IT Governance Business Continuity

Santhosh K., a manager in the IT Department, has been tasked with developing a Business Continuity Plan (BCP) which was a recent audit finding. His manager believes that his will be a simple checklist of all applications and services that IT supports today. The request is that the BCP should be ready by the time the Governance Management team meets in three weeks. Santhosh, remembering back to his IT Governance class, and the reference book used, is not so sure it will be that easy. Knowing that all applications and services cant be available post-disaster, Santhosh believes that there are a lot of questions and decisions that will need to be made to make a realistic Business Continuity Plan. Santhosh needs to develop a plan to create the Business Continuity Plan.

Question 1 [5 points]: What should Santhosh tell his manager right away indicating what kind of effort is involved in creating a BCP.

Santhosh needs to search if there is any existing business continuity planning (BCP) in order to draft rough draft and can let his manager know the steps that he is going through and what are requirement before he starts anything. He can consult with his manager which ones needs to be done early than the other one (prioritization).

Question Describe a method to identify the core business capabilities and related IT applications or services.

Identifying appropriate strategies for maintaining the core business capabilities and having people who have the knowledge in the enterprise could lead high possibility and acting high level BCP risk assessment such as identifying all key systems product lines, business parts or other business continuity priorities.

Question 3 : Describe a quantitative way to access the business impact should that application or service not be available.

The quantitative is a way of accessing business impact includes reduced sales revenues, and if employees get fired or any other natural disaster that could happen companys properties.

Question 4 : Describe specific responses options that should be applied to each item to reduce its potential impact.

If a disaster affects the business such as tornado, terrorist attack, and anything else that can harm technologies. A company must have data redundancy or back up plan in case unexpected happen in order to protect data loss or loss of information.

Question 5 In addition to applications and services, what other key IT and enterprise resources needs to be specifically called out in a BCP and why?

People are the part of BCP because without them business would not run. Applications and services are part of BCP and these application services cannot represent people or work alone.