When 2007 blew in with heavy storms, car bomb attacks and tornados the pressure mounted on businesses to have a secure business continuity plan in place. This year is already set to be eventful with snow storms in the North and businesses having to use remote working to stay afloat.
Similarly 2007 proved to be a bad year for the Government with mass data record losses which failed to assure the general public that they could securely manage and safely retain information. Their data loss record was pretty abysmal with one disaster after another being exposed, with cases of senior civil servants laptops going missing, the HMRC fiasco, the numerous data loss scandals at the DVLA and DVA as well as the thousands of NHS patients who now have their records at large!
However, in the real world of competitive business in order to stay standing after an incident it has to be a very different case! You have to have contingency plans and resilience systems in place to survive and stay ahead of the game. In essence Business continuity is all about good business practice, creating a strong framework with the right IT infrastructures and procedures in place so that when a disaster of any kind does hit the business can continue to operate successfully.
As businesses are fast expanding it is proving imperative for businesses to implement an effective business continuity strategy in order to minimise business interruption and maintain operation continuity in the face of any adverse situation. Richard Fitzhugh – Content Director for Business Continuity Expo 2008 cherry picks the top business continuity websites for 2008, click online to discover how to maintain your business throughout a disaster.
www.Continuitycentral.com
Continuity Central provides a constantly updated one-stop resource of business continuity news, jobs and information.
www.bs25999.com
BS25999.COM has been created by a team of industry specialists with the intention of providing both experienced practitioners and industry newcomers relevant information, useful content and a number of interactive capabilities concerning BS25999.
www.ncc.co.uk
The National Computing Centre (NCC) is the single largest and most diverse corporate membership body in the UK IT sector.
NCC champions the effective deployment of IT to maximise the competitiveness of its members' business, and serves the corporate, vendor and government communities.
www.thebci.org
The Business Continuity Institute – (BCI) - The Business Continuity Institute’s mission is to promote the art and science of Business Continuity Management worldwide. The BCI promotes the highest standards of professional competence and commercial ethics in the provision, maintenance and services for Business Continuity Management (BCM).
www.theirm.org
Institute of Risk Management is risk management's professional education body. Established as a not-for-profit organisation, the Institute is governed by practising risk professionals and has strong links to leading universities and business schools across the world.
www.contingencytoday.com
Contingency Today is a web-based magazine and the only publication, online or print, dedicated to the challenges and opportunities of Critical National Infrastructure protection. Critical National Infrastructure can be defined as those assets, services or systems which, if destroyed or damaged, threaten the social or economic well-being of the nation, including by the infliction of mass casualties. Contingency Today covers all significant threats to the Critical National Infrastructure, including electronic attack and the sophisticated misuse of computer systems; physical attacks by terrorist organisations and other criminals; the effects of climate change; and other natural disasters, including pandemics, fire and flood.
www.cirmagazine.com
Continuity Insurance & Risk is the UK's leading bi-monthly risk management and insurance journal. The magazine has rapidly established itself as a key weapon in the risk and insurance professional's armoury. Continuity Insurance & Risk offers a unique combination of editorial elements to provide an essential, practical tool in today's business environment.
www.strategicrisk.co.uk
Magazine aimed at people who have to deal with risk at a strategic level and with the necessary responsibility for corporate governance.
“StrategicRISK is affiliated to AIRMIC, the UK-based Association of Insurance and Risk Managers, and is the only publication that receives their official endorsement."[2] StrategicRISK covers all the aspects of risk management that confront large organisations of all types throughout Europe.
www.businesscontinuityexpo.co.uk
Business Continuity Expo is the only event dedicated to managing operational risk, resilience and recovery. With a unique format combining a comprehensive exhibition, a highly popular free-to-attend seminar series and a stimulating and thought-provoking conference, the show brings together professionals spanning the growing Business Continuity and risk management industry. Business Continuity Expo is a unique opportunity to explore best practice, identify industry trends and cement vital relationships to help ensure operational continuity before, during and after an incident. The event will be held on 2-3rd April 2008 at the ExCel, London.
Showing posts with label business continuity. Show all posts
Showing posts with label business continuity. Show all posts
Are You Getting Value from Your BIA?
James R. Mitchell, CBCP
Director, eBRP Solutions, Inc.
Cost vs. Benefit
The standard practice of conducting a Business Impact Analysis (BIA) to determine the basic recovery requirements (Mission Critical Processes, RTO’s, RPO’s, Critical Applications, Suppliers, and other Resources) is a vital phase of every Business Continuity Management program.
The BIA process can be long and difficult – no matter what data collection method is used. Is the return on your BIA investment (time, manpower and resources) offset by the value of the results?
If a BIA is a fundamental part of BCM, the underlying cost may simply be a necessary evil. But, when a BIA is a one-time ‘project’ – as in many organizations – is the cost realistically proportional to the value?
Some organizations conduct a BIA expecting to repeat the process at regular intervals. However, once the initial BIA is completed and the true cost known, such expectations are often abandoned.
Focus on change
Failure to update a BIA is a leading cause of Recovery Plan failure. Change is the only constant in business. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.
Intending to update a BIA is easy; yet the update process often fails.
Consider the effort required to complete the original BIA: questionnaire preparation, distribution and collection; interviews to “normalize” the results, plus the cost of analysis and report generation.
Often, the original BIA process “project”, may take three to eight months. Significant business changes make the prospect of repeating that lengthy process daunting. Postponing the update may be rationalized. Like most things in life, postponing difficult tasks allows them to grow more unwieldy
To streamline the process, the updated BIA must focus on the changes – rather than repeat the entire process. It is likely that much of the information from the earlier BIA is still valid. The update process simply entails drilling down to which business processes have changed, and how those changes affect the original BIA results. Of course, the method used to conduct the earlier BIA will determine just how easy – or how difficult – the update process becomes.
In Information Technology, an updating process is generally ongoing (Change Management) because IT changes have a direct impact on daily operations. In business operations, changes occur regularly, but are seldom, if ever, documented. (To be fair, no matter how robust the IT program, not every organization consistently correlates its Change Management information with its DR Plan.)
The Whole is Greater than the sum of its Parts
Is it sufficient for individual business process “Owners” or function leaders to update their own critical resource requirements? Yes, if the update method allows for the capture of changes in enterprise-wide dependencies (on other processes, applications, etc.). But no effective update can be conducted in a vacuum; any change to critical dependencies or resources is likely to have a corresponding affect upon those dependent processes.
While it may be efficient for a process team to update its own BIA, only by collecting and integrating changes across the enterprise can the true impact of business changes emerge.
The Path of Least Resistance
Frequently, the cost of updating a BIA (in manpower and time) is perceived as unjustifiably high. Not updating a BIA may become an accepted risk. BCM management may opt to focus on BC/DR Plan updating (assuming most process owners understand the impacts of change and will modify their Plans appropriately) without revising the BIA. The more burdensome the BIA process, the higher the propensity not to repeat it.
Once made, such a decision often becomes institutionalized. Later, the failure to reflect fundamental changes in the organization’s structure may result in flawed Plans and a failed recovery. With luck, flaws show up in a test or exercise – not a real life incident.
What’s in your Toolbox?
Does your existing BIA format lend itself to manipulation? Or do you have to start from scratch? Do you use software that integrates BIA and Plan development?
Does the BIA format lend itself to the use of collaborative tools? Can business process owners gain access to the original BIA survey? Network- or Web-based collaborative tools reduce the pain of updating a BIA, while enabling monitoring and auditing of the process by the BCM leaders or planners.
Assess your options, and pick a BIA updating method that works best for your situation. It may not be free, it may be time-consuming, and it may not be painless. But it will pay dividends if you have a disruptive event.
An out-of-date BIA exponentially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA information, the validity of Plans should be questioned, and their successful execution must be suspect.
eBRP Solutions, Inc will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk
Director, eBRP Solutions, Inc.
Cost vs. Benefit
The standard practice of conducting a Business Impact Analysis (BIA) to determine the basic recovery requirements (Mission Critical Processes, RTO’s, RPO’s, Critical Applications, Suppliers, and other Resources) is a vital phase of every Business Continuity Management program.
The BIA process can be long and difficult – no matter what data collection method is used. Is the return on your BIA investment (time, manpower and resources) offset by the value of the results?
If a BIA is a fundamental part of BCM, the underlying cost may simply be a necessary evil. But, when a BIA is a one-time ‘project’ – as in many organizations – is the cost realistically proportional to the value?
Some organizations conduct a BIA expecting to repeat the process at regular intervals. However, once the initial BIA is completed and the true cost known, such expectations are often abandoned.
Focus on change
Failure to update a BIA is a leading cause of Recovery Plan failure. Change is the only constant in business. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.
Intending to update a BIA is easy; yet the update process often fails.
Consider the effort required to complete the original BIA: questionnaire preparation, distribution and collection; interviews to “normalize” the results, plus the cost of analysis and report generation.
Often, the original BIA process “project”, may take three to eight months. Significant business changes make the prospect of repeating that lengthy process daunting. Postponing the update may be rationalized. Like most things in life, postponing difficult tasks allows them to grow more unwieldy
To streamline the process, the updated BIA must focus on the changes – rather than repeat the entire process. It is likely that much of the information from the earlier BIA is still valid. The update process simply entails drilling down to which business processes have changed, and how those changes affect the original BIA results. Of course, the method used to conduct the earlier BIA will determine just how easy – or how difficult – the update process becomes.
In Information Technology, an updating process is generally ongoing (Change Management) because IT changes have a direct impact on daily operations. In business operations, changes occur regularly, but are seldom, if ever, documented. (To be fair, no matter how robust the IT program, not every organization consistently correlates its Change Management information with its DR Plan.)
The Whole is Greater than the sum of its Parts
Is it sufficient for individual business process “Owners” or function leaders to update their own critical resource requirements? Yes, if the update method allows for the capture of changes in enterprise-wide dependencies (on other processes, applications, etc.). But no effective update can be conducted in a vacuum; any change to critical dependencies or resources is likely to have a corresponding affect upon those dependent processes.
While it may be efficient for a process team to update its own BIA, only by collecting and integrating changes across the enterprise can the true impact of business changes emerge.
The Path of Least Resistance
Frequently, the cost of updating a BIA (in manpower and time) is perceived as unjustifiably high. Not updating a BIA may become an accepted risk. BCM management may opt to focus on BC/DR Plan updating (assuming most process owners understand the impacts of change and will modify their Plans appropriately) without revising the BIA. The more burdensome the BIA process, the higher the propensity not to repeat it.
Once made, such a decision often becomes institutionalized. Later, the failure to reflect fundamental changes in the organization’s structure may result in flawed Plans and a failed recovery. With luck, flaws show up in a test or exercise – not a real life incident.
What’s in your Toolbox?
Does your existing BIA format lend itself to manipulation? Or do you have to start from scratch? Do you use software that integrates BIA and Plan development?
Does the BIA format lend itself to the use of collaborative tools? Can business process owners gain access to the original BIA survey? Network- or Web-based collaborative tools reduce the pain of updating a BIA, while enabling monitoring and auditing of the process by the BCM leaders or planners.
Assess your options, and pick a BIA updating method that works best for your situation. It may not be free, it may be time-consuming, and it may not be painless. But it will pay dividends if you have a disruptive event.
An out-of-date BIA exponentially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA information, the validity of Plans should be questioned, and their successful execution must be suspect.
eBRP Solutions, Inc will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk
Subscribe to:
Posts (Atom)
