Published Article / This study investigated the different business continuity risks organisations face and the existence of business continuity plans to address and manage these risks. The study found that although the majority of organisations are aware of the business continuity risks that they are faced with, not all fully understand the impact thereof on their organisations, and accordingly do not have effective and adequate business continuity plans in place to address and manage these risks. Also, not all organisations are placing enough emphasis on the establishment of a business continuity culture within their organisations to support their business continuity philosophy and plan.

Companies are during their operation impacted many risks from inside or outside. Business Continuity Management is a managerial discipline that deals with providing resistance against operation company risks and was developed due to the increasing requirement to save against unforseen incidents. The goal of this thesis is to optimize the Business Continuity Plan of particular company in accordance with a system of crisis management in Czech Republic.

Business continuity is an area of research that ensure continuity of enterprise operations. Business continuity requires knowledge and input from business and IT leaders to assess and manage risks associated with critical business processes to develop a plan that can allow the organization to resume operations. Organizations that have a holistic enterprise risk management approach can better manage business and technology risks. The increasing dependency on technological resources asserts the need to assess business and technology risks to develop business continuity. Nevertheless, governance and enterprise leaders find difficult to determine the scope and impact of risks associated with enterprise operations. In organizational contexts, business continuity planning is perceived as an element of contingency instead of an opportunity for improvement. In addition, there is a lack of academic literature related to the organizational implementation of a business continuity plan. For this reason, there is a need to merge enterprise risk management and governance of enterprise IT views to provide an integrated perspective of business and technological risk in the im-plementation of a business continuity plan.The objective of the study relies on assessing how the implementation of a business continuity plan is conducted, together with its challenges and benefits, to provide insights on the elements that facilitates a business continuity plan implementation. The study focuses on the preparation phase of a business continuity plan, where enterprise risks are identified, evalu-ated and mitigated. The study results are based on a case study performed at a multination retail and manufacturing enterprise in Spain. The results indicates that awareness from the higher governance body and senior management on the dependency that enterprises have developed on IS/IT key resources is a factor that influence how risk management and technology risk is perceived in organizations. This influence how the higher governance body views the need to implement enterprise risk management, governance of enterprise IT and business continuity initiatives. Likewise, the elements facilitating a business continuity imple-mentation are associated with the sponsorship and leadership from organizational actors, the involvement of an external organizational agent that can bring expertise and methodology related to business continuity planning, identification of enterprise critical areas and processes and the creation of business and IT risk scenarios to depict threats to the organization operations and processes. This internal reflection brings challenges and benefits to the or-ganization and both are addressed in the study.The study concludes with the presentation of two high level frameworks that can aid enter-prise leaders to visualize and understand the influence that enterprise risk management and governance of enterprise IT has on the implementation of a business continuity plan and the underlying elements that facilitate a business continuity plan implementation in organizations.

This master thesis deals and analyzes the problems in the area of Business Continuity and Disaster Recovery strategy. It proposes a possible solutions, its practical implementation in the real environment of bank. Part of this work speaks about theoretical background, second part of this work analyzes the current situation, which describes the deficiencies in the given directions and in the end are explained my practical advices for implementation of the Business Continuity and Disaster Recovery strategy.

Diante da constante necessidade de funcionamento ininterrupto dos sistemas computacionais, das mais diversas organizações, é imperativo que existam meios de continuidade dos negócios e recuperação de desastres implantados, testados e prontos para serem invocados. Diante disso, torna-se essencial a existência de uma maneira de avaliar se as informações, os procedimentos e o nível do conhecimento dos colaboradores da organização estão adequados para enfrentar uma ocorrência inesperada e devastadora no ambiente computacional da organização. A presente tese propõe um modelo hierárquico para se representar e avaliar a qualidade dos Projetos de Planos de Continuidade de Negócios (PPCN) aplicados a sistemas computacionais. Este modelo apresenta o mapeamento das principais características que esses planos devem possuir, de acordo com as principais normas relativas ao tema (BS 25999, ABNT NBR ISO/IEC 27001 e ABNT NBR ISO/IEC 27002), as experiências de especialistas da área e dados reais dos usuários dos PPCNs obtidos por meio da utilização de questionários. É proposto neste trabalho, também, um Índice de Qualidade (IQ) para os PPCNs que permite a comparação de um PPCN existente com um PPCN ideal, identificando-se os pontos fracos nele existentes e munindo a organização com informações para a busca de soluções que resultarão na melhoria do PPCN atual. / Given the need for computer systems uninterrupted operation, for the most different organizations, it is imperative that business continuity and disaster recovery plans be already in place, tested and ready to be invoked. Given this, it is essential for there being a way to assess whether the information, procedures and organizations employees knowledge level are adequate to deal with an unexpected and devastating event in the organization\'s computing environment. This thesis proposes a hierarchical model to represent and assess the organizations computer systems Business Continuity Plan Project (BCPP) quality. This model maps the main features these plans should have, in accordance with the main standards related to this area (BS 25999, ISO/IEC 27001 and ISO/IEC 27002), specialists experience and real data from BCPPs users obtained from questionnaires. As a complementary proposal, a BCPP Quality Index (QI) is suggested, which will allow organizations to compare their existing BCPP against an ideal BCPP, identifying the gaps between these plans and providing the organization with information for seeking solutions that will result in the improvement of current BCPP.

Diante da constante necessidade de funcionamento ininterrupto dos sistemas computacionais, das mais diversas organizações, é imperativo que existam meios de continuidade dos negócios e recuperação de desastres implantados, testados e prontos para serem invocados. Diante disso, torna-se essencial a existência de uma maneira de avaliar se as informações, os procedimentos e o nível do conhecimento dos colaboradores da organização estão adequados para enfrentar uma ocorrência inesperada e devastadora no ambiente computacional da organização. A presente tese propõe um modelo hierárquico para se representar e avaliar a qualidade dos Projetos de Planos de Continuidade de Negócios (PPCN) aplicados a sistemas computacionais. Este modelo apresenta o mapeamento das principais características que esses planos devem possuir, de acordo com as principais normas relativas ao tema (BS 25999, ABNT NBR ISO/IEC 27001 e ABNT NBR ISO/IEC 27002), as experiências de especialistas da área e dados reais dos usuários dos PPCNs obtidos por meio da utilização de questionários. É proposto neste trabalho, também, um Índice de Qualidade (IQ) para os PPCNs que permite a comparação de um PPCN existente com um PPCN ideal, identificando-se os pontos fracos nele existentes e munindo a organização com informações para a busca de soluções que resultarão na melhoria do PPCN atual. / Given the need for computer systems uninterrupted operation, for the most different organizations, it is imperative that business continuity and disaster recovery plans be already in place, tested and ready to be invoked. Given this, it is essential for there being a way to assess whether the information, procedures and organizations employees knowledge level are adequate to deal with an unexpected and devastating event in the organization\'s computing environment. This thesis proposes a hierarchical model to represent and assess the organizations computer systems Business Continuity Plan Project (BCPP) quality. This model maps the main features these plans should have, in accordance with the main standards related to this area (BS 25999, ISO/IEC 27001 and ISO/IEC 27002), specialists experience and real data from BCPPs users obtained from questionnaires. As a complementary proposal, a BCPP Quality Index (QI) is suggested, which will allow organizations to compare their existing BCPP against an ideal BCPP, identifying the gaps between these plans and providing the organization with information for seeking solutions that will result in the improvement of current BCPP.

IT solutions must be protected so that the business can continue, even in the case of fatal failures associated with disasters. Business continuity in the context of disaster implies that business cannot continue in the current environment but instead must continue at an alternate site or data center. However, the BC/DR concept today is too fragmented, as many different frameworks and methodologies exist. Furthermore,many of the application-specific solutions are provided and promoted by software vendors, while hardware vendors provide solutions for their hardware environments. Nevertheless, there are concerns that BC/DR solutions often do not connect to the technical components that are in the lower layers, which function as the foundationfor any such solutions; hence, it is equally important to connect and map the requirements accordingly. Moreover, a shift in the hardware environment, such as cloud computing, as well as changes in operations management, such as outsourcing,add complexity that must be captured by a BC/DR solution. Furthermore, the integrated nature of IT-based business solutions also presents new challenges, as it isno longer one IT solution that must be protected but also other IT solutions that are integrated to deliver an individual business process. Thus, it will be difficult to employa current BC/DR approach. Hence, the purpose of this thesis project is to design, develop, and present a novel way of addressing the BC/DR gaps, while supporting the requirements of a dynamic IT environment. The solution reuses most elements fromthe existing standards and solutions. However, it also includes new elements to capture and present the technical solution; hence, the complete solution is designatedas a framework. The new framework can support many IT solutions since it will havea modular approach, and it is flexible, scalable, and platform and application independent, while addressing the solution on a component level. The new framework is applied to two application scenarios at the stakeholder site, and theresults are studied and presented in this thesis.

Bakgrund: Då kriser inträffar allt oftare är det av stor vikt för organisationer att ha en utvecklad strategi för att hantera dessa störningar. Ett sätt för att hantera risker och kriser är Business Continuity Management som involverar hela processen med planering av åtgärder i förväg, krishantering samt utvärdering efter krisen. Syfte: Syftet med uppsatsen är att identifiera och analysera teorierna kring Business Continuity Management samt huruvida dessa tillämpas praktiskt i stora svenska tillverkande företag. Vidare ämnar studien skapa en djupare förståelse kring hur de studerade företagen, med hjälp av jämförelser och granskning, agerar under en rådande krissituation. Metod: Uppsatsen bygger på en kvalitativ forskningsmetod med där den empiriska materialinsamlingen har skett via semistrukturerade intervjuer. Ytterligare empiriskt material är de studerade företagens års- och kvartalsrapporter. En komparativ forskningsdesign har tillämpats, vilken möjliggör för jämförelser mellan de studerade företagens användning av BCM. Slutsats: Studien kan konstatera att inget utav de studerade företagen tillämpar Business Continuity Management fullt ut. Däremot nyttjas modeller och strategier som ligger i linje med den teoretiska referensramen för BCM. / Background: As crisis occur more and more frequently around the world, it is vital for organizations to have an implemented strategy to cope with these disruptions. One way to manage these crises is Business Continuity Management which involves the entire process of planning actions in advance, crisis management and post-crisis evaluation. Purpose: The purpose of this thesis is to identify and analyse the theories related to Business Continuity Management and whether these theories practically applies in Swedish manufacturing companies. Furthermore, the study aims to create a deeper understanding of how the studied companies, by means of comparisons and review, act in a crisis situation. Method: The thesis is based on a qualitative research method where the empirical material collection has been done via semi-structured interviews. Further empirical material is the annual and quarterly reports of the companies studied. A comparative research design has been applied, which allows for comparisons between the studied companies' use of BCM. Conclusion: The study finds that none of the studied companies fully applies Business Continuity Management. However, models and strategies that are in line with the theoretical frame of reference for BCM are used.

[pt] Todos os dias, diversos sistemas são invadidos, muitas pessoas são vítimas de vírus, os mais variados dados são obtidos ilegalmente e muitas empresas ficam de uma hora para outra sem poder operar normalmente. A segurança da informação se ocupa exatamente da proteção dos recursos de informação de empresas e indivíduos. Dentre os diversos assuntos abrangidos pela segurança da informação, o plano de continuidade de negócios (PCN) é o objeto de estudo deste trabalho. Antes confinado à literatura especializada, o PCN ganhou projeção na mídia há pouco mais de dois anos, quando o mundo assistiu perplexo a queda das torres do World Trade Center. O plano de continuidade de negócios tem como objetivo principal evitar, ou reduzir sensivelmente, as perdas das empresas em casos de incidentes que afetem suas operações, além de restaurar suas atividades no espaço de tempo mais breve possível. O objetivo final deste estudo é estabelecer o retrato atual dos planos de continuidade de negócios das empresas brasileiras e propor sugestões para torná-las menos vulneráveis às ameaças internas e externas, sejam novas, antigas ou potenciais. Para atingir o objetivo proposto, foi realizada uma pesquisa com 112 empresas, levantando as percepções de seus executivos, por meio de questionários e entrevistas. A pesquisa demonstra que as empresas não estão preparadas para enfrentar incidentes que possam interromper suas atividades operacionais, estando sujeitas até mesmo à falência. Por fim, é recomendado às empresas que avaliem detalhadamente os riscos aos quais estão submetidas e as conseqüências que os incidentes podem causar. Os impactos podem justificar o investimento em um plano de continuidade de negócios. / [en] Everyday, systems around the world are invaded by hackers, people fall victim to virus attacks, sensitive data are stolen, and firms find their operations screech to a halt. Information Security is responsible for the protection of the information resources of companies and people. The business continuity plan (BCP), one of the many issues that fall under the label of Information Security, is the object of this study. Previously confined to esoteric research journals, BCP gained significant coverage in the mainstream media in the wake of the attacks on the World Trade Center. The primary goal of a business continuity plan is the avoidance, or substantial reduction, of losses that a firm might suffer as a result of security incidents. Put simply, a BCP's goal is to keep firms operating as normal as possible during a disaster and get the firm back to standard operations as quickly as possible. The purpose of this study is to illustrate the current utilization of business continuity plans in Brazilian businesses and suggest how to make them less vulnerable to internal and external threats, regardless of whether they are old, new, or as yet undiscovered. To achieve this objective, 112 companies were selected and the executives could express their perceptions filling the surveys and through interviews. The research demonstrates that firms are not prepared to face incidents which may cause interruptions of their activities. Finally, the research recommends that companies to evaluate carefully the risks involved in their businesses and what consequences the security incidents may cause. The impacts can certainly justify the investments in Business Continuity Plan.

Este trabalho propõe diretrizes de Gestão de Continuidade de Negócios (GCN) para a tecnologia de Ensino Presencial Mediado por Recursos Tecnológicos (EPMRT), que conta, para a realização de suas atividades acadêmicas, com um sistema complexo para transmissão de aulas e exige um grande esforço para o controle das suas operações e das respostas coordenadas diante de erros, falhas e defeitos, ou quaisquer incidentes que resultem na interrupção das suas atividades. A manutenção deste ambiente tecnológico está relacionada com a implantação de processos eficientes de gestão de risco e do ciclo de melhoria contínua em ambiente de TI com a adoção do ITIL® e através da construção das diretrizes de um Plano de Continuidade de Negócios (PCN), documentado por meio de elementos da UML, utilizando a Análise de Impacto nos Negócios (BIA), a Avaliação dos Riscos (RA) e os atributos de Dependabilidade para os elementos tecnológicos: disponibilidade, confiabilidade, segurança, confidencialidade, integridade e manutenibilidade. / This paper proposes guidelines for Business Continuity Management (BCM) that uses a technology called Education System Mediated Classroom Resources Technology (SPMRT), which needs, for the achievement of their academic activities, a complex system for transmission of lessons and requires a great effort to control their operations and coordinated fast responses in case of errors, faults, attacks and defects, or any incidents that result in the disruption of their activities. Maintaining this technological environment is related to the implementation of efficient processes of risk management and continuous improvement cycle in the IT environment with the adoption of ITIL® and through the construction of a Business Continuity Plan (BCP), documented by elements of the UML using the Business Impact Analysis (BIA), Risk Assessment (RA) and the attributes of Dependability: availability, reliability, security, confidentiality, integrity and maintainability.