لطفا منتظر باشید ...
BUSINESS CONTINUITY PLANNING EVALUATION
Plan Management
Does this healthcare organization have a business continuity planning project plan or program?
Does the healthcare organization's business continuity planning address computer recovery issues as well as recovering other environmental components (facility, power, staff, etc.) that allow the business to function?
Does the business continuity planning program have a budget?
Is there a business continuity planning policy statement?
Have business continuity planning team member roles and responsibilities been assigned at an appropriate level of authority to carry out responsibilities?
Does the healthcare organization have Business Continuity Planners?
Do the business continuity plans address a worst-case scenario?
Business Impact Analysis
Has a Business Impact Analysis (BIA) been completed?
Does the BIA assess the dollar value and market share implications of the healthcare organization being out of service for a given amount of time?
Does the BIA identify critical processes and their dependencies?
Have threat avoidance and loss mitigation measures for critical assets been identified?
Have recovery time objectives (RTOs) been assigned to all critical components?
Have key vendors been contacted and arrangements made to provide critical goods and services in a timely manner in the event of an emergency?
Have minimum recovery resources items been identified?
Is the data backup procedure adequate to fulfill HIPAA requirements?
Recovery Strategies
Are there recovery strategies for all the critical components of production?
Are there provisions to safeguard data during recovery?
Is there a strategy for both temporary resumption of services and for full recovery of normal operations?
Has the configuration of critical Information Technology equipment been documented?
Have the requirements for a temporary facility been documented? Has a telecommunications inventory been produced? Does the inventory include:
Information about modems, communication lines, and switching equipment?
Information about voice and data lines to customers and other healthcare organizations?
Circuit identification numbers of communications channels?
Is there an inventory of critical systems software?Does the inventory include:
Configurations;
Versions/releases and dates of last update;
Security software needed to ensure protection and control of data access paths throughout recovery?
Vendor identification and information?
Is the recovery of critical applications and data tested periodically?
Do all critical components have an automatic fail-over component available?
Plan Development
Does the business continuity plan contain:
Contact information for all team members;
Inventories of resources items;
Equipment specifications;
Vendor details;
Hot site configuration details (if a hot site is used);
Communications and equipment layout schematics.
Does the healthcare organization understand how long it would take to recover the Information Technology function?
Have procedures to address the recovery of data lost between the last backup and the time of disaster been developed and documented?
Does the plan contain procedures designed to react to cyber attacks?
Does the plan contain damage assessment procedures?
In the plan, do all resource categories have an associated recovery procedure?
Plan Maintenance
Are there procedures for maintaining the plan?
Have maintenance triggers been identified?
Are plans reviewed for their current status?
Plan Testing
Are the plans tested periodically?
Are test results compared against test criteria to determine the relative success of the test?
After the test, are outstanding issues identified?
Is the business continuity plan modified as a result of issues identified during testing?
Has the plan been exercised, via testing or actual recovery situations, and met its stated recovery time objectives?
I have used this questionnaire or a variant on many occasions. What always amazes me is the interest with which senior managers view the results. If you depict the results in a bar-chart with each bar representing a percentage of questions in a category being answered "yes", you will have a very powerful tool to use to get management's attention. The following is an analysis of a payer healthcare organization:
