Introduction to Business Continuity Management

Throughout this module, the primary focus will be on ensuring the security of information assets and systems owned by organizations. However, focusing only on information security without ensuring the existence and continuity of the operations and systems related to that information would not be the best approach.

For this reason, the concept of "Business Continuity" and a corresponding process are required.

Business Continuity is defined as the ability of an organization to maintain critical business processes and quickly recover affected systems in the face of extraordinary situations, disasters, or unexpected events.

The goal of Business Continuity is to ensure that organizations can continue to operate, maintain their ability to provide services, and respond effectively to customers, employees, and other stakeholders.

While Business Continuity ensures the continuity of business processes, it is also a part of information security. As a basic knowledge that has been mentioned in numerous studies, there are 3 basic dimensions of information security and these are called the CIA (Confidentiality, Integrity, Availability) Triad.

Within this tree dimension, Availability refers to the continuous accessibility of information assets and the availability of information systems. This is only possible with "Business Continuity".

Defining and organizing the necessary processes as part of Business Continuity is called Business Continuity Management (BCM).

BCM focuses on protecting organizations from two main problems:

• Disruptive Events

• Disasters

"Disruptive events are unexpected events that affect or even interrupt the normal workflow and processes of an organization. Examples include infrastructure problems, system failures, and ordinary problems that disrupt the availability of human resources or the availability of a physical location.

"Disasters" are events that have a catastrophic impact on an organization's processes, either completely or comprehensively. Disasters can be natural, such as earthquakes, floods, or fires, or man-made, such as vandalism, terrorism, or war.

Disasters can also include damage to an organization's entire IT infrastructure or large-scale cyber attacks that compromise the security of all information assets.

Business Continuity vs Disaster Recovery

The terms Business Continuity and Disaster Recovery are often used interchangeably and can be confused.

Although there are different definitions for Business Continuity and Disaster Recovery in different sources, the relationship and differences between the two concepts are summarized in the table below, according to the most valid approach:

As you can see from the table above, Business Continuity Management is a broader concept. For this reason, when BCM is discussed in a way that takes Disaster situations into account, both topics will be discussed together.

In this module, the section will be based on BCM in accordance with the above approach.

Business Continuity Management Steps and Module Scope

The steps of BCM planning and the details of the work to be done in each step vary according to the size of the organization. It is not expected that the Business Continuity organization of a small or medium-sized company and a large-scale financial institution will have the same context. However, the approach to the work to be done will be similar due to the general concept of information security.

For example, the business continuity team of a small company will consist of a few people, while the team of a large organization will consist of dozens of people. In any case, the establishment of a BCM team will be realized as part of the process. Accordingly, a basic BCM process is expected to include the following steps:

The headings above are the primary steps in the process, and each has sub-sections.

In this module, starting with the next section, each of the above steps will be treated as a heading and BCM will be explained in detail.

At the end of the steps, the module will conclude with an introduction to Business Continuity Management Guidelines.

Business Continuity Project Initiation will be covered in the next chapter.