SP8: Ensure continuity

 

Process name: Prepare for disaster events - Part of: Supporting processes

Previous process: Ensure security

Next process: Ensure compliance

 

Process description

The disaster prevention process in YaSM ensures service continuity in the case of events considered disasters, such as floods, fires, power failures, etc.
Preparing for disaster events starts with the compilation of a register of managed disaster events, which lists the types of disasters for which the service provider has decided to put some kind of preparation in place. The register also specifies the responses to the identified events, in particular the related service continuity plans.

Figure 1: "Prepare for disaster events." - YaSM supporting service management process SP8.

The continuity manager may ensure service continuity in a number of ways. Most importantly, this role is involved in the service design and build stages to ensure continuity aspects are taken into account when creating or updating services. Once it has been established during service design which continuity arrangements and mechanisms are required for a new service, these can be put in place, notably

• Through the service build process, by adding suitable continuity features to the service infrastructure that is to be created
• Through the disaster preparation process, by updating continuity arrangements and mechanisms which are operated under the responsibility of the service continuity manager.

The service continuity manager is also involved in service or process improvement initiatives if service continuity aspects are to be considered.

If new types of disasters are to be addressed or if the continuity arrangements need to be upgraded for other reasons, the disaster preparation process is able to start continuity improvement initiatives on its own account. Such initiatives are managed through the continuity improvement plan.

 

Sub-processes

YaSM's disaster management process has the following sub-processes:

 

SP8.1: Assess risks associated with disaster events

Process objective: To identify the disaster events which need to be managed by the service provider, and to define appropriate continuity arrangements and mechanisms.

SP8.2: Define continuity improvements

Process objective: To define the objectives of initiatives to improve service continuity and the approach for their implementation. This includes creating business cases for the initiatives.

SP8.3: Start up continuity improvement initiatives

Process objective: To launch initiatives aimed at ensuring or improving service continuity. This includes obtaining authorization by requesting a budget and submitting a request for change.

SP8.4: Implement continuity arrangements

Process objective: To implement, test and deploy new or improved continuity arrangements and mechanisms.

SP8.5: Operate the continuity arrangements

Process objective: To arrange adequate training to prepare the service provider's staff and customers for disaster events, and to ensure regular maintenance and testing of the continuity arrangements and mechanisms.

SP8.6: Review the continuity arrangements

Process objective: To submit the continuity arrangements and mechanisms to regular reviews, in order to identify potentials for improvement to be addressed by continuity improvement initiatives.

 

Process outputs

This section lists the documents and records produced by 'disaster prevention and service continuity management'. YaSM data objects [*] are marked with an asterisk, while other objects are displayed in gray.

 

Budget request

A budget request is typically issued to obtain funding for setting up, improving or operating a service or process. An approved budget request means that the required financial resources have been allocated by the financial manager. [*]

Change record

A change record contains all details of a change, documenting the lifecycle of a single change. In its initial state, a change record describes a request for change (RFC) which is to be assessed and authorized prior to implementing the change. Further information is added as the change progresses through its lifecycle. [*]

Change status information

Current status information related to the implementation of a change. This information is sent to the change manager from the various processes that implement authorized changes. It is used by the change manager to keep the change records and the change schedule up-to-date.

CI record

Configuration information is maintained in CI records for all configuration items (CIs) under the control of the configuration manager. In this context, CIs can be of various types: Applications, systems and other infrastructure components are treated as CIs, but often also services, policies, project documentation, employees, suppliers, etc. Configuration information is stored in the configuration management system (CMS). [*]

Continuity improvement plan

Items in the continuity improvement plan are used by the service continuity manager to record and manage continuity improvement initiatives throughout their lifecycle. Initiatives in the continuity improvement plan may aim to enhance the resilience of services or to put mechanisms in place for the recovery of services in the case of disaster events. [*]

Continuity operation manual

The continuity operation manual specifies the activities required for the operation of the continuity arrangements and mechanisms operated under the responsibility of the service continuity manager. Some instructions related to the operation of particular security systems may be documented in separate technical manuals or 'standard operating procedures (SOPs)'. [*]

Continuity review report

A continuity review report records the details and findings from a continuity review. This report is an important input for the definition of continuity improvement initiatives. [*]

Data for project plan update

Current information related to project progress and resource consumption. This information is sent from various service management processes to the project manager as input for project control.

Guideline for disaster events

The guideline for disaster events contains detailed instructions on when and how to invoke the procedure for responding to disaster events. Most importantly, the guideline defines the first steps to be taken by 1st level support after learning that a (suspected) disaster event has occurred. [*]

Index of disaster-relevant information

A catalogue of all information that is relevant in the context of responding to a disaster event. The index of disaster-relevant information is maintained and circulated by the service continuity manager to all members of staff with responsibilities for fighting disasters. [*]

Purchase request

A request to procure goods or services from an external supplier. Purchasing requests are typically sent to the supplier manager, for example if applications, systems or other infrastructure components are needed for setting up a new service, or if standard infrastructure components and consumables are required for service operation.

Recovery plan

Recovery plans contain detailed instructions for returning specific services and/ or systems to a working state, which often includes recovering data to a defined consistent state. [*]

Register of managed disaster events

The register of managed disaster events is a tool used by the service continuity manager to keep an overview of the disaster events against which the service provider has decided to set up some kind of protection, considering the potential impacts and occurrence likelihoods. The register of managed disaster events also specifies the responses to the identified events, in particular the related service continuity plans. [*]

Request to assess security risks

A request to assess security risks, typically issued during service design if new or changed security controls and mechanisms are likely to be needed for a new or improved service.

Service continuity plan

A service continuity plan describes how service continuity is ensured with regards to a particular type of disaster event. The plan specifies the required preventive measures and describes how to effectively respond to the disaster event. Service continuity plans usually include references to more detailed recovery plans with specific instructions for returning applications, systems or other infrastructure components to a working state. [*]

Suggested continuity improvement

A suggestion for improving service continuity. Suggestions for continuity improvements may originate from anywhere within the organization.

Suggested process modification

A suggestion for modifying one or several service management processes. Suggestions for process modifications or improvements may originate from anywhere within the organization.

Suggested service modification

A suggestion for modifying a service, for example to improve service quality or economics. Suggestions may originate from anywhere within or outside of the service provider organization.

Test report

A test report provides a detailed account of testing activities. A test report is created for example during tests of new or changed service components, or during tests of security or service continuity mechanisms. [*]

Test script

A test script specifies a set of test cases including their expected outcomes. The nature of the test cases will vary depending on what is to be tested. [*]

 

---

Notes:

[*] "YaSM data objects" are those documents or records for which the YaSM model provides detailed recommendations: Every YaSM object has an associated checklist (see example) describing its typical contents, and an associated lifecycle diagram depicting how the status of the object changes as it is created, updated, read and archived by various YaSM processes (see example).

"Other objects" are mostly informal data or information where YaSM has less strong views about their contents. There are no associated lifecycle diagrams or checklists.

 

Process metrics

Process metrics are used, for example, to assess if the service management processes are running according to expectations.

For suggestions of suitable metrics, please refer to the list of metrics for the YaSM disaster prevention process.

 

Roles and responsibilities

Process owner: Service continuity manager

• The service continuity manager is responsible for managing risks that could seriously impact the service provider's services. In particular, this role ensures that the service provider can provide minimum agreed service levels in cases of disaster.

 

Responsibility matrix: "SP8: Prepare for disaster events"

YaSM role / sub-process		Compli. mgr.	Oper.	Proc. owner	Secur. mgr.	Serv. contin. mgr.	Serv. owner	Techn. domain expert
SP8.1	Assess risks associated with disaster events	-	-	R	-	AR	R	-
SP8.2	Define continuity improvements	R	-	-	R	AR	-	-
SP8.3	Start up continuity improvement initiatives	-	-	-	-	AR	-	-
SP8.4	Implement continuity arrangements	-	R	-	-	AR	-	R
SP8.5	Operate the continuity arrangements	-	R	-	-	AR	-	-
SP8.6	Review the continuity arrangements	-	-	-	-	AR	-	-

 

Notes

Is based on: The disaster prevention process from the YaSM Process Map.

By:  Stefan Kempter   and  Andrea Kempter , IT Process Maps.

 

Process description  › Sub-processes  › Process outputs  › Metrics  › Roles