IT Management Reference Guide

Just as IT professionals have a language all their own that few outside of IT may fully understand, so also do business continuity planners. IT managers need to know some of the basic terms and conditions associated with business continuity to enact meaningful communication with these planners. This week's update offers 15 of the most common terms and definitions surrounding business continuity. Many IT managers entrust business continuity planners with providing viable recovery plans for critical IT systems. Knowing how to speak the language of business continuity is a basic but essential necessary for IT managers and the following 15 terms and definitions help to satisfy this requirement.

1. Business Continuity Plan A business continuity plan describes the steps an enterprise would take to ensure the continuous operation of its critical business processes. The plan contains required resources – human, software and hardware – and contact lists, and should be tested at least annually.
2. Business Continuity Program A business continuity program is an executive-sponsored initiative to staff a business continuity function. The function is headed up by a business continuity manager who coordinates the conducting of a business impact analysis to derive business recovery strategies from which business continuity plans are developed and tested.
3. Business Impact Analysis (BIA) A business impact analysis is an evaluation performed for each business unit within an enterprise in which critical business processes, along with their essential input and output dependencies, are identified and prioritized according to their business impact.
4. Contingency Planning Contingency planning involves anticipating various types of disaster scenarios, and then developing appropriate plans to effective deal with the event. Contingency planning differs from business continuity planning in that the former emphasizes health and safety issues and having multiple scenarios happen at once, while the latter emphasizes business recovery (although impacts to life, limb and property are included) from typically a single disastrous event.
5. Emergency Preparedness Emergency preparedness entails proactively coordinating the response to an emergency situation with appropriate support groups. These groups include suppliers, facilities departments and local public safety agencies such as police, fire and medical services departments.
6. Emergency Response Team (ERT) An emergency response team may be either internal or external. An internal ERT is a group of employees selected and trained to coordinate the initial response, such as a building evacuation, to a company emergency such as a fire alarm. An external ERT includes local public safety agencies such as building inspectors, hazard materials personnel and police and fire departments.
7. First Responders First responders are those individuals who are designated to initially assess the impact and damage of a disaster, and to coordinate relief efforts. Within a company first responders are usually coordinated through the business continuity group and may include either internal or external response teams.
8. Recovery Point Objective (RPO) A recovery point objective is one of two (along with RTO) common business continuity metrics. RPO describes the point in time to which systems and data must be recovered after a sustained outage. For example, if the RPO is four hours, then data must be backed up or replicated at least every four hours to ensure that no more than fours of data is lost.
9. Recovery Time Objective (RTO) A recovery time objective is the other (along with RPO) common business continuity metric. An RTO is the maximum period of time within systems, applications or business processes must be restored to full operation. The relationship of RPO to RTO is sometimes depicted as having an RPO move backwards in time from the moment of a disaster while the RTO moves forward in time.
10. Risk Assessment Risk assessment involves identifying and measuring the threats and vulnerabilities to the continuous operation of critical processes within the environment of an organization.
11. Risk Management Risk management entails comparing the amount of risk a company faces to the continuous operation of its critical processes to the quantities of time and costs required to mitigate such risks.
12. Single Point of Failure A single point of failure is an essential component to a critical system, application or process for which there is no backup or alternative. A sound business continuity program attempts to identify and eliminate all single points of failure.
13. Threat Analysis Threat analysis is the identification and quantification of those risks caused with malicious human intent such as vandalism, theft, sabotage or terrorism.
14. Vital Records Vital records are documents or files that are critical to business processes and must be preserved and made available for retrieval when needed.
15. Vulnerability Analysis Vulnerability analysis is the identification and quantification of those risks caused by natural or man-made disasters such as earthquakes, floods, hurricanes or power outages.

These are 15 of the most common terms and definitions used within the arena of business continuity. Knowing and understanding these expressions and their meanings will enable you communicate more effectively with your business continuity planners as they plan and implement your recovery strategies.