每当你选择接受风险时，你应该将风险接受过程写成详细文档，以便将来供审计师使用。这一步应该在实施安全控制、设计灾难恢复计划和重复业务影响分析(BIA)之前发生。

Whenever you choose to accept a risk, you should maintain detailed documentation of the risk acceptance process to satisfy auditors in the future. This should happen before implementing security controls, designing a disaster recovery plan, or repeating the business impact analysis (BIA).

RAID 技术可为硬盘驱动器故障提供容错功能，属于业务连续性操作。利用备份磁带来恢复数据、切换到冷站点、重新启动业务操作都是灾难恢复操作。

RAID technology provides fault tolerance for hard drive failures and is an example of a business continuity action. Restoring from backup tapes, relocating to a cold site, and restarting business operations are all disaster recovery actions.

制定资产清单后，业务影响评估小组应为每个资产分配价值。

After developing a list of assets, the business impact analysis team should assign  values to each asset.

安装下一代防火墙可降低应用程序攻击的可能性，从而降低风险。

Installing a device that will block attacks is an attempt to lower risk by reducing thelikelihood of a successful application attack.

高级管理人员在业务连续性规划中负责多项任务，包括优先级设置、资源获取以及对团队成员之间的争议进行仲裁。

Senior managers play several business continuity planning roles. These include setting priorities, obtaining resources, and arbitrating disputes among team members.

SLA 通常不涉及数据保密性问题，有关数据保密性的规定通常包括在不披露协议中。

SLAs do not normally address issues of data confidentiality. Those provisions are normally included in a nondisclosure agreement (NDA).

业务连续性计划文档通常包括连续性计划目标、重要性说明、优先性声明、组织职责说明、紧急和时间表、风险评估、风险接受和缓解文档、关键记录计划、紧急情况响应指南以及用于维护和测试计划的文档。

Business continuity plan documentation normally includes the continuity planning goals, a statement of importance, statement of priorities, statement of organizational responsibility, statement of urgency and timing, risk assessment and risk acceptance and mitigation documentation, a vital records program, emergency response guidelines, and documentation for maintaining and testing the plan.

电子保险库是一种数据备份任务，它是灾难恢复的一部分，而不是业务连续性的任务。

Electronic vaulting is a data backup task that is part of disaster recovery, not business continuity, efforts.

组织中的每个人都应接受业务连续性计划的基本安全意识培训。具有特定角色的人员，如第一响应者和高级管理人员，还应该接受更详细、更有针对性的培训。

Everyone in the organization should receive a basic awareness training for the business continuity program. Those with specific roles, such as first responders and senior executives, should also receive detailed, role-specific training.

应急响应指南应包括一个组织应对紧急情况应采取的步骤，这些步骤包括立即响应程序、紧急事件需通知的人员名单和这些人员的后续行动流程。应急响应指南不包括长期操作，例如激活业务连续性协议、订购设备或激活冷站点。

The emergency response guidelines should include the immediate steps an organization should follow in response to an emergency situation. These include immediate response procedures, a list of individuals who should be notified of the emergency and secondary response procedures for first responders. They do not include long-term actions such as activating business continuity protocols

尽管首席执行官通常不会在业务连续性计划小组工作，但为使计划能顺利进行，最好还是获得最高管理层的支持。

Although the CEO will not normally serve on a BCP team, it is best to obtain top-level management approval for your plan to increase the likelihood of successful adoption.

项目范围和规划阶段包括四个具体的行动：对组织进行结构分析、设立一个业务连续性计划小组、评估现有资源、分析法律和监管环境。

The project scope and planning phase includes four actions: a structured analysis of the organization, the creation of a BCP team, an assessment of available resources, and an analysis of the legal and regulatory landscape.

冷站点包括数据中心运行所需的基本要求：空间、电源、供热通风、空气调节和通信，但不包括恢复操作所需的任何硬件。

A cold site includes the basic capabilities required for data center operations: space,power, HVAC, and communications, but it does not include any of the hardware required to restore operations.

虽然通常情况下高级管理层应该在BCP团队中有代表，但CEO不是业务连续性计划团队的成员。

While senior management should be represented on the BCP team, it would behighly unusual for the CEO to fill this role personally.

在业务影响评估中，经常使用定性工具来描述无形因素所产生的影响，例如客户信心、员工士气和声誉等。

Qualitative tools are often used in business impact assessment to capture the impact on intangible factors such as customer confidence, employee morale, and reputation.

如果组织实施关键记录管理计划的话，那么应当首先发现所有记录重要业务的文件。如果组织要在新位置重新开始业务，那么肯定会用到其业务连续性计划的所有记录。

An organization pursuing a vital records management program should begin by identifying all of the documentation that qualifies as a vital business record. This should include all of the records necessary to restart the business in a new location should the organization invoke its business continuity plan.