Conclusion

Purpose and scope

• What is the purpose and scope of your BCDR plan?
• Does it cover all your critical BUs, functions, resources, stakeholders (including customers), and the various kinds of disasters?

Governance and roles

• Do you have a senior management team that controls and approves the plan?
• Have you identified the team that crafts and modifies the plan?
• Have you identified other teams that need to be involved in the BCDR planning, creation, training, and approval processes?

Risk assessment

• Have you identified the risks to your organization – Is it lack of IT security, poor building structure, disasters such as earthquakes, floods and pandemics, man-made accidents such as fire and infrastructure failure such as power failure?
• Have you assessed the likehood of the disasters and evaluated the risks?
• Have you identified the measures to control and mitigate these risks?
• Have you documented all your risk assessment data?

Business impact analysis

• Have you identified the critical BUs and their functions?
• Have you identified the interdependencies between these BUs and functions?
• Have you identified the critical resources for the BUs and their backups?
• Have you identified the critical IT systems?
• Have you established the RTO and RPO?
• Have you identified the minimum infrastructure, systems, and resources requirements to keep your business running?
• Have you identified the financial impact to your organization?
• Have you identified what is at stake for your company should the disaster last for weeks/months such as a pandemic?
• Have you documented the impact and created a BIA report?

BCDR planning

Response

• Have you identified the emergency response teams (including IT) and personnel?
• Have you established the notification strategy based on your organizational hierarchy and structure?
• Have you identified the assembly points in case of a disaster?
• Do you have emergency response procedures for all disaster types? Are all IT arrangements in place such as protecting IT equipment, alternative power backup, alternative network connection? Is data backed up regularly? Are fire alarm systems in place?
• Have you identified the loacl emergency hot lines?
• Do you document every step and do you have forms in place to capture all details, example: disaster form?

Communication

• Do you have a communications team to create your communications plan?
• Do you have a well defined internal and external communication strategy in place?

Recovery

• Have you created a timeline of your recovery activities? What will you do in the first 3-4 hours of the disaster, 5-24 hours, 2-4 days, 5-14 days?
• Have you identified the emergency command centers and alternate locations for continued business operations?
• What are your business continuity measures to ensure availability: data recovery and back procedures, data center resilience, secondary DCs, multiple ISPs, power back-up, temperature control systems, and fire-prevention systems in place?
• Does your organization have a succession plan for making key decisions during disasters?
• How will you stabilize the disaster situation?
• Do you do damage assessment during a disaster to assess damage to critical assets?
• What do you do to ensure continuity of supplies? Have you identified backup vendors?

Implementation and training

• Do you provide regular training to all emergency personnel?
• Do you conduct mock drills for fire, IT security such as phishing attacks et cetera with live simulations?
• Have you established the time frames and frequency of these mock drills and simulations?
• Do you document the results of the training for continual improvement?

Plan review and maintenance

• Do you regularly review and update your BCDR plan to ensure that the plan stays current with the latest information and changes in terms of IT systems, resources, infrastructure and policies?