developing a business continuity plan (業務持續性計畫)

introduction
In the business world, computer disaster recovery planning is evolving toward business continuity planning.
In recognition of this trend, in 1995, Disaster Recovery Institute (DRI) International, an organization founded
in 1988 to provide a base of common knowledge in continuity planning, replaced the designation Certified
Disaster Recovery Planner (CDRP) with the designation Certified Business Continuity Planner (CBCP).
What is the difference between disaster recovery and continuity planning? A disaster recovery plan is
reactive and usually focuses on recovering the computing environment. Although work may be done to
harden the computing infrastructure to prevent a disaster, the plan’s main purpose is to recover from
damage to the infrastructure. In contrast, a business continuity or contingency plan is not only proactive,
but it is also targeted at keeping the business running during an event, not just recovering the computers
after the fact.

As part of its continuity planning process, a company needs to review the continuity or recovery of
manufacturing, packaging, warehousing, shipping, customer support, and any other facilities or operations
that are critical to the company’s survival.

Many companies today do not have a working continuity plan. Of those companies that do develop a plan,
many proceed without sufficient knowledge or input from end users. Because end users are not involved in
developing the continuity plan, their manual procedures, physical facilities, hard-copy records, and other
special needs are often overlooked. Thus hardware and applications might be recovered, but not the
business processes that use them.

beginning the continuity planning process

One way to approach a business continuity planning program is called the Delphi method. Experts in each
business function identify their critical business processes and develop separate (but coordinated) continuity
plans for each process. The benefits of this distributed approach are many:

‧ Business processes that are not critical do not hinder those that are, so limited resources can be used
effectively.
‧ An infrastructure that supports noncritical business processes does not get recovered.
‧ Multiple critical business processes or applications can be recovered in parallel.
‧ Applications that normally run on different systems can be recovered on the same system, if necessary.
The survival of your business after a disaster depends on having a continuity plan in place. This brief is
intended to help you develop and deploy one. Directed at a hypothetical employee, a corporate continuity
planner, it details the procedures for launching a continuity planning program.