Business Continuity Plan for Motosport Limited - Assignment Example

Business continuity plan Business continuity plan abbreviated as BCP is a document which details the schedule methodology, procedures, practices and instructions of actions to be done during disaster recovery (www.thebci.org). The document documents all the alternative measures that an organization can take, the personnel required and other resources. Motosport wants to include an internet based system to its business operation. This is projected to help its client’s quick access to the services. This system according to the clients will save time and increase the number of customers for the company. Given that the company does not have vast knowledge on information system especially internet based business, the journey that Motosport is embarking upon is a risky one, including the roll-out of some radical changes (from both a business and technical viewpoint). Therefore there is a need for a contingency plan in place to ensure that the business can still function even in the event of systems failure. Business continuity plan entails coming up with new tasks that will enable the company have a competitive advantage in the market and increase revenue. Motorsport Company has put implementation of ICT a top priority in its priority plan. To develop BCP, there will be five steps followed. It is also assumed that the top management of Motosport Company support the BCP development and has approved the model. they also support the process by offering their leadership support. They approve, guide, encourage and offer visionary leadership during this process. BCP development steps 1. Initiation The project to be developed and implemented is integrating the current system with an online system which enables customers to check their stock, be able to order for goods and make delivery arrangements of the ordered goods online. The organization is determined to improve the customer service and increase its revenue hence it conducted a survey to find out what the customers want. It is therefore the top priority of the management to ensure customers are satisfied. Given that the company had done a survey on this subject the BCP leader will assume that the top management knows what the project is all about. The staffs are also aware of the BCP, therefore there will be no need for a background statement on the project. 1.1 The objectives of the plan Information system has emerged as an integration agent in today’s business not only in computer related business but to other businesses as well. It has proven to be the best tool to gain competitive advantage in the market. Customers are becoming sophisticated each day, their demands are dynamic given the environment they are in. clients are able to compare different services of several organization just by the click of a mouse. They are able to buy at the comfort of their seats in the office or at home. In many surveys carried out in industries, information system implementation system is often pointed out as a challenge (Martin, 1982, Porter and Miller, 1985). While King (1995), insists that evaluation of the company’s strategy plan is a key to maintaining competitive advantages. It is therefore important for Motorsport to review its strategic plan with an aim of remaining ahead of its competitors. To meet the current customer needs the organization has to come up with a strategy that enable its information and processes run on an internet based system in its business operations. An evaluation of risks, requirement and needs should be intensively done to ensure the company does not loss sight on the overall company goals. 2. Business impact analysis This step evaluates how much the company is going to loss in the event that the new system is being undertaken. The information about this can be collected from the staff members or the experts who will be developing the system. According to Motosport company, the following critical function should not be altered or negatively affected by the new system. They include: 1. Customer Service: The business requires vast amounts of pre and post-purchase service. The customer service is critical for the business as it addresses customer requirements. Good customer service is the basis for maintaining good customer relationships and forming customer loyalty. 2. Procurement and Logistics: Procurement is one of the basic business functions in Motosport. Procurement involves product purchase planning, standards determination, specification development, supplier research and choices, value analysis, price negotiation and conducting the purchase, inventory control and disposals. Logistics deal with the supply of products. The logistic department will obtain products from the supplier and deliver them to customers who order the products. The logistics department also needs to handle the importing and exporting of products. 3. Marketing: Marketing deals with identifying customers and constructing a marketing strategy (Wind, 1981). One needs to understand his customers and potential customers to be able to persuade them to buy the products. Understanding the competitors will help one to enhance the products and marketing by setting the prices competitively and promoting the products against competitors in a timely manner. Online marketing is another effective marketing channel including email newsletters, search engine optimization, online social networking and Google advertising (Business Link, 2011). 4. Personnel: The HR department is in charge of recruiting, training and management of the employees for the business. The functions of the department include creating job descriptions, monitoring candidates, designing training programs and incentive programs. 3. Disaster readiness strategies 1.3 Process of risk and threat assessment a. Risk assessment There are two major elements in risk assessment; likelihood and consequence therefore risk assessment can be defined mathematically as RISK = Consequence x Likelihood. Likelihood can be defined as a “individual or a group with the motivation and capability for theft or sabotage of assets, or other malevolent acts that would result in loss of assets” (Garcia, 2001, p. 302). Consequence according to Blades is the degree of damage that may in the event of threat occurrence (Blades, n.d. p.38). There are four steps that should be taken into account as assessing risks in an organization. 1. Identifying Hazards Step one is identifying hazards and those at risk that puts the company operation at stake. 2. Evaluating and Prioritizing Risks Step two is the evaluating and prioritizing risks which basically involve estimating the existing risks and prioritizing them in order of importance. 3. Identifying the Correct Measures Deciding on preventive action is under step three which involve identifying the correct measures to eliminate or control the risks. Table 1 Risk Assessment Sheet (SAG 1991) 4. Taking Action Step four involve taking action through putting in place the preventive and protective means by prioritization plan and specifying who does what and when. Step five is the final step which involves monitoring and reviewing. The assessment should be reviewed now and then to ensure it remains up to date and it should be revised whenever important changes occur in the organization. The management of an organization will make decisions of protecting its assets according to this assessment. In risk assessment both immediate and long-term solutions are recommended by the risk analyst. Risks are described in terms of likelihood and consequences. In likelihood; a risk can described in a level of very likely to occur, likely, possible, unlikely, rare or unknown. 3.1 Security challenges to the proposed system Given that the company information is going to be online, it means tha many internet security challenges will be inevitable. Some of the major security risks include: a. Data being stolen; hackers can intercept emails and read the contents which may be sensitive company information. The customers’ credit card numbers may also be stolen this was the main security concern of the top management. b. Login/password and other access information many be stolen , this will give an unauthorized users to access company information. The user login information may be captured by malicious people. c. Operating system shutdown; an operating system may stop working and shutdown automatically. d. File system corruption, the clients’ information and the company’s details on the internet are prone to virus attack. Viruses can result from unauthorized programmes such as games being played on the website. 3.2 Security Strategies 1) use of separate host Separate hosts ensure that hackers do not have access to company files from the internal systems. The clients will be connected to the internet but not to the company network. Users are able to gain access via the internet because they will dial to a separate host. 2) Password protection Clients will be able to have a password eight characters minimum length and it must be alphanumeric. The passwords will not be stored in directories where they can easily be retrieved. Clients will also be informed on the importance of the passwords as an ultimate protection they have. They will be required to regularly change their passwords. Anti-span facilities such as capture will be used to ensure that automatic form filling does not occur. 3) Security log files Security log files are the files that show every transaction. The system will be designed to keep records of the major transactions of every logged in user on their website. 4) Track transactions Put alarm alert when one tries to access secure area. Enforce password log in accounts for internal users with logs on their transaction in the organization. Sensitive files such as credit card information should be protected such that one can not copy, print of email them from the company directory. 5) Cryptograph Encryption is converting information in to unintelligent format whereby only the sender and the receiver can have a sensible data. This ensures that interceptors do not get meaningful information in the event that they succeed to get emails. 6) Antivirus and firewalls Antivirus ensures that information is not corrupted. Internet security viruses should be installed and updated in order to secure the files from the server and the internet. Firewalls ensure that there are not internet attacks. Information transferred from the server should be well guided. Reference: Jon William Toigo and M., (1999), Disaster Recovery Planning: strategies for protecting Critical Information assets, Prentice Hall. King William R.,(1995), Creating A strategic Capabilities Architecture, information Systems Management. Martin James, Strategic Data-Planning Methodologies, Printice Hall Porter M.E., and Millar V.E,(July-August, 1985) How Information Gives You Competitive Advantage, Harvard business review. Read More