Is this how your employees / co-workers would react in an emergency situation?

Yesterday in a presentation to a new client one of the participants announced that he “finally got it”. He stated to his counterparts that “developing a business continuity plan was like packing a parachute.” Think about it – I’ve even made the same statement myself, in a different fashion but the translations are still the same. “There is a right way and a wrong way to develop your plan, what matters is the fact that the thing needs to work when the time comes.”

The “Professional Practices” that have been developed, that define just how a business continuity plan should be put together, is the “right way”. Any other way is the “wrong way”. As I’ve said in the past – Can you afford to do it the wrong way? When that business disruption occurs that we all hope never happens, you want to hit the ground running, not hit the ground.

Think about it … you need to familiarize yourselves with those “Professional Practices”. If you are just starting to develop your plan, build your plan accordingly. If you have what you consider a viable plan, visit those “Professional Practices” and make sure you have “packed your chute” correctly.

Remember your business continuity plan - given the right event - might be the only remaining element of your business. Technology.inc.com agrees that, “Having a business continuity plan to help ensure the survivability of your business is essential these days.” It has to work or you are out of business. That statistic is well proven!

Business Continuity is NOT a Seasonal Activity - It Will Take You Forever!

I’ve been doing business continuity planning in one form or another for sometime now – 33 years or so. One thing that has always amazed me is how business continuity planning is a seasonal activity. If you were to look at it from a calendar year perspective, from my experience, the process begins in January, after the holidays and gets pretty intense – an every other week activity (if you’re lucky). That works until June when school gets out and stops for the summer. When school gets back in session, it picks up at the same serious pace that occurs from January till June. Then you hit the wall again in November, when the holiday season begins, grinding to an absolute halt by mid December. The result at the end of the year – there is NOT a viable plan in place!

So what’s wrong with this you ask? Well to do it right (wrong is not an option) it takes the better part of six to eight months worth of actual activity. You do the math … the seasonal approach does not work! I’ve passed this observation on to my peers and clients for many years, with no real solution offered up. The concept is fairly straight forward, the process is quite detailed – the end result is a viable business continuity management plan that deals with – crisis management, business continuation and disaster recovery. If you are (or the boss is) serious about staying in business following a major business disruption there is only one approach – a serious, on-going continuous approach to the development of a viable business continuity plan. Read this case study about a credit union that I helped develop a business continuity plan, after thorough analysis of specific risks and exposures, and continue to augment that plan today with ongoing maintenance to ensure it’s successful execution when necessary.

As Always, I would not want to be the one to tell the boss following a serious disruption…”We’ve been working on our business continuity plan for a while, but we just haven’t got it done yet.” How does one fix this? I know this is an issue for many of you… let me hear from you. I’ve had almost 600 readers access my blog since I started this thing in April. There are a lot of you out there that access it and read it, but significantly fewer that offer their opinions in response. So as I print my observations, I welcome yours in return!

]]> http://johnames.wordpress.com/2008/09/17/back-to-schoolback-to-business-continuity/feed/ johnames http://johnames.wordpress.com/2008/09/08/would-your-business-continuity-plan-work-the-need-to-exercise-your-plan/ http://johnames.wordpress.com/2008/09/08/would-your-business-continuity-plan-work-the-need-to-exercise-your-plan/#comments Mon, 08 Sep 2008 21:41:06 +0000 johnames http://johnames.wordpress.com/?p=93

What mechanism do you use to determine the viability of your business continuity plan? Do you exercise all the elements of your plan? Do you exercise the response, resumption and recovery strategies you’ve defined? If you are like 60% of those that have not taken the time to develop / document a business continuity plan you do not.

There are many stories about organizations that have taken the time to exercise their plans, only to discover that they would NOT have worked at time of a major business disruption. The exercises often revealed that the strategies, polices, practices and procedures were not adequate to allow them to respond to an event, resume their critical business functions and actually recover their business over time. The end result would most likely be something other than business as usual or no business at all. Read this successful story about AT&T in response to Hurricane Gustav and in preparation for Hurricane Hanna. 

I can not stress enough the need to exercise or test your plan at least annually. I suggest that even if you take the time to conduct an exercise – take the time to ask yourself at least several times a year “what has changed in our business and would our plan still work?” Here are some questions that need to be answered and only a formal exercise will draw out the answer, whether it’s one you want to hear or not 

• Does your staff demonstrate adequate knowledge of the plan?
• Have specific individuals been assigned specific responsibilities?
• Have the resources (people / places / things) you would need to respond to the event and to resume / recover your business been identified. Have you set them aside?
• Where would you go to resume your business?
• What about technology?
• Have you identified critical vendors or contacts you need to reach following an event?
• Have you adequately documented the above? A quick note – tribal knowledge is great, but in the absence of the individual that possesses that knowledge your shot at putting a viable recovery solution in place at time of event will fail. That is well proven!

I use a simple tabletop exercise, a building fire, to lead folks through their plan logic. You’d be surprised what you can learn from a simple sit down, a one to two hour get together playing out a fire event that lasts an extended period and ultimately ends up in the search for a new location from which to conduct business. California is testing their earthquake DR plans, in response to the Chino earthquake last month. Although there was minimal damage, it served as a wake-up call to emergency planners. This article explains the steps they are taking to prepare for the next quake.

If you have a plan and / or conduct such an exercise, make sure that all the gaps that are identified (and there will be some, if not many) are placed on someone’s action item list to be resolved. Timelines for resolution should be identified and monitored for completion.

We’ve all heard the adage that “organizations simply don’t know what they don’t know.” Therefore, I strongly suggest you exercise your plan until you feel as if “you got it right” and that you do this periodically to ensure your plan remains viable.

Take the time to test & exercise your plan – I dare you!

Do you consider your insurance policy your business continuity plan?  Often times when we start a conversation with a prospect, especially in the “C” Suite, regarding the need for a detailed business continuity plan we hear “we have insurance to cover that”.  We immediately suggest they think that through a bit more.  Looking at it from one perspective it can take months, even years to recover under a business insurance policy and that’s assuming you have the right coverage in place.  Just ask anyone who has experienced the time associated with recovery from a catastrophic loss under a homeowner’s insurance policy.  Just imagine if this happened to you…

A business continuity plan, when put together utilizing knowledge of risk and the correct assumptions from a business impact assumption is an invaluable tool following a catastrophic event.  The plan details what should be done in response to the event, what needs to be done to resume critical business operations and eventually recover the business over time.   If you’re not familiar with what it takes to put your business continuity plan together here is a link to the Disaster Recovery Institutes guidelines for developing a professional plan.  https://www.drii.org/professional_prac/index.php

Detailed business continuity plans are essential at-time-of event, regardless of the event.  Insurance policies only help share financial risk.  They are NOT a disaster recovery / business continuity plan.  I suggest you seriously consider both regardless of what business you are in.  Business continuity plans AND the right insurance plan are part of an organizations survival plan following a major business disruption.  Their aim is to ensure survival of the continuous flow of resources to your organization following that event – financial resources, and the resources needed at time of response, resumption and recovery.

Unless you are satisfied with a business resumption / recovery window of weeks, months or years consider making a detailed business continuity plan part of your “survival kit”.

I know the answer, but I have been involved in business continuity planning over 33 years.  John Glenn, a long-time continuity planner and who is well published in our industry, once asked that question.  He went on to phonetically spell it out as well.  I’m not sure I have this right, but it went something like this … biz-nes, or bid-nes (if you’re from the South) kan-te-nu-e-ty.

There truly is a right way to spell it and a wrong way to spell it!  There is also a right way to get the job done and a wrong way to get the job done.  Let’s talk about the right way.

First, it is defined as a “an interdisciplinary concept used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical function within a predetermined time after a disaster or extended disruption” – check out Wikipedia!   That’s a mouthful.  Easier put – “it is a process that allows a business to respond to an event, resume business, and recover the business over time” – my words, not theirs.

It is not a document or a manual that you develop and put on the shelf “just in case” of an event.  It is a process, and that process entails the following:

• Knowledge of Local Risk – what can happen from a natural, technological, and human-caused perspective;
• Knowledge of What is Critical to your Organization – what functions are critical, what are essential, what can wait;
• Knowledge of What Resources Need To Be Put In Place (In Advance) – what technology is required, what data needs to be backed-up, what amount of workspace is needed — from a limited service-offering perspective;
• Knowledge of What Constitutes a Usable Planning Document – what does the crisis management, business continuity and disaster recovery plan look like;
• Knowledge about Testing, Exercising and Maintenance – what needs to be done to keep the plan current;
• Knowledge about Others’ Expectations – what do others look for from an audit, certification perspective.

 As you can see from the above, it’s NOT about how you spell continuity that matters.  What will matter when push comes to shove is how you went about the process.  Who was it that once said, “I love it when a plan comes together?”  I would want to be the person with the plan that worked.

Last week I was interviewed by Tom Sowa, a Staff Reporter for the Spokesman Review regarding the importance of data backup.  The article made the front page of the business section in last Sunday’s paper (You can also read this article on my articles page).  This week I’ve had several discussions with folks regarding data backup.  Most have indicated that they would be in deep trouble.  They had assumed the “it won’t happen to me” position.  They admitted that their dependency on technology, and thus, data was vital to the continuance of their business operations.

 So, how dependent are you on your data?  Do you back it up? How often do you back it up?  Where do you take it once it’s backed up?  Have you ever tested your ability to restore that data?

When I conduct a Business Impact Analysis these days the response to the question of how dependent a business is on its data, 99.9% indicate an extreme dependency on that information.  Couple that with the inability to perform critical functions manually and you have one crippled business following a major event, such as the Joel building fire here in Spokane.

As I indicated in the newspaper article, you don’t have to back up all the data.  Back up what is critical.  Back it up frequently. These steps are important, especially If you don’t have the ability to recreate the data after it’s lost.  Back it up to a reliable form of media.  Put it somewhere safe and protected from the elements.  The trunk of your car or another location without the proper environment, (heating, cooling, moisture control) is not a good choice.  Also, ensure that you have timely access to the data as well.  A bank vault may not work if you need immediate access to the data following an event.  Banks are open approximately 48 hours a week, which is only 25% of the total hours in a week.  That means that 75% of the time you will not be able to access your data…not very good odds.

And by all means take the time to ensure you can restore the data.  I can’t tell you the number of horror stories I’ve heard about inadequate data backup.   Perhaps you have a horror story of your own!

If you’ve read the newspaper or listened to the news, the reports from the recent California earthquake indicate little or no damage or disruption of life in general. As a contingency planner I know what I’m thinking - complacency is still alive and well. What are you thinking?

Most of my clients and prospects live in earthquake zones. I have discussed the California event with a few and there is some concern, but not as much as someone in my profession would hope - and NO I’m not looking at this from revenue stream perspective. The thought process is amazing when you consider the likelihood of the “big” one or even a “bigger” one and the damage and disruption that would occur. For those of you NOT in an earthquake zone, what other hazards are you faced with that could cause a major disruption to your business activities? Have you taken a look at the Hazards List published by your local department of emergency management? Here is an example of my local Hazard List in Spokane County. Maybe nothing has happened so far, but everyone should have a plan to stay in business - regardless of what your business is!

I would encourage all of you to heighten your awareness of your local hazards - natural, technological and human-caused. Take the time to conduct a Risk Analysis! It will be well worth it if you carry it forward and create a Business Continuity Plan and put the “appropriate” measures in place to respond to an event (regardless of what it is), resume your critical business functions, and recover your business over time.

If you have a plan you should take this opportunity to revisit your plan from a risk perspective - all risks! Make sure you have the resources you would need at-time-of-event set aside to accomplish the above. If not, it’s time to start thinking about Crisis Management, Business Continuity, and Disaster Recovery. How will you deal with the event? What business functions really need to come back on line? What resources would you need to set aside - technological and work area related?

Oh yeah, one last tidbit! Make sure whatever you do from a physical resource allocation perspective - that the solution you develop for data backup, the location of critical IT infrastructure, and the alternate workspace for your employees involved in the resumption of your critical business functions would not be impacted by the same event - i.e. an earthquake. Take a look at this blog post “Where NOT to keep your severs according to Mother Nature.”

I wrote my first article about liability and contingency planning in 2003. We are not talking about liability as it relates to a businesses’ inability to supply products and services to their customers. We are talking about liability as it relates to lost revenue as the result of not developing a business continuity plan. This could be a dilemma for a lot of businesses large and small. When you consider the number of businesses that do not have a plan in place to deal with a major business disruption - it’s a big deal or should I say a potential deal buster. This issue isn’t going away!

I just returned from yet another prospect whose driver for dealing with the issues of business continuity planning is NOW driven by a long time customers request to see the prospects business continuity plan. One problem - they don’t have one. They are not a large organization by any means. The revenue stream from the customer requesting to see the plan is ONLY $25,000 a year but it pays the bills! In another case a prospect was facing the possibility of losing out on a large multi-million dollar deal because of the absence of a business continuity plan - we built the plan, they secured the business.

Have you been asked by a key customer or prospect if you have a business continuity plan? Some of my customers and prospects have had to address this issue in order to keep their revenue stream intact. If you deal with banks and credit unions you find yourself being asked questions like - Do you have a plan? Is it based on your knowledge of local risk? Is it based on a formal business impact analysis? Do you have a solution in place to deal with a major business disruption? Is it based on the output from your business impact analysis? Is the plan documented and exercised on a regular basis? If you have a plan - show me! Where do you stand? Unless you are prepared to lose revenue from that valued customer or that anticipated piece of new business, you’d better get on with it - time to develop that business continuity management plan.

The Real Thing - This is Why We Practice!

The big question for me as I look to the private sector is, if the real professionals have challenges during an emergency, what would it look like from an individual’s company’s perspective following a major business disruption? Are you prepared? Would communications flow freely? Could you respond to a business disruption? Could you resume your business? Recover your business over time? Unless you test your plan (assuming that you have one), you will never know! My theory is, better to find out during an exercise vs. during an emergency. If you are not going to make the effort to exercise your plan - good luck following the disruption we all hope never occurs.