Published Article / This study investigated the different business continuity risks organisations face and the existence of business continuity plans to address and manage these risks. The study found that although the majority of organisations are aware of the business continuity risks that they are faced with, not all fully understand the impact thereof on their organisations, and accordingly do not have effective and adequate business continuity plans in place to address and manage these risks. Also, not all organisations are placing enough emphasis on the establishment of a business continuity culture within their organisations to support their business continuity philosophy and plan.

Companies are during their operation impacted many risks from inside or outside. Business Continuity Management is a managerial discipline that deals with providing resistance against operation company risks and was developed due to the increasing requirement to save against unforseen incidents. The goal of this thesis is to optimize the Business Continuity Plan of particular company in accordance with a system of crisis management in Czech Republic.

Business continuity is an area of research that ensure continuity of enterprise operations. Business continuity requires knowledge and input from business and IT leaders to assess and manage risks associated with critical business processes to develop a plan that can allow the organization to resume operations. Organizations that have a holistic enterprise risk management approach can better manage business and technology risks. The increasing dependency on technological resources asserts the need to assess business and technology risks to develop business continuity. Nevertheless, governance and enterprise leaders find difficult to determine the scope and impact of risks associated with enterprise operations. In organizational contexts, business continuity planning is perceived as an element of contingency instead of an opportunity for improvement. In addition, there is a lack of academic literature related to the organizational implementation of a business continuity plan. For this reason, there is a need to merge enterprise risk management and governance of enterprise IT views to provide an integrated perspective of business and technological risk in the im-plementation of a business continuity plan.The objective of the study relies on assessing how the implementation of a business continuity plan is conducted, together with its challenges and benefits, to provide insights on the elements that facilitates a business continuity plan implementation. The study focuses on the preparation phase of a business continuity plan, where enterprise risks are identified, evalu-ated and mitigated. The study results are based on a case study performed at a multination retail and manufacturing enterprise in Spain. The results indicates that awareness from the higher governance body and senior management on the dependency that enterprises have developed on IS/IT key resources is a factor that influence how risk management and technology risk is perceived in organizations. This influence how the higher governance body views the need to implement enterprise risk management, governance of enterprise IT and business continuity initiatives. Likewise, the elements facilitating a business continuity imple-mentation are associated with the sponsorship and leadership from organizational actors, the involvement of an external organizational agent that can bring expertise and methodology related to business continuity planning, identification of enterprise critical areas and processes and the creation of business and IT risk scenarios to depict threats to the organization operations and processes. This internal reflection brings challenges and benefits to the or-ganization and both are addressed in the study.The study concludes with the presentation of two high level frameworks that can aid enter-prise leaders to visualize and understand the influence that enterprise risk management and governance of enterprise IT has on the implementation of a business continuity plan and the underlying elements that facilitate a business continuity plan implementation in organizations.

Magister Commercii (Information Management) - MCom(IM) / This thesis examines what a Business Continuity Plan (BCP) should comprise off, as well as the difference between a BCP and a Disaster Recovery Plan (DRP) and the key elements of an effective BCP as well as the different types of disasters. It also investigates why companies that have BCP in place and conducts testing of their plan on a regular basis, either quarterly or bi-annually, still experience prolonged downtime during a disaster resulting in Service Level Agreements (SLA) not being met or major financial loses. It also inspects acceptable processes within a BCP to determine whether there are ways of improving these processes to prevent companies from experiencing prolonged downtime. The objective of this research is to determine and understand: • Why organisations within the Western Cape experience prolonged downtimes during a disaster event • The potential deficiencies in a BCP and how they can be amended.

Magister Commercii (Information Management) - MCom(IM) / This thesis examines what a Business Continuity Plan (BCP) should comprise off, as well as the difference between a BCP and a Disaster Recovery Plan (DRP) and the key elements of an effective BCP as well as the different types of disasters. It also investigates why companies that have BCP in place and conducts testing of their plan on a regular basis, either quarterly or bi-annually, still experience prolonged downtime during a disaster resulting in Service Level Agreements (SLA) not being met or major financial loses. It also inspects acceptable processes within a BCP to determine whether there are ways of improving these processes to prevent companies from experiencing prolonged downtime. The objective of this research is to determine and understand: Why organisations within the Western Cape experience prolonged downtimes during a disaster event. The potential deficiencies in a BCP and how they can be amended. A case study of four companies based in the Western Cape was conducted. These companies were chosen because each of them has a BCP in place and each have experienced prolonged downtime during a disaster. Qualitative interviews with the aid of an open-ended questionnaire were used to interview the BCP or Risk Manager of each company. The data was analysed to determine what the causes of their prolonged downtime were during a disaster. In the analysis and findings process each company is presented as a separate case study. The intension with this research study is to add an additional concept to the Common BCP Process that was identified within this study and that formed the basis for the Conceptual Framework, thereby reducing the downtime during a disaster for the companies that formed part of the research.

This master thesis deals and analyzes the problems in the area of Business Continuity and Disaster Recovery strategy. It proposes a possible solutions, its practical implementation in the real environment of bank. Part of this work speaks about theoretical background, second part of this work analyzes the current situation, which describes the deficiencies in the given directions and in the end are explained my practical advices for implementation of the Business Continuity and Disaster Recovery strategy.

Diante da constante necessidade de funcionamento ininterrupto dos sistemas computacionais, das mais diversas organizações, é imperativo que existam meios de continuidade dos negócios e recuperação de desastres implantados, testados e prontos para serem invocados. Diante disso, torna-se essencial a existência de uma maneira de avaliar se as informações, os procedimentos e o nível do conhecimento dos colaboradores da organização estão adequados para enfrentar uma ocorrência inesperada e devastadora no ambiente computacional da organização. A presente tese propõe um modelo hierárquico para se representar e avaliar a qualidade dos Projetos de Planos de Continuidade de Negócios (PPCN) aplicados a sistemas computacionais. Este modelo apresenta o mapeamento das principais características que esses planos devem possuir, de acordo com as principais normas relativas ao tema (BS 25999, ABNT NBR ISO/IEC 27001 e ABNT NBR ISO/IEC 27002), as experiências de especialistas da área e dados reais dos usuários dos PPCNs obtidos por meio da utilização de questionários. É proposto neste trabalho, também, um Índice de Qualidade (IQ) para os PPCNs que permite a comparação de um PPCN existente com um PPCN ideal, identificando-se os pontos fracos nele existentes e munindo a organização com informações para a busca de soluções que resultarão na melhoria do PPCN atual. / Given the need for computer systems uninterrupted operation, for the most different organizations, it is imperative that business continuity and disaster recovery plans be already in place, tested and ready to be invoked. Given this, it is essential for there being a way to assess whether the information, procedures and organizations employees knowledge level are adequate to deal with an unexpected and devastating event in the organization\'s computing environment. This thesis proposes a hierarchical model to represent and assess the organizations computer systems Business Continuity Plan Project (BCPP) quality. This model maps the main features these plans should have, in accordance with the main standards related to this area (BS 25999, ISO/IEC 27001 and ISO/IEC 27002), specialists experience and real data from BCPPs users obtained from questionnaires. As a complementary proposal, a BCPP Quality Index (QI) is suggested, which will allow organizations to compare their existing BCPP against an ideal BCPP, identifying the gaps between these plans and providing the organization with information for seeking solutions that will result in the improvement of current BCPP.

Diante da constante necessidade de funcionamento ininterrupto dos sistemas computacionais, das mais diversas organizações, é imperativo que existam meios de continuidade dos negócios e recuperação de desastres implantados, testados e prontos para serem invocados. Diante disso, torna-se essencial a existência de uma maneira de avaliar se as informações, os procedimentos e o nível do conhecimento dos colaboradores da organização estão adequados para enfrentar uma ocorrência inesperada e devastadora no ambiente computacional da organização. A presente tese propõe um modelo hierárquico para se representar e avaliar a qualidade dos Projetos de Planos de Continuidade de Negócios (PPCN) aplicados a sistemas computacionais. Este modelo apresenta o mapeamento das principais características que esses planos devem possuir, de acordo com as principais normas relativas ao tema (BS 25999, ABNT NBR ISO/IEC 27001 e ABNT NBR ISO/IEC 27002), as experiências de especialistas da área e dados reais dos usuários dos PPCNs obtidos por meio da utilização de questionários. É proposto neste trabalho, também, um Índice de Qualidade (IQ) para os PPCNs que permite a comparação de um PPCN existente com um PPCN ideal, identificando-se os pontos fracos nele existentes e munindo a organização com informações para a busca de soluções que resultarão na melhoria do PPCN atual. / Given the need for computer systems uninterrupted operation, for the most different organizations, it is imperative that business continuity and disaster recovery plans be already in place, tested and ready to be invoked. Given this, it is essential for there being a way to assess whether the information, procedures and organizations employees knowledge level are adequate to deal with an unexpected and devastating event in the organization\'s computing environment. This thesis proposes a hierarchical model to represent and assess the organizations computer systems Business Continuity Plan Project (BCPP) quality. This model maps the main features these plans should have, in accordance with the main standards related to this area (BS 25999, ISO/IEC 27001 and ISO/IEC 27002), specialists experience and real data from BCPPs users obtained from questionnaires. As a complementary proposal, a BCPP Quality Index (QI) is suggested, which will allow organizations to compare their existing BCPP against an ideal BCPP, identifying the gaps between these plans and providing the organization with information for seeking solutions that will result in the improvement of current BCPP.

IT solutions must be protected so that the business can continue, even in the case of fatal failures associated with disasters. Business continuity in the context of disaster implies that business cannot continue in the current environment but instead must continue at an alternate site or data center. However, the BC/DR concept today is too fragmented, as many different frameworks and methodologies exist. Furthermore,many of the application-specific solutions are provided and promoted by software vendors, while hardware vendors provide solutions for their hardware environments. Nevertheless, there are concerns that BC/DR solutions often do not connect to the technical components that are in the lower layers, which function as the foundationfor any such solutions; hence, it is equally important to connect and map the requirements accordingly. Moreover, a shift in the hardware environment, such as cloud computing, as well as changes in operations management, such as outsourcing,add complexity that must be captured by a BC/DR solution. Furthermore, the integrated nature of IT-based business solutions also presents new challenges, as it isno longer one IT solution that must be protected but also other IT solutions that are integrated to deliver an individual business process. Thus, it will be difficult to employa current BC/DR approach. Hence, the purpose of this thesis project is to design, develop, and present a novel way of addressing the BC/DR gaps, while supporting the requirements of a dynamic IT environment. The solution reuses most elements fromthe existing standards and solutions. However, it also includes new elements to capture and present the technical solution; hence, the complete solution is designatedas a framework. The new framework can support many IT solutions since it will havea modular approach, and it is flexible, scalable, and platform and application independent, while addressing the solution on a component level. The new framework is applied to two application scenarios at the stakeholder site, and theresults are studied and presented in this thesis.

Bakgrund: Då kriser inträffar allt oftare är det av stor vikt för organisationer att ha en utvecklad strategi för att hantera dessa störningar. Ett sätt för att hantera risker och kriser är Business Continuity Management som involverar hela processen med planering av åtgärder i förväg, krishantering samt utvärdering efter krisen. Syfte: Syftet med uppsatsen är att identifiera och analysera teorierna kring Business Continuity Management samt huruvida dessa tillämpas praktiskt i stora svenska tillverkande företag. Vidare ämnar studien skapa en djupare förståelse kring hur de studerade företagen, med hjälp av jämförelser och granskning, agerar under en rådande krissituation. Metod: Uppsatsen bygger på en kvalitativ forskningsmetod med där den empiriska materialinsamlingen har skett via semistrukturerade intervjuer. Ytterligare empiriskt material är de studerade företagens års- och kvartalsrapporter. En komparativ forskningsdesign har tillämpats, vilken möjliggör för jämförelser mellan de studerade företagens användning av BCM. Slutsats: Studien kan konstatera att inget utav de studerade företagen tillämpar Business Continuity Management fullt ut. Däremot nyttjas modeller och strategier som ligger i linje med den teoretiska referensramen för BCM. / Background: As crisis occur more and more frequently around the world, it is vital for organizations to have an implemented strategy to cope with these disruptions. One way to manage these crises is Business Continuity Management which involves the entire process of planning actions in advance, crisis management and post-crisis evaluation. Purpose: The purpose of this thesis is to identify and analyse the theories related to Business Continuity Management and whether these theories practically applies in Swedish manufacturing companies. Furthermore, the study aims to create a deeper understanding of how the studied companies, by means of comparisons and review, act in a crisis situation. Method: The thesis is based on a qualitative research method where the empirical material collection has been done via semi-structured interviews. Further empirical material is the annual and quarterly reports of the companies studied. A comparative research design has been applied, which allows for comparisons between the studied companies' use of BCM. Conclusion: The study finds that none of the studied companies fully applies Business Continuity Management. However, models and strategies that are in line with the theoretical frame of reference for BCM are used.