Business Continuity Management: Plan

[Justin N]

Background: Our company implemented GRC in early 2022 and customized the BCM process quite a bit to meet business need. We are currently revising our process in order to revert back to OOTB BCM to help with plugin updates and longevity. 

Through our analysis of our currently customized process and the OOTB process, I have the following questions that I would like some experienced insights into:

1. Do other SN customers keep track of the following in their BC Plans:
   1. Number of employees/essential employees
   2. Number of workstations/essential workstations
   3. Equipment needs (Copiers, printers, scanners, etc.)
   4. Phone rerouting plans (Tracked at the department, process, or location level)
2. If so, are these tracked as element definitions (Asset types) on the plans?

If anyone with BCM/GRC experience has insight into this question, I would love to hear other opinions. Thanks!

[Community Alums]

Hi @Justin N ,

For one of my customer, we had to deviate from OOTB and we were Tracking luckily all you mentioned on your list as element definitions on the plans. That's the best possible way to track.

[Justin N]

Hello Sandeep, 

Thank you for the quick reply - This is great to hear. 😊

For this customer, how did this work? I have some thoughts below on how I image this would be set up, but let me know if anything seems incorrect.

1. Essential Employees:
   1. Was this directly referencing the sys_user table?
2. Workstations
   1. Was this directly referencing the cmdb_ci table? 
   2. How is the situation handled when selecting something not in the cmdb like an 'other' option?

I know that showing columns on the asset types is difficult when trying to dot walk past the element definition itself (for example, if you are referencing hardware, it wont let you dot walk to model type and grab the manufacturer). Have you encountered issues with this where you are unable to display desired information for something like users?

[Aswin6]

Hi Justin,

Another option to capture this information is to add these as dependencies in the BIA for the business process. Then configure BIA downstream dependency updates in the plans.

Thanks,
Aswin