Ensuring business continuity in the event of a disaster is crucial for any business. Jeff Keyes at Plutora, sets out the steps for building a robust business continuity plan.
‘Time is money’ is a phrase known to us all, but how many businesses can really say that they have the necessary plans in place to prevent downtime? Ensuring business continuity in the event of a disaster is crucial for any business. The most effective way to prevent downtime from getting the better of you is to create – and adhere to – a business continuity plan (BCP).
Many business and IT leaders think they may have the necessary measures in place. With so many still suffering from unexpected outages on a regular basis, it’s important to put a plan into place if you don’t have one already, or bolster an existing BCP if it needs a refresh.
Who needs a business continuity plan?
Put simply: everyone. Business continuity plans ensure that disruptions arising from disasters don’t threaten a company’s profitability. When disaster strikes, profitability is reduced by increased costs of operations and revenue loss. Depending on insurance alone is highly likely to result in an unsatisfactory outcome as it usually doesn’t cover all of the costs that occur in the event of a disaster.
Disasters of any intensity can cause anything from a minor impact to a major crisis for businesses and hamper their operations. With a BCP, businesses can continue to function even after a catastrophe. For many organisations, there’s a big focus on the company’s information technology systems, as these are often the company’s most valuable asset. Being able to quickly restore those systems and get back to normal service, therefore, is crucial.
However, while this can sound daunting to any business leader that currently operates without a BCP – or with a very basic one – you don’t have to create a full-blown plan to start. After determining your most vital business functions, prioritise them, and create a detailed plan for the highest priority service, then a plan for the next most critical service, and so on.
Businesses need to become profitable again as quickly as possible after a disaster. Therefore, it’s important to restore vital functions such as IT services first. However, priorities will be different for organisations that don’t have a strong focus on delivering IT services, so a good BCP will take these specifics into account.
Steps to building the perfect business continuity plan
It’s easy to say that a business continuity plan needs to be implemented – it’s harder to actually do it. The plan must be detailed and should address all possible threats the organisation is likely to face. It should also include a strategy and procedures to protect the organisation against those possible threats. Crucially, it must designate which personnel will lead each of the documented processes to ensure that nothing is left to chance.
It is important to keep a BCP well-organised, so that any person reading the plan can understand all the processes outlined in it. This isn’t to say that someone in HR should be able to restore IT services, but it does mean they can understand why a certain service is needed or how it impacts the key operations of the business.
So, with this in mind, how can businesses create the perfect business continuity plan? Here are six steps to get you there.
1. Identify key objectives and goals
The best starting point is to identify the scope of the plan you want to implement. For example, what level of detail will be covered in the plan, which departments need to be involved, what is the desired outcome of the plan, and which major milestones will be tracked? Business continuity management applies to the entire organisation, not just the IT department that manages the systems.
2. Build a business continuity team
Your team is the most important part of the BCP. It needs to include titles, contact details, and any other required information for each member of the team. It is also a good idea to include contact information for a backup person for each assigned responsibility – after all, disasters can still happen when someone is unavailable.
There should be two types of teams in a business continuity plan: the command and control team, and the task-oriented team:
- The command and control team ensures the plan is executed perfectly, and has crisis and recovery management sub-teams
- The task-oriented team is made up of employees who are assigned specialised operations, with separate subteams for areas such as legal, information technology, internal communications, HR, and customer service operations to name a few.
3. Determine all critical business functions
This stage is fairly self-explanatory – you must decide which business processes are the most crucial. Disruption of these would cause heavy losses to the company, therefore you must classify each business process as a function with a high, medium, or low level of importance. Doing so ensures that the most important business features are recovered first, reducing the potential loss.
4. Develop a business impact analysis report
Following step 3, you must create a business impact analysis (BIA) report, which recognises the areas of your business that are most vulnerable to disruption following a disaster. It must also quantify the losses you may experience if your organisation’s business processes go down for any length of time.
The BIA report should include the details already identified about your company’s key business operations and the most critical areas for business continuity. You can then also determine which resources you’ll need to ensure that these critical departments remain functioning during and after a disaster.
5. Specify acceptable downtime levels
Downtime will happen when disasters strike – there’s no foolproof way to prevent it entirely. It’s therefore beneficial to consider how much downtime is acceptable for each business operation. You must also agree on acceptable levels of loss concerning the company’s reputation, market share, finance, data, operations, and other key aspects.
You must decide how long the company’s systems can stay down before a loss becomes too great. The bigger the loss, the higher the risk for the survival of the company. Setting limits will aid the company in recovering the most critical functions first, by setting priorities of where to focus employees’ attention.
6. Build an operations maintenance plan
This is the largest section of the business continuity plan, as it identifies how the business will continue to function through a disaster. You must update this part of the plan regularly as your company evolves. It should begin with analysing the company’s current recovery capacity and determining how to improve it. Prevention strategies, response strategies, and recovery strategies all have a crucial place in your BCP, and reflect whether your plan will be effective. Crucially, discussing and rehearsing the plan annually or bi-annually to ensure that it works and that anyone new to the plan understands their role, is also critical to success.
Business continuity is more important now than ever, as companies are working hard to ensure that they can keep their services up and running for customers despite the challenges we have all faced this year. With ransomware attacks on the rise, businesses need to be prepared for any disaster to strike, and having a business continuity plan is one of the best ways to guarantee that even in a crisis, you can get back on your feet as quickly as possible.
Jeff Keyes is VP of Product at value stream management platform Plutora.
Main image courtesy of iStockPhoto
