Business Continuity Planning

Data is the heart of most businesses and without it they would cease to operate.  It is a simple fact that resources like space, computers and even people can be replaced much more easily than corporate data.  A commonly quoted statistic is that “94% of companies suffering from a catastrophic data loss do not survive – 43% never reopen and 51% close within two years.” (University of Texas).  Even though this quote appears on numerous blogs, Web sites and backup product data sheets, my experience has been that there is still an incredible number of businesses that are either woefully neglectful or outright negligent when it comes to their backup procedures and related policies. 

If you are a business owner or IT director who simply takes it on faith that your backups are running and will be useable in the case of system failure, human error or a disaster like the flooding that seems to be in the news regularly, this article is not for you.  In today’s business environment, there is no valid justification not be 100% confident that a robust backup system is in place and operational.  While it may sound harsh, you have already lost the battle and are simply a statistic waiting to happen if you don’t take action immediately. 

This article is for business owners who already take data protection seriously.  Image-based backups are in place and updated throughout the day, off-site replication is performed at least nightly, appropriate retention policies exist, backup logs are checked daily and test restores are performed on a set recurring schedule.  With the confidence that these protections are in place for your information technology, you can start to consider what more can be done to ensure that the business is protected from all of the risks that it might be exposed to.

The development of a Business Continuity Plan (BCP) is the logical next step for owners and executives who want to take further action towards ensuring they are safe from risk.  This has begun to gain greater importance recently in part because it is becoming more common to be asked for business continuity details by high-value clients or to include specific details in service contracts or RFP responses.  Information technology is an important component of a BCP plan, so you are on your way down the path, however it is just one piece of a much larger puzzle. 

BCP planning examines the products or services you supply that are important to your customers and therefore the success of your business.  Some companies can continue to operate and provide products and services for a considerable period of time should computer systems experience problems, but if a key production system like a printing press, delivery truck or just in time vendor become unavailable, losses might begin to add up very quickly.  This is where a business continuity plan comes into play.
 A BCP identifies key Business Impact Areas (BIAs) and connects key activities with the locations, facilities, departments, applications, resources, suppliers and staffing dependencies for each.  Risks are documented from a worst case perspective and associated impact and likelihood of occurrence ratings applied helping to identify which areas need specific, detailed action plans. Many plans allow companies to document reputational, operational, legal and financial impacts that the loss of an activity will have on the BIA, often with financial impact mapped out on a timeline of hours, days, and weeks.

BCP planning is no small task.  It requires intimate knowledge of the people, process and technology that your business depends on.  Additionally, plans are only useful if they are accurate and complete, meaning that someone needs to take the responsibility to revisit and update documentation on a scheduled basis.  In a small business maintaining and updating an overall plan may fall to a single individual but in larger businesses each BIA would generally have an owner responsible for their section of the plan.  
Much like the data backups mentioned earlier in this article, waiting until a plan is needed is not a recommended best practice.  Scheduled tests and drills are important not only to ensure that plans are practical and complete but are also necessary to ensure that required recovery time objectives (RTO) can be met.

Want to know more about_ business continuity planning or how to get started putting yours together?  There are numerous articles available on the Web, ranging from general information on Wikipedia to more detailed guides and templates from a wide variety of agencies and vendors.  My preferred solution is Catalyst, a Web based tool https://bccatalyst.com/. Protect your business, hone your competitive advantage or simply provide for a deeper and more secure sleep at night by getting started on your business continuity plan today.