The Business Continuity Institute's recent Horizon Scan Report identifies that cyber attacks are still perceived as the top threat by businesses. Also within the top 10 is concern about supply chain disruption, especially as they are becoming increasingly complex and often transgress international borders. Other sources of anxiety include a data breach and, for the first time this year, concerns over the availability of talent and skills. So how does business continuity help with these very real issues for businesses operating today?
The need to understand your business
Taking what is termed a 'granular approach' to your business and investing time to understand the various processes and roles within your organisation will probably provide one or two revelations. You may discover that there is duplication of processes or an incompatibility in how contact details are saved e.g. product names versus name of supplier. Could this be causing unnecessary delays or confusion between your own departments? Would the purchasing department have a plan in place if a key supplier suddenly fails? Do HR and departmental managers allow themselves the time to think about what actions may be required in the short, medium and long term if a key member of staff is unexpectedly going to be absent? Is this key person's knowledge accessible for whoever may have to fill their post on a temporary basis? Being aware of these things may improve both the efficiency of your internal systems and as a consequence the quality of service provided to other departments. So often businesses spend time worrying about the customer experience but many often ignore the fact that 'customers' i.e. people or persons requiring a product or service, exist within their own organisation, and that getting those departmental customer interactions right, can make a huge contribution to the bottom line. Gaining a better understanding of the interactions within your organisation is just one supplementary benefit of thorough business continuity planning.
Data management often comes under scrutiny during a disaster recovery (DR) programme initiative. A business that really thinks about its data will often discover the diversity and value of information that it has acquired and stored, though one aspect of this that is often overlooked or not fully appreciated is the system's ability to ‘de-duplicate’ this data. Much of the data on your organisation's live system will be copied time and time again. For example, when you cc an email to other people in the business the same data is saved multiple times across the business. With a modern DR system only one version of the email will be stored. At its most effective, this de-duplication system can deliver a staggering reduction in data storage of up to 65 percent!
What other questions should you be asking?
When planning business continuity the first question is, 'What are the vital assets without which my business can't function?' Relocating staff is inconvenient but not impossible, buildings are a shell housing your business and can be replaced. It is the records of contacts, contracts, transactions and communications that represent years of trading, and the associated applications that have been developed to manage and evaluate this knowledge and intelligence, that are the unique asset that needs protecting. Maintaining reliable and secure access to this information is key to ensuring the continuity of your business. With this in mind take some time to assess your current situation; ask yourself; ‘Am I as protected as I can be?'
Consider the following:
- Can you access your data remotely?
- Have all sources of information (data) been identified
- Is it backed up and accessible off site?
- Are staff able to work remotely, with access to relevant files?How long would it take to get alternative services up and running?
- Have you considered moving processes away from a dedicated IT infrastructure to hosted capacity and applications, delivered over the Internet?
If you answered ‘yes’ to the last question there are some supplementary points you should consider checking with your provider:
- What guarantees are within the Service Level Agreement (SLA)?
- Where is my data? Check where your data is being housed, UK, Europe, America…
Choosing a Cloud provider should be done with business continuity and due diligence in mind. Should the unthinkable happen and your day-to-day business is compromised you will need to get to that all important data so the first thing you need to ask is, “How do I get my data out?”’How do I get my data out?’
Future proofing your BC plan
A BC (business continuity) plan needs to be adaptable to Cloud technologies and these are constantly changing and improving. Your BC plans should not define how to operate with a Cloud vendor but should allow for the relationship to evolve and respond to your business' growth and evolution and that of the technology. Many Clouds are provided ’as is’ with no recourse, as long as you know that and accept the risk you can plan for it. Where there is a service level agreement, this needs to be understood and reflected in your own BC planning and may cover elements such as the speed and amount of data restored. This is where taking the time to think about your business can really improve the efficiency of your BC plan. You will need the phone numbers and emails of your suppliers and customers within the first few hours of any incident occurring, in order to keep them informed about progress should your business be compromised. What you won't need with quite the same urgency, if ever, are the photos from the last staff Christmas party!
Having the right recovery time should be decided by the business, with careful consideration around which applications should be given priority and the maximum outage period. Having near instant restores will cost more than an eight hour recovery option, but not all business functions need to be restored at the same rate and every business is different.
So to conclude, don't approach business continuity planning as another process to follow through mechanically. Embrace it as an opportunity to review, refine and reinvigorate your business and not only will you sleep at night with the knowledge that you have a backup plan, you may even find new opportunities and ideas that bring new life to you, your staff and your customers.
Russell Cook, managing director at SIRE Technology has long been an advocate of business continuity and not just because it makes sense to make a contingency plan in case of the unexpected. No longer is business continuity just about backing-up your IT systems; if implemented and maintained in a professional manner, business continuity planning becomes a valuable business tool in its own right.