Let’s See Now – Insurance Policy or a Business Continuity Plan?

Do you consider your insurance policy your business continuity plan?  Often times when we start a conversation with a prospect, especially in the “C” Suite, regarding the need for a detailed business continuity plan we hear “we have insurance to cover that”.  We immediately suggest they think that through a bit more.  Looking at it from one perspective it can take months, even years to recover under a business insurance policy and that’s assuming you have the right coverage in place.  Just ask anyone who has experienced the time associated with recovery from a catastrophic loss under a homeowner’s insurance policy.  Just imagine if this happened to you…

 

A business continuity plan, when put together utilizing knowledge of risk and the correct assumptions from a business impact assumption is an invaluable tool following a catastrophic event.  The plan details what should be done in response to the event, what needs to be done to resume critical business operations and eventually recover the business over time.   If you’re not familiar with what it takes to put your business continuity plan together here is a link to the Disaster Recovery Institutes guidelines for developing a professional plan.  https://www.drii.org/professional_prac/index.php

 

Detailed business continuity plans are essential at-time-of event, regardless of the event.  Insurance policies only help share financial risk.  They are NOT a disaster recovery / business continuity plan.  I suggest you seriously consider both regardless of what business you are in.  Business continuity plans AND the right insurance plan are part of an organizations survival plan following a major business disruption.  Their aim is to ensure survival of the continuous flow of resources to your organization following that event – financial resources, and the resources needed at time of response, resumption and recovery.

 

Unless you are satisfied with a business resumption / recovery window of weeks, months or years consider making a detailed business continuity plan part of your “survival kit”.

 

 

How Do You Spell Business Continuity?

I know the answer, but I have been involved in business continuity planning over 33 years.  John Glenn, a long-time continuity planner and who is well published in our industry, once asked that question.  He went on to phonetically spell it out as well.  I’m not sure I have this right, but it went something like this … biz-nes, or bid-nes (if you’re from the South) kan-te-nu-e-ty.

 

There truly is a right way to spell it and a wrong way to spell it!  There is also a right way to get the job done and a wrong way to get the job done.  Let’s talk about the right way.

 

First, it is defined as a “an interdisciplinary concept used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical function within a predetermined time after a disaster or extended disruption” – check out Wikipedia!   That’s a mouthful.  Easier put – “it is a process that allows a business to respond to an event, resume business, and recover the business over time” – my words, not theirs.

 

It is not a document or a manual that you develop and put on the shelf “just in case” of an event.  It is a process, and that process entails the following:

 

• Knowledge of Local Risk – what can happen from a natural, technological, and human-caused perspective;
• Knowledge of What is Critical to your Organization – what functions are critical, what are essential, what can wait;
• Knowledge of What Resources Need To Be Put In Place (In Advance) – what technology is required, what data needs to be backed-up, what amount of workspace is needed — from a limited service-offering perspective;
• Knowledge of What Constitutes a Usable Planning Document – what does the crisis management, business continuity and disaster recovery plan look like;
• Knowledge about Testing, Exercising and Maintenance – what needs to be done to keep the plan current;
• Knowledge about Others’ Expectations – what do others look for from an audit, certification perspective.

 As you can see from the above, it’s NOT about how you spell continuity that matters.  What will matter when push comes to shove is how you went about the process.  Who was it that once said, “I love it when a plan comes together?”  I would want to be the person with the plan that worked.

So Where is Your Data?

Last week I was interviewed by Tom Sowa, a Staff Reporter for the Spokesman Review regarding the importance of data backup.  The article made the front page of the business section in last Sunday’s paper (You can also read this article on my articles page).  This week I’ve had several discussions with folks regarding data backup.  Most have indicated that they would be in deep trouble.  They had assumed the “it won’t happen to me” position.  They admitted that their dependency on technology, and thus, data was vital to the continuance of their business operations.

 So, how dependent are you on your data?  Do you back it up? How often do you back it up?  Where do you take it once it’s backed up?  Have you ever tested your ability to restore that data?

 

When I conduct a Business Impact Analysis these days the response to the question of how dependent a business is on its data, 99.9% indicate an extreme dependency on that information.  Couple that with the inability to perform critical functions manually and you have one crippled business following a major event, such as the Joel building fire here in Spokane.

 

As I indicated in the newspaper article, you don’t have to back up all the data.  Back up what is critical.  Back it up frequently. These steps are important, especially If you don’t have the ability to recreate the data after it’s lost.  Back it up to a reliable form of media.  Put it somewhere safe and protected from the elements.  The trunk of your car or another location without the proper environment, (heating, cooling, moisture control) is not a good choice.  Also, ensure that you have timely access to the data as well.  A bank vault may not work if you need immediate access to the data following an event.  Banks are open approximately 48 hours a week, which is only 25% of the total hours in a week.  That means that 75% of the time you will not be able to access your data…not very good odds.

And by all means take the time to ensure you can restore the data.  I can’t tell you the number of horror stories I’ve heard about inadequate data backup.   Perhaps you have a horror story of your own!