Volume 10,3 Disaster Recovery Journal Articles- Summer 1997

Volume 10, Issue 3
Summer 1997

Standards for Certification of Business Continuity Professionals: “Professional Practices for Business Continuity Planners”

By Dr. Raja K. Iyer, Ph.D., CBCP

Introduction
The formal acceptance and recognition of any profession occurs when the contributions made by the individuals in the profession follow generally accepted professional practices, and such professional individuals are recognized as such, through established procedures for testing and verifying knowledge and experience in the profession. The business continuity planning profession was established several years ago by pioneers and is currently reaching a level of learned maturity worldwide. The profession is now at a stage where a necessary and sufficient set of generally accepted professional practices have been accumulated, documented, and verified through the efforts of several organizations worldwide. Notable among these organizations are the Disaster Recovery Institute (DRI) International, headquartered in the U.S., and the Business Continuity Institute (BCI), headquartered in England. This article describes the “Professional Practices for Business Continuity Planners (PPBCP),” which prescribes a set of global standards which the individuals in the business continuity profession may follow as generally accepted professional practices for executing their responsibilities as business continuity planners in organizations. Furthermore, the professional practices also provide a formal definition for the business continuity profession itself, thereby establishing the profession’s purpose for those outside the business continuity profession.

The Premise for Professional Practices:
A Common Body of Knowledge
Professions are recognized through their contributions to society, and such contributions are formalized through generally accepted professional practices, which will ensure that uniform results can be anticipated from standards in practice. Furthermore, a body of common knowledge that is shared by members of the profession and used in their work characterizes professions. While each organization in a variety of industries may need specific requirements from a profession, a set of generally accepted and widely adaptable professional practices may serve as the foundation upon which specific structures may be built.
The common body of knowledge is usually abstract, stable, and technology dependent. It is independent of necessary skills, tasks, or activities. Rather, the specific skills, tasks, or activities for the profession emerge and evolve from a set of subject areas of a common body of knowledge that characterize a profession. For the business continuity profession, a total of 10 subject areas of common body of knowledge have evolved, as shown in Table 1. It must, however, be recognized that these areas of common body of knowledge will continue to evolve, both in terms of the number as well as the content of the areas of common body of knowledge.
The “Professional Practices for Business Continuity Planners,” has been compiled by the Education and Testing Standards Committee of the DRI International Certification Board, with significant input from BCI. It combines the generally accepted professional practices and the ten areas of common body of knowledge into a unique framework that establishes the role of the professional and the knowledge the professional should demonstrate in each area of the common body of knowledge as outlined in the following section.

A Historical Perspective on the PPBCP
The PPBCP is the result of the on-going work of two major certification bodies, namely the DRI International and the BCI. A short historical perspective is essential in order to obtain a fuller understanding and appreciation of the PPBCP development process.
At the DRI International, the “Common Body of Knowledge (CBK),” originally consisting of nine subject areas, evolved under the leadership of DRI International Certification Boards and DRI staff members from 1990 to date. Meanwhile, during the same period, BCI developed its “Certification Standards for Business Continuity Professionals,” which consisted of 14 subject areas. The merger of the two approaches to certification standards into the current PPBCP was accomplished during the 1996-97 period under the current Certification Board of DRI International and the membership of BCI. It is anticipated that the document will continue to evolve in the future.

An Overview
The “Professional Practices for Business Continuity Planners” (PPBCP) is organized into ten subject areas, as listed in Table 1. Each subject area description contains two major sections as follows:
1.The Professional’s role, describing generally accepted and widely adaptable practices, and
2.A description of the knowledge that the professional should gain and demonstrate.

As mentioned earlier, the professional practices are based on two major sources as follows:
• Common Body of Knowledge (CBK) developed by DRI International; and
• Certification Standards for Business Continuity Practitioners from BCI.
Since the professional practices represent the combined efforts of two of the most authoritative certification bodies in the business continuity industry worldwide, one can conclude with confidence that the professional practices described in this paper present global standards for the business continuity profession. Furthermore, in order to maintain the currency and integrity of these professional practices, the Education and Testing Standards Committee of DRI International has established formal procedures for receiving input from all interested agencies and individuals, and reviewing and updating the professional practices, whenever appropriate.
To ensure global adaptability, the PPBCP explicitly recognizes the need for country-specific knowledge and professional practice standards, above and beyond those practices which are generally accepted and widely adaptable worldwide. In this regard, the first eight areas of the PPBCP are developed to serve as generally accepted knowledge and practices, and the last two areas, as shown in Table 1, are country specific areas of common body of knowledge and professional practices. It is expected that certification bodies, such as DRI International and BCI, will maintain these country-specific areas in conjunction with inputs, suggestions, and information received from a variety of country-specific sources.
A full description of the PPBCP is beyond the scope of this paper, due to the size of the document. A full text of the PPBCP may be obtained from the DRI International or BCI.

Certification Process
The PPBCP forms a common base upon which professionals may be tested for their knowledge and experience to become a certified Business Continuity Planner. The DRI International, one of the leading certification bodies worldwide, utilizes the PPBCP, as it currently exists, to certify professionals at three levels as follows:
• Associate Business Continuity Professional (ABCP), for individuals with knowledge demonstrated through examination, but with no experience;
• Certified Business Continuity Professional (CBCP), for individuals with knowledge demonstrated through examination, and with 2 or more years of experience in at least three of the first eight areas of professional practices; and
• Master Business Continuity Professional (MBCP), for individuals with knowledge demonstrated through examination, and with 5 or more years of experience in at least seven areas of the common body of knowledge and professional practices.
It should also be noted that the certification examination administered by DRI International will begin to address the needs based on the first nine areas generally accepted and widely adaptable worldwide, and the last area which is country-specific.

Concluding Remarks
This article has provided an overview of the “Professional Practices for Business Continuity Planners (PPBCP),” developed and adopted by DRI International and BCI, to serve as worldwide standards for certification of business continuity professionals. The PPBCP combines generally accepted and globally adaptable professional practices and a common body of knowledge to support the professional practices. Thus, the PPBCP not only provides global certification standards for the business continuity planning profession, but also enables development of educational and research programs which can address general as well as country-specific concerns in the business continuity industry.
Table 1: The Ten Subject Areas OfThe Professional Practices For Business Continuity Planners 1. Project Initiation and Management
Establish the need for a Business Continuity Plan (BCP), including obtaining management support and organizing and managing the project to completion within time and budget limits.
2. Risk Evaluation and Control
Determine the events and environmental surroundings that can adversely affect the organization and its facilities with disruption as well as disaster, the damage such events can cause, and the controls needed to prevent or minimize the effects of potential loss. Provide cost-benefit analysis to justify investment in controls to mitigate risks.
3. Business Impact Analysis
Identify the impacts resulting from disruptions and disaster scenarios that can affect the organization and techniques that can be used to quantify and qualify such impacts. Establish critical functions, their recovery priorities, and inter-dependencies so that recovery time objective can be set.
4. Developing Business Continuity Strategies
Determine and guide the selection of alternative business recovery operating strategies for recovery of business and information technologies within the recovery time objective, while maintaining the organization’s critical functions.
5. Emergency Response and Operations
Develop and implement procedures for response and stabilizing the situation following an incident or event, including establishing and managing an Emergency Operations Center to be used as a command center during the emergency.
6. Developing and Implementing Business Continuity Plans
Design, develop, and implement the Business Continuity Plan that provides recovery within the recovery time objective.
7. Awareness and Training Programs
Prepare a program to create corporate awareness and enhance the skills required to develop, implement, maintain, and execute the Business Continuity Plan.
8. Maintaining and Exercising Business Continuity Plans
Pre-plan and coordinate plan exercises, and evaluate and document plan exercise results. Develop processes to maintain the currency of continuity capabilities and the plan document in accordance with the organization’s strategic direction. Verify that the Plan will prove effective by comparison with a suitable standard, and report results in a clear and concise manner.
9. Public Relations and Crisis Communication
Develop, coordinate, evaluate, and exercise plans to handle media during crisis situations. Develop, coordinate, evaluate, and exercise plans to communicate with and, as appropriate, provide trauma counseling for employees and their families, key customers, critical suppliers, owners/stockholders, and corporate management during crisis. Ensure all stakeholders are kept informed on an as-needed basis.
10. Coordination with Public Authorities
Establish applicable procedures and policies for coordinating response, continuity, and restoration activities with local authorities while ensuring compliance with applicable statutes or regulations.

Raja K. Iyer, Ph.D., CBCP, is a Professor of Information Systems in the College of Business Administration at the University of Texas at Arlington, and Chairman of the Education and Testing Standards Committee of the Certification Board of DRI International.

|Return to the Summer 1997 Index | Send Email to DRJ |

Webmaster---Robert Arnold

Last Updated--Wed. July 2, 1997.