Business Continuity Planning
What Is Business Continuity Planning?
Business Continuity Planning (BCP) is the creation of an actionable plan for how an organization will continue its business processes and deliver products and services in the event of a disruptive incident. Disruptive incidents can include anything from a catastrophic system failure to a volcano spewing ash disrupting
air traffic.
The basic steps to Business Continuity Planning are:
- Risk Assessment and Business Impact Analysis (BIA) - the determination of what assets are at risk and how each impacts critical business functions.
- Plan Development - creation of viable plans to respond to
business interruptions. - Testing & Simulation - exercising plans (rehearsing them) to
ensure viability. - Plan Maintenance - keeping the plans current and making them part of corporate policy and culture.
- Incident Management - invoking plans and responder teams when an incident occurs, and over all command, control and communications which includes tracking resources, monitoring progress and fostering collaboration.
Some organizations are responsible for delivering essential services to the public and lives may be at risk if they are unable to deliver these services. Other organizations suffer crippling financial losses if their business processes are disrupted even for a
few minutes.
There are many kinds of incidents that can disrupt a business's ability to function: floods, fires, labour disputes, technology disruptions, supply chain breakdowns, illness and many more. Localized events can disrupt business areas and employees abilities to access their workplace. Viable planning requires that business can be continued or recovered regardless of what disrupted normal operations.
Where's the Flood Binder? How the World Has Changed BCP.
The BCP methodology developed in the 1970's defined a complete Business Continuity planning cycle that resulted in a formal printed manual to be used as a reference before, during and after the disruptive incident.
Organizations and the events they face today are more complex than when BCP methodology was first developed. Advances in technology have enabled companies to become global, and the last decade alone has seen disasters in the Western world unforeseen by traditional scenario-based planning. A flood plan does little good when an entire city is under water.
What technology can accomplish today simply was not possible when that original BCP methodology was first developed. In the 70's most businesses were localized and catered to customers in their immediate region or country. Today e-commerce transcends time zones, currency, geographic, cultural and language barriers. Incorporating all these factors into Business Continuity planning requires more than traditional office productivity tools. With today's instantaneous information dissemination, access to instant messaging and social networking, organizations have to react in increasingly shorter timeframes to assuage customer reactions. Only actionable plans based on up-to-the-minute information can be executed quickly and effectively.
Beyond Business As Usual
Writing Business Continuity and Disaster Recovery plans isn't enough to ensure your organization will be able to respond to a disruptive incident effectively. Today's organizations are complex. Interdependencies among assets (facilities, suppliers, technology resources, business processes and the people who manage them) are critical to both day-to-day operations and recovery from a disruption. Effective Incident Management requires decision support: real time information about assets and interdependencies to assist in the decision making process.
The goal of advanced business resiliency is to achieve a level of operational knowledge that surpasses the traditional objective of getting back to business-as-usual. When an organization has full visibility of all its operations and asset dependencies, it is more efficient and cost effective. Sound Business Resiliency planning can do more than simply help an organization return to business-as-usual after an incident, it can actually improve day-to-day operations.