BCP Information by cis-security

BCP INFORMATION

CIS BCP INFORMATION

Consequences of power loss: A loss of power can shut down an entire business unless organizations take suitable precautions. A complete loss of commercial power is the worst-case scenario, as opposed to local and/or regional outages that are confined to specific locations. This can result in catastrophic business losses that may last hours, days or weeks. The preparations for the potential rolling outages may well be part of your BCP in terms of temporary disruptions to power and there are already mitigating plans and processes in place, if so, testing these and ensuring they are effective must be carried out.

Potential Rolling Power Outages: There are reports that we may be facing power restrictions if enough gas cannot be secured for the winter: https://mol.im/a/11325439. This is of course worst-case scenario but having Business Continuity Management Systems (BCMS) and Business Continuity Plans (BCP) forward testing and preparation is always an advantage. Especially if we are protecting data, Disaster Recovery (DR) plans will also need to be considered. Electric power is one of the most important resources to protect when it comes to critical infrastructure. Power loss is something virtually every business could face at some time, and the results can be disastrous. A power outage business continuity plan must be included in an organization’s incident response protocols. Organizations can also take various measures to minimize the likelihood of power outages, such as infrastructure testing and ensuring ample backup power supply access.

CIS BCP INFORMATION

Minimize business disruption from power outages: Business continuity and disaster recovery (BCDR) and organizational resiliency plans typically include strategies for power outages response and necessary resources. These include local backup power systems, spare power supplies for equipment racks and devices, spare power cables, power connectors and spare power outlets. Consider what you have as backup for power, on site generators, battery banks etc, are these checked? and can they be operated for extended periods or for short periods over multiple occasions. Some buildings operate from dual power feeds, in principle this means that they will not have power supply issues as the feed is from two major external sources. This can mean that there are no generators on site. The potential for rolling power outages may test dual supply, so consider if external generators are available. Short-term power outages that last for minutes at a time are a nuisance but are not likely to disrupt business operations. However, having the potential for regular outages, what will this do to repeated resets on systems? Once power returns, the business will need time to recover and restart systems, hence checking these for repeated disruption.

Longer-term power outages, lasting hours, or days, require a more intensive process. Depending on information provided by the local utility company, management will need to decide whether to amend how resources are deployed. These power outages may impact those working from home, it is extremely unlikely that domestic homes have reserve power supplies. Will additional resources be needed for remote internet access, dongles etc so work can carry on wirelessly? From a technology perspective, regular backups of systems, data and databases will ensure that the company can return to business, even if employees need to work remotely. The COVID-19 pandemic has demonstrated the importance of remote working, which has become part of the “new normal” for many organizations. It has also become a primary business recovery strategy and is especially applicable in power outages. Launching emergency power systems can help keep the organization running unless other circumstances necessitate a physical evacuation. Backup power and remote working make sense so long as the outage is of a relatively short duration and is largely confined to a specific geographic area. For larger-area and extended power outages, the above strategies may be insufficient, so it is important to discuss short- and longterm power outage strategies periodically with senior management, facilities teams, and utility companies.

CIS BCP INFORMATION

Include power loss in BCDR and resilience plans: One of the principal risks and threats to business continuity is a loss of power. Vulnerabilities to an organization from a power outage can be caused by a lack of backup power, improper internal wiring by not following local construction codes, and failure to periodically engage building management or an electrical contractor to examine the building power infrastructure. For BCDR, incident response and resilience plans, include power disruptions into risk assessments and business impact analyses. These examinations will help identify ways to prepare for power outages and how to mitigate the severity of an outage to the business.

We are at the mercy of the power suppliers and we are also restricted in terms of how much influence we have over clients resilience and at times the occupier resilience plans. The aims here are that we consider considerations to potential disruption where we can effect change and support the client. If you have influence in any of the recovery plans associated with this, then take the time to discuss with the teams across your contracts to assist and consider your planning.