Business Continuity and Risk Management : Essentials of Organizational Resilience

**If You re New to Business Continuity Planningor Want a Thorough Corporate Training Toolwith a Variety of Instructional Aids****5 REASONS You ll Want the Most Comprehensive and Up to DateBusiness Continuity Handbook Available (c2012):****1) State-of-the-art exposition of the global body of knowledge for Business Continuity Management and Risk Management,**__including current international standards and best practices.__**2) Flexible, modular design that allows you to customize your own self-study plan:**Ten chapters cover fundamental principles and practices; three chapters give greater detail on Information Technology and Emergency Management if your work focuses in these areas; and four chapters explain Risk Modeling if you want a foundation in the statistical underpinnings of risk management.**3) Comprehensive training package for professional development classes, including instructor materials:**test bank, syllabi, PowerPoint slides, and sample solutions to case studies, discussions, and end-of-chapter questions. Two of the case studies are integrated throughout the text to give managers experience in applying chapter principles to a service company and a manufacturer.**4) Holistic coverage of two interfacing fields: Business Continuity,**which tends to deal with consequences, and**Risk Management,**which tends to be preventative. Both The Business Continuity Institute (BCI) and The Institute of Risk Management (IRM) have endorsed the book.**5) Quick desk reference for your BCM team**offering a readable blend of academic principles and practical applications an effective tool for grounding interdepartmental teams learning to develop and maintain BC plans.**Kurt J. Engemann, PhD, CBCP,**is the Director of the Center for Business Continuity and Risk Management and Professor of Information Systems in the Hagan School of Business at Iona College. Dr. Engemann is editor-in-chief of the International Journal of Business Continuity and Risk Management. Professionals from a number of Wall Street banking firms and Fortune 500 companies attend his graduate courses in business continuity and risk management.**Douglas M. Henderson, FSA, CBCP,**is President of Disaster Management, Inc. and has consulting experience of 20+years in all areas of Business Continuity and Emergency Response Management. He is the author of several books and templates for business continuity planning.This is a book that will inform the novice, support the expert and enhance every business continuity planner s efforts to create a resilient organization. The book is well organized as an instructional tool, a reference guide, and a toolkit for practitioners . an executive, a student, or a practitioner who absorbs the content of this book will be better prepared to function in a field where preparedness is absolutely essential.__Thomas D. Phelan, PhD, Program Director, Emergency and Disaster Management and Fire Science at American Public University System; Founding Member of the U.S. Department of Homeland Security__Practitioners constantly emphasize the necessity of a holistic approach and I am pleased to see this new book does just that. It is also important to blend theory with practice in this hands-on field; again this is accomplished by authors who have extensive academic and business continuity and emergency management experience. They bring the subject to life with rich teaching and learning features, making it an essential read for students and practitioners alike.__Phil Kelly, DBA, FHEA, (FIRM); Senior Lecturer, Liverpool (UK) Business School; Lead Examiner, Risk Decisions, The Institute of Risk Management (IRM)__" Cover 2 Title Page 4 Copyright Page 5 Foreword 6 Brief Contents 10 Table of Contents 11 Preface 17 About the Authors 20 Section I: Development 21 Chapter I: Fundamentals of Business Continuity Management 22 Objectives 22 Business Continuity and Risk Management 22 BCM Responsibility 23 BCM Development Process 25 Project Management 27 Professional Standards 28 Professional Terminology 29 Information Technology and Business Continuity 29 Green BCM 30 Review Topics 30 Case Studies 30 Bibliography 31 Chapter II: Business Continuity Management Organization 32 Objectives 32 Overview of BCM Organization 32 Key BCM Individuals and Groups 33 Review Topics 35 Case Studies 35 Bibliography 35 Chapter III: Business Impact Analysis 37 Objectives 37 Organization Objectives and Business Impact Analysis 37 Recovery Time Objective 38 Recovery Point Objective 39 Operations 39 Interdependencies 39 Single-Point-of-Failure 41 Support Infrastructure and Physical Environment Requirements 42 BIA Provides Direction for BCM 43 Review Topics 44 Case Studies 44 Bibliography 46 Chapter IV: Risk Assessment 48 Objectives 48 Risk 48 Threat Identification 50 Controls Identification and Evaluation 51 Event Probability Estimation 55 Impact Estimation 56 Risk Measure Evaluation and Risk Prioritization 58 Risk Treatment 59 Review Topics 61 Case Studies 61 Bibliography 68 Chapter V: Strategy Development 70 Objectives 70 Developing Strategies 70 Selecting Strategies 71 Specific Strategies 73 Implementing Strategies 76 Review Topics 76 Case Studies 76 Bibliography 77 Chapter VI: Disaster Recovery for Information Technology 79 Objectives 79 Overview of Disaster Recovery Planning 79 IT Alternate Site 79 IT Alternate Site Provider 81 IT Alternate Site Location 82 Data Center Controls 83 Data Center Recovery 85 Information Management 85 Information Security 87 Review Topics 87 Case Studies 87 Bibliography 88 Chapter VII: Information Systems Security 90 Objectives 90 The Control Environment 90 Information Systems Auditing Considerations 91 Information Technology and Security Considerations 93 Conclusion 97 Review Topics 97 Bibliography 98 Section II: Implementation 99 Chapter VIII: Emergency Response 100 Objectives 100 Emergency Response Overview 100 Pre-Crisis Activities 101 Actions during the Pre-Strike Phase 104 Actions during the Strike Phase 105 Interfacing with Civil Authorities 106 Review Topics 108 Case Studies 108 Bibliography 109 Chapter IX: Enhancing Coordination with External Agencies 110 Objectives 110 External Relations Overview 110 External Relations throughout the Four Phases: Overview 110 Opportunities to Develop Relationships in the Mitigation and Preparedness Phases 111 External Relations throughout the Four Phases 111 State and Local Government Agencies 113 Non-Government Organizations (NGOs) 116 Review Topics 120 Bibliography 120 Chapter X: Business Continuity Plan 122 Objectives 122 Business Continuity Plan Overview 122 BCP Objectives 123 Organization 124 Requirements 124 Strategies 124 Activation 124 Actions 128 Communication 132 Maintenance 132 Review Topics 132 Case Studies 132 Bibliography 135 Chapter XI: Crisis Communication 136 Objectives 136 Crisis Communication Overview 136 Crisis Communication Team 136 Media Communication 137 Systems and Equipment – Key Features 139 Systems and Equipment – Evaluation 139 Crisis Communication Procedures and Protocols 141 Review Topics 141 Case Studies 141 Bibliography 142 Chapter XII: Crisis Information Management Systems 144 Objectives 144 Systems for Crisis Information Management 144 Information Management during Crisis 144 How Information Technology is Used 146 Social Media In Crisis Communications 150 Institutional Initiatives 152 Review Topics 153 Bibliography 153 Section III: Maintenance 155 Chapter XIII: Sustaining Organizational Resilience 156 Objectives 156 Making BCM EffectiveAwareness and Training 156 Testing and Exercising 157 Maintaining and Updating 160 Review Topics 161 Case Studies 161 Bibliography 162 Section IV: Risk Modeling 163 Chapter XIV: Fundamentals of Probability and Statistics 164 Objectives 164 Fundamentals of Probability and Statistics 164 Graphical Presentation of Data 165 Stem and Leaf Plot 166 Frequency Distributions 166 Measures of Central Tendency 167 Measures of Dispersion 169 Basic Probability Concepts 172 Discrete Probability Distributions 181 Continuous Probability Distributions 184 Review Topics 188 Bibliography 188 Chapter XV: Statistical Applications in Risk Management 189 Objectives 189 Forecasting Techniques 189 Regression Analysis 192 Maintenance Modeling 195 Reliability Modeling 196 Review TopicsBibliography 198 Chapter XVI: Simulation Modeling and Supply Chain Risk 200 Objectives 200 Introduction 200 Case 1: Supply Chain Analysis 203 Case 2: A Three Tier Supply Chain 207 Conclusions 210 Review Topics 210 Bibliography 210 Chapter XVII: Risk and Decision Modeling 212 Objectives 212 Introduction 212 Decision Making Environments 212 Decision Making under Certainty 213 Decision Making under Risk 213 Decision Making under Uncertainty 214 Other Decision Making Models under Uncertainty 216 Recent Approaches 216 Other Decision Making Models 220 Dealing with Imprecise Information 221 Decision Making under Uncertainty and Imprecise Information 223 Review Topics 225 Bibliography 225 Section V: Case Studies 227 Case Study A: Alpha Investment Services 228 Operations 228 Resource Requirements 230 Information Technology 232 Revised Recovery Time Objectives 233 Crisis Communication 234 Case Study B: Beta Widget Makers 236 Operations 236 Resource Requirements 238 Information Technology 241 Revised Recovery Time Objectives 242 Crisis Communication 242 Case Study C: Supply Chain Analysis 244 Supply Chain Analysis 244 Case Study Questions 250 Bibliography 253 Case Study D: Sample Risk Assessment 254 Introduction 254 Risk Analysis 254 Risk Assessment Illustration 256 Probability 261 Expected Disruption 262 Impact 263 Risk Evaluation 263 Review Topics 264 Bibliography 264 Case Study E: Phased Pre-Positioning of Employees 266 Objectives 266 Employee Release Groups 266 Plan of Action 267 Review Topics 268 Bibliography 268 Case Study F: Tabletop Exercise 269 Tabletop Exercise Overview 269 Alpha Investment Services Tabletop Exercise 271 Beta Widget Makers Tabletop Exercise 274 Section VI: Additional Information 279 Glossary 280 Appendices 285 Appendix B: Disaster Assistance Plan 290 Appendix C: Building Fortification 292 Appendix D: Pandemic Outbreak Planning and Response 294 Appendix E: Emergency Operations Center (EOC) 301 Appendix F: Evacuation Procedures 303 Appendix G: Shelter-in-Place Procedures 305 Appendix H: Hurricane Preparation Steps 307 Appendix I: Tornado Preparation Steps 309 Appendix J: Severe Winter Storm Preparation Steps 310 Appendix K: DHS Advisory Code System 312 Appendix L: Assigning Actions by Department 315 Appendix M: National Weather Service Terms 324 Appendix N: Seismic Terms 326 Index 327 If You re New to Business Continuity Planning or Want a Thorough Corporate Training Tool with a Variety of Instructional Aids 5 REASONS You ll Want the Most Comprehensive and Up to Date Business Continuity Handbook Available (c2012): 1) State-of-the-art exposition of the global body of knowledge for Business Continuity Management and Risk Management, including current international standards and best practices. 2) Flexible, modular design that allows you to customize your own self-study plan: Ten chapters cover fundamental principles and practices; three chapters give greater detail on Information Technology and Emergency Management if your work focuses in these areas; and four chapters explain Risk Modeling if you want a foundation in the statistical underpinnings of risk management. 3) Comprehensive training package for professional development classes, including instructor materials: test bank, syllabi, PowerPoint slides, and sample solutions to case studies, discussions, and end-of-chapter questions. Two of the case studies are integrated throughout the text to give managers experience in applying chapter principles to a service company and a manufacturer. 4) Holistic coverage of two interfacing fields: Business Continuity, which tends to deal with consequences, and Risk Management, which tends to be preventative. Both The Business Continuity Institute (BCI) and The Institute of Risk Management (IRM) have endorsed the book. 5) Quick desk reference for your BCM team offering a readable blend of academic principles and practical applications an effective tool for grounding interdepartmental teams learning to develop and maintain BC plans. Kurt J. Engemann, PhD, CBCP, is the Director of the Center for Business Continuity and Risk Management and Professor of Information Systems in the Hagan School of Business at Iona College. Dr. Engemann is editor-in-chief of the International Journal of Business Continuity and Risk Management. Professionals from a number of Wall Street banking firms and Fortune 500 companies attend his graduate courses in business continuity and risk management. Douglas M. Henderson, FSA, CBCP, is President of Disaster Management, Inc. and has consulting experience of 20+years in all areas of Business Continuity and Emergency Response Management. He is the author of several books and templates for business continuity planning. This is a book that will inform the novice, support the expert and enhance every business continuity planner s efforts to create a resilient organization. The book is well organized as an instructional tool, a reference guide, and a toolkit for practitioners . an executive, a student, or a practitioner who absorbs the content of this book will be better prepared to function in a field where preparedness is absolutely essential. Thomas D. Phelan, PhD, Program Director, Emergency and Disaster Management and Fire Science at American Public University System; Founding Member of the U.S. Department of Homeland Security Practitioners constantly emphasize the necessity of a holistic approach and I am pleased to see this new book does just that. It is also important to blend theory with practice in this hands-on field; again this is accomplished by authors who have extensive academic and business continuity and emergency management experience. They bring the subject to life with rich teaching and learning features, making it an essential read for students and practitioners alike. Phil Kelly, DBA, FHEA, (FIRM); Senior Lecturer, Liverpool (UK) Business School; Lead Examiner, Risk Decisions, The Institute of Risk Management (IRM) " As an instructor, you have seen business continuity and risk management grow exponentially, offering an exciting array of career possibilities to your students. They need the tools needed to begin their careers -- and to be ready for industry changes and new career paths. You cannot afford to use limited and inflexible teaching materials that might close doors or limit their options. Written with your classroom in mind,Business Continuity and Risk Management: Essentials of Organizational Resilience is the flexible, modular textbook you have been seeking -- combining business continuity and risk management. Full educator-designed teaching materials available for download.From years of experience teaching and consulting in Business Continuity and Risk, Kurt J. Engemann and Douglas M. Henderson explain everything clearly without extra words or extraneous philosophy. Your students will grasp and apply the main ideas quickly. They will feel that the authors wrote this textbook with them specifically in mind -- as if their questions are answered even before they ask them.Covering both Business Continuity and Risk Management and how these two bodies of knowledge and practice interface, Business Continuity and Risk Management: Essentials of Organizational Resilience is a state-of-the-art textbook designed to be easy for the student to understand -- and for you, as instructor, to present.Flexible, modular design allows you to customize a study plan with chapters covering:Business Continuity and Risk principles and practices.Information Technology and Information Security.Emergency Response and Crisis Management.Risk Modeling – in-depth instructions for students needing the statistical underpinnings in Risk Management.Global Standards and Best PracticesTwo real-world case studies are integrated throughout the text to give future managers experience in applying chapter principles to a service company and a manufacturer.Chapter objectives, discussion topics, review questions, numerous charts and graphs.Glossary and Index.Full bibliography at the end of each chapter.Extensive, downloadable classroom-tested Instructor Resources are available for college courses and professional development training, including slides, syllabi, test bank, discussion questions, and case studies.Endorsed by The Business Continuity Institute (BCI) and The Institute of Risk Management (IRM).QUOTES'It's difficult to write a book that serves both academia and practitioners, but this text provides a firm foundation for novices and a valuable reference for experienced professionals.'--Security Management Magazine'The authors...bring the subject to life with rich teaching and learning features, making it an essential read for students and practitioners alike.'– Phil AUTHOR BIOSKurt J. Engemann, PhD, CBCP, is the Director of the Center for Business Continuity and Risk Management and Professor of Information Systems in the Hagan School of Business at Iona College. He is the editor-in-chief of the International Journal of Business Continuity and Risk ManagementDouglas M. Henderson, FSA, CBCP, is President of Disaster Management, Inc., and has 20+ years of consulting experience in all areas of Business Continuity and Emergency Response Management. He is the author of Is Your Business Ready for the Next Disaster? and a number of templates. Annotation This is the first core textbook specifically designed for senior undergraduate and graduate college courses in business continuity and risk management. Extensively classroom tested, it offers everything instructors need to start a new course or enhance the one they teach�text, test bank, PowerPoint slides, case studies, review topics, discussion questions, bibliographies, and more. The modular design of the text allows flexibility in structuring a core course with the first ten chapters; focus in greater depth on information systems or emergency management with three additional chapters; or incorporate a comprehensive risk management approach with a Risk Modeling module of four chapters. Two of the six case studies are fictional businesses that continue chapter by chapter to help students gain experience in applying each chapter¿s principles to an organization. The first ten chapters cover the fundamentals of business continuity plan development, implementation, and maintenance, including crisis communication and crisis information management systems. The text is also appropriate for corporate professional development classes