¢ Why Should the It Department Not Be Solely Responsible for Business Continuity
What Is a Business Continuity Plan and Why Does Your Company Need One?
June 20, 2019
Benjamin Franklin said it best: By failing to prepare, you're preparing to fail. In few places does this strike closer to home than business continuity planning (BCP).
Business continuity creates roadmaps to follow in the event of an emergency. Yet not every company's continuity plan is made equal. Many experience confusion over business continuity versus disaster recovery, including their similarities and differences, which steps to include in a BCP and even how to secure buy-in for the business continuity policy from key enterprise leaders.
Learn how to write a business continuity checklist that works for your exact business processes — that is, one that addresses your company's key domains and relevant pain points — and brings peace of mind to everyone at your organization.
What Is a Business Continuity Plan (BCP)?
Business continuity plans are pre-drafted, pre-determined protocols for how your organization will overcome a business disruption caused by an emergency.
Containing a serialized checklist of risk-mitigating actions to take, business continuity planning addresses both natural and human disasters that can strike, ultimately bringing operations to a halt. Such disaster scenarios include:
- Weather incidents, such as floods, hurricanes and tornadoes
- On-premise accidents
- Technological outages
- Breaches and cybersecurity events
- Supply chain disruptions
- Any other significant system, process or operational failure that stalls core functions and grinds "business as usual" to a halt
The goal of a BCP is to mitigate the damage and reinstate operations before any of the above scenarios become existential business threats. Even small-seeming events like a severe storm damaging physical building infrastructure can trigger consequences affecting other core business domains. For example, consider the effects of a tornado that destroys the only third-party warehousing service you use to store your inventory, or a ransomware attack holding hostage your customers' payment and account information.
When these incidents strike, a business continuity plan outlines what to do, when to do it and who takes care of it, keeping risks mitigated and the business above water.
What Is the Purpose of a Business Continuity Plan?
Business continuity plans have one guiding onus — to keep organizations running as smoothly and productively as possible in the event of an emergency.
While the rates and severity of BCP emergencies vary, the fact remains that at some point, your organization will encounter a natural or human-caused emergency with an immediate effect. BCP checklists ensure when such inevitable disruptions strike — be it a storm, a piece of software failure or a supply chain interruption — they're contained and controlled incidents, not escalating ones.
Because of this preparedness, business continuity plans also contain many benefits:
1. Organizational Assurance
Organizations need to assure their customers, third-party vendors and partners that things are under control in the event of an emergency. They also need to comfort their own employees, communicating swiftly and transparently what the issue is, what's affected and all action steps currently and projectively underway.
Clear communication keeps employee stress and confusion to a minimum. Teams understand what's expected of them amidst the BCP procedures as well as who to turn to with further questions or concerns.
2. Quality Control
A significant part of brand reputation hinges on the end quality of your product or services. If those deliverables are inconsistent in any way, customers take note — and their dissatisfaction can become a business threat all its own.
When business operations experience disruptions, BCPs promptly patch the affected or interrupted resources, including replacement technology, buildings, infrastructure, personnel and more. This maintains the quality of your goods and products and keeps consistency prioritized, protecting your customer base and your brand.
3. Risk Management
Business continuity and recovery plans prevent disruptions from snowballing into existential business crises. This is their central tenet, one that — if mismanaged — opens your organization to a cacophony of costly damage control initiatives more expensive and more cumbersome than preparing for that incident in the first place.
4. Decreased Downtimes
Technology outages alone — that is, temporarily downed networks — cost the average small or medium business (SMB) around $5,600 per minute. While exact figures will range, all businesses understand the importance of product or service continuity to keep revenue flowing. The quicker typical business operations can be replaced or resolved, the shorter your downtimes and the smaller your losses.
5. Continued Product and Service Excellence
When well executed, business continuity plans turn emergencies from hemorrhages into hiccups. Operations can pick up where they left off, continuing to serve your clients and customers, deliver value and protect the integrity of your overall business.
How Do I Write a Business Continuity Plan?
Organizations impelled to create their own BCPs — for the productivity and the peace of mind — can successfully do so by following these steps.
1. Conduct a Business Impact Analysis (BIA) to Find Risk Areas and Dependencies
Business impact analyses profile your business' most vulnerable operations. In other words, they identify the domains and functions from personnel and technology to equipment and physical infrastructure across your entire enterprise's operations that don't have any sort of "Plan B," then calculate the costs associated with interrupting each.
BIAs give you the first indication of vulnerabilities within essential business functions. These risk areas a BIA helps identify include, but aren't limited to, domains like:
- Customer service channels and centers
- Distribution and transportation networks
- Warehousing and inventory storage infrastructure
- Key software, hardware and data systems, including those on-premise and in the cloud
- Operationally necessary utilities, such as heating, cooling and power
From BIA's calculations, you determine which operations are most critically valuable to your company's existence. In addition, they also outline worst-case but acceptable downtime projections, including manageable revenue losses due to operational disruptions and how one downed process affects others downstream. All this information is vital to begin mapping a relevant business continuity plan checklist.
2. Explore Recovery, Backup and Replacement Options Based on BIA
With a business impact analysis in place, your organization can move onto the next BCP step — vetting backup and replacement solutions.
Recovery and replacement strategies are the backbone of business continuity. Use the key risk areas and dependencies calculated in your BIA to begin exploring tangible infrastructure and service support most pertinent to your needs. The coverage you select helps protect your domains, closing or securing the operational gaps most at risk in the event of storms, power outages, disrupted supply chains and more.
3. Create the BCP Framework
You've identified your largest operational risk areas. You've calculated the cost of their downtimes. You've researched solutions that'll provide backup for these risk areas. Now it's time to establish your formal business continuity framework — the documents outlining your exact, step-by-step emergency preparedness plan.
At their core, an official business continuity policy should cover:
- Business continuity teams:The personnel in charge of maintaining BCP documents and triggering actions when disasters do happen. Depending on the size of your organization, your business continuity team could be the CEO or president themselves, or a series of managers selected from across departments who each spearhead an aspect of the policy.
- A relocation plan: The outlined buildings or new locations where operations will take place if a natural disaster or similar event causes sustained damage to your place of business.
- Backup technology: The physical and digital backup systems protecting your business' critical IT assets, from alternate hardware replacing lost or damaged devices to established software workarounds to backup network infrastructure able to maintain your servers, enterprise data and more.
- Document manual and automated workarounds:The serialized, step-by-step action plans for all teams and personnel to take when specific emergencies strike, allowing each to maintain a "business as usual" standard.
- Secure BCP and disaster recovery vendors:The third-party, outsourced partners that swoop in to assist you in times of business emergencies, most commonly for supply chain replacement services and managed IT support functions.
4. Implement the Official Business Continuity Plan
At this step, your organization should be prepared to roll out its formal BCP. This means institutionalizing the teams, actions and outsourced services picked during step three, plus familiarizing all employees into the new backup strategies and technologies.
For smooth BCP implementation, keep the following in mind:
- Employee orientations: Customized to each department, communicating the importance of the BCP as it pertains to their roles and responsibilities, plus what backup systems or actions they'll participate in if their work is ever disrupted.
- HR assistance:Helping maintain the formal BCP's documents in writing, available for staff and leadership to access and review.
- IT assistance: Reviewing and maintaining any emergency IT asset needs, particularly software and application workarounds as well as emergency data restoration.
5. Develop and Maintain Testing Exercises
Maintenance is the fifth and final step of a BCP — yet less an item to cross "off" the checklist and more an org-wide, institutionalized mindset.
Continuity exercises ensure the recovery strategies, technology and support you've implemented actually perform according to your formal framework. In other words, it makes sure your business continuity plan checklist gets the job done — and that employees know what to do when incidents strike.
BCP maintenance and testing at a minimum should include:
- Appointed BCP training leaders
- Scheduled BCP orientations and training for employees
- Pre-planned mock emergencies, with documented test results
- BCP reviews to incorporate the findings from tests, making tweaks and changes to secure today's assets even stronger tomorrow
What Should a Business Continuity Plan Include?
Regardless of your business type or industry, your business continuity plan should formally include the following:
- BCP scope:The equipment, devices, supplies and personnel who are affected by the outlined emergencies, as well as which staff members or teams use these resources most.
- BCP domains:The business critical risk areas, or departments, whose roles and responsibilities will adapt under the business continuity policy scope.
- BCP teams: The formal leaders and decision makers in the event of a business emergency, as well as the contact information of all relevant emergency responders and support personnel.
- BCP documented workarounds: The official, go-to actions and procedures to train employees on when a typical business process is disrupted, including backup tools and technology to use.
- IT-related disaster recovery methods: The data backup and recovery systems you selected to preserve and access proprietary data during emergencies, including on-premise backup devices, self-managed cloud storage, outsourced cloud storage or a hybrid data solution.
- BCP managed service provider (MSP) contracts:Any outsourced third-party vendor to contact whose services will need to step in to assist during the emergency.
When Should a Business Continuity Plan Be Reviewed?
Once instated, a business continuity plan should be reviewed a minimum of once a year but sometimes as often as once every quarter.
These are best-practice suggestions, though, not black-and-white rules. It's beneficial to set your testing schedule only after determining how often your business can manage complete table-top BCP exercises without overwhelming employees, plus how much your business infrastructure or technology has even changed between testing rounds.
What's the Difference Between a Disaster Recovery Plan (DRP) and a Business Continuity Plan?
Disaster recovery plans center on restoring business-critical IT infrastructure — both hardware and software — after an emergency renders them damaged.
While similar to continuity plans in their focus to get essential business functions up and running, disaster recovery is predominantly concerned with IT functions and only IT functions, whereas business continuity plans focus on the entire organization's restoration. What's more, disaster recovery plans are a part of a company's overall continuity strategy, typically included as a section in the formal policy but not the complete focus of the policy itself.
The full differences between BCP versus DRP can be broken down even further:
- Scope: BCP considers all core, interconnected business domains and resources. DRP prioritizes your IT infrastructure like hardware, software and data systems.
- Cost:BCP costs revolve around reducing the toll of revenue loss on the entire organization. They are calculated after an in-depth business impact analysis that accounts for downstream damage when just a single business vulnerability stalls or fails. Likewise, a DRP will conduct a similar business impact analysis but only to calculate the costs of IT downtimes, not necessarily the peripheral, domino-like expenditures that occur days and even weeks after the incident.
- Objectives: As mentioned above, disaster recovery plans center almost exclusively on IT assets. Business continuity plans account for IT asset recovery in addition to other business domains, from supply chain sourcing to warehousing operations to uninterrupted customer service availability.
- Personnel:More stakeholders will be intimately involved in business continuity than disaster recovery operations. Given its macro nature, BCPs will likely, though not always, have more dedicated personnel trained on its processes and fluent in its implementation and maintenance. Since DRPs are an IT concern, it will be mainly IT personnel creating, implementing and managing that policy.
- Regulations:Certain industries are required to instate disaster recovery plans and business continuity plans. This is particularly important for entities that manage personally identifiable information (PII) and other sensitive consumer information online, such as institutions in finance and healthcare. It is also mandated for organizations that manage national "critical infrastructure," such as companies in the energy sector. However, no legal policies require the average SMB must have a business continuity plan unless it's involved in one of these critical infrastructure industries. If your business is not classified as one of these, then BCPs remain a proactive and profitable best practice — but not a legal obligation.
What Will Your Organization Do If an Emergency or Natural Disaster Strikes?
Consolidated Technologies, Inc. has helped over 2,000 companies implement the technology they need to prepare for the emergencies they don't anticipate.
We take a proactive and personalized approach to all our work, simplifying the often complex and evolving technological world so your business can achieve functionality and risk-mitigation. Learn more about Consolidated Technologies, Inc.'s managed IT and enterprise network solutions today so you can be prepared for tomorrow.
Source: https://consoltech.com/blog/what-is-a-business-continuity-plan-and-why-does-your-company-need-one/