Cabinet Office

Main navigation

Business Continuity

Introduction

The three key tenets of Information Assurance are Confidentiality, Integrity and Availability. All three must be addressed in relation to the needs of the organisation, if IA is to be achieved; IA is not concerned solely with confidentiality.

Business Continuity is a specific area of IA relating to the maintenance of service integrity and information availability.

Terminology

Business Continuity is defined as those actions designed to prevent or reduce interruptions in business processes. For this reason the process is also known as ‘continuity of operations’. The focus is on business-critical resources, and the process takes a holistic view of business activities and centres on planning before the event.

Disaster Recovery Planning considers the post-incident restoration of infrastructure through a pre-defined set of actions.

Business Continuity may also include an element of Crisis Management, which relates to the overall management of a major incident including aspects such as Public Relations. Crisis Management is not considered to be within the scope of this paper, although further advice can be obtained from the UK Resilience website. [External website]

It can be seen that the requirement for availability of information and services drives the need for Disaster Recovery, and that Disaster Recovery is a component of Business Continuity. These processes are driven by the risk assessment and the identification of critical business processes.

The plans produced as outputs can be considered to be countermeasures in their own right.

The situation is summarised in the diagram below.

Principles of Governance

ISO/IEC 17799
ISO/IEC 17799 identifies an effective business continuity process as a key element of IA, encompassing a planning framework, the conduct of an impact analysis, and the regular testing and maintenance of plans and the use of backup procedures.

OGC
The OGC [External website] state that ‘Each government department is responsible for ensuring it has robust Business Continuity Plans in place so they can respond effectively to a wide range of problems affecting the organisation's assets; including buildings, people and equipment e.g. computers’.

Best Practice Guidelines

Best practice guidance is available from a number of sources:

• The Business Continuity Institute (BCI) [External website] is an established source of best practice in the UK. In particular, publication PAS56 provides a source of definitions, advice and process definitions in this area.
• The OGC ITIL [External website] documentation set includes best practice guidelines for government.
• The DTI [External website]publish short guidance documents setting out best practice in a number of areas including business continuity.

This guidance is issued against a background in which the UK is considering its preparedness in the event of a civil emergency, and also against the background of the recommendations of the Turnbull report [External website], which although not mandatory, nevertheless have significant implications for FTSE-registered companies. Because of this, organisations should keep a watching brief on emerging standards in the commercial sector, and should be prepared to adapt to meet developing best practice.

General Advice

Proprietary methods are available for the development of business continuity and related plans. When selecting a method, the following aspects should be taken as a minimum set:

• The process must be based on an initial analysis of the business processes, identifying those which are deemed critical to the continued operation of the business, and identifying also maximum service recovery times and the necessary sequence of recovery.
• The process should be sufficiently flexible to accommodate changes in circumstances and should incorporate an ongoing review of threats and vulnerabilities.
• The method must include an element of testing, and a review of the results of testing business continuity and disaster recovery plans.
• The process must be a business owned activity.
• The process must be integrated with other, relevant initiatives such as application development, so that plans remains current.
• There must be an element of decision making in the process i.e. it must not be mechanistic. There will be areas in which it will be more cost-effective to add resilience rather than invoke a plan.
• Invocation criteria and processes must be specified (such as the regular testing of backups to ensure their usability).

Specific Advice

Service-based procurements
For government bodies, where a service is being procured then the provision of disaster recovery facilities (or not) may appear to be a decision for the supplier, and therefore the responsibility of the supplier.