If you’re new to disaster recovery or risk mitigation, you might be overwhelmed with business continuity terminology.
To start, what is business continuity? If you’re not sure, don’t worry. We’re going to cover the definition of business continuity, what it is, what’s included in a bc management program, how to manage a continuity plan and the four-step business continuity process.
Having some type of business continuity planning in place is appropriate for all organizations regardless of revenue, size or industry. The planning and level of effort may vary depending on your needs, but you should make every effort to have something in place. So, what is business continuity and where do you start?
Is your business ready for a disaster? This is the question a business continuity plan is trying to address.
What is Business Continuity? The Definition
Business continuity is the advance planning and preparation undertaken to ensure that an organization will have the capability to operate its critical business functions during emergency events. Events can include natural disasters, a business crisis, pandemic, workplace violence, or any event that results in a disruption of your business operation. It is important to remember that you should plan and prepare not only for events that will stop functions completely but for those that also have the potential to adversely impact services or functions.
What Does Business Continuity Include?
BC covers the planning and preparation needed to ensure an organization will have the capability to perform its critical business functions during emergency events. It identifies, plans for, and/or creates:
- How to communicate with customers, vendors and other third parties to ensure you are providing good information and support.
- How to ensure services or products can still be provided to customers.
- The order and timing required to restore business processes.
- How to support employees during an emergency event.
- The required technology to support the business functions (disaster recovery – or DR – will implement recovery solutions for technology).
- Workaround processes to use when technology is not available.
- Where and how to relocate people and processes in the event business locations are impacted or not available.
- The teams and organization that will be necessary to manage emergency events.
- Business process dependencies (what, or who does each business process rely upon in order to do their work).
- Regular exercises to validate that plans and actions meet requirements and will be functional in an actual event.
- Ensure staffing levels will be adequate during an event for both external and internal needs.
- Documentation of the steps and actions to take during an event to accomplish the items above.
The Anatomy of a BCM Program
At MHA, we divide up the Business Continuity Management (BCM) program into four key dimensions:
- Program Administration
- Crisis Management
- Business Recovery
- IT Disaster Recovery
We believe that when these four dimensions are operating optimally, individually and in an integrated fashion, the BCM program will have an elevated level of sophistication, maturity, and capability.
Organizations may not be able to work on the four dimensions in parallel and effectively implement the components, but without implementing all areas, an organization will not truly be prepared. Many unexpected issues arise during a crisis event, too many to address ad hoc. If your organization tries to address the unexpected and perform critical actions on the fly during a crisis event, it will not be able to effectively and efficiently perform the tasks required for a successful recovery.
The BCM Team
A good BC program starts with a Business Continuity Management (BCM) team. The following individuals are the core members of the BCM team. They are responsible for implementing the policies and directing BCM efforts across the organization.
- Sponsor: The senior management individual with overall responsibility and accountability for the BCM program.
- The Business Continuity Manager: The individual with direct responsibility for the BCM program.
- Assistant Business Continuity Manager: The backup to the Business Continuity Manager. This could be a titled position or an assigned position.
- Administrative Assistant: The individual responsible for supporting the BCM team. This is often an administrative assistant working in the Business Continuity office, if it exists, or another individual from the administrative assistant team.
In addition to these individuals, representatives from business units and IT must be involved to provide input related to the development of appropriate recovery strategies for business and technology functions. From a functional perspective, the non-BCM staff members will perform the work of recovery preparation; the BCM team will provide guidance and support.
Find out more about forming the Business Continuity Management team.
The BCM Process
To get started, consider performing the following steps. We have provided links to relevant MHA blog posts on these topics.
- Assessment: The first step to a successful planning process is to make sure that you have a thorough understanding of what is, and is not, critical to your organization. You can (and should) perform a Business Impact Analysis (BIA) and a Threat & Risk Assessment to guide you. Without understanding your organization’s processes, how critical those processes are, and the threats and risks inherent in your operations, you cannot effectively develop appropriate plans and strategies.
- Business Recovery: The purpose of business recovery planning is to ensure that your critical business processes can be recovered in the event of an emergency. Your plan will document the actions, including temporary workarounds, that will be necessary to keep critical functions operational until IT applications, systems, facilities, or personnel are again available.
- IT Recovery: IT recovery planning refers to the development of plans and strategies for the recovery of your technology, including actions that will be necessary to restore critical IT applications and systems.
- Crisis Management: Crisis Management refers to a specific plan that details how your organization will manage a crisis event, as well as to an internal organizational unit (the Crisis Management Team) that will manage that event.
Start With Something Manageable
It might seem overwhelming at first, but identifying critical processes and applications, and implementing basic recovery strategies and plans are a requirement for any functional, and effective, BC plan. Your plan should include a basic organizational structure for your team, as well as necessary guidance and checklists for your business units, IT department, and the management team that will allow for quick response and action.
Even if you are unable to implement your ideas, just having a basic strategy in mind will provide much-needed structure in the event of an emergency. Remember, it’s important to have something in place; perfection will be less important than structure in the event of an emergency. Remember, something is better than nothing; perfect is the enemy of good.
Want to know more about the benefits of Business Continuity? Read more.
Business Continuity Education and Awareness
A search within your organization could reveal operational incidents, failures of service level achievements, quality deficiencies, help desk issues, product defects and other problems which could have been disasters. Awareness may be raised by a Business Continuity Education and Awareness program.
This program could include:
- The Business Continuity Manager attending key meetings (project meetings, progress meetings, quality meetings, service management meetings) to ensure Business Continuity considerations are included the activity or project specifications
- Placing Business Continuity Management as a standard item on meeting agendas
- General briefings and presentations on Business Continuity
- Induction training for new hires
- A Business Continuity consultation process involving all departments
- Articles, news and letters in corporate newsletter
- Use of internal web pages, blogs, and Intranet
- Circulating news items, video clips, DVDs, photographs and articles and disaster or incident reports of Business Continuity relevance
- Promoting attendance at BC-oriented conferences and exhibitions
- Organizing visits to the recovery sites(s)
- Conducting tests and exercises, with observers
Further Reading
For more information on business continuity and other hot topics in BC and IT/disaster recovery, check out these recent posts from MHA Consulting and BCMMETRICS:
- 20 Steps to a Robust Business Continuity Plan
- Start Here: The Business Continuity Management Guide for Beginners
- Your First Task: Scout the Business Continuity Territory
- What to Include in Your Crisis Management Plan
- The Plan that Time Forgot: The Importance of Protecting Your Business Processes
- IT Change Management: Don’t Leave Your Recovery Environment Behind
“What is Business Continuity?” is the first piece of our Business Continuity 101 series, created for those new to BCM and those looking to improve their knowledge of the fundamentals of business continuity best practices. If you’re not sure where to start when it comes to BCM, this series was written for you.
