In this lesson,
we're going to talk about continuity of operations plans.
Now, your organization's continuity of operations plan
is going to ensure that your organization
is able to recover from a disruptive event or disaster.
This is a specialized field within an organization,
and one that takes a lot of planning and forethought
to keep your organization running smoothly
during an event or incident.
Now, there are two major terms
associated with continuity of operations planning.
The first one is business continuity planning,
which is often spoken as business continuity plans,
which themself are going to be abbreviated as a BC plan.
Now, this business continuity plan
can refer to the plans or processes
that are used for your response to a disruptive event.
The second kind we have
is known as a disaster recovery plan, or DRP.
Now, these disaster recovery plans
are going to specifically refer to any plans or processes
that are going to be used during a disaster.
Now, a disaster recovery plan
usually is going to be considered a subset
of a more complete business continuity plan as well.
And so, you'll see often that people would just call these
a BC/DR or business continuity disaster recovery plan.
Now, when you think about a business continuity plan,
this plan is going to be used for any disruptive event
or any kind of response to a given threat.
Now, for example,
what would you do if your domain controller
fell victim to a ransomware attack
and all of your users could no longer log into your network?
Well, this would be a disruptive event,
and it might actually activate your incident response plans
and your business continuity plans,
and that's really what we're talking about here.
Now, your business continuity plans
are all about creating a system of preventative actions
and recovery steps in response to threats
that could materialize and then disrupt your business.
Now, your business continuity plan
may also cover your non-technical things too
that would also end up disrupting your business,
so keep that in mind too.
For example, in my business,
we rely heavily on our ability
to take credit card payments online from our students.
So, if a merchant processing account
was going to be canceled for some reason,
this could actually affect our ability
to take payments from our students,
and this would have a major impact on our company.
So, as part of our business continuity planning,
we've discussed how we're going to immediately switch over
to our backup credit card processor
so we can continue our business operations
and simultaneously work
with our primary credit card processor
to get them back online again,
and then get our credit cards
to be able to be processed once more.
Now, if our primary credit card processor
cannot get us back online within X number of days,
then we're going to shift to a tertiary contract
that we have set up,
and that would allow us
to continue our operations indefinitely,
even though that tertiary processor may charge us more
for each processing transaction
than our primary or secondary one does.
But all of this becomes part
of our business continuity plan.
And as we go through, we're going to plan for our primary,
our secondary, and our tertiary actions
that we want to use
to be able to continue our business operations.
Now, another example I saw in a previous organization
that was focused on what they would do
if there was protests in the streets.
Now, this was an IT organization,
and it may seem kind of weird to you
that they're thinking about protests in the streets,
but because their headquarters
was actually located near a major American city,
they had this as a concern.
Now, when there was protests
and riots in the city back in 2020,
they actually found that it disrupted their business
because their employees
couldn't get to the headquarters to do their job.
So, now they decide,
what are we going to do in case the streets get barricaded?
Whether that's from protesters trying to make a point
or police try to hold back those rioters,
how are we going to get our employees to do their job?
Well, after that initial incident,
the company learned they need to have a backup plan
for how they're going to keep
their operations running all the time,
even if their people
can't physically get to the office building.
And so, that became one of the big considerations
in their business continuity plan,
and they actually have a section titled Riots and Protests
and What Their Employees Should Do If That Happens.
Now, we just spent a little bit of time here
talking about the basic idea of a business continuity plan,
but let's touch on the concept
of a disaster recovery plan too.
Now, a disaster recovery plan, or DR plan,
is usually going to be a subset
of your business continuity plan.
The disaster recovery plan
is going to focus on disruptive events,
just like a business continuity plan would,
but it's going to specifically focus
on how to resume your operations more quickly
after you have a disaster.
For example, our Dion training offices
are located down in Orlando, Florida,
which is very likely to suffer from hurricanes
because of its location.
Now, our business continuity plan
contains a disaster recovery plan portion
that's focused on our response actions
for things like hurricanes, fires, floods,
and other things like that.
So, if we have a hurricane down here in Florida,
how are we going to be able to keep our offices open
and our servers online 24 hours a day, 7 days a week?
And if we can't, what are we going to do in response to that?
What are we going to do if there's an earthquake,
a fire, a flood, or some other kind of disaster?
Now, all of these are things that we had to think about
when we were creating our disaster recovery plan.
So, for example, when we did our risk management analysis,
we determined it was just too risky for us
to host our servers in our on-premise environment
because of our location is so hurricane prone,
and we were worried about the threat of a power loss
or network connectivity loss
because a hurricane ravages the area.
So, instead, we ended up building out
our entire infrastructure in the cloud,
and we actually use Amazon Web Services to do this,
and they provide us with continuity of operations
by spreading all of our services
across multiple AWS regions and availability zones.
This way, even if there was a severe disaster
in Orlando, Florida,
our business operations can continue on unimpeded.
Now, another thing we did
is we actually split our staff across multiple locations,
both within Florida, the rest of the United States,
and a few other locations around the world.
For example, if you email us and ask a question,
that's actually handled by our student success team.
Now, our student success team
is actually split evenly between the United States
and the country of the Philippines.
Now, if there's a power outage in our offices in Florida,
our Philippines team can actually take over operations
and continue to work to make sure that you, our students,
are being taken care of.
Similarly, over the last few years,
we've seen that floods have happened
in the country of the Philippines.
And when that happened, our US-based team
was able to step up and cover for the Philippines team
while they took a couple of days off of work
to make sure they were safe, their family was safe,
and their homes were taken care of
because our Philippines team
had other more important things to do,
and they couldn't get to work
because maybe their power was down,
or their internet was offline,
or their house was being flooded.
And in any of these cases,
they need time to take care of that,
and we can do that by shifting the operations
back to our Florida Center.
By dispersing our operations
across multiple geographic regions,
we're able to continue our operations
even in the face of these kinds of disasters.
So, now that we've covered the differences
between a business continuity plan
and the disaster recovery plan it contains,
for the rest of this lesson,
I'm only going to refer to the business continuity plan.
But when I do, remember I'm really equally referring
to both the business continuity
and the disaster recovery plan it contains
because the only real difference here
is the type of event that you are going to be responding to.
If it's an incident,
then it's going to be a business continuity issue.
If it's a disaster, it's going to be a disaster recovery issue.
That's really going to determine which plan you're going to follow
during your response actions based on the event
that you're actually taking actions against.
Now, the development of your business continuity plan
is really going to be the responsibility
of your senior managers within your organization.
It's up to them to drive this effort
and ensure that it's being done properly.
Now, without their support,
the business continuity plan development
is actually going to stall out and fail.
For this reason, it really is the responsibility
of your senior management to help set goals
for the business continuity
and disaster recovery efforts
that are being put under this senior management control.
They're also going to make sure
that a business continuity coordinator is being appointed,
and they're going to lead the business continuity committee
that develops these plans.
Now, this business continuity committee
should have representatives
from different departments across your organization,
including your technology department,
your legal department, your security department,
your communications department,
and others, just to name a few.
Now, this should not be just the IT people doing this thing
because we all need to work together across the organization
to ensure we know how we're going to continue
to operate our business.
Remember, we're not just covering
the technology or the networks,
we are covering everything inside of the business.
And this is the reason we need people
from across the organization helping us.
This committee is going to be working
to determine the recovery priorities
for the different types of events that could occur,
whether they're going to be disruptive,
and whether they're going to be covered
by the business continuity plan
or your disaster recovery plan if it's a disaster.
This committee is also going to seek out to identify
and prioritize all of our systems
that we're going to need to support
the continuity of our business,
and then they'll report back to senior management.
Now, another key part of a good business continuity plan
is defining the scope of the plan itself.
Otherwise, you could face scope creep.
Again, this is another great job for senior management
because they need to determine the level of risk
that they're willing to accept
based on the organization's risk appetite
and risk tolerance thresholds.
Now, the business continuity plan
will be broken down by business function
or geographical area
if you're working in a very large organization.
But again, all these pieces have to be coherent
and they must be able to operate together,
especially during times of crisis.
So, remember, when it comes
to the continuity of operations plan,
you're going to have two main parts of that.
One is going to be your business continuity plan,
or your BC plan,
and the second
is going to be your disaster recovery plan, or DRP.
When it comes to your business continuity plan,
remember that this refers to the plans and processes
that are used for your response to a disruptive event.
But when you're dealing with a disaster recovery plan,
you're specifically talking about
the plans and processes
that are going to be used to respond to a given disaster.
That's really the biggest difference
between a business continuity plan
and a disaster recovery plan
because one, we're dealing with incidents and issues,
and the other, we're dealing with disasters.