Performance, survivability, and cost aspects of Business Continuity Processes According to BS 25999
Wolfgang Boehmer · 2009
A new model is presented for evaluating the perfor- mance of a Business Continuity Management System according to BS 25999. Performance is based fundamentally on the system's Business Continuity Plans and Disaster Recovery Plans. Typi- cally, the performance of these plans is inadequately evaluated using a number of specific exercises at various intervals and, in many cases, with a variety of targets. Consequently, it is di cult for companies to give ex-ante statements of their survival in the case of a disaster. Two key performance indicators are presented that allow the performance of a Business Continuity Management System to be evaluated according to BS 25999. Using these key performance indicators, the probability of survival can be estimated before extreme events occur. However, the two key performance indica- tors compete and their use invokes a trade-o : an alignment in favor of one key performance indicator is necessarily done at the expense of the other. A key performance matrix with four ranges is presented according to the Business Continuity Management System. The best range is the strategic balance in which both key performance indicators support the economic strategy and a suitable cost/benefit relationship is achieved. Moreover, if a company is already in the range of the strategic balance, a further improvement, which yields minimal turnover, may be possible. This improvement can be obtained via a combinatorial optimiza- tion between the two competing key performance indicators. Index Terms—BS 25999; BCMS; Business Continuity Plan (BCP); Knapsack-Problem; Branch & Bounding.