Published Article / This study investigated the different business continuity risks organisations face and the existence of business continuity plans to address and manage these risks. The study found that although the majority of organisations are aware of the business continuity risks that they are faced with, not all fully understand the impact thereof on their organisations, and accordingly do not have effective and adequate business continuity plans in place to address and manage these risks. Also, not all organisations are placing enough emphasis on the establishment of a business continuity culture within their organisations to support their business continuity philosophy and plan.

This master thesis deals and analyzes the problems in the area of Business Continuity and Disaster Recovery strategy. It proposes a possible solutions, its practical implementation in the real environment of bank. Part of this work speaks about theoretical background, second part of this work analyzes the current situation, which describes the deficiencies in the given directions and in the end are explained my practical advices for implementation of the Business Continuity and Disaster Recovery strategy.

Södra har i nuläget en modell för leverantörssegmentering med segmenten strategiska-, prioriterade- och avtalade leverantörer. Det finns emellertid förbättringsmöjligheter kring tillämpningen av modellen, såväl som den efterföljande hanteringen av segmenten. Syftet är att ge förslag på hur strategier för hantering av leverantörssegment kan differentieras för Södra. För att uppnå syftet tas avstamp i litteraturen kring Supplier Relationship Management (SRM). Därefter samlas empirisk data in utifrån en enkätundersökning och två semistrukturerade intervjuer. Uppsatsens första bidrag är ett förslag på hur strategier för hantering av Södras leverantörssegment kan differentieras utifrån litteraturen kring SRM. 14 element identifieras och förslag på hur dessa kan tillämpas för Södras leverantörssegment presenteras. Ett av dessa element är kommunikation, där strategiska leverantörsrelationer bör karaktäriseras av omfattande kommunikation, medan kommunikationsnivån successivt bör minska för prioriterade- och avtalade leverantörsrelationer. Ytterligare ett element är inköpspris, där fokus för avtalade leverantörer bör vara att erhålla ett fördelaktigt pris, medan fokus för strategiska leverantörer bör vara att säkerställa tillgången. För det andra bidrar uppsatsen med att identifiera förbättringsmöjligheter i tillämpningen av Södras segmenteringsmodell. Enkätundersökningen och intervjuerna visar att modellen upplevs som komplicerad och otydlig, samt att det finns ett behov av utbildningar och rutiner. Slutligen bidrar uppsatsen med att identifiera förbättringsmöjligheter i Södras hantering av olika leverantörssegment. Det framgår att ett flertal inköpare inte tar hänsyn till alla 14 element, vilket visar på förbättringsmöjligheter kring hur hänsyn kan tas till dessa element. / Södra currently has a model for supplier segmentation with the segments strategic-, prioritized-, and contracted suppliers. However, there are opportunities for improvement in the application of the model, as well as in the subsequent management of the segments. The purpose is to propose how strategies for managing supplier segments can be differentiated for Södra. To achieve this purpose, the literature on Supplier Relationship Management (SRM) is used as a starting point. Empirical data is then collected through a survey and two semi-structured interviews. The first contribution of the thesis is a proposal on how strategies for managing Södras supplier segments can be differentiated based on the SRM literature. 14 elements are identified, and suggestions on how these can be applied to Södras supplier segments are presented. One of these elements is communication, where strategic supplier relationships should be characterized by extensive communication, while the level of communication should gradually decrease for prioritized- and contracted supplier relationships. Another element is purchase price, where the focus regarding contracted suppliers should be to obtain a favorable price, while the focus regarding strategic suppliers should be to ensure availability. Secondly, the thesis contributes by identifying opportunities for improvement in the application of Södras segmentation model. The survey and interviews reveal that the model is perceived as complicated and unclear, and that there is a need for training and routines. Finally, the thesis identifies opportunities for improvement in Södras management of different supplier segments. It is evident that several buyers do not take all 14 elements into consideration, which indicates potential improvements in how these elements can be considered.

This thesis is concerned about Business Continuity Management with the focus on determination of the RTO and RPO parameters. The work is divided into two main parts. The first section briefly describes theoretical issues of Business Continuity Management in conjunction with IT Service Continuity Management. Then there are described various technologies that are currently used to ensure continuity and recovery of IT systems. In conclusion of the theoretical part, the work focuses on the process of Business Impact Analysis. This thesis thus offers a comprehensive view of main principles and benefits that these concepts have for company and how they should be integrated with each other. It provides an overview of various technologies, their link to RTO and RPO parameters and also the definition of steps of disaster recovery procedure. The work also briefly defines the basic procedure for determination of the RTO and RPO parameters, subsequent steps needed to design recovery solutions and analyzes various aspects which need to be considered when defining the parameters of continuity. The second practical part is based on the previous theoretically defined procedure and its aim is to analyze the data acquired during the questionnaire investigation in chosen company to determine the parameters of continuity for the applications in use and then suggest appropriate ways of addressing their backup and recovery. The result of this thesis is therefore a description of the analysis and practical application of methods for setting the parameters for continuity of information systems and the subsequent establishment of necessary measures.

There are various types of disasters and no one can expect when they will occur. IT disaster recovery plan (ITDRP) became one of the most important contingency plans for organizations in the event of disasters. Organizations started realizing the importance of having IT Disaster recovery plan but many hesitate to apply this plan before a disaster occurs. However, even when the importance of ITDRP is acknowledged in the IS field, most scholarly work has focused on the process and strategies while briefly looking at the challenges and benefits of the DRP. This paper aims to investigate the most common challenges associated with having an effective ITDRP and the opportunities associated with this plan. A qualitative study was conducted which consists 6 interviews within several organizations which have developed an ITDRP. The results show that top management support, staff issues, maintenance, and disaster recovery sites are the main challenges organizations face during DRP. While the benefits were data protection, reducing the interruption for business functions, enhancing the reliability for staff and IT services and speeding up the decision-making process.

El presente proyecto tiene como finalidad contribuir el desarrollo de un plan de continuidad operativa para proteger y garantizar la operatividad de los servicios críticos de TI basado específicamente en la norma ISO/IEC 27031:2011 y otras guías o normativas para la entidad del sector público, la cual es el Registro Nacional de Identificación y Estado Civil (RENIEC) con el fin de tener una mejor capacidad de respuesta ante una paralización parcial o total de los servicios que brinda la entidad, asimismo, lograr una correcta disponibilidad con el análisis de los tiempos de recuperación tolerables para continuar con las operaciones del negocio. El proyecto cuenta principalmente con cinco capítulos para saber cómo podremos diseñar un plan de continuidad operativa. En primer lugar, se elaboran los aspectos introductorios donde nos señala la situación problemática, los objetivos, general y específicos, la justificación del proyecto para saber la importancia del desarrollo y el estado del arte. En segundo lugar, se desarrolla el marco teórico que se encarga de la definición de todo lo relacionado al plan de continuidad operativa de los servicios de TI, su valor y sus etapas de diseño. En tercer lugar, se analizará la situación problemática que se plantea, el análisis de impacto al negocio y sus niveles de servicios, el análisis de riesgo y su catálogo de amenazas, vulnerabilidades y controles para mitigar los riesgos, el alcance y los requerimientos del proyecto. En cuarto lugar, se elabora las políticas de continuidad, las estrategias de recuperación para cada escenario de amenaza evaluado y las alternativas de solución para cada uno; y la propuesta del diseño que se realiza por medio de las fases del Ciclo de Deming (PDCA). En quinto lugar, se desarrolla el plan de pruebas, su ejecución y ensayos de los escenarios establecidos, resultados y validación de las pruebas; y los planes de mejora para el plan de continuidad operativa del servicio de TI. Finalmente, se elaboran conclusiones y recomendaciones para trabajos a futuros. / The purpose of this project is to contribute to the development of an operational continuity plan to protect and guarantee the operation of critical IT services based specifically on the ISO/IEC 27031: 2011 standard and other guides or regulations for the public sector entity, which is the National Registry of Identification and Civil Status (RENIEC) in order to have a better response capacity before a partial or total stoppage of the services provided by the entity, in addition, to achieve correct availability with the analysis of the times tolerable recovery measures to continue business operations. The project mainly has five chapters to know how we can design an operational continuity plan. In the first place, the introductory aspects are elaborated where it points out the problematic situation, the objectives, general and specific, the justification of the project to know the importance of development and the state of the art. Second, the theoretical framework that is responsible for defining everything related to the operational continuity plan of IT services, its value and its design stages, is developed. Third, the problem that arises, the analysis of the impact on the business and its service levels, the risk analysis and its catalog of threats, vulnerabilities and controls to mitigate risks, the scope and requirements of the project are analyzed. Fourth, continuity policies, recovery strategies for each threat scenario evaluated and alternative solutions for each one are developed; and the design proposal that is carried out through the phases of the Deming Cycle (PDCA). In fifth place, the test plan, its execution and tests of the established scenarios, results and validation of the tests are developed; and the improvement plans for the IT services operational continuity plan. Finally, conclusions and recommendations for future work are drawn up. / Tesis

[pt] Embora cada vez mais aceita na academia e adotada no meio empresarial, a responsabilidade social corporativa ainda não representa um consenso e está em constante evolução. Evidências indicam que tal abordagem pode proporcionar benefícios às empresas que vão de funcionários mais produtivos e motivados a aumento de vendas e fidelização de clientes, além de ganhos de imagem perante a sociedade. Por outro lado, existem argumentos no sentido de que as empresas devem focar seus esforços tão somente na maximização de lucro, já que a remediação de fraquezas sociais deveria ser uma atribuição exclusiva do governo ou de entidades do terceiro setor. Dessa discussão, emerge a criação de valor compartilhado, um conceito híbrido e que dialoga com as duas vertentes citadas acima a partir do olhar das fraquezas sociais como oportunidades de negócio. A abordagem do valor compartilhado pressupõe, portanto, que as empresas podem – e devem – adaptar seus produtos e serviços, aprimorar sua cadeia de valor e/ou fomentar um ambiente favorável a suas operações a fim de remediar uma determinada causa social e, com isso, obter ganhos comerciais. Para ilustrar a operação dessa estratégia, o presente estudo faz uma análise do Coletivo Coca-Cola Brasil, a plataforma de criação de valor compartilhado da subsidiária brasileira da empresa líder global no setor de bebidas não-alcoólicas. A análise se dá em torno do Coletivo Varejo, que capacita jovens moradores de comunidades carentes de todo o Brasil com vistas à sua incorporação no mercado formal de trabalho e ao aumento de sua autoestima. O resultado do estudo aponta para a existência de impactos positivos tanto para as comunidades apoiadas quanto para a empresa. / [en] Despite being increasingly accepted by academy and adopted by businesses, corporate social responsibility is not yet a consensus, and is still an evolving concept. Evidences show that this approach can generate benefits to enterprises, from more productive and motivated employees to sales growth and client loyalty, besides corporate image gains towards society. On the other hand, some authors argue that companies ought to focus on profit maximization, since social weaknesses mitigation would be a government s or third sector s exclusive attribution. The shared value creation emerges from this discussion as a hybrid concept that dialogs with both points of view and which faces social weaknesses as business opportunities. Therefore, the shared value approach holds that companies must adapt their products and services, redefine productivity in the value chain and/or enable local cluster development in order to mitigate some social cause and obtain commercial gains in consequence. As an illustration of that strategy, the present study analyses Coca-Cola Brasil s Coletivo, the Coca-Cola Company s Brazilian affiliate s shared value platform. The analysis focuses on Coletivo Retail, which trains young residents from poor communities throughout Brazil so that they can reach formal labour market and experience self-esteem growth. Results show positive impacts to both supported communities and Coca-Cola Brasil.

Este trabalho propõe diretrizes de Gestão de Continuidade de Negócios (GCN) para a tecnologia de Ensino Presencial Mediado por Recursos Tecnológicos (EPMRT), que conta, para a realização de suas atividades acadêmicas, com um sistema complexo para transmissão de aulas e exige um grande esforço para o controle das suas operações e das respostas coordenadas diante de erros, falhas e defeitos, ou quaisquer incidentes que resultem na interrupção das suas atividades. A manutenção deste ambiente tecnológico está relacionada com a implantação de processos eficientes de gestão de risco e do ciclo de melhoria contínua em ambiente de TI com a adoção do ITIL® e através da construção das diretrizes de um Plano de Continuidade de Negócios (PCN), documentado por meio de elementos da UML, utilizando a Análise de Impacto nos Negócios (BIA), a Avaliação dos Riscos (RA) e os atributos de Dependabilidade para os elementos tecnológicos: disponibilidade, confiabilidade, segurança, confidencialidade, integridade e manutenibilidade. / This paper proposes guidelines for Business Continuity Management (BCM) that uses a technology called Education System Mediated Classroom Resources Technology (SPMRT), which needs, for the achievement of their academic activities, a complex system for transmission of lessons and requires a great effort to control their operations and coordinated fast responses in case of errors, faults, attacks and defects, or any incidents that result in the disruption of their activities. Maintaining this technological environment is related to the implementation of efficient processes of risk management and continuous improvement cycle in the IT environment with the adoption of ITIL® and through the construction of a Business Continuity Plan (BCP), documented by elements of the UML using the Business Impact Analysis (BIA), Risk Assessment (RA) and the attributes of Dependability: availability, reliability, security, confidentiality, integrity and maintainability.

Este trabalho propõe diretrizes de Gestão de Continuidade de Negócios (GCN) para a tecnologia de Ensino Presencial Mediado por Recursos Tecnológicos (EPMRT), que conta, para a realização de suas atividades acadêmicas, com um sistema complexo para transmissão de aulas e exige um grande esforço para o controle das suas operações e das respostas coordenadas diante de erros, falhas e defeitos, ou quaisquer incidentes que resultem na interrupção das suas atividades. A manutenção deste ambiente tecnológico está relacionada com a implantação de processos eficientes de gestão de risco e do ciclo de melhoria contínua em ambiente de TI com a adoção do ITIL® e através da construção das diretrizes de um Plano de Continuidade de Negócios (PCN), documentado por meio de elementos da UML, utilizando a Análise de Impacto nos Negócios (BIA), a Avaliação dos Riscos (RA) e os atributos de Dependabilidade para os elementos tecnológicos: disponibilidade, confiabilidade, segurança, confidencialidade, integridade e manutenibilidade. / This paper proposes guidelines for Business Continuity Management (BCM) that uses a technology called Education System Mediated Classroom Resources Technology (SPMRT), which needs, for the achievement of their academic activities, a complex system for transmission of lessons and requires a great effort to control their operations and coordinated fast responses in case of errors, faults, attacks and defects, or any incidents that result in the disruption of their activities. Maintaining this technological environment is related to the implementation of efficient processes of risk management and continuous improvement cycle in the IT environment with the adoption of ITIL® and through the construction of a Business Continuity Plan (BCP), documented by elements of the UML using the Business Impact Analysis (BIA), Risk Assessment (RA) and the attributes of Dependability: availability, reliability, security, confidentiality, integrity and maintainability.