Over the past few years, this question has been asked of me more than once as I present on the topic of Major Incident Handling. It is a very valid question because the topics are very closely related, yet at the same time they are distinctly different. Below is my attempt to differentiate the two and provide some clarity to the topic.

Question: Business Continuity Planning and Major Incident Handling seem to be quite similar. Can you share where you see similarities and differences?

-- In my view, Business Continuity Plans tend to focus on an "after the fact" response to catastrophic events that have already occurred and that have already produced a significant impact which now threatens Business Continuity. A good example would be a Data Center fire that requires restoration of services to an alternate location. Business Continuity Plans are also more business focused and tend to look at multiple aspects of the business that may be impacted, not necessarily just only Incident Response.

-- Major Incident Handling is more "real time" and seeks to control or mitigate an event in progress in order to prevent a significant impact to the business that might threaten Business Continuity.

-- Both are focused on Incident Response with the caveat that Major Incident Handling tends to be focused on managing an incident in progress while Buisness Continuity is usually post event with a goal of managing the after effects of the Incident.

-- Think of Major Incident Handling as the fire fighters fighting a major fire in a housing community while Business Continuity would be the rescue and relocation teams who work with the victims of the fire after it has been extinguished in order to insure they have adequate shelter and basic necessities to survive.

Just like Major Incident Planning, Business Continuity planning has a very important role to play in an overall Organizational Risk Management scheme.  With that in mind, I want to share a source of some well-founded guidance. For me, I have found that the National Institute of Standards and Technology (NIST) is a very good source. Below are some links to the NIST guidance concerning Business Continuity and Risk Management that I think you will find useful.

Link to all of the NIST Standards (Special Publication Series 800-XX)

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

Contingency Planning Guide for Federal Information Systems (Errata Page - Nov. 11, 2010

NIST Contingency Plan Template

DRAFT Guide for Conducting Risk Assessments

More to follow...

Braun Tacon

Thursday, September 1st, 1859  Richard Carrington would become a placeholder in history as he recorded Sol's burst of gastric relief which became one of the most recognized and followed astronomical events of modern times.  History records this as the "Carrington  Event".

Just before dawn the next day, skies all over planet Earth erupted in red, green, and purple auroras so brilliant that newspapers could be read as easily as in daylight. Indeed, stunning auroras pulsated even at near tropical latitudes over Cuba, the Bahamas, Jamaica, El Salvador, and Hawaii.

Even more disconcerting, telegraph systems worldwide went haywire.  Spark discharges shocked telegraph operators and set the telegraph paper on fire. Even when telegraphers disconnected the batteries powering the lines, aurora-induced electric currents in the wires still allowed messages to be transmitted.

"What Carrington saw was a white-light solar flare—a magnetic explosion on the sun," explains David Hathaway, solar physics team lead at NASA's Marshall Space Flight Center in Huntsville, Alabama.

If this same event were to occur today, most if not all of what we take for granted (electricity, solid-state electronics, radio/TV, etc) would cease to exist.  Our safe and sound world is far more fragile than we imagine.

More to follow...

Braun Tacon

Billion-Ton Comet May Have Missed Earth by a Few Hundred Kilometers in 1883. 

A reanalysis of historical observations suggest Earth narrowly avoided an extinction event just over a hundred years ago.

Read the rest, as they say.

As I have said before, and will say again, "Some Major Incidents can never be avoided, but all Major Incidents should be planned for."

H/T: Instapundit

More to follow...

Braun Tacon

It is clear from the current weather models and forecasts that Hurricane Irene has the potential to create significant havoc and devastation for the East Coast. Hopefully the cities, counties, and states affected have sufficient Major Incident Response Plans in place to deal with the real-time events that may be caused by the storm’s landfall. Additionally, after the storm, Disaster Response Plans will be required to direct and sustain the rescue and clean-up efforts should that be required.

This post is not about Incident Response or Disaster Recovery though. Instead it concerns our personal responsibility as individuals to plan and prepare for an event as significant as a hurricane prior to its arrival. An East Coast Storm of this magnitude is a very rare event. As such, most of the folks that will be affected have no prior experience or knowledge to guide them. If you are in the storm’s path please take this event seriously…it could save your life and the lives of your loved ones. (I say this as an individual who experienced Hurricane Andrew first hand as a member of the USAF stationed in Biloxi Mississippi).

If you are in the path of Irene check out these links for tips on Disaster Preparedness (thanks to Glenn Reynolds of Instapundit). Also for real-time updates on the storm's status and progress, visit weather blogger Brendon Loy's site, Weather Nerd.

UPDATE 8/29/11:  Silly me, I neglected to point you to BraunsBlog's official Disaster Preparedness Checklist, courtesy of Bruce F Webster.  Download a copy and keep it handy.  You'll never know when it might be needed, until it is.

More to follow...

Braun Tacon

The times, they are a changing.  It is natural, part of the momentum of the universe.  Change happens and Change is real. 

There is Change in the IT industry.  It’s called “Service on Demand.”  It is everywhere around us.  Consider this:

Reaching for the Clouds
 

Google, Netflix, Home Banking…all lead to the same premise.  You can have what you want, when you want, anywhere you want at a price that motivates you to consume more and more and more.  The digital equivalence of conspicuous consumption.
 

To survive in today’s world, you must be agile, you must be nimble, you must be lean and most of all you must be “right” 99 percent of the time.  That is how you change the game.

At the same time, betting the odds on a situation you probably will have little to no control over is not a best practice or even a best option from the perspective of Continuous Service Delivery.

Think of Service Delivery as the Service Chain.  It’s not necessarily the first link.  Nor probably the second link.  It can be any link that is dependent on another link which is dependant on delivering service to the customer.

And finally “Who” owns it? 

And more finally how will they own it?

More to follow...

Braun Tacon