A. Users often install unauthorized modems because of restricted and monitored Internet access.

must now take the prioritized list of concerns raised by the quantitative and qualitative resource prioritization exercises and determine which risks will be addressed by the business continuity plan. Fully addressing all of the contingencies would require the implementation of provisions and processes that maintain a zero-downtime posture in the face of each and every possible risk. For obvious reasons, implementing a policy this comprehensive is simply impossible. The BCP team should look back to the maximum tolerable downtime MTD estimates cre- ated during the early stages of the BIA and determine which risks are deemed acceptable and which must be mitigated by BCP continuity provisions. Some of these decisions are obvious— the risk of a blizzard striking an operations facility in Egypt is negligible and would be deemed an acceptable risk. The risk of a monsoon in New Delhi is serious enough that it must be mit- igated by BCP provisions. Keep in mind that there are four possible responses to a risk: reduce, assign, accept, and reject. Each may be an acceptable response based upon the circumstances. Once the BCP team determines which risks require mitigation and the level of resources that will be committed to each mitigation task, they are ready to move on to the provisions and pro- cesses phase of continuity planning. Provisions and Processes The provisions and processes phase of continuity planning is the meat of the entire business con- tinuity plan. In this task, the BCP team designs the specific procedures and mechanisms that will mitigate the risks deemed unacceptable during the strategy development stage. There are three categories of assets that must be protected through BCP provisions and processes: people, build- ingsfacilities, and infrastructure. In the next three sections, we’ll explore some of the techniques you can use to safeguard each of these categories. People First and foremost, you must ensure that the people within your organization are safe before, during, and after an emergency. Once you’ve achieved that goal, you must make provisions to allow your employees to conduct both their BCP and operational tasks in as normal a manner as possible given the circumstances. Don’t lose sight of the fact that people are truly your most valuable asset. In almost every line of business, the safety of people must always come before the organization’s business goals. Make sure that your business continuity plan makes adequate provisions for the security of your employees, custom- ers, suppliers, and any other individuals who may be affected People should be provided with all of the resources they need to complete their assigned tasks. At the same time, if circumstances dictate that people be present in the workplace for