Managing disaster recovery and business continuity risks involves:

• Understanding the environment, vulnerabilities and criticalities of the organization.

• Identifying the nature and source of potential disruption events that pose business continuity risks, both positive and negative, to the organization.

• Understanding the consequences of these events in terms of their impact on the business.

• Implementing strategies to mitigate, or benefit from, the occurrence of the risk.

• Recognising that disruption events may occur that have not been considered through formal risk assessment.

• Requiring that business continuity and disaster recovery plans maintain a high degree of flexibility.

When tackling a risk and vulnerability assessment,  you may consider the following approach:

• An examination of the risks and their context.

• A consideration of the organization's vulnerabilities to those risks.

• Identification and provision of resources and infrastructure to support the critical functions of the business.

• Determine the communication requirements before, during and after a disruption.

Eight key business disruption categories have been listed below. It is important to note that there is an almost indefinite number of potential threats, with varying levels of likelihood, that could result in a severe disruption to your normal business operations. 

However, the results or impacts of the vast majority of threats can be categorised within the following eight risk areas:

1. Loss of precinct (loss of access to the business premises and surrounding area)

2. Loss of building

3. Denial of access to building for a limited time

4. Loss of Information Technology service (data)

5. Loss of Information Technology services (voice)

6. Loss of vital records (non electronic)

7. Loss of key staff

8. Loss of key dependencies

An example of a risk assessment tool is locate below.

The risk assessment tool acts as a guide to help you determine an appropriate rating for each risk. It is important to note that risk is subjective and therefore any ratings applied should be considered in this context.

The table below shows an example of the eight risk items that were considered.  The table also includes a current and target consequence and likelihood rating. 

The column on the far right lists the end risk rating.  The art of cost effective business continuity planning is applying controls to reduce the risk rating (residual risk) to an acceptable level. 
 

This table will be used as an example in the next section - developing Recovery Strategies.