Business continuity in 2008
As has become customary for Continuity Central, we start the new year with a speculatory look ahead at the changes and challenges the business continuity profession can expect to see emerging though the year. THE IMPACTS OF BS 25999 CERTIFICATION 2007 started with business continuity managers around the world attempting to get to grips with BS 25999 part one, British Standards’s new business continuity management offering. 2008 sees the next step in the process, with BS 25999 part two being released in time for business continuity managers to decide whether it was a Christmas present or a Christmas turkey. 2008 will allow us to see which way the decision went. If BS 25999 part two is widely accepted, 2008 should see many organisations working towards the formal certification of their business continuity arrangements, followed by the same organisations placing pressure on their suppliers to follow suit. Continuity Central expects to see business continuity suppliers leading the certification charge, as it will provide a useful, probably essential, requirement to show that they have ‘put their money where their mouth is’ in terms of developing their own business continuity capabilities. MOVEMENT TOWARDS AN ISO BUSINESS CONTINUITY MANAGEMENT STANDARD 2008 is expected to see further movement towards a recognised ISO standard for business continuity management. During 2007, ISO published ‘ISO/PAS 22399:2007 Societal security - Guideline for incident preparedness and operational continuity management’ which ‘presents the general principles and elements for incident preparedness and operational continuity of an organisation’. PAS documents are not full standards but are guidelines of good practice and the approval process is less onerous than for a formal ISO standard. Work is on-going to develop a formal standard, but it has a long way to go. CONTINUED DISCUSSION OVER TERMINOLOGY Ever since the term ‘business continuity’ was first used an interminable discussion has been taking place as to its suitability. The standards development process has brought this discussion to a head with BS 25999 part two introducing the new term of ‘business continuity management system (BCMS)’, which is defined as ‘that part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity.’ However, the debate is far from complete and the BCMS has yet to receive widespread acceptance as a useful term. For the ISO standards process it is thought that a more inclusive term than ‘business continuity’ might be useful. So expect to see discussions on whether ‘operational continuity management’ would provide a way of amalgamating ‘business continuity management’, ‘operational risk management’, ‘continuity of operations planning’ and ‘continuity of government planning’ into one easily understood term. BUSINESS CONTINUITY LOOKS TOWARDS THE COMMUNITY No business exists in a vacuum: it has many dependencies on its local community (for example employees, services and customers may all come from the local area) and, however well an individual business is protected, if the external community is impacted then that business itself will also be impacted. Good business continuity planning therefore takes into account local community dependencies and works with and within the local community to help make it more resilient. Some of the most forward thinking business continuity managers are already active in this area. 2008 should see community resilience discussed in more detail, with many more business continuity managers starting to follow the example of their trend-setting peers. VIRTUALIZATION MARCHES ON In a similar article at the beginning of 2007 we advised people that: THE EMERGENCE OF BUSINESS CONTINUITY QUALITY SYSTEMS The importance of managing the quality of business continuity plans and strategies has long been understood, with much of the focus in this area being on the use of tests and exercises to examine the practicality of business continuity plans during invocation and to identify and remedy any mistakes or out of date elements in the plans. However, while the need for testing and exercising will never go away, forward thinking business continuity managers are starting to look at other forms of quality control and quality improvement measures. These include formal benchmarking against industry best practices and against the business continuity management systems in place within other comparative companies and organisations. Measurement systems are also being implemented which allow return on investment to be proved and which allow continual improvements in business continuity arrangements to be documented. As business continuity management matures, formal quality control measures will be seen as an essential aspect. 2008 will see progress made in this area and more discussion of the subject. PRESSURE ON BUSINESS CONTINUITY BUDGETS The 2007 United States subprime mortgage financial crisis has created huge headaches for many financial sector firms, with these looking to use 2008 to recover as many of their losses as possible. The financial sector undoubtedly leads the field in terms of business continuity take-up and in terms of the budget made available for business continuity. As firms look to tighten their belts in 2008, business continuity spending may well be one of the areas which is squeezed. With the finance sector making up such a large proportion of the business continuity cake, 2008 may be a relatively lean year for the business continuity market and its suppliers. Add your own thoughts – email editor@continuitycentral.com
•Date: 3rd January 2008• Region: World •Type: Article •Topic: BC general |
