| How to prioritise the BCP effort with recovery timeframe objectives
An English proverb states, “A good beginning makes a good end.” It’s obvious and simple advice, but is sometimes forgotten in the business world, in particular in professions such as business continuity planning. BCP is often an under-funded afterthought that lacks a “good beginning.” Unfortunately, poor advanced planning can lead to a business continuity plan that provides a patchwork of false security. To begin the planning process, a business impact analysis (BIA) should always be conducted. The BIA will identify processes or computing systems that may need continuity plans - in large, complex organisations, it may identify thousands of these processes and systems. If that is not intimidating enough, the people needed to document these plans may already be over-committed. This type of problem can occur in both small and large organisations and the public and private sectors. Organisations that have this type of problem are in the majority. The BIA should provide recovery timeframe objectives (RTOs) for each process and the critical application systems needed to support the processes. The RTOs shouldn’t just be viewed as goals for recovery. In fact, RTOs can and should be used to prioritise the entire planning process. First things first With an established RTO for each critical process and system, the planner can determine what efforts will provide the most benefit for the organisation. It is important to note that some key items will support the entire organisation including the development of risk mitigation strategies, the creation of an overall crisis management plan, the documentation and exercising of building evacuation plans, and the establishment of business continuity policy. For each of these the planner will work with departments such as property management, safety, security, human resources, and other business unit managers and these enterprise-wide plans should always be the first priority when writing continuity plans. Crisis management plans for each business unit and a global plan for the entire organisation will support primary notification of management and identification of each critical process (as identified in the BIA). At the time of a disaster, these crisis management plans will support the adjustment of priorities for all processes and systems based on the current business conditions. These plans will be used to support management decision-making related to recovery resources that will be shared by departments when a disaster occurs. Building-centric continuity plans will contain evacuation procedures and provide for the safety of all employees. Most organisations already have these procedures in place because building owners and property management companies have responsibility for the safety of all building occupants. The 30-day rule Recovery plans for departmental processes or
supporting systems should be developed if: An organisation may have a vast number of processes within each business unit or department and should use an approach that will enable the development of detailed plans for the most critical processes first. This approach will support development of detailed plans for any process that must be restored in less than 30 days. (One potential issue with this described method of prioritising processes for plan development is that some interdependencies may not be discovered between processes until actual recovery requirements and procedures are developed.) In order to determine which plans should be written and in what order, the following prioritisation steps should be followed: 1. Determine the critical processes for each
business unit (from the BIA). 5. Within each tier assign a criticality rating
(1-10); one should be reserved for processes or systems that are
needed to support at least 25 percent of the revenue or critical
services (e.g., life safety). Filling in the gaps Plans supporting RTOs of zero to 14 days should have requirements for pre-defined strategies (communication, locations, etc.), explicit teams and positions, task lists, recovery procedures, vendor management procedures (if required), and plan testing procedures. These plans may also require pre-positioned contingencies (e.g., stand-by equipment, work areas, and routable networks) to support the strategies. Processes with an RTO of 30 days or more may not require a documented plan, but should at a minimum be subject to appropriate records management standards to assure the processes can be re-established within appropriate timeframes. The BCP department, acting as the plan administrator and as the plan development support group, must clearly document the prioritisation approach at the business unit level. This documentation (typically in the form of a policy) should include the risks of pursuing a less than comprehensive approach. The overall policy will likely be the basis for audits of the business continuity program and auditors will scrutinise prioritisation of plan development as a measure of good governance. While no plan can ever be considered foolproof, some are certainly better than others. The best involve advanced planning and a well-thought out process. Because, after all, with a good beginning, planners can help ensure a good end. About the author DOWNLOAD PDF VERSION OF THIS ARTICLE
•Date:
21st May 2004 •Region: N.America/World •Type:
Article •Topic: BC
plan d'ment |
