CISSP For Dummies

It is an accomplishment indeed when the BCP documentation has been written, reviewed, edited, and placed into three-ring binders. However, the job isn’t yet done. The Business Continuity Plan needs senior management buy-in, the plan must be announced and socialized throughout the organization, and one or more persons must be dedicated to keeping the plan up-to-date. Oh yeah, and the plan needs to be tested!

Securing senior management approval

After the entire plan has been documented and reviewed by all stakeholders, it’s time for senior management to examine it and approve it. Not only must senior management approve the plan, but senior management must also publicly approve it.

 Instant Answer   Senior management approval is needed so that all affected and involved employees in the organization understand the importance of emergency planning.

Promoting organizational awareness

Everyone in the organization needs to be made aware of the existence of the plan and of his or her role in it. This may mean training for potentially large numbers of people who are expected to be there when a disaster strikes.

 Instant Answer   All employees in the organization must be made aware of the existence of the Business Continuity Plan.

Maintaining the plan

No, the plan isn’t finished. It has just begun! Now the BCP person (the project team members by this time have collected their commemorative denim shirts, mugs and mouse pads, and have moved on to other projects) needs to periodically chase The Powers That Be to make sure that they know about all significant changes to the environment.

In fact, if the BCP person has any leadership left at this point in the process, he or she needs to start attending the Change Control Board (or whatever that company calls it) meetings and to jot down notes that may mean that some detail in a BCP document may need some changes.

 Tip   The Business Continuity Plan is easier to modify than it is to create out of thin air. Once or twice each year, someone knowledgeable needs to examine the detailed strategy and procedure documents in the BCP to make sure that they’ll still work.