is the magnitude of a disaster that an organization is willing to commit its resources to reduce the impact of the disruption.
is comprised of two parts: The Disaster Scenario (Also known as the threat scenario) and the Planning Time Horizon.
The Disaster Scenario focuses the plan on a class of disasters, such as denial of access (e.g. fire), loss of manpower (e.g. pandemic), IT failures or supply chain disruption. It tells you what type of Business Continuity Plan you should be developing and aiming towards.
The Planning Time Horizon derives the impact due to a threat to an organisation from a upper limit of outage deviation (highest Period of Disruption) from a list of threats identified during the RAR phase. It determines whether the plan accounts for a 3-day outage, or a 3-week outage.
forms the basis for the development and implementation of the BC plan and recovery procedures.
is derived based on the list of threats identified which the BCM Steering Committee which deems its likelihood to occur or impact not acceptable, and that, if nothing is done, will cause significant (potential) losses and subsequently, result in huge costs to recover the business.
enables the organization to develop its BC plan that will address multiple threats and the threat that results in the maximum outage time is used as the planning norm.
is used to determine the impact to the business, and the priority with which critical business and support functions will be recovered. The recovery time lines, resources and vital records must ensure the recovery of these functions, and shall be consistent with the key disaster scenario.
Note (2): Test and exercise scenarios should also be realistic. The scenarios developed should be consistent with the key planning scenario. For example, if an earthquake is not identified as a threat which leads to the key planning scenario, then one should not consider developing a test or exercise scenario based on an earthquake. Fire is an inherent risk to most, if not all organizations; thus, a test scenario based on a fire will be a practical choice.'
Note (3): Worst-case disaster scenario is another term used to refer to the key planning scenario. Unfortunately, this term is often misinterpreted as implying a “dooms-day” scenario. Planning for the dooms-day scenario is not recommended as it will mean that organization needs to expand and commit significant amount of resources and funds to develop such plans and conduct exercises to improve readiness. But, the effort and resources to be committed is unjustifiable.
