Disaster Recovery Journal - Spring 2001 Issue- Cultivating Business Contingency Planning

DISASTER RECOVERY
JOURNAL

Return to the Spring 2001
Index

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276
Fax: (314) 894-7474
Internet www.drj.com
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

EDITOR
Michelle Saab
michelle@drj.com

COPY EDITORS
Edward H. Pearce, CBCP
drj@drj.com
Richard Sandhofer
richards@drj.com

INTERNET /
ADVERTISING
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
ww.drms.com.br

Click Here for a Printable Version

Cultivating Business Contingency Planning
‘Be Gosh or Be Gone’

- by Wyman Q. Reese, Jr. CBCP

TIME AND COMMITMENT
These two things..… Past and future make obvious that the world of recovery is continually changing in today’s capricious environment where business processes are being revolutionized by emerging technologies.

All individuals charged with the guardianship of maintaining a ‘living’ continuity of business program are impacted by this cascading effect. Each face the constant struggle of change as a result of business processes being altered to gain profitability. This seemingly unmanageable and unthankful undertaking, with all its mystery (and uncertainty), can be effectively managed when one starts to think of it in terms of ‘maintenance’.

Traditionally, most organizations obtain a vendors shrink-wrapped software package to initiate a recovery program. While this can be great, it will set the mode for recovery. This usually results in written Plans which are widely distributed, outside the scope of committed resources, making it more difficult to keep current, and normally sit on a shelf and wait for the next scheduled test or audit to set in motion the updating process. Until you come to recognize the problem and realize that maintenance is one of the primary areas where Plans become ineffective in supporting the potential for a successful recovery, you will not be able to move forward. The maintenance attitude should be applied all the way through the process.

Notwithstanding popular acceptance, a written Plan does not inevitability have to instruct ‘how’ to do something, but should always tell ‘what’ to do. Remember that the primary purpose of a written Plan is to advance the recovery process by providing guidelines and information. The base of these directions should be aimed toward quickly alerting the various teams so they can achieve their individual team responsibilities and make sustainable progress towards a successful recovery. Bear in mind that during an operational failure or major catastrophe you are really trying to retrieve your business from a ‘loss of time’. .

Boundless attention should be given in divesting your self of non-essential information within the written Plan, while at the same time, not jeopardizing recovery. Without moving into a panorama of considerations, one of the essential ingredients is to utilize your off site location and the team concept to the fullest. Here are but a few of the things that normally change on a regular basis and can be removed without jeopardizing recovery, and be maintained elsewhere.

Consider creating a packet of information that can be placed in the back of each written Plan. The approach will encourage changes to be made by both the administrator and each Plan holder. It will also help maintain stability in the written Plan. This packet might include:
· Organizational charts, calling trees, team names & addresses, contact telephone number, recovery command center information, listening radio and television stations.
The items for off site storage are limitless, and may include:
· Hardware and software information, job flow diagrams, vendor contact information, detail team recovery procedures, network configurations, supply lists, emergency pull boxes, and so on and so forth.

This common-sense approach works.
The value of maintenance cannot be overstressed, especially since the degree of maintenance undertaken could have a significant impact on the organization’s ability and your business continuity program to survive and continue into the future.
Maintenance also includes the challenge of keeping senior management and the various divisions, departments, and geographic locations synchronized into your recovery program. It is essential to patronize an active Awareness program. Such a program will instill an alertness in observing or in interpreting what others see, hear, feel about continuity planning and justify the level of commitment by Management. The success of the overall program can be greatly influenced by the productiveness of positive communication and will help guard against future factors, which may have an otherwise negative impact on the progress of the overall program.

Of all the essential “Elements” necessary to developing a successful business continuity program, the maintenance involved in the testing and authentication of your program is likely the most consequential. Testing and authentication must not only be viewed as a necessity to ensure readiness, but it should also be a requirement specified in your Corporate Policy. Proper documentation and follow-through on problems encountered during each event are absolutely mandatory. For each test, prepare an itinerary for the various teams prior to the test and follow up with an official critique at the conclusion of the test.

· Team Itinerary prior to test: Travel Itinerary, Test Scenario, Test Objectives, Projected Time Line, Hot Site Vendor Assistance Package, Customer test procedures and Team Contact Information
Upon completion of the test, prepare a follow up critique of the overall test.

1. Test Overview

a. Scope
b. Scenario
c. Objectives (Primary, Secondary and/or Blind)

2. Testing Process

a. Overview
b. Projected Time Line
c. Actual Time Line
d. Pre-test
e. Live test
f. Post test critique

3. Test Results

a. Objective critique
b. Hot Site Vendor critique
c. External/Internal Auditor critique
d. Letter to Executive Management

4. Action Items

a. List of action items requiring resolution

5. Resolution of Action Items

These, in combination with all the other distinct parts or elements, plus using a formulated approach involving your most qualified technical, administrative, audit staff, select customer or end user or supplier base to test and authenticate your organizations recovery program should result in a successful venture in overcoming most adverse issues.

Wyman Q. Reese, Jr., CBCP is an experienced IT professional. He now works for Lockheed Martin Corp. - LMGT (Integrated Business Solutions-IBS) division.