Career Progression

[CTaylor21]

Has anyone lined out a career path/progression for a BC/DR person? I think it would look something like this:
1. Jr BC/DR analyst
2. Sr BC/DR analyst
3. BC/DR Supervisor
4. BC/DR Manager
5. BC/DR Director
6. IT Manager
7. IT Director
8. CTO

I understand that not all positions would necessarily be at one company; but some form or fashion of them would exist during a person's career. What would be your dream path of the corporate ladder?

[grewjac]

C:

You lost me at "IT Manager." I've known people in IT who grow into doing business continuity planning, but not the other way around. I suspect you're under the impression that BCM is about recovering IT operations. There's been a lot of that going around for the past dozen years or so, mainly because IT recovery services vendors chose to "brand" what had been called disaster recovery (DR) as "business continuity." But if you go to the DRII.org website and read through the "Ten Areas of Professional Practice in Business Continuity," you will find nearly no mention of IT.

BC is about recovering critical business operations, and begins with a business impact analysis (BIA), which nails down how long a given operation can stop before the loss to the enterprise is unacceptably high. Then, every resource supporting that operation is identified, quantified, and the recovery time objective (RTO) is set. For some operations and for IT systems, the recovery point objective, what is the enterprise's tolerance for loss of data and other vital records, is also set.

After completing a second process - risk evaluation and control - strategies for recovering each operation are developed. With management approval for funding the mitigating measures each strategy requires, plan development and implementation begins. The "plan" states how the strategy will be executed. When all the mitigating measures are in place and operational, the plan is considered "implemented." This is to say that a plan is just a stack of paper unless the things to effect the timely recovery of the operation in question are actually in place and ready to use.

If this sounds some distance from your notion of BC and the career path possibilities, perhaps staying in the IT end of the business may be the best decision. Good luck to you.

[pridder]

Well grewjac, if I'm going to be following you, I might as well know your name. A sincere "tip of my hat" to you for your your reply to CTaylor21. I absolutely understand the predicament and ultimately the perspective that embraces CT. So many of us are hired into the IT world to work on basic disaster recovery with no consideration given to actual business continuity. I've been in several battles over the years trying to get well intentioned IT leaders to understand the limitations of their narrow approach.

This is a subject I'm very passionate about. In fact, I've submitted an article to DRJ for publication in the winter edition on this very topic. CTaylor21, all I can say is that I feel your pain. Remember that your profession requires a corporate conscience even though you may only be asked to contribute locally. The best of efforts in disaster recovery will not replace a comprehensive BCM process. I've personally NEVER been employed outside the IT department. However, through will and determination I've advanced previous employers into the BCM arena. The IT leaders don't always like it, but they eventually understand the motivation. It's difficult any time one stands against many, don't give up.

One last thing, the career ladder seldom reflects the value of our contribution. We face an eternal imbalance between responsibility and authority. Lots of the former, very little of the latter. The best thing we can hope for is that our opinions are respected and we're able to inspire positive changes in our environment. If you can find value in that, you are probably in the right profession.

[grewjac]

Thanks, Pat. The basic challenge is getting a client - I do mostly contract consulting, since it's hard to break into a full-time position with no managerial experience. Frankly, I enjoy the challenge of building a program from the ground up, because every company is different, and it makes the job more interesting. That way, I'm more of a project manager, herding the cats, so to speak.

The trouble with CTaylor21's view is that it's based on a common misconception of what BCM is, and, as previously stated, IT recovery services vendors are to blame. Their marketing efforts are zeroed in on CIO's and their budgets. There's just one truly serious downside to their viewpoint: If you think of the enterprise as a ship, these guys are providing water-tight integrity for the engine room. Period. They don't hire people who know how to ensure the rest of the ship stays afloat, and they don't care. Problem is, when the ship takes a torpedo below the waterline, the engine room may still be humming along at the bottom of the ocean, but the ship is still sunk.

Cheers,

Gregg Jacobsen, MBA, CBCP, MBCI

[pridder]

Pleasure to meet you Gregg. We're definitely dancing to the same tune. I'm currently employed by a fortune 100 company that has a fairly mature DR plan (meaning they are pretty close to knowing what to do) and virtually nothing that will address business continuity. My coworker, an 8 year veteran of the company, has perpetuated the miopic approach to BCM that we're discussing and I'm now struggling to influence. To the point where I have to explain to my boss that the two of us are doing entirely different jobs. The depth of the misconception knows no bounds. I see the environment here as a real life example of the emperors new clothes.

I would STRONGLY remind any certified planner that their responsibilities do not stop at recovery and to not let themselves or their employer fall into this pit. Understanding of course that they will often find themselves at odds with their leadership but it's easier to avoid the trap than it is to get out of it.

Anyone in this position should go back do the DRII website and review the code of ethics. This is what we signed on for when we were awarded our certifications. We might not have direct responsibility for change but we can influence through persistence. (and patience)

Patrick Ridder, MBCP, MBCI, CHPCP