April 2000 January, 2000 Chart #1 - Rating Criteria Business Recovery Planning Status Report Chart #1 Zone 1: The BRP process has started. The area has demonstrated some effort to identify critical processes, document procedures Organizations Zone 1 Zone 2 Zone 3 Zone 4 Zone 5 and have reviewed their BRP development plans with the BRP Director. BRP issues of backup, alternate sites and team members have not been addressed yet. Recovery probability is very low. Acquistions Group Pension Zone 2: The program is moving in the right direction. Critical processes and levels of disruption have been identified. Notification procedures are being addressed. Progress is evident in team selection, relocation, documentation and training. Overall, the Life Insurance - LA program is taking shape, but needs more depth. Given the right circumstances, the chance of recovering business operations in a Life Insuance Division - K.C. timely manner is fair. Living Benefits Medicare Zone 3: The program is well documented and team members work well together in simulated disasters and business recovery scenarios. The area is committed to maintaining the program at a high level of readiness. The chances of recovering from a real Reinsurance event are good. Structured Settlements Assurance Co. Zone 4: The BRP process includes LAN recovery, mainframe issues: protection and recovery. The BRP process has become a normal part of managing. The area maintains its own plan and regularly rehearses its team members and procedures with Financial Resources simulated disaster recovery tests. Review and assistance from the BRP Director is rarely required. Team members are proactive at Administrative Services preventing disasters, while remaining ready to recover from one, should it occur. Corporate Relations Financial - Accounting / Treasurers Zone 5: The BRP process provides all of the above. Processes and operations are viewed from a crisis avoidance perspective. Employees are alert to the signs of potential crises and are skilled at preventing and/or taking advantage of them. The program is DCA - Systems Recovery # highly integrated with all other emergency response and recovery programs. This program level avoids disasters, learns from CTL - BRP others mistakes and seeks continuous improvement throughout the area by avoiding operational problems. DCS - BRP Law Life of N.Y. Life of Canada Chart #2 1. Critical Process 2. Disruption Levels 3. Notification Procedures 4. Relocation Options 5. Completed Checklists 6. Plan/People Tested 7. Overall Rating Organizations 1 2 3 1 2 3 1 2 3 1 2 3 1 2 3 1 2 3 1 2 3 Acquisitions Medicare Assurance Co. CTL - BRP DCS - BRP Life of Canada * Changes this month Distribution: Senior Management Council and Business Recovery Planning Coordinators #DCS - Systems Recovery refers to recovery of mainframe computing services only. Chart # 2 - Rating Criteria 1. Critical Processes The BRP must include the identification, prioritization, length of time an outage can be tolerated (if applicable) and how the processes and components, (specific programs, data or critical personnel) are being protected and/or backed up. Zone 1 – A listing of critical processes has started, but priorities and details have not been determined or documented. 2 – Processes have been identified and prioritized, but details on protection and key personnel have not been completed. 3 – All critical processes have been prioritized and details of outages, backup/protection and key personnel have been documented. 2 – Disruption Levels The BRP must provide for a variety of disaster situations and scenarios from minor to major in impact and duration on the business. Zone 1 – Some documentation exists, but various levels of disaster have not been adequately addressed. 2 – Several different levels of disruption and associated plans have been attempted, but details are missing. More work is required. 3 – Many different levels of disruption have been provided for and are well documented. 3 – Notification Procedures The BRP must provide for the notification of key personnel during and after work hours. Notification procedures must include how the BRP will be activated. Phone trees are expected and alternate methods of notification and communication should be detailed in the plan. Zone 1 – Some attempt has been made to identify key contacts, but numbers and methods are incomplete. 2 – Key personnel and phone trees are available, but plan activation and alternate communication methods are not detailed in the plan. 3 – All key contacts, phone numbers, activation procedures and alternate communication methods have been adequately documented in the plan. 4 – Relocation Options The BRP must provide for one or more options for relocation of the line, sub-line, etc., including requirements for employees, equipment and locations. When possible, each plan should utilize the resources of its own organization (branch or satellite offices, etc.). Zone 1 – Some data has been provided but it lacks credibility and procedures are missing for acquiring space or moving to the alternate location. 2 – Requirements have been detailed but procedures are insufficient to successfully implement the plans as designed. 3 – Requirements are detailed and associated procedures and options are acceptable to provide a reasonable chance of success under each of the various levels of disruption. 5 – Completed Checklists The BRP must include one or more checklists for each key employee required to manage any of the BRP processes: Preventing/Preparing for disasters, Responding and/or Recovering from a catastrophic event affecting their business functions. Zone 1 – Checklists have been indicated, but usable details are lacking. 2 – Checklists are defined and primary and alternate parties have been listed, but more task details and levels of disruption need to be provided. 3 – Checklists, key personnel and tasks have been defined. Multiple scenarios and levels of disruption are detailed. 6 – Tested The BRP teams must clearly demonstrate a working knowledge of their plan and knowledge about processes/concepts of BRP. Teams must be tested yearly and have demonstrated success at implementing their plans under a variety conditions and levels of disruption. Zone 1 – Team members incomplete. No training or testing has been initiated. 2 – Team members selected. Minimal education, inadequate testing and training. Team is not ready for the real event. 3 – Team members selected, trained and tested frequently. Team works well together and is capable of handling successfully a real event. 7 – Overall Rating This category combines the BRP documentation with the skill and knowledge of the team members. Documentation should be complete and usable, team members skilled and experienced and senior management involved in team testing and approval of the written documentation. Zone 1 – BRP is name only. Minimal documentation and/or no viable BRP team. 2 – Plan and team are barely adequate. Only very experienced primary team members could recover given the state of the program. Few others in the organization would be of any help. But they have a small chance of success. Limited involvement from Senior Management. 3 – All documentation is detailed and accurate. Teams and procedures are nicely integrated. Senior Management is heavily involved. Team members (primaries and alternates) are well trained and frequently tested. They have shown excellent results during tests. Team members, Senior Management and their plans are as ready as they can be for a real event.
Pages to are hidden for
"BRP Status Report"Please download to view full document