BS25999
BS25999 Part 1 - Code of Practice
Business Continuity Glossary | Business Continuity Glossary |
|
|
|
|
BS 25999-1:2006 has its own list of terms and definitions that pertain to the standard itself and users should pay close attention to them. Like any industry, business continuity management has its own set of jargon, terms, definitions and acronyms. Read on for a consolidated glossary and details of where to find more
Each organisation will no doubt have its own terminology and jargon but it is vital that all those participating in the business continuity management process know what each of these mean
Although BS25999 specifically excludes emergency management business continuity managers should have some knowledge of the emergency management processes and procedures in place in their country as they will often need to liaise with the emergency services. The glossary below combines business continuity and emergency management terminology from a number of sources aACTION LISTS A specific IS Service Continuity Management term referring to defined actions, allocated to recovery teams & individuals, within a phase of a plan ACTIVATION The implementation of business continuity capabilities, procedures, activities, and plans in response to an emergency or disaster declaration; the execution of the recovery plan ACTIVITY Processes carried out by an organisation, for example Accounts (also see Business Activity)
ACCESS OVERLOAD CONTROL (ACCOLC) bBACKLOG a) The amount of work that accumulates when a system or process is unavailable for a long period of time. This work needs to be processed once the system or process is available and may take a considerable amount of time to process. b) A situation whereby a backlog of work requires more time to action than is available through normal working patterns. In extreme circumstances, the backlog may become so marked that the backlog cannot be cleared. BACKLOG TRAP The effect on the business of a backlog of work that develops when a system or process is unavailable for a long period, and which may take a considerable length of time to reduce BACK-OUT PLAN A plan that documents all actions to be taken to restore the service if the associated Change or Release fails or partially fails BACKUP (Data) A process, by which data, electronic or paper based, is copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted. BACKUP GENERATOR An independent source of power, usually fuelled by diesel or natural gas BATTLE BOX A container in which data, information and other essentials is stored so as to become readily available to those responding to an incident BENCHMARKING A form of comparison usually between the activities of one organisation and those of one or more comparable external organizations BODY HOLDING AREA An area close to the scene of an emergency where the dead can be held temporarily before transfer to the emergency mortuary or mortuary BRONZE Operational level is the level at which the management of hands-on work is undertaken at the incident site or impacted areas BSA Bomb Shelter Area; Internal area that offers protection from blast, flying glass and other fragments BS15000 The British Standards Institution 'Specification for IS service management'. BUILDING DENIAL Any damage, failure or other condition which causes denial of access to the building or the working area within the building, e.g. fire, flood, contamination, loss of services, air conditioning failure, forensics BUSINESS ACTIVITY A group of activities/processes undertaken by an organisation to produce a product and/or service and/or in pursuit of a common goal BUSINESS ACTIVITY LEVELS The predicted or historic levels of business method activity that are to be or have been supported by the IS infrastructure. Measured in business terms (e.g. number of account holders) BUSINESS CONTINUITY A pro-active process which identifies the key functions of an organisation and the likely threats to those functions BUSINESS CONTINUITY MANAGEMENT (BCM) A holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. Also the management of the overall program through training, rehearsals, and reviews, to ensure the plan stays current and up to date. BUSINESS CONTINUITY MANAGEMENT ACTIVITY An action or series of actions that forms part of the BCM process BUSINESS CONTINUITY MANAGEMENT CO-ORDINATOR A member of the business continuity management team who is assigned the overall responsibility for co-coordinator of the recovery planning programme including team member training, testing and maintenance of recovery plans. (Associated terms: business recovery planner, disaster recovery planner, business recovery co-coordinator, disaster recovery administrator) BUSINESS CONTINUITY MANAGEMENT LIFECYCLE The activities and processes divided into various stages that are necessary to manage business continuity BUSINESS CONTINUITY MANAGEMENT MATURITY The level and degree to which business continuity activities have become standard and assured practices within the organisation BUSINESS CONTINUITY MANAGEMENT PLAN A collection of procedures and information which is developed, compiled and maintained in readiness for use in the event of an emergency or disaster BUSINESS CONTINUITY MANAGEMENT PLANNING The advance planning and preparations which are necessary to identify the impact of potential losses; to formulate and implement viable recovery strategies; to develop recovery plan(s) which ensure continuity of organisational services in the event of an emergency or disaster; and to administer a comprehensive training, testing and maintenance programme BUSINESS CONTINUITY MANAGEMENT POLICY A BCM policy sets out an organisations aims, principles & approach to BCM, what & how it will be delivered, key roles & responsibilities & how BCM will be governed & reported upon. BUSINESS CONTINUITY MANAGEMENT PROGRAMME An ongoing management & governance method supported by senior management & resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies & plans, & ensure continuity of products/services through exercising, rehearsal, testing, training, maintenance & assurance BUSINESS CONTINUITY MANAGEMENT STRATEGY An approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage BUSINESS CONTINUITY MANAGEMENT TEAM A group of individuals functionally responsible for directing the development and execution of the business continuity plan, as well as responsible for declaring a disaster and providing direction during the recovery process, both pre-disaster and post-disaster BUSINESS CONTINUITY PLAN A clearly defined and documented plan BUSINESS CRITICAL POINT The latest moment at which the business can afford to be without a critical function or process. BUSINESS CRITICAL FUNCTIONS Critical operational or support activities BUSINESS IMPACT ANALYSIS (BIA) A management level analysis which identifies the impacts of losing company resources. The BIA measures the effect of resource loss and escalating losses over time in order to provide senior management with reliable data upon which to base decisions on risk mitigation and continuity planning. BUSINESS INTERRUPTION Any event, whether anticipated (i.e., public service strike) or unanticipated (i.e., blackout) which disrupts the normal course of business operations at an organization’s location BUSINESS INTERRUPTION COSTS The impact to the business caused by different types of outages, normally measured by revenue lost BUSINESS INTERRUPTION INSURANCE Insurance coverage for disaster related expenses that may be incurred until operations are fully recovered after a disaster BUSINESS RECOVERY COORDINATOR An individual or group designated to coordinate or control designated recovery processes or testing BUSINESS RECOVERY TIMELINE The chronological sequence of recovery activities, or critical path, that must be followed to resume an acceptable level of operations following a business interruption. This timeline may range from minutes to weeks, depending upon the recovery requirements and methodology BUSINESS RECOVERY TEAM A group of individuals responsible for maintaining the business recovery procedures and coordinating the recovery of business functions and processes BUSINESS UNIT RECOVERY A component of Business Continuity which deals specifically with the recovery of a key function or department in the event of a disaster cCALL TREE A document that graphically depicts the calling responsibilities and the calling order used to contact management, employees, customers, vendors, and other key contacts in the event of an emergency, disaster, or severe outage situation CALL TREE CASCADE TEST A test designed to validate the currency of contact lists & the processes by which they are maintained CAPABILITY Originally a military term which includes the aspects of personnel, equipment, training, planning and operational doctrine, now used to mean a demonstrable capacity or ability to respond to and recover from a particular threat or hazard CASCADE SYSTEM A system whereby one person or organization calls out/contacts others who in turn initiate further call-outs/contacts as necessary. Similar Terms: Contact List, Call Tree CASUALTY BUREAU The purpose of the Casualty Bureau is to provide the initial point of contact for the receiving and assessing of information relating to persons believed to be involved in the emergency. The primary objectives of a Casualty Bureau are: inform the investigation process relating to the incident; trace and identify people involved in the incident; and reconcile missing persons and collate accurate information in relation to the above for dissemination to appropriate parties CATEGORY 1 RESPONDER A person or body listed in Part 1 of Schedule 1 to the UK Civil Contingencies Act. These bodies are likely to be at the core of the response to most emergencies. As such, they are subject to the full range of civil protection duties in the Act. Examples of Category 1 responders include the emergency services and local authorities CATEGORY 2 RESPONDER A person or body listed in Part 3 of Schedule 1 to the UK Civil Contingencies Act. These are co-operating responders who are less likely to be involved in the heart of multi-agency planning work, but will be heavily involved in preparing for incidents affecting their sectors. The Act requires them to co-operate and share information with other Category 1 and 2 responders. Examples of Category 2 responders include utilities and transport companies. CBRN Chemical, Biological, Radiological & Nuclear. Chemical, biological and radiological incidents involve both the release of the corresponding material and threats, hoaxes and false alarms. A nuclear incident would involve the detonation of a nuclear weapon or an improvised nuclear device CERTIFICATION The formal evaluation of an organisation's processes by an independent & accredited body against a defined standard & the issuing of a certificate indicating conformance CHANGE CONTROL The procedures to ensure that all Changes are controlled, including the submission, recording, analysis, decision making, approval, implementation & post-implementation review of the change CHECKLIST a) Tool to remind and /or validate that tasks have been completed and resources are available, to report on the status of recovery. b) A list of items (names or tasks etc.) to be checked or consulted. CHECKLIST EXERCISE A method used to exercise a completed disaster recovery plan. This type of exercise is used to determine if the information such as phone numbers, manuals, equipment, etc. in the plan is accurate and current. CIVIL CONTINGENCIES ACT The Civil Contingencies Act 2004 establishes a single framework for civil protection in the United Kingdom. Part 1 of the Act establishes a clear set of roles and responsibilities for local responders. Part 2 modernises the emergency powers framework in the United Kingdom
CIVIL EMERGENCY
CRITICAL ACTIVITY dDAMAGE ASSESSMENT The process of assessing damage to computer hardware, vital records, office facilities, etc. and determining what can be salvaged or restored and what must be replaced following a disaster DATA BACKUPS The copying of production files to media that can be stored both on and/or offsite and can be used to restore corrupted or lost data or to recover entire systems and databases in the event of a disaster DATA BACKUP STRATEGIES Data backup strategies will determine the technologies, media and offsite storage of the backups necessary to meet an organizations data recovery and restoration objectives DATA CENTER RECOVERY The component of Disaster Recovery which deals with the restoration of data centre services and computer processing capabilities at an alternate location and the migration back to the production site DATA MIRRORING A process whereby critical data is replicated to another device DATA PROTECTION Process of ensuring confidentiality, integrity and availability of data DATA RECOVERY The restoration of computer files from backup media to restore programs and production data to the state that existed at the time of the last safe backup DATABASE REPLICATION The partial or full duplication of data from a source database to one or more destination databases DECISION POINT The latest moment at which the decision to invoke emergency procedures has to be taken in order to ensure the continued viability of the enterprise DECLARATION (OF DISASTER) A formal statement that a state of disaster exists. DECLARATION FEE A fee charged by a Commercial Hot Site Vendor for a customer invoked disaster declaration DELEGATION A formal agreement whereby one organisations functions will be carried out by another DENIAL OF ACCESS The inability of an organization to access and/or occupy its normal working environment DEPENDENCY The reliance or interaction of one activity or process upon another DESKTOP EXERCISE See: Table Top Exercise. DISASTER A sudden, unplanned catastrophic event causing unacceptable damage or loss DISASTER RECOVERY (DR) The process of returning a business function to a state of normal operations either at an interim minimal survival level and/or re-establishing full scale operations DISASTER RECOVERY OR BUSINESS CONTINUITY COORDINATOR A role of the BCM program that coordinates planning and implementation for overall recovery of an organization or unit(s) DISASTER RECOVERY PLAN (DRP) OR RECOVERY PLAN A plan to resume, or recover, a specific essential operation, function or process of an enterprise DISASTER RECOVERY PLANNING The technical component of business continuity planning DISASTER RECOVERY SOFTWARE An application program developed to assist an organization in writing a comprehensive disaster recovery plan DISASTER RECOVERY TEAMS (Business Recovery Teams) A structured group of teams ready to take control of the recovery operations if a disaster should occur DISK MIRRORING Disk mirroring is the duplication of data on separate disks in real time to ensure its continuous availability, currency and accuracy. Disk mirroring can function as a disaster recovery solution by performing the mirroring remotely. True mirroring will enable a zero recovery point objective. Depending on the technologies used, mirroring can be performed synchronously, asynchronously, semi-synchronously, or point-in-time
DISRUPTION eELECTRONIC VAULTING Electronic transmission of data to a server or storage facility EMERGENCY An actual or impending situation that may cause injury, loss of life, destruction of property or interfere with normal business operations to such an extent to pose a threat of disaster EMERGENCY (UK) An event of situation that threatens serious damage to human welfare in a place in the UK or to the environment of a place in the UK, or war or terrorism which threatens serious damage to the security of the UK. To constitute an emergency this event or situation must require the implementation of special arrangements by one or more Category 1 responder. EMERGENCY CONTROL CENTRE The location from which disaster recovery is directed and tracked; it may also serve as a reporting point for deliveries, services, press and all external contacts EMERGENCY COORDINATOR The person designated to plan, exercise, and implement the activities of sheltering in place or the evacuation of occupants of a site with the first responders and emergency services agencies EMERGENCY DATA SERVICES Remote capture and storage of electronic data, such as journaling, electronic vaulting and database shadowing EMERGENCY MANAGEMENT TEAM The group of staff who command the resources needed to recover the enterprises operations EMERGENCY MANAGEMENT PLAN A plan which supports the emergency management team by providing them with information and guidelines EMERGENCY OPERATIONS CENTER (EOC) A site from which response teams/officials (municipal, county, state and federal) provide direction and exercise control in an emergency or disaster EMERGENCY PLANNING (EP) Development and maintenance of agreed procedures to prevent, reduce, control, mitigate and take other actions in the event of an emergency. EMERGENCY PREPAREDNESS The capability that enables an organization or community to respond to an emergency in a coordinated, timely, and effective manner to prevent the loss of life and minimize injury and property damage EMERGENCY PROCEDURES A documented list of activities to commence immediately to prevent the loss of life and minimize injury and property damage EMERGENCY RESPONSE The immediate reaction and response to an emergency situation commonly focusing on ensuring life safety and reducing the severity of the incident EMERGENCY RESPONSE PLAN A documented plan usually addressing the immediate reaction and response to an emergency situation EMERGENCY RESPONSE PROCEDURES The initial response to any event and is focused upon protecting human life and the organizations assets EMERGENCY RESPONSE TEAM (ERT) Qualified and authorized personnel who have been trained to provide immediate assistance EMERGENCY SERVICES Usually refers to the civil services of Police, Fire & Ambulance ESCALATION Passing information and/or requesting action on an Incident, Problem or Change to more senior staff (hierarchical escalation) or other specialists (functional escalation) The circumstances in which either vertical escalation for information/authority to apply further resources or horizontal escalation for greater functional involvement need to be precisely described, so that the purpose of the escalation & the nature of the required response is absolutely clear to all parties as the escalation occurs. Escalation rules will be geared to priority targets. Functional Escalation is sometimes called Referral ENTERPRISE An organisation, a corporate entity; a firm, an establishment, a public or government body, department or agency; a business or a charity ENTERPRISE WIDE PLANNING The overarching master plan covering all aspects of business continuity within the entire organization EVACUATION The movement of employees, visitors and contractors from a site and/or building to a safe place (assembly area) in a controlled and monitored manner at time of an event EVENT Any occurrence that may lead to a business continuity incident EXCEPTION REPORTING Reducing the Management Information produced to that which most demands or deserves attention. The Top Ten style of list is an example. EXECUTIVE / MANAGEMENT SUCCESSION PLAN A predetermined plan for ensuring the continuity of authority, decision-making, and communication in the event that key members of executive management unexpectedly become incapacitated EXERCISE A people focused activity designed to execute business continuity plans and evaluate the individual and/or organization performance against approved standards or objectives. Exercises can be announced or unannounced, and are performed for the purpose of training and conditioning team members, and validating the business continuity plan. Exercise results identify plan gaps and limitations and are used to improve and revise the Business Continuity Plans EXERCISE AUDITOR An appointed role that is assigned to assess whether the exercise aims / objectives are being met and to measure whether activities are occurring at the right time and involve the correct people to facilitate their achievement EXERCISE CONTROLLER See Exercise Owner EXERCISE COORDINATOR They are responsible for the mechanics of running the exercise EXERCISE OBSERVER An exercise observer has no active role within the exercise but is present for awareness and training purposes. An exercise observer might make recommendations for procedural improvements. EXERCISE OWNER An appointed role that has total management oversight and control of the exercise and has the authority to alter the exercise plan EXERCISE PLAN A plan designed to periodically evaluate tasks, teams, and procedures that are documented in business continuity plans to ensure the plans viability. This can include all or part of the BC plan, but should include mission critical components EXPOSURE The potential susceptibility to loss; the vulnerability to a particular risk EXTRA EXPENSE The extra cost necessary to implement a recovery strategy and/or mitigate a loss. An example is the cost to transfer inventory to an alternate location to protect it from further damage, cost of reconfiguring lines, overtime costs, etc. Typically reviewed during BIA and is a consideration during insurance evaluation. fFACILITIES MANAGEMENT (FM) The function that manages all aspects of an organisations real estate assets & infrastructure FAILURE A failure occurs when a functional unit is no longer fit for purpose. FALLBACK Another term for alternative e.g. a fallback facility is another site/building that can be use when the original site/building is unusable or unavailable. FAULT TOLERANCE The ability of a service to continue when a failure occurs FAMILY ASSISTANCE CENTRES A one-stop-shop for survivors, families, friends and all those affected by the emergency, through which they can access support, care and advice. FILE SHADOWING The asynchronous duplication of the production database on separate media to ensure data availability, currency and accuracy FIRST LEVEL SUPPORT The technical & managerial resources within the Service Desk available at the initial point of contact with the Customer/User FINANCIAL IMPACT An operating expense that continues following an interruption or disaster, which as a result of the event cannot be offset by income and directly affects the financial position of the organization FLOOR WARDEN Person responsible for ensuring that all employees, visitors and contractors evacuate a floor within a specific site FORWARD RECOVERY The process of recovering a database to the point of failure by applying active journal or log data to the current backup files of the database FULL REHEARSAL An exercise that simulates a Business Continuity event where the organization or some of its component parts are suspended until the exercise is completed gGAP ANALYSIS A detailed examination to identify risks associated with the differences between Business/Operations requirements and the current available recovery capabilities GOLD Strategic decision makers and groups at the local level. They establish the framework within which operational and tactical managers work in responding to and recovering from emergencies hHAND-CARRIED BOMB Any type of portable bomb, usually contained in a form that would blend easily with the target surroundings, for example, suitcases, handbags, briefcases, video cassette boxes HARDENING The process of making something more secure, resistant to attack, or less vulnerable HAZARD An accidental or naturally occurring event or situation with the potential to cause physical (or psychological) harm to members of the community (including loss of life), damage or losses to property, and/or disruption to the environment or to structures (economic, social, political) upon which a communitys way of life depends. HAZARD OR THREAT IDENTIFICATION The process of identifying situations or conditions that have the potential to cause injury to people, damage to property, or damage to the environment HEALTH AND SAFETY The process by which the well being of all employees, contractors, visitors and the public is safeguarded. All business continuity plans and planning must be cognizant of H&S statutory and regulatory requirements and legislation. Health and Safety considerations should be reviewed during the Risk assessment. HIGH AVAILABILITY Systems or applications requiring a very high level of reliability and availability. High availability systems typically operate 24x7 and usually require built-in redundancy to minimize the risk of downtime due to hardware and/or telecommunication failures HIGH-RISK AREAS Areas identified during the risk assessment that are highly susceptible to a disaster situation or might be the cause of a significant disaster HOTSITE An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems HUMAN RESOURCE DISASTER RECOVERY A specific strategy for dealing with risk assessment, prevention, control and business recovery for critical (key) personnel HUMAN THREATS Possible disruptions in operations resulting from human actions. (i.e., disgruntled employee, terrorism, blackmail, job actions, riots, etc.) iIED Improvised Explosive Device IMMEDIATE RECOVERY In liberal terms, this IS Service Continuity option provides for the immediate recovery of services in a contingency situation. The instant availability of services distinguishes this option from what may be referred to as Hot Stand-by/Start, which typically will permit services to be recovered within 2 to 24 hours depending on the criticality of the business method they support. Depending on that business criticality, immediate recovery may then vary from zero to 24 hours IMMEDIATE RECOVERY TEAM The team with responsibility for implementing the business continuity plan and formulating the organisations initial recovery strategy IMPACT The effect, acceptable or unacceptable, of an event on an organization IMPACT ANALYSIS The identification of critical business processes & the potential damage or loss that may be caused to the organisation resulting from a disruption to those processes, or perhaps from a proposed change INCIDENT An event which is not part of a standard operating business which may impact or interrupt services and, in some cases, may lead to disaster INCIDENT CATEGORISATION A sub-division of Classification, which provides a means of identifying, using a series of structured codes, firstly, what appears to have gone wrong with the IS Service (the symptoms), secondly why (the cause of that failure) & thirdly identification of the component likely to be at fault. The category codes are elements within the classification data string & are essential for fault analysis purposes INCIDENT COMMAND SYSTEM (ICS) Combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure with responsibility for the command, control, and coordination of assigned resources to effectively direct and control the response and recovery to an incident INCIDENT MANAGEMENT The process by which an organization responds to and controls an incident using emergency response procedures or plans INCIDENT MANAGEMENT PLAN A clearly defined and documented plan of action for use during an incident
INCIDENT MANAGER kKEY PERFORMANCE INDICATOR A measure (quantitative or qualitative) that enables the overall delivery of a service to be assessed by both business & IS representatives KEY TASKS Priority procedures and actions in a Business Continuity Plan that must be executed within the first few minutes/hours of the plan invocation KNOWLEDGE BASE Data repository holding information on Incidents, Problems & Known Errors, enabling an organisation to match new Incidents against previous ones & thus to reuse established solutions & approaches lLEAD TIME The time it takes for a supplier to make equipment, services, or supplies available after receiving an order
LIKLIHOOD mMAJOR INCIDENT A UK Emergency Services definition. Any emergency that requires the implementation of special arrangements by one or more of the Emergency Services, National Health Service or a Local Authority MAJOR INCIDENT An Incident where the impact on the business is extreme MANUAL PROCEDURES An alternative method of working following a loss of IT systems
MAXIMUM TOLERABLE PERIOD OF DISRUPTION nN + 1 A fault tolerant strategy that includes multiple systems or components protected by one backup system or component NATURAL THREATS Events caused by nature that have the potential to impact an organization. NETWORK OUTAGE An interruption of voice, data, or IP network communications oOFF-SITE LOCATION A storage facility at a safe distance from the primary facility which is used for housing recovery supplies, equipment, vital records etc OFF-SITE STORAGE Any place physically located a significant distance away from the primary site, where duplicated and vital records (hard copy or electronic and/or equipment) may be stored for use during recovery OPERATIONAL EXERCISE See: Exercise OPERATIONAL IMPACT An impact which is not quantifiable in financial terms but its effects may be among the most severe in determining the survival of an organisation following a disaster OPERATIONAL IMPACT ANALYSIS Determines the impact of the loss of an operational or technological resource. The loss of a system, network or other critical resource may affect a number of business processes OPERATIONAL RISK The risk of loss resulting from inadequate or failed procedures and controls OPERATIONAL TEST A test conducted on one or more components of a plan under actual operating conditions. ORDERLY SHUTDOWN The actions required to rapidly and gracefully suspend a business function and/or system during a disruption.
ORGANISATION pPERIOD OF TOLERANCE The period of time in which an incident can escalate to a potential disaster PEER REVIEW A review of a specific component of a plan by personnel (other than the owner or author) with appropriate technical or business knowledge for accuracy and completeness PIPELINES SAFETY REGULATIONS 1996 UK Legislation on the management of pipeline safety, using an integrated, goal-setting, risk-based approach encompassing both onshore and offshore pipelines; includes the major accident prevention document, the arrangements for emergency plans and the transitional arrangements PLAN ADMINISTRATOR The individual responsible for documenting recovery activities and tracking recovery progress PLAN MAINTENANCE The management process of keeping an organizations Business continuity management plans up to date and effective. Maintenance procedures are a part of this process for the review and update of the BC plans on a defined schedule. Maintenance procedures are a part of this process PLANNING ASSUMPTIONS Descriptions of the types and scales of consequences for which organisations should be prepared to respond POST IMPLEMENTATION REVIEW One or more reviews held after the implementation of a Change to determine initially, if the Change has been implemented successfully & subsequently, if the expected benefits have been obtained. PRE-POSITIONAL RESOURCE Material (i.e. equipment, forms and supplies) stored at an off-site location to be used in business resumption and recovery operations. (Associated terms. pre-positioned inventory) PREVENTATIVE MEASURES Controls aimed at deterring or Mitigating undesirable events form taking place PRIORITIZATION The ordering of critical activities and their dependencies are established during the BIA and Strategic-planning phase. The business continuity plans will be implemented in the order necessary at the time of the event PROTECTIVE SECURITY The safeguarding of physical and personnel welfare or information qQUALITATIVE ASSESSMENT The process for evaluating a business function based on observations and does not involve measures or numbers. Instead, it uses descriptive categories such as customer service, regulatory requirements, etc to allow for refinement of the quantitative assessment. This is normally done during the BIA phase of planning QUANTITATIVE ASSESSMENT The process for placing value on a business function for risk purposes. It is a systematic method that evaluates possible financial impact for losing the ability to perform a business function. It uses numeric values to allow for prioritizations. This is normally done during the BIA phase of planning. QUICK SHIP See Drop Ship rRADIATION (EMERGENCY PREPAREDNESS AND PUBLIC INFORMATION) REGULATIONS 2001 (REPPIR), THE Implemented in UK the articles on intervention in cases of radiation (radiological) emergency in Council Directive 96/29/Euratom, also known as the BS596 Directive. The Directive lays down the basic safety standards for the protection of the health of workers and the general public against the dangers arising from ionising radiation. The REPPIR also partly implement the Public Information Directive by subsuming the Public Information for Radiation Emergencies Regulations 1992 (PIRER) on informing the general public about health protection measures to be applied and steps to be taken in the event of an emergency. RECIPROCAL AGREEMENT Agreement between two organizations (or two internal business groups) with similar equipment/environment that allows each one to recover at the others location RECOVERABLE LOSS Financial losses due to an event that may be reclaimed in the future, e.g. through insurance or litigation. This is normally identified in the Risk Assessment or BIA RECOVERY Implementing the prioritized actions required to return the processes and support functions to operational stability following an interruption or disaster RECOVERY EXERCISE An announced or unannounced execution of business continuity plans intended to implement existing plans and / or highlight the need for additional plan development RECOVERY MANAGEMENT TEAM A team of people, assembled in an emergency, who are charged with recovering an aspect of the enterprise, or obtaining the resources required for the recovery RECOVERY PERIOD The time period between a disaster and a return to normal functions, during which the disaster recovery plan is employed RECOVERY PLAN A plan to resume a specific essential operation, function or process of an enterprise RECOVERY POINT OBJECTIVE (RPO) The maximum amount of data loss an organization can sustain during an event. RECOVERY SERVICES AGREEMENT \ CONTRACT A contract with an external organization guaranteeing the provision of specified equipment, facilities, or services, usually within a specified time period, in the event of a business interruption RECOVERY SITE A designated site for the recovery of business unit, technology, or other operations, which are critical to the enterprise RECOVERY STRATEGY A pre-defined, pre-tested, management approved course of action to be employed in response to a business disruption, interruption or disaster RECOVERY TEAM A group of individuals given responsibility for the co-ordination and response to an emergency or recovering a process or function in the event of a disaster RECOVERY TIME OBJECTIVE (RTO) The period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day) RECOVERY TIMELINE The sequence of recovery activities, or critical path, which must be followed to resume an acceptable level of operation following a business interruption. The timeline may range from minutes to weeks, depending upon the recovery requirements and methodology. RECOVERY WINDOW The time scale within which time sensitive function or business units must be restored, usually determined by means of a business impact analysis REDUNDANCY Where a system has been designed to eliminate single points of failure RENDEZVOUS POINT Point to which all vehicles and resources arriving at the outer cordon are directed RESIDUAL RISK The level of uncontrolled risk remaining after all cost-effective actions have been taken to lessen the impact & probability of a specific risk or group of risks, subject to the organisations risk appetite RESILIENCE The ability of an organization to absorb the impact of a business interruption, and continue to provide a minimum acceptable level of service RESPONSE The reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required RESTART The procedure or procedures that return applications and data to a known start point. Application restart is dependent upon having an operable system RESTORATION Process of planning for and/or implementing procedures for the repair of hardware, relocation of the primary site and its contents, and returning to normal operations at the permanent operational location RESUMPTION The process of planning for and/or implementing the restarting of defined business processes and operations following a disaster. This process commonly addresses the most critical business functions within BIA specified timeframes RDD Radiological Dispersion Device. Commonly known as a "dirty bomb", designed to disperse radioactive material, with or without explosives RISK Potential for exposure to loss. Risks, either man-made or natural, are constant. The potential is usually measured by its probability in years RISK APPETITE Willingness of an organisation to accept a defined level of risk RISK ASSESSMENT & MANAGEMENT The identification and evaluation of operational risks that particularly affect the enterprises ability to function and addressing the consequences RISK ASSESSMENT / ANALYSIS Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls RISK CATEGORIES Risks of similar types are grouped together under key headings, otherwise known as risk categories RISK CONTROLS All methods of reducing the frequency and/or severity of losses including exposure avoidance, loss prevention, loss reduction, segregation of exposure units and non-insurance transfer of risk RISK MANAGEMENT The culture, processes and structures that are put in place to effectively manage potential negative events. As it is not possible or desirable to eliminate all risk, the objective is to implement cost effective processes that reduce risks to an acceptable level, reject unacceptable risks and treat risk by financial interventions i.e. transfer other risks through insurance or other means, or by organizational intervention RISK MITIGATION Implementation of measures to deter specific threats to the continuity of business operations, and/or respond to any occurrence of such threats in a timely and appropriate manner RISK REDUCTION OR MITIGATION The implementation of the preventative measures which risk assessment has identified RISK TRANSFER A common technique used by Risk Managers to address or mitigate potential exposures of the organization. A series of techniques describing the various means of addressing risk through insurance and similar products RISK TREATMENT A systematic process of deciding which risks can be eliminated or reduced by remedial action and which must be tolerated ROLL CALL The process of identifying that all employees, visitors and contractors have been safely evacuated and accounted for following an evacuation of a building or site sSALVAGE & RESTORATION The act of performing a coordinated assessment to determine the appropriate actions to be performed on impacted assets.The assessment can be coordinated with Insurance adjusters, facilities personnel, or other involved parties. Appropriate actions may include: disposal, replacement, reclamation, refurbishment, recovery or receiving compensation for unrecoverable organizational assets SCENARIO A pre-defined set of Business Continuity events and conditions that describe, for planning purposes, an interruption, disruption, or loss related to some aspect(s) of an organizations business operations to support conducting a BIA, developing a continuity strategy, and developing continuity and exercise plans SCOPE Generally, the extent to which a method or procedure applies. The scope of Configuration Management may not, for example, extend to Customer information (other than on an as informed basis) & the scope of a Change Management procedure may not apply to Urgent Changes. Also a key concept in outsourcing, defining which activities are covered by the base contract & which are separately chargeable SECURITY REVIEW A periodic review of policies, procedures, and operational practices maintained by an organization to ensure that they are followed and effective SELF INSURANCE The pre-planned assumption of risk in which a decision is made to bear loses that could result from a Business Continuity event rather than purchasing insurance to cover those potential losses SERVICE LEVEL AGREEMENT (SLA) A formal agreement between a service provider (whether internal or external) and their client (whether internal or external), which covers the nature, quality, availability, scope and response of the service provider. The SLA should cover day-to-day situations and disaster situations, as the need for the service may vary in a disaster SERVICE LEVEL MANAGEMENT (SLM) The process of defining, agreeing, documenting and managing the levels of any type of services provided by service providers whether internal or external that are required and cost justified SILVER Tactical level of management introduced to provide overall management of the response SIMULATION EXERCISE One method of exercising teams in which participants perform some or all of the actions they would take in the event of plan activation. Simulation exercises, which may involve one or more teams, are performed under conditions that at least partially simulate disaster mode. They may or may not be performed at the designated alternate location, and typically use only a partial recovery configuration SINGLE POINT OF FAILURE: (SPOF) A unique pathway or source of a service, activity, and/or process SITE ACCESS DENIAL Any disturbance or activity within the area surrounding the site which renders the site unavailable, e.g. fire, flood, riot, strike, loss of services, forensics. The site itself may be undamaged SOCIAL IMPACT Any incident or happening that affects the well-being of a population and which is often not financially quantifiable STANDBY SERVICE The provision of the relevant recovery facilities, such as cold-site, warm-site, hot-site and mobile standby
STAKEHOLDERS tTABLE TOP EXERCISE One method of exercising plans in which participants review and discuss the actions they would take without actually performing the actions. Representatives of a single team, or multiple teams, may participate in the exercise typically under the guidance of exercise facilitators TASK LIST Defined mandatory and discretionary tasks allocated to teams and/or individual roles within a Business Continuity Plan TERMS OF REFERENCE A document that usually describes the purpose & scope of an activity or requirement TEST A pass/fail evaluation of infrastructure (example-computers, cabling, devices, hardware) and\or physical plant infrastructure (example-building systems, generators, utilities) to demonstrate the anticipated operation of the components and system THREAT A combination of the risk, the consequence of that risk, and the likelihood that the negative event will take place TRAUMA COUNSELING The provisioning of counselling assistance by trained individuals to employees, customers and others who have suffered mental or physical injury as the result of an event TRAUMA MANAGEMENT The process of helping employees deal with trauma in a systematic way following an event by proving trained counsellors, support systems, and coping strategies with the objective of restoring employees psychological well being TOLERANCE THRESHOLD The maximum period of time which the business can afford to be without a critical function or process
TOP MANAGEMENT uUNEXPECTED LOSS The worst-case financial loss or impact that a business could incur due to a particular loss event or risk. The unexpected loss is calculated as the expected loss plus the potential adverse volatility in this value UNINTERTUPTIBLE POWER SUPPLY (UPS) A backup electrical power supply that provides continuous power to critical equipment in the event that commercial power is lost. The UPS (usually a bank of batteries) offers short-term protection against power surges and outages. The UPS usually only allows enough time for vital systems to be correctly powered down vVALIDATION SCRIPT A set of procedures within the Business Continuity Plan to validate the proper function of a system or process before returning it to production operation. VBIED Vehicle-Borne Improvised Explosive Device. A car or van filled with explosive, driven to a target and detonated. VENDOR An individual or company providing a service to a department or the organisation as a whole VIRUS An unauthorised programme that inserts itself into a computer system & then propagates itself to other computers via networks or disks VITAL RECORDS Records essential to the continued functioning or reconstitution of an organization during and after an emergency and also those records essential to protecting the legal and financial rights of that organization and of the individuals directly affected by its activities VOIED Victim Operated Improvised Explosive Device or booby-trap bomb VOLUNTARY SECTOR Bodies, other than public authorities or local authorities, that carry out activities otherwise than for profit wWARM SITE An alternate processing site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of providing backup after additional provisioning, software or customization is performed WMD Weapons of Mass Destruction. WMD encompasses nuclear, biological and chemical weapons WORKAROUND PROCEDURES Alternative procedures that may be used by a functional unit(s) to enable it to continue to perform its critical functions during temporary unavailability of specific application systems, electronic or hard copy data, voice or data communication systems, specialized equipment, office facilities, personnel, or external services WORK AREA STANDBY A permanent or transportable office environment, complete with appropriate office infrastructure x,y,zZ-CARDS A patented format for publishing information, p to an A3-sized page can be folded down to credit card size. This size means it is convenient to carry and can be stored in pockets, handbags, etc
Document Author - Harvey Fawcett
Set as favorite
Bookmark
Email This
Hits: 1434 Comments
(2)
...
written by Editor , March 17, 2008
The PDF feature has been enabled on the site. Just click on the PDF icon at the top right of the article and you will get a PDF
...
written by danny sinclair , March 17, 2008
dont suppose this entire glossary is available in a down loadable version? pdf?
regards danny |
| < Prev | Next > |
|---|