Business Continuity Plan & Security in Operational Processes
A Business Continuity Plan (BCP) is essential for several reasons when managing information security, privacy and quality as well as ensuring the resilience of business operations, particularly during crises or disasters:
- The BCP helps identify potential risks to the organization’s operations and sets out plans to mitigate those risks. In the event of a crisis or unexpected disruption, the BCP ensures that critical functions can continue with minimal interruption, reducing the financial and operational impact of such events.
- Maintaining data integrity and availability is crucial during emergencies. A BCP includes strategies for data backup, recovery, and protection, minimizing the risk of data loss during critical situations.
- Many industries require businesses to have a business continuity plan in place to comply with legal or regulatory obligations. A BCP ensures that the organization can meet these obligations, avoiding legal risks and potential fines or penalties.
- Having a well-defined BCP demonstrates that the organization is resilient and capable of maintaining operations even during disruptions. This builds confidence among customers, partners, and stakeholders, enhancing the organization’s reputation as a reliable and secure business.
The process of conducting a Business Continuity Plan (BCP) assessment varies based on the size of your organization and its specific continuity needs. You have the flexibility to determine the scope and extent of your BCP, provided it is reasonably justified. Compleye recommends performing a questionnaire-based BCP assessment to evaluate controls and measures across the entire business. This includes not only technical systems but also organizational resources, management involvement, and overall operational processes. Please note that while the BCP assessment includes elements of the Disaster Recovery Plan (DRP), the BCP itself goes beyond just disaster recovery. It focuses on how the entire business and its operations are prepared to handle disruptions, ensuring that all aspects of the organization—technical systems, resources, management, and processes—are equipped to maintain continuity during adverse situations.
Step-by-Step Guide for Performing the BCA
Step 1: To perform a thorough BCP Assessment (BCA), follow the BCP assessment, which can be accessed in the Compleye Online Templates Section. Answer the questions carefully and truthfully to assess your organization’s preparedness in the event of a disruption. This includes evaluating your available resources, the involvement of management in compliance activities, and technical aspects of your continuity plan. Some topics might not seem relevant now but could become important in the future, or they may provide valuable insights for improvements. It’s also a good idea to consult your Compliance Officer, if available, for additional guidance. The result of the BCP will be a PDF document summarizing your findings and recommendations. Once this step is complete, you’ll be ready to proceed to the next phase.
Step 2a: This is applicable only if the BCP assessment is performed in the second continuous year. If you perform for the first time, you can skip this step.
Review Last Year’s Findings
- What to do: Look at the findings from last year’s BCP assessment and note any improvements or changes that have been made.
- Questions to answer:
Was the issue identified last year resolved?
If not, explain why it wasn’t addressed.
Was the improvement effective? (Yes/No)
Step 2b: Effectiveness Check
- What to do: Evaluate the effectiveness of each improvement.
- Action: For every improvement made, mark “Yes” if it worked or “No” if it did not.
- If “No”, provide additional justification for why the improvement wasn’t effective.
Step 3: Review Other Relevant Assessments
- What to do: Check if other assessments related to your business have been completed and approved. If no assessments have been made, simply skip this step.
- Questions to answer:
List the date and month for each assessment.
Identify findings or improvements from each assessment.
Confirm whether management has approved the findings.
Key Assessments to Review:
- ISRA (Information Security Risk Assessment)
- Supplier Assessments
- Privacy Assessment
- Data Privacy Impact Assessment (DPIA)
- Disaster Recovery Plan (DRP)
- Security in Operational Processes
- Security Assessment of Office
For each assessment, indicate if it was approved by management (Yes/No/NA).
Step 4: Assess Business Operations
- What to do: Answer the following questions regarding your organization’s structure, customer relations, suppliers, financials, and resources.
Key Areas to Assess:
- Organization:
Is your intellectual property (IP) defined and protected?
Was your IP at risk in the last 6 months?
Do you have up-to-date contact details for all customers?
Are there any high-risk suppliers impacting security or business continuity?
Do you have sufficient insurance and emergency funds?
- People:
How many people are involved in the organization (team members, suppliers)?
Do you have easy access to all contact details for your team and suppliers?
Do you have enough staff to perform all tasks, including information security duties?
- Physical/Hardware Assets:
How many hardware assets are in use?
Do you have processes for returning hardware and devices?
Do you have a backup plan for your office space?
- Technological:
How many incidents occurred last year, and what was their impact?
Are there any trends identified that require attention?
Are disaster recovery scenarios and tests up-to-date?
Step 5: Review and Identify Areas for Improvements:
- What to do: Based on the responses from the previous sections, identify any areas that need improvement.
- Action: Provide specific findings and suggestions for how to address weaknesses, fill gaps, and improve your business continuity plan.
Step 6: Document the Approval Process
- What to do: After completing the assessment and identifying areas for improvement, ensure that the final assessment is approved by management.
- Questions to answer:
Who are the people (names and roles) involved in the approval process?
Ensure that approval is documented either via signature or email confirmation.
By following the above steps, you will complete your Business Continuity Assessment. This process should help you to identify necessary improvements and ensure that your operations can continue seamlessly during adverse situations. It is crucial that this assessment is reviewed and approved by C-level management.
Step 7. Register your findings in the Compleye Online system under the ‘Improvements Section’. This is the final step and can be carried out by your Compliance Officer.
To record your BCP assessment in Compleye Online, follow these steps:
- Navigate to the ‘BCP Section’.
- Click on the ‘Create New BCP’ button located at the bottom left of the page.
A new window will open where you can upload the BCP document. Once attached, the document cannot be deleted, but it can be downloaded. The BCP card will be named based on the upload date. If you have multiple documents, you can upload additional files; however, ensure the main document is uploaded first.
After creating the BCP, you can add your findings by copying them from the main document. If needed, you can also upload additional relevant documents under the ‘Attachments’ tab, though this is optional.
- When adding a finding, there’ll automatically be an option to create an improvement (in blue).
NOTE: if you don’t create an improvement, you’ll need to justify why to the external auditor. Perhaps you have already solved the improvement – and added the evidence in ‘Attachments’. If so, please make sure that you have addressed that in the finding (eg, by adding, ‘Already solved by .’ ….’ evidence can be found in attachment.’)
We strongly advise creating an improvement for each finding. Improvements will become part of the Management Review and show that you’re able to improve and mature your compliance.
When you create an improvement, a new pop-up screen will appear. The finding will already be pre-filled, tagged with ‘BCP’ to indicate its source. You’ll then need to assign an owner responsible for the improvement and set a due date, which should reflect the estimated date for the first expected results.
Once all fields are completed, click the ‘Create Improvement’ button. This will automatically generate an improvement with a unique ID in the ‘Improvements Section.’
Next Steps:
- The assigned owner is responsible for working on the improvement.
- Ensure the owner has board access and has added an email address in the ‘@People Section’ to receive notifications about improvement deadlines.
- The Compliance Officer will review the progress of all improvements during the monthly compliance meeting.
- Once an improvement is completed, it will be marked with a green checkbox, along with the closure date and the name of the person who closed it.
Security in operational processes is crucial to protect our products, services, and sensitive information at every stage. It ensures that every step from acquiring to delivering and maintaining our offerings is shielded against potential risks. This assessment outlines the practical measures your organization should take to secure its operations, including:
- Developing and continuously improving a robust security management system.
- Incorporating security into project management to ensure consistent protection.
Since your core activities involve acquiring, serving, and maintaining your products and services, this assessment will help you understand and document how to effectively organize and evaluate security within your operational processes.
Security in Operational Processes is an assessment that should be performed at least once a year and updated whenever significant changes occur in your organization or internal processes. It is crucial to evaluate the operations and the personnel in each department from an operational perspective, including the way project management is run and organized.
Follow these steps to locate and complete the assessment:
Step 1 Locate the Template: Find the Security in Operational Processes Assessment Template in the Compleye Online Templates Section.
Step 2 Understand the Purpose: Know that this document should outline the practical security measures in your operational processes and explain how you protect your products, services, and sensitive information. It also evaluates the project management approach and security measures within it.
Step 3 Review the Structure: Familiarize yourself with the main sections, including overall purpose, process descriptions, interactions, and risk management measures for each function (e.g., Marketing, Sales, Board, Finance/HR, Technical).
Step 4 Gather Information: Collect details about current security practices, process owners, and team members. Document how each department manages security, including the tools and procedures they use.
Step 5 Fill in the Details: For each section, add the necessary information (e.g., owner names, specific processes, and risk management measures). Use the provided table as a template for each office facility or department.
Step 6 Integrate Security into Projects: Include how security is incorporated into your project management workflows. Note the tools and checkpoints used to monitor security at every phase.
Step 7 Add Examples and Tips: Utilize the examples and tips provided in the table to guide you. Customize these as needed for your organization.
Step 8 Review & Approval: Once completed, have the document reviewed by the relevant stakeholders and approved by C-Level Management. This should include an approval of the identified findings.
Step 9 Upload the Document: After final adjustments, upload the document to the ‘BCP Section’ as a new entry. Record the findings and improvements created, following the instructions provided in the ‘BCP Section’ for creating new entries, recording findings, and creating improvements based on those findings.
Key Tips for Completing the Security in Operational Processes Assessment:
- The assessment should comprehensively cover security measures implemented at every stage of the operational lifecycle, ensuring that security is embedded from acquisition to delivery and maintenance.
- Ensure that security is incorporated into every step of the project management process. This includes pre-planning, development, delivery, and post-delivery maintenance phases.
- Create and enforce specific security checkpoints within your project management tools. These should serve as mandatory security reviews at key stages of the project.
- The assessment should offer a holistic view of security practices across all departments and operational processes. This ensures that all aspects of your organization’s operations are covered.
- Detail the security practices used by each department, whether it’s marketing, HR, finance, or technical teams. Identify overlaps or gaps in security coverage.
- Involve relevant departments and key team members in gathering information about the security measures they currently use.
- Conduct interviews or surveys to collect detailed insights from process owners about the tools and practices they rely on to maintain security.
- Avoid siloing security practices within individual departments. Security should be a collaborative effort across all functions within the organization, ensuring cohesive risk management.
