Business Continuity Plans (BCP)
Note: We will use Business continuance and Business continuity interchangeably in this post.
Fires, floods, tornadoes, equipment failure, malice, ineptitude, human errors, etc all lead to various degrees of data loss and interruption in an organization’s operations [2].
As such, it is an organization’s responsibility to have a plan in place in the event of a disaster. The plan will help them resume and continue business operations as efficiently as possible while minimizing both financial impacts and data loss. One way to ensure the success of the business and the ability to recover from catastrophes as quickly as possible is for organizations to set up a Business Continuity Plan (BCP) [2].
What is Business Continuity and why is it important?
As discussed in a previous blog, “Data Loss and Disaster Recovery,” businesses are experiencing data loss in mass quantities and with a variety of detrimental effects. Whether it be from a natural or manmade disaster, organizations deal with an average of 17 data loss occurrences on a daily basis. When a disaster occurs, regardless of the cause, it interrupts an organization’s capability to sustain vital components both throughout and after a disaster takes place, also known as business continuity [1].
One way for businesses to stave off the interruption of operations is to make a Business Continuity Plan (BCP). A BCP is a plan that organizations have on record in case a disaster, such as fire, cyber attacks, floods, public health outbreaks, etc. occurs and makes it possible for them to recover from it as quickly as possible [1].
Why is a business continuance plan necessary?
Having a BCP in place is essential for businesses for two main reasons:
- It is necessary so businesses, especially large ones, can sustain all their vital operations throughout the span of the disaster [1]. In reality no matter how large or small a business data loss may prove fatal to the entity’s existence.
- It helps reduce the financial losses associated with interruptions. When normal business activity is interrupted, it is costly. Revenue losses, the added expenses of hiring consultants and experts and the costs of lost customers due to a poor reputation can be devastating to a business [2].
What are the steps organizations should take to make a BCP?
A good BCP begins with the organization first conducting a Business Impact Analysis (BIA). A BIA helps expose potential risks and threats, forecasts the effects that an interruption in business would have and collects data required to develop potential retrieval methods [1] [2].
The next step in forming a business continuance plan is identifying recovery strategies to help restore the essential business operations based off data collected during the BIA. Recovery strategies are methods utilized to reestablish business operations to the lowest acceptable level after a business disruption. During the BIA, recovery time objectives (RTO) are used to decide on the best recovery strategies which are then chosen based off the approval of management [2].
Various recovery strategies include:
- Utilizing third-party contracts and/or partnerships [2]
- Relocating business operations to a different location if possible [2]
- Telecommuting [2]
- Using failover technologies such as copy data, file mirroring, and backup [1].
Once recovery strategies are identified, organizations should establish a business continuity team to design the BCP and to manage operational interruptions [2]. An important part of this step is for the continuity management team to create a plan that does not focus solely on the IT aspects involved in a disaster. While disaster due to infrastructure failures is a large element of any BCP, the BCP must also consider factors such as loss of staff, human capital, facilities, vendors, reputation and partnerships [4].
Lastly, it is essential that organizations educate continuity management teams and conduct trial runs and drills to assess the effectiveness of the BCP plan [2]. Many organizations develop their business continuity plan in a way that is easy for the preliminary development of the plan rather than real-use situations. This is problematic because when the actual catastrophe occurs, teams are often confused and unfocused about what to do first. The plan must be designed in a way that it is easy to deploy during the first minutes or seconds of the crisis. The best ways to guarantee that it is easy to implment is by education, trial runs and a thorough assessment of the plan [3]. It must be a live plan that continues to be revisited and updated as the business, people, means of production and technology change.
Conclusion
When businesses are expected to be functioning and accessible at all times, the importance of being able to maintain uninterrupted business operations is critical for success and survival. Proactive organizations plan ahead, formulate and test the BCP. A BCP will help organizations recover in a timely manner, while reducing financial losses and maintaining their good reputation.
Resources
- Rouse, Margaret (September 2016). “Business Continuity”. TechTarget. Retrieved 25 April 2017.
- “Business Continuity Plan”. Ready.gov. Retrieved 25 April 2017.
- Beattie, John (13 August 2014). “3 Important Elements Your Business Continuity Plan Is Missing”. Forbes. Retrieved 3 May 2017.
- Koeppel, Harvey R. (January 2016). “A disaster recovery/business continuity plan for the data breach age”. TechTarget. Retrieved 3 May 2017.
Related articles
Share this Post