OPPapers.com

Singapore

[pic]

Rôles and responsibilities

for

contingency planning

Version 1

July 2008

Dr Gary Hinson PhD CISSP, CISM, CISA, MBA,
CEO of IsecT Ltd.

And

Larry Kowalski, CISSP, ITIL
Cybersecurity DR Program Office, IRS

Contents

Section Page

1 Introduction 3

1.1 Background, concepts and key terms 3

1.2 Scope and applicability of this document 4

1.3 Using this document – an important caveat 4

2 Contingency Planning (CP) rôles and responsibilities 5

2.1 CP Manager 5

2.2 CP Compliance Manager 5

2.3 CP Office 6

3 Business Continuity Planning (BCP) and Business Resumption Planning (BRP) rôles and responsibilities 7

3.1 BCP Manager 7

3.2 BRP Manager 7

3.3 BCP/BRP office 8

4 IT Disaster Recovery Planning (DRP) rôles and responsibilities 9

4.1 IT DRP Manager 9

4.2 IT DR Compliance Manager 9

4.3 IT DRP Test and Exercise Coordinator 10

4.4 IT DRP Development & Technical Assessment Manager 11

4.5 IT DR Office 11

5 Other CP-related rôles and responsibilities 12

5.1 Incident Management rôles 12

5.2 Crisis Management rôles 12

5.3 Incident and Crisis Management deputies, succession planning and job rotation 13

5.4 Information Asset Owners (IAOs) 13

5.5 Custodians 13

5.6 BC Operations functions 14

5.7 IT DR Operations functions 14

6 References and further reading 14

7 Feedback on this document 15

8 Acknowledgement 15

9 Copyright notice and disclaimer 15

Introduction

1 Background, concepts and key terms

The fundamental basis of Contingency Planning (CP) is that, since all risks cannot be totally eliminated in practice, residual risks always remain. Despite the organization’s very best efforts to avoid, prevent or mitigate them, incidents will still occur. Particular situations, combinations of adverse events or unanticipated threats and vulnerabilities may conspire to bypass or overwhelm even the best information security...