2 cissp ® Official Study Guide Eighth Edition

Buildings and Facilities 
Many businesses require specialized facilities in order to carry out their critical operations. 
These might include standard offi ce facilities, manufacturing plants, operations centers, 
warehouses, distribution/logistics centers, and repair/maintenance depots, among others. 
When you perform your BIA, you will identify those facilities that play a critical role in your 
organization’s continued viability. Your continuity plan should address two areas for each 
critical facility. 
 Hardening Provisions
Your BCP should outline mechanisms and procedures that can be 
put in place to protect your existing facilities against the risks defi ned in the strategy devel-
opment phase. This might include steps as simple as patching a leaky roof or as complex as 
installing reinforced hurricane shutters and fi reproof walls.
 Alternate Sites
In the event that it’s not feasible to harden a facility against a risk, your BCP 
should identify alternate sites where business activities can resume immediately (or at least in 
a period of time that’s shorter than the maximum tolerable downtime for all affected critical 
business functions). Chapter 18 describes a few of the facility types that might be useful in 
this stage.
Infrastructure 
Every business depends on some sort of infrastructure for its critical processes. For many 
businesses, a critical part of this infrastructure is an IT backbone of communications and 
computer systems that process orders, manage the supply chain, handle customer interaction, 
and perform other business functions. This backbone consists of a number of servers, work-
stations, and critical communications links between sites. The BCP must address how these 
systems will be protected against risks identifi ed during the strategy development phase. As 
with buildings and facilities, there are two main methods of providing this protection.