Page 235 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

time, arrangements must be made for shelter and food. Any continuity
plan that requires these provisions should include detailed

instructions for the BCP team in the event of a disaster. The
organization should maintain stockpiles of provisions sufficient to feed
the operational and support teams for an extended period of time in
an accessible location. Plans should specify the periodic rotation of
those stockpiles to prevent spoilage.

Buildings and Facilities

Many businesses require specialized facilities in order to carry out

their critical operations. These might include standard office facilities,
manufacturing plants, operations centers, warehouses,
distribution/logistics centers, and repair/maintenance depots, among
others. When you perform your BIA, you will identify those facilities
that play a critical role in your organization’s continued viability. Your
continuity plan should address two areas for each critical facility.

Hardening Provisions Your BCP should outline mechanisms and

procedures that can be put in place to protect your existing facilities
against the risks defined in the strategy development phase. This
might include steps as simple as patching a leaky roof or as complex as
installing reinforced hurricane shutters and fireproof walls.

Alternate Sites In the event that it’s not feasible to harden a facility
against a risk, your BCP should identify alternate sites where business
activities can resume immediately (or at least in a period of time that’s

shorter than the maximum tolerable downtime for all affected critical
business functions). Chapter 18 describes a few of the facility types
that might be useful in this stage.

Infrastructure

Every business depends on some sort of infrastructure for its critical
processes. For many businesses, a critical part of this infrastructure is
an IT backbone of communications and computer systems that

process orders, manage the supply chain, handle customer interaction,
and perform other business functions. This backbone consists of a
number of servers, workstations, and critical communications links
between sites. The BCP must address how these systems will be