different scenarios or different timelines. 338 338 00:12:02,970 --> 00:12:05,700 For example, in my company, we use a full hot site 339 339 00:12:05,700 --> 00:12:07,500 for our servers to ensure they're always up 340 340 00:12:07,500 --> 00:12:09,210 and operational at all times, 341 341 00:12:09,210 --> 00:12:11,880 but we don't use a full hot site for our employees. 342 342 00:12:11,880 --> 00:12:13,800 Instead, we have a small office 343 343 00:12:13,800 --> 00:12:16,620 and we allow and encourage telework in our organization. 344 344 00:12:16,620 --> 00:12:19,140 So for the most part, most of my team members 345 345 00:12:19,140 --> 00:12:21,210 are working from their own home offices. 346 346 00:12:21,210 --> 00:12:23,160 Since we've designed all our technical backend 347 347 00:12:23,160 --> 00:12:24,960 to allow this fully remote workforce, 348 348 00:12:24,960 --> 00:12:27,300 if one of their home offices loses internet or power, 349 349 00:12:27,300 --> 00:12:29,310 we could simply have them go to a local hotel 350 350 00:12:29,310 --> 00:12:31,320 and as all day at internet and power in the hotel, 351 351 00:12:31,320 --> 00:12:33,900 they can reconnect and go back to work right away. 352 352 00:12:33,900 --> 00:12:35,850 Now, in addition to that, we also plan 353 353 00:12:35,850 --> 00:12:38,550 for power outages and internet outages at our office 354 354 00:12:38,550 --> 00:12:41,130 because we have primary power delivered by solar panels 355 355 00:12:41,130 --> 00:12:42,420 and then we have battery backups 356 356 00:12:42,420 --> 00:12:44,040 for the times the sun isn't out. 357 357 00:12:44,040 --> 00:12:45,600 Now, if we run out of battery power, 358 358 00:12:45,600 --> 00:12:47,610 we also can go to our backup generators, 359 359 00:12:47,610 --> 00:12:49,890 and we also have a connection back to the local power grid 360 360 00:12:49,890 --> 00:12:52,440 and we could pull power from there too if we needed to. 361 361 00:12:52,440 --> 00:12:53,700 See, for internet connectivity, 362 362 00:12:53,700 --> 00:12:54,780 we do the same type of thing. 363 363 00:12:54,780 --> 00:12:56,940 We have three different connections to our office. 364 364 00:12:56,940 --> 00:12:58,380 The first one is a microwave link 365 365 00:12:58,380 --> 00:13:00,660 that gives us high speed uploads and downloads. 366 366 00:13:00,660 --> 00:13:02,820 If that fails, we have a redundant connection 367 367 00:13:02,820 --> 00:13:04,170 from a local cable company, 368 368 00:13:04,170 --> 00:13:06,840 and that provides high speed downloads, but slower uploads. 369 369 00:13:06,840 --> 00:13:08,010 If both of those fail, 370 370 00:13:08,010 --> 00:13:09,750 we also have a cellular modem backup, 371 371 00:13:09,750 --> 00:13:12,180 and this provides about 20 megabits per second of service 372 372 00:13:12,180 --> 00:13:13,620 for uploads and downloads. 373 373 00:13:13,620 --> 00:13:15,090 By layering our internet connectivity 374 374 00:13:15,090 --> 00:13:16,920 as part of our business continuity plan, 375 375 00:13:16,920 --> 00:13:19,620 we know that our expected response and downtime would be 376 376 00:13:19,620 --> 00:13:21,780 for our primary internet connection failure, for example, 377 377 00:13:21,780 --> 00:13:24,030 because we can shift to the second one in seconds 378 378 00:13:24,030 --> 00:13:26,100 or the third one in seconds after that. 379 379 00:13:26,100 --> 00:13:28,830 So when you're creating your BCP and your DRP, 380 380 00:13:28,830 --> 00:13:31,650 remember, you can't just think of the technology stack, 381 381 00:13:31,650 --> 00:13:32,483 but you also have to think 382 382 00:13:32,483 --> 00:13:34,020 about where are your people going to work 383 383 00:13:34,020 --> 00:13:35,820 and how are you going to support them long term 384 384 00:13:35,820 --> 00:13:37,890 as you attempt to continue to support your operations 385 385 00:13:37,890 --> 00:13:38,853 and your customers.