DEFINITION
Business Continuity can be defined as “a business process, which provides for the continuation of time-sensitive or critical services regardless of any event that may occur.” Emergency or Crisis Management’s main focus is on protecting life and organization assets and in some plans covers restoring the organization to a pre-event level. The focus of business continuity is to achieve a cost-effective continuity solution that balances the value of potential losses to the organization and its assets against the cost of guaranteeing continuity of time-sensitive or critical organization processes. Service levels may be reduced due to a “disruption” but through good advance work, a minimum level of service can be provided and a perception of business as usual conveyed to the customer.
PROGRAM VS. PLAN
Business continuity is established initially as a project and on completion becomes an operational process requiring ongoing management. It will be an active program that reflects the changing environment and requirements of the District, unlike a plan that, once completed, is placed on the shelf.
What is “TIME-SENSITIVE”?
Many people wrongly associate what is time-sensitive or critical with what is important. All workgroups or services are important. Time-sensitive functions are people, services and hardware that without the organization cannot function. Many important workgroups and/or services can shut down for short periods of time without causing major disruption to the organization. Example: Christmas Break.
What is a “DISRUPTION”?
When the word “Disruption” is used or better yet the traditional word “disaster,” most people think fires, flooding, wind and/or tornado damage, and September 11. Although all the above are risks for the District in varying degree there are other “Disruptions” that can effect the District just as much or more:
- A contractor digging a ditch with a backhoe cuts a fiber optic cable and/or power lines.
- A major vendor for the District goes out of business.
- A building is unusable due to mold remediation, which last for several weeks.
- Due to a mechanical failure, the computer room suffers major water damage.
- The campus finds it necessary to close due to events outside and unrelated to the District.
|
Since the possible scenarios are endless, the best working definition for “Disruption” is: an event, of significant proportion, that disrupts normal organization activities for an extended period of time.
Why do we need a “BUSINESS CONTINUTIY PROGRAM”
The District is not the only organization offering educational programs and services in the Dallas area.
If a potential or current student gives up trying to enroll in classes because he or she was transferred too many times on the phone, it is not hard to predict their response if they are told to come back tomorrow or next week to register for classes.
In addition to customer service the District will need to address requirements from outside auditors, insurance companies, and accrediting organizations. Currently the outside auditors plan to test the District’s ITs’ continuity program at the next audit. Insurance companies are now requiring evidence of business continuity in all areas of an organization and are adjusting their rates accordingly. Accrediting organizations are also asking more questions related to business continuity and crisis management in their reviews.
Put simply … failure to have a business continuity program could lead to interruption of academic classes, financial losses, unnecessary injury, and delays in completing other mission critical activities.
Developing a “BUSINESS CONTINUITY PROGRAM”
Typical the first step in developing a business continuity program is conducting a Business Impact Analysis (BIA) Questionnaire. The BIA is a consistent and objective way to gather information regarding a workgroup and its function. Elements of risk are also identified. The survey asks a wide variety of questions. To list only a very few:
- What is the minimum number of persons that would be needed to re-establish the workgroup’s time-sensitive functions at the recovery site?
- Specifically, who will perform the identified time-sensitive functions? Specifically, who are their trained back ups?
- What computer applications are absolutely critical to the workgroup’s function?
- Who are the workgroup’s customers and/or contacts (both internal and external to the organization) that would be most affected by its downtime? Do you have their contact information stored off-site?
- Who are your critical vendors? Do you have their contact information stored off-site?
- For each major workgroup function, what is the maximum amount of downtime that can be tolerated?
- Any critical documents, reports, or microfiche? If so, what are they and where are they?
- Are there fines or breach of contract conditions that can result from this workgroup’s downtime?
- Are there highly modified or one-of-a-kind devices that are critical to the workgroup’s operation? If so, do they have back ups?
- Are the workgroup’s servers and/or PC hard drives backed up on a regular basis? If so, is the backup media taken to a secure off-site location?
|
Another reason to perform BIA is to determine the relative degree of time-sensitivity or criticality of the organization’s workgroups. If you asked all the organization’s supervisors about their workgroup’s degree of “time-sensitivity, they would say that their workgroup’s function is the most important to the organization’s survival. However, in reality, there will be only a few workgroups that are absolutely mission critical, there will be some that are pretty important, and several that are not time-sensitive.
The reason for realistically classifying the workgroups to their degree of “time-sensitivity” is that you want to recover only the most time-sensitive organizational functions first. Organizational functions considered less time-sensitive could be recovered later in a phased manner. It is unwise (and probably impossible) to try and restore everyone at the same time. The BIA process assists the coordinator in objectively making decisions by providing facts and information that can be compared across the wide variety of workgroups.
The “BUSINESS CONTINUITY PROGRAM”
A business continuity program is generally made of two sections. A section covering matters at the District level and one covering matters at the campus and workgroup level. In the event of a “Disruption,” the documentation should answer the following basic questions:
1. Who’s In-Charge and Who’s their Backup?
Unlike going out-of-town on a business trip a supervisor often does not have the opportunity during a disruption to designate the “acting supervisor”. During a disruption the workgroup’s “regular” supervisor may be injured or on the other side of town and unable to physical reach or communicate with his or her office. Also, its possible that the supervisor is out of town and their “acting supervisor” is injured or unreachable. A document covering the “Chain of Command” for lack of a better term would cover most possible disruptions.
2. Where does the workgroup relocate or meet?
There are several options from which to choose. The following are several options (with varying cost) that the IT workgroup might choose:
HOT-SITE VENDOR
An outside vendor for a fee makes available a site which is constantly updating its’ equipment, available 24/635, and offers testing periods once or twice a year.
DISTRICT owned WARM-SITE
The District in addition to its’ primary site would have an alternate site with the same equipment made available by the hot-site vendor which could be ready within one day.
DISTRICT owned COMPUTER ROOM BUNKER
The District would move the computer room to a weather -hardened structure. (No Alternate Site) District could add a *DropShip Vendor to this option.
DISTRICT owned COLD SITE
The District in addition to its’ primary site would have an alternate site with an empty computer room equipped with communication lines, power and HVAC. Hardware would be purchased and delivered or *DropShip after the “disruption” occurred.
*DROPSHIP VENDOR
The hardware would be DropShip *(delivery of temporary replacement hardware kept in stock by vendor) by an outside vendor after the “disruption” occurs. Hardware would be delivered to the District’s computer room or an alternate site chosen by the District.
3. What should we do when we get there?
After receiving a phone call in the middle of the night informing you that your building is on fire is probably not the best time to start thinking about the many things that you need to do. It is really hard to think clearly and rationally. A better approach is to develop a portion of the continuity program that is called the “Day 1 List”. This portion of the program summarizes the critical few (no more than 10 - 15) items that MUST be performed in the first twelve hours of a disaster. This way the workgroup supervisor and their key personnel can go point-by-point right down the list and not overlook something important. If you can act in an efficient / organized manner in the first twelve hours of a disaster, you’re a long way down the road to survival and, hopefully, to recovery.
A major aspect of the “Day 1 List” is contacting a wide variety of persons (internal and external to the company) and/or organizations and informing them that you are experiencing a disruption. This portion of the program should detail their contact information (i.e., name, address, telephone number, fax number, after hours telephone number, E-mail address (office and home), pager number, and cell phone number, etc). If the person to be contacted is a VIP, who within the organization should make the call? People normally can be very understanding and helpful if they know up front that you are experiencing a disruption. What they don’t like are surprises.
4. What resources are needed at the recovery site?
Some needed items that can be ready for you at the recovery site (i.e., the usual desk/chairs, PCs, general office supplies, etc.). However, there are some items that you’ll need to obtain once you arrive at the recovery site (i.e., backup data from off-site storage, special pre-printed forms from your vendor’s warehouse, etc). These items need to be detailed in the program along with the vendor’s contact information and the time frame in which the items are needed (i.e., immediate, 1 – 2 days, etc.).
Testing the BUSINESS CONTINUITY PROGRAM
The initial writing of the program is important, but equally important is testing the program and reviewing the program for needed modifications on a regular basis. A very lengthy, eloquently worded program can be written and placed in a fancy binder, but is this program really capable of doing its intended job (i.e., facilitating the recovery of the respective workgroup’s time-sensitive functions)? There is only one way to find out. Test it. As the program is tested there will be items identified that will necessitate additions and/or corrections to the program. No real continuity program has ever received a “perfect” score. There will always be a need for changes.
How frequently the program is to be tested depends on the workgroup’s degree of time-sensitivity and required recovery time window. Minimally, it should be tested once a year. Preferably it should be tested quarterly. It just depends on the workgroup’s situation. The intensity of testing may run the range from a full / unannounced activation to a planned tabletop walk-through.
Regarding the program’s review, did you ever see a workgroup that didn’t have personnel turnover or changes in its functions? The program must be kept current and reflect an accurate picture of the workgroup and its functions. The reviewing, testing, and modifying the program should be a never-ending iterative process.
Another important aspect of the written program is to have it stored at several secure off-site locations (i.e., key employees’ homes) so there can be quick easy access. The program should also be marked and treated as a confidential document.
CONCLUSION
This paper is an overview of the business continuity program process. It is meant to give a sample of some of the information gathering, thought process, and decision making, which goes into developing a Business Continuity Program.
Also, this article was designed to stimulate the thought process.
Does your workgroup have answers to the four basic business continuation questions?
Who’s In-Charge and Who’s their Backup?
Where do we relocate or meet?
What should we do when we get there?
What resources are needed at the recovery site?
If you asked your people some of the sample BIA questions, what kind of answers do you think you’d get?