If you’re faced with the task of choosing business continuity management software this can often seem overwhelming. In this article, RiskLogic provides a checklist of the important factors you should look for whilst making a decision. Although RiskLogic is a business continuity software provider, the article is still reasonably objective and offers useful advice.
Determine your requirements
Before you begin your search, it is important to understand what you want the software to achieve. Are you looking for a straightforward business continuity tool that will be used in a single location or a more complex database that can be utilised worldwide, anywhere, on any device? Some users’ main goal is to automate the administration of plans, whereas others want a mobile response tool or software that offers in-depth analysis and reporting. If you consider the size of your business continuity function, it enables you to understand if the provider offers scalable solutions to match your needs. Clearly understanding, listing and prioritising all your requirements will ensure you know the right questions to ask.
Consider the product and provider’s history
Finding out how long the product has been on the market is critical to understand the type of experience you are likely to have when using the system. If they are well established in the market, the system is likely to be more stable and predictable, having been tried and tested by many users who have come before you. On the flip side, are you getting the latest technology and user experience? Or, if the software is new it is important to weigh up the pros and cons of being an early adopter. You may land a great price and get some great new interfaces or technology but you could face frequent updates and changes for a while during the start-up process. New products generally take months, if not years, of constant updates and testing to establish themselves. Ask what clients they currently work with, how long they have worked with them and are they known to have a history of problems? Have they won any awards and what type of industry presence do they command?
Another factor that searchers often forget to look into is the actual provider. Are they subject matter experts in business continuity or are they just a software vendor? For some, they may think this does not matter. However, when it comes to training, tips and tricks and advice, a software demo provided by industry professionals will be able to give you the answers you need. Is it possible to provide a technical tool that provides a solution to a field you know little about? On the flip side, you don’t want a fixed methodology or approach thrust upon you from ‘industry experts’ if it doesn’t match your approach.
Take a look at the product
If you are at the point where you are ready for a demonstration, then it’s safe to say you are already partially bought into the product. At this stage, you should revisit your initial requirements and make sure the software’s functionality matches your needs and have your questions ready. Some organizations will focus on their highlights and ‘best bits’, whereas other demos allow you to understand how it will function in normal operation. It will always be hard to find a product that does everything you need, in the way you want it done, so be realistic about your ‘must haves’ and ‘nice to haves’ and be prepared to do a little compromising. As a minimum, systems should:
- Provide an easy to use and simple interface for users;
- Provide visual dashboards for plan maintenance;
- Align to ‘best practice’ in your industry;
- Cover the full life cycle of business continuity with dedicated functionality for BIAs, plans, risk assessments, exercising and reporting;
- Allow sufficient data storage for supporting documents;
- Include automation of system reminders for administrative tasks like plan updates;
- Provide some form of portable access to plans during a disruption via mobile applications of similar;
- Provide a strong data analytics function with visual reporting;
- Adhere to robust data security and privacy policies for all users;
- Provide the ability to access the system securely from any device, anywhere.
Other useful elements may include:
- The ability to integrate with other systems, such as HR databases;
- In-built communications capability;
- Issues registers.
Some vendors will provide a free trial, but given the complexity of most business continuity programs this is not always feasible. The vendor should be willing to provide numerous demonstrations (you will generally need at least two, if not more) with various stakeholders in your organization either in person or via the web. Both have different benefits:
In person:
- More in-depth information in one go;
- Ask questions directly on the spot;
- Build rapport and confidence in their knowledge;
- Understand if they are on-shore or overseas
On the web:
- Less time consuming;
- Gives a good snapshot of the main features;
- Allows you to watch at your own leisure;
- Replay the important parts to your key stakeholders.
Is the software being continually improved?
Even though the business continuity software system seems well suited now, it is always important to consider the future. Technology becomes outdated quickly, you want an innovative product that is going to continue to grow, update and improve as new technologies emerge and as we discover new ways of doing things. The innovation curve tends to slow down rapidly for many software vendors when a critical mass of clients are using their system. Meaningful innovation requires thinking of new ways of doing things, often for less cost to the client, and this has the risk of cannibalising established revenue bases.
Again, on the flip side, too much change, too often, can also be disruptive, especially when trying to build engagement with your business continuity program, so we need to strike the right balance of continual improvement. One major release each year and smaller quarterly release seems to be a good benchmark of a product that is moving forward in the right direction.
Before signing up, be sure to determine if upgrades are included in your licence fees or are going to cost additional each time a release is provided. It is also useful to understand if releases are mandatory and applied to all clients, or whether you have flexibility in how your instance of the system is managed. Remember, you may not want all the updates provided.
What training and support options are available?
If you have come to a decision on the right business continuity management software for your organization, it is time to assess the training and support options that are available. If new users do not feel comfortable operating the software, then they probably won’t use it which will make you feel unsatisfied with your purchase and in worst case situations, users will simply disengage from your business continuity program.
First, you need to understand the user profiles required to manage your system and business continuity program. All systems are different, but you will generally require administrators who have full system access, team members who may need read only access to their plans, plan owners and/or maintainers who need editable rights, and general staff who may simply be registered in the system for contact purposes. You then need to create a training program to suit how these users will interact with the system and your business continuity program.
Considering your organizational preference, it is important to understand which training option best suits your users. If you prefer on-site training, this will not always be possible if you opted for an overseas vendor so this is important to consider during the decision-making process. Often, considerable upfront time is required to train the more active users in the system which is often best done face to face in small groups and over several days or weeks.
If e-learning is your preferred training method for lighter users or as refreshers, there are also a few things to consider. You want to ensure it is easy to understand and that the terminology is digestible by the end user. E-learning is a good option for geographically dispersed teams as well as for regular refresher training and new staff members as they do not need to wait for the next on-site training session. It is also often the most cost effective training option.
Support is probably the most important consideration for the ongoing success of your business continuity software purchase. You need to be comfortable with the service level time-frames on offer, and that the support staff can respond when you need them. If your chosen software doesn’t have local representation, what are the support hours? Are they available 24/7, during your business hours or only during business hours in their time zone? What methods of support are being provided? Is there an online portal, email or phone support? Are user groups available or online forums? Being part of a user community (either face to face or online) is often a great way to get the level of support you need and influence the direction of the product you are using.
How are systems generally priced?
As you would expect, all systems are different when it comes to how they are priced. In general terms, you can expect to pay an ongoing licence fee for access to the system based on some or all the following factors:
- Size and nature of your organization;
- Geographic use of the system;
- Functionality required;
- Number and type of users in the system;
- Contract term, many vendors have a minimum three years;
- Payment schedules – many vendors will require upfront payment.
Given the complexity of most business continuity programs you will also generally pay for an upfront implementation fee to setup your instance. This can vary widely based on the level of support and customisation required from the vendor. A general benchmark for standard implementations is about 20 percent of the annual licence fee.
Lastly, you will generally pay additional fees for support and training with most business continuity software vendors. Again, this often depends on the level of support and training being provided including service level standards, format of support and training, geographies it is being provided and operating hours. Many vendors will charge between 10-20 percent of the annual licence fee for standard support of their system.
System hosting and security
Security is a crucial factor when considering a hosted solution. Your IT department will more than likely throw you a very long list of requirements. The key questions you need to consider are:
- Where are servers located?
- Are these secure environments which meet international standards (e.g. ISO 27001)?
- Is your data encrypted? Or maybe your organization has regulatory requirements to keep data onshore?
- Will your information be backed up instantly, nightly etc. and how long are backups kept for?
- What is the system uptime?
- How quickly can the system be recovered if there is a failure?
To conclude
Software is the future of business continuity management, but selecting the right tool for your organization can initially seem like a strenuous task. To select the perfect solution, you need to understand your functional and technical requirements for the software, look at what’s out there, decide what level of support you will need and be comfortable that the vendor can provide this for you. You need to establish that you can work happily with the vendor and of course ensure you have the budget.
The author
RiskLogic is business continuity software provider. To find out about its BC-3 web based business continuity tool visit www.BC-3.com.au
