BC.1.0.2 - Business Continuity Plan: Roles and Responsibilities

Control Statement

Business contingency roles and responsibilities are assigned to individuals and their contact information is communicated to authorized personnel.

Context

Establishing defined roles and responsibilities reduces organization confusion in the event of disruption. Knowing who the DRI are and how to contact them empowers faster communication, reduced response times, makes for easier and more substantive triage, and ultimately, more speedy recovery from disruption.

This control is a subset of the Business Continuity plan. The purpose of this control is to ensure that IllumiDesk is able to return to its daily operations as quickly as possible after an unforeseen event. Hence the main idea here is to identify key staff, such that: resources are protected, customer inconvenience minimized and specific responsibilities are assigned in the context of a quick recovery. This plan will clearly define the Roles and responsibilities of individuals within IllumiDesk who will be responsible, accountable, consulted and informed.

Scope

Roles and Responsibilities should be defined for the following environments and systems:

• BC plan for my.illumidesk.com

• Processes and procedures that support business operations and above environments

Ownership

• Business Operations owns this control.

Guidance

As part of the establishment of a BC plan: One of the key areas is to identify individuals who will be designated to be the key personnel responsible for the restoration activities. A high level BC roles & responsibilities section should include the following listed below:

• The BC plan roles & responsibilities section will detail the names of the assigned individuals, their roles, plan of action during disaster, what they are responsible to recover along with their contact information.

• This has to be reviewed and approved by the respective managers and senior management for correctness.

• Distribute copies of this contingency plan to all the defined key contingency personnel

• Coordinate the contingency planning activities with incident handling activities and review the contingency plan for each information system under consideration.

• Update the plan based on personnel leaving the organization, information system ownership changes, or environment of operation changes and problems encountered during the implementation, execution, or testing.

• Protect the plan from unauthorized disclosure and modification.

In a much detailed level, the BC plan - roles & responsibilities should include:

• Designation of appropriate teams to implement the strategy. Each team should be trained and ready to deploy in the event of a disruptive situation requiring plan activation.

• The specific types of teams required, The size of each team, specific team titles, hierarchy designs are all based on the systems taken into consideration.

• Personnel should be chosen to staff these teams based on their skills and knowledge. Ideally, teams would be staffed with the personnel responsible for the same or similar operation under normal conditions.

• Team members must understand not only the BCDR plan purpose, but also the procedures necessary to execute the recovery strategy. Teams must be sufficient in size to remain viable if some members are unavailable to respond or alternate team members may be designated.

• Team members should be familiar with the underlying goals and procedures of other teams to facilitate inter-team coordination.

• Plan for an alternate team - personnel from different geographic areas should be chosen, to eradicate the possibility of disaster occurring in the area where all team members reside. As an alternative, hiring contractors or vendors can be done and such personnel have to be coordinated and trained.

• Team leader disseminates information to team members and approves decisions on behalf of the team. An alternate to act as the leader to be designated, if the primary leader is unavailable.

• Each team will be managed by a Management Team, to provide overall guidance in lieu of a major system disruption or emergency. This team is responsible for activating the contingency plan, facilitating communications among other teams and supervising the execution of contingency plan operations, tests and exercises.

• These teams are in turn managed by a senior management official, who has the ultimate authority to activate the plan, and to make decisions regarding spending levels, acceptable risk, and interagency coordination.

• The plan should also detail the order of succession as to who assumes responsibility for the contingency plan execution in the event that the highest authority is unavailable or unable to do so.

Additional control information and project tracking

Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Business Continuity Plan: Roles and Responsibilities issue.

Policy Reference

Framework Mapping

• SOC2 CC

  • CC7.5

  • CC9.1

• SOC2 Availability

  • A1.2