Spring World 2015

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

DRJ Blogs

DRJ Community Blogs
Tags >> Business Continuity Management
Aug 27
2014

Recipe for Recovery: A Cookbook for a Winning Business Continuity Program

Posted by Linda Laun in DR , Disaster Recovery , Business Continuity Planning , Business Continuity Management , Business Continuity

Linda Laun

Food is a universal language. So is man’s need to survive. Whether in the business world or the kitchen we need a simple recipe for business continuity success.  In this four part series I’ll introduce you to the four basic courses necessary when cooking up an appetizing and rewarding business continuity program. This week the focus is on doing what’s good for us…exercising and eating our veggies!

Aug 05
2014

Recipe for Disaster Recovery: A Cookbook for building an effective Business Continuity Program

Posted by Linda Laun in DR , Business Continuity Management

Linda Laun

Food is a universal language. So is man’s need to survive. Whether in the business world or the kitchen we need a simple recipe for business continuity success.  In this four part series I’ll introduce you to the four basic courses necessary when cooking up an appetizing and rewarding business continuity program.   Let's get started... Remember the "devil(ed egg) is in the detail".

 

Apr 16
2014

Disaster Recovery and Change Management

Posted by Alex Belyarchik in Business Continuity Management , BIA , BCP , BCM , BC/DR conference

Alex Belyarchik

Change Management is often times the most overlooked aspect when it comes to Disaster Recovery. Not only does it not get enough attention, but we often times forget that building a recovery footprint is just as important as maintaining it. 

Has your server been operational in sync with the production environment? Have all the new production changes been replicated over to the DR? How can you be assured that your applications are still functioning? 

Dec 24
2013

Rudolph the red-faced business continuity manager (a Christmas tale – sort of!)

Posted by Andy Osborne in Disaster Recovery , Business Continuity Plans , Business Continuity Management , Business Continuity

Andy Osborne

By Andy Osborne, Consultancy Director at Acumen

Once upon a time there was a senior manager called Rudolph who, on top of his other responsibilities, was put in charge of the business continuity project. Rudolph was a busy chap with a lot on his plate – he didn’t have time for detail. And anyway, disasters never happen do they? Well, only to other people. 

Nov 13
2013

Delving into the depths

Posted by Andy Osborne in Business Continuity Plans , Business Continuity Planning , Business Continuity Management , Business Continuity

Andy Osborne

By Andy Osborne, Acumen.    
Originally posted on Oz's Business Continuity Blog

Following the recent departure of number one son to Manchester (see “University challenge”), on Sunday afternoon I decided to address a small issue that's been troubling me for a while. For several years, in fact. When I say troubling, I mean causing my blood to simmer gently on a pretty much permanent basis, and to boil over about once a week, often punctuated by the phrase "...and tidy your @*~%#& bedroom!"

Nov 01
2013

University Challenge

Posted by Andy Osborne in Planning , Crisis Management , Business Continuity Management , Business Continuity

Andy Osborne

By Andy Osborne, Consultancy Director at Acumen

We recently reached a significant milestone in the Oz family history, when we transported number one son (number one as in the sequence in which they arrived, as opposed to any order of preference, I hasten to add) with a car chock-full of his gear, to his chosen university in Manchester, some 120 miles from home.

Oct 29
2013

BCM/DR/ERM Terms: The Difference Between a Disaster Mgmt and a Crisis Mgmt (An Outsiders View)

Posted by Alex Fullick in Disaster Recovery , Business Continuity Management , Business Continuity

Alex Fullick
Recently, I was asked to sit in on a meeting – not participate mind you – and listen to some discussions that were going on regarding a project.  The discussions revolved around requirements and were pretty intense and detailed at time.   The point is, there was a question asked about Disaster Planning and Business Continuity Plans (BCP) and if they had to include anything in their scope.  My ears perked up on this one…and yet, I had to keep quite.The question asked by one of the attendees was this, “What’s the difference between a disaster and a crisis?”  Of course, I wanted to answer this but a quick look and grin from the individual that asked me to attend, told me not to interrupt because she knew I was chomping at the bit to jump into the fray.What I found interesting was the explanation given by one of the meeting participants, who I found later, had no involvement in Disaster Recovery (DR), Business Continuity Management (BCM) or Emergency Response Management (ERM) for that matter.  They weren’t even up to speed on technology; he was a business analyst (BA).  But his description was something I thought I’d pass along to others because it really got the message across to people in the room; something many of us have stumbled over in the past when trying to explain our industry terminology to ‘outsiders.’   I’ve paraphrased all the comments by the meeting participants into two descriptions below.  Before I forget, I’m not stating one way or another whether he was right or wrong, just conveying some information that might help others when communicating the differences or terms related to DR, BCM and ERM.A Disaster Is…“An event that causes major problems for a company or community…”“A disaster is something that happens suddenly and you have to immediately respond to it…”“With a disaster you have impacts that are immediately apparent…”“…something major that stops us from working.”“…something that has gone beyond normal crisis management processes.”“Everyone is impacted and involved…”A Crisis (Management) Is…“…is the management of the disaster or emergency situation…”“…a group of knowledgeable leaders (Note: “leader’ wasn’t defined) that make decisions to ensure activities      start/complete when required…” “…a team that coordinates response  activities…”“…the Single Point of Contact for questions and guidance as to what to do…”“Following documented plans and procedures to help respond to the situation…”“…managing the situation before it becomes a full-scale disaster.”“…not everyone needs to be involved with the management of a crisis.”I thought it was rather interesting coming from someone not in the industry, especially knowing how much people get these terms (and others) confused.  At least not one asked what the difference is between a contingency plan and a recovery plan.The descriptions are rather simplified and effective.  People understood after a minute or two what was being discussed and it helped get the meeting moving.  With industry terminology, it can get very confusing because there are so many different variations on what both of these mean; even among industry experts, professionals and practitioners.   Corporations that offer DR/BCM/ERM services also end up using their own terminology as well, so that adds to the confusion.I thought this person didn’t too badly of a job of stating the difference.  Of course, I wanted to state a few things but since he got his message across to a large group that had difficulty understanding between the terms.By the way, when they were completed, they decided they didn’t need to include DR, BCM or ERM in their project (Hope that doesn’t become a jinx on their project…) **NOW AVAILABLE** “Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a Social Responsibility”and“Made Again Volume 1 – Practical Advice for Business Continuity Programs” by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3Available at www.stone-road.com, www.amazon.com & www.volumesdirect.com
Oct 18
2013

12 Tips, Trips & Traps: The Business Impact Analysis (BIA)

Posted by Alex Fullick in Business Impact Analysis , Business Continuity Management , BIA

Alex Fullick
Business Continuity Management (BCM), like most corporate programs, is often plagued by common mistakes; these common mistakes also apply to the Business Impact Analysis (BIA. The following are some common mistakes that need to be addressed to ensure that the BIA is effective: 1. Minimal Management Support – Senior management must buy in to the need for continued maintenance of the BCP program. The program requires on-going resources to ensure that the program is funded and there are dedicated resources assigned across the organization. The people who head up the BCP program must have the requisite training, as well as the skills to provide leadership, prioritize tasks, communicate with stakeholders, and manage the program. 2. No Timely Follow Up of Results – A BIA is conducted almost always in support of an enterprise-wide business continuity program. The real value of a BIA is the follow-up activities that lead to effective recovery strategies being implemented based on the BIA priorities of the business processes. Occasionally, so much effort and cost is put into the BIA that business continuity planners never get around to fully implementing the follow-up recovery strategies and plans. Without the implementation of these follow-ups, the value of the BIA becomes wasted. 3. No Agreement on Scope (Level of Detail) – This level of detail can span an entire spectrum. On one end, some BIAs will contain relatively little detail to provide a higher-level executive view of the analysis. On the other end, and far more prevalent, are BIAs that include for each business process its corresponding input dependencies, output dependencies, recovery point objectives, recovery time objectives, and financial impacts. The common mistake here does not involve selecting the right or wrong level of detail – what’s appropriate for one company may be totally inappropriate for another – but rather, failing to reach agreement among all relevant parties as to what level of detail best meets the requirements that are driving the BIA in the first place. 4. Minimal Executive Support – One of the factors that most influences the relative success of a BIA is the degree of executive support offered at the outset. The kickoff process usually consists of two parts: a widely distributed email and an initial presentation. The email should come from the highest level executive sponsoring the BIA and should be distributed to all parties who will be participating in the effort. The email should emphatically voice the executive’s support for the project and insist on the support of al participants, particularly during the interview process. 5. Poor Questionnaires – An important step of any BIA is the collection of data from business units. The manner in which this data is asked for often spells the difference between a full, timely and meaningful collection of data, and one that is delayed and incomplete. One of the best ways to avoid this situation is to develop survey forms that are thorough enough to capture all relevant information and simple enough for business users to complete quickly and easily. 6. Lack of Preparation for Interviews/Workshops – Interviews are the cornerstone of a successful BIA, yet few planners prepare adequately for them to ensure their effectiveness. Interviewers need to learn as much as they can about a given business unit prior to the meeting, including a thorough review of the respondent’s survey. 7. Lack of Critical Focus – Analysts frequently make the mistake of asking business users ‘what are the most important business processes within their department?’ The reason this is a mistake is because virtually all critical business processes have a large degree of importance and value – otherwise they would not be designated as critical – resulting in less likelihood of it being easy to prioritize processes according to value or importance. A much better question to ask is ‘how long can a business process be idle before major impact is felt? 8. Focusing on the Tools Instead of the Process – Some analysts who conduct BIAs become very focused on the tools they will be using in the collection, compiling and analyzing the data provided by the business users. The emphasis often shifts inappropriately from the process being used, to the automation that can be applied to the process. There is an inherent flaw in this approach. If a poorly designed manual process that is being used to collect and analyze the data suddenly becomes automated, what you typically end up with is a poorly designed automated process. 9. Ineffective Interviewing Technique – I have known more than a few BIA analysts who preferred to rely solely on surveys, questionnaires and emails to collect needed data. The example previously cited concerning the over-focus on tools shows how this can less than desirable results. Analysts often say that setting up interviews can be more hassle than it’s worth. They will mention how interviews often start late, or may be cut short, or have to be re-scheduled, or cancelled altogether. In my experience, the real reason some BIA analysts try to steer clear of face-to-face meetings is that they tend to use ineffective techniques when interviewing business process owners. 10. Insufficient Results Analysis – Analysts conducting a BIA collect a wealth of information during the course of their efforts. But the value of this information is sometimes diminished by poor or incomplete analysis of the data. Analysts need to look for trends, patterns, relationships and discrepancies among and within the data to ensure a thorough and meaningful analysis. 11. Unclear Presentations – Data that is thoroughly collected and well analyzed is sometimes de-valued by an unclear or confusing presentation of the information and results. Managers in general and sponsoring executives in particular, expect BIA analysts to summarize their results in high-level presentations that are succinct and effective. Unfortunately, this does not always happen. Analysts gather a huge amount of data in the process of conducting BIA. In compiling and analyzing this data, analyst sometime err on the side of presenting too much information rather than too little. 12. Undefined Scope – Often, the BCP focuses entirely on system restoration. Resumption of business needs to include the people and processes required to resume operations. Many BCP programs are headed up by IT departments. ‘Tunnel vision’ can often cause these departments to focus on system recovery and not take the people issues into account. During an event, the people issues are often the most difficult to resolve. The scope of a business impact analysis (BIA) pertains to the number of business units, such as Finance, Administration and IT, which will be participating in the effort. Don’t let your BIA efforts fall to the wayside; make sure you have strong BIA approach and you’ll end up with a strong BCM / DR program. (C) StoneRoad (A.Alex Fullick) 2013Alex Fullick is the author of several books including the latest, "Business Impact Analysis: Building the Foundation for a Strong Business Continuity Program"  (Available at www.amazon.com or www.stone-road.com/shop.)
Oct 18
2013

A pair of debriefs

Posted by Andy Osborne in Exercising and testing , Business Continuity Management

Andy Osborne

By Andy Osborne, Consultancy Director at Acumen

It's fairly standard practice to hold some form of debrief at the end of an exercise or test, which is a very sensible thing to do. It helps to ensure that any issues and actions arising are captured and it's a good way to obtain feedback from the participants on how they thought things went. But some debriefs are a bit on the, well, brief side. Because it comes at the end of what can sometimes be a lengthy or challenging, sometimes stressful, session, it can be all too easy to make the debrief too brief. There can be a temptation to let people "get away" so that they can return to their day jobs. But the danger is that, once they do so, all the good stuff that the exercise teased out will be forgotten within a couple of weeks or, at best, vaguely remembered but not given the attention it deserves.

That's not to suggest that the debrief should be overly lengthy, just that sufficient time should be allowed  to ensure that everything that needs to be captured is, so that a follow-up action plan can be agreed.

And, whilst it may seem like a bit of a luxury, it can be very beneficial to hold two debriefs - a "hot" debrief immediately after the exercise or test and a second, "cold" debrief a couple of weeks later, after the proverbial dust has settled. Go on, be honest, how brief are your debriefs? And how many do you do? If you don't already do so, why not give the double-debrief a try after your next exercise or test and see what the results are like?




Oct 08
2013

8 TIPS for COMMUNICATING DURING A CRISIS

Posted by Alex Fullick in Tips , Responsibility , Leadership , Disaster Response , Crisis Management , Business Continuity Management

Alex Fullick

To most people a crisis is bad and for the most part, they’d probably be right. However, an organization can do good things when they are hit with a crisis; some may even say there is an opportunity. The situation itself might be bad enough but it it’s not being managed correctly or communications aren’t approached in a positive way, the crisis can be compounded because the media and the public will think there are more things being hidden by the organization.

If it seems that an organization isn’t prepared – through its communications and response actions – the media and public may start to go ‘hunting’ for more information and uncover other details of the organization that the organization may not want released. Not that they are bad examples on their own but compounded with the existing crisis they will seem larger and could create another crisis or even escalate the existing one. The organization will then be fighting more than one crisis on its hands.

Below are some tips for how to communicate during a crisis; some do’s and don’ts and tips for ensuring good communications when speaking to the media and the general public.

1. Lawyers Aren’t the Face of the Organization – This is one of the biggest mistakes organizations make when communicating with the media and public; they let their lawyers do the talking. Lawyers are good at what they do don’t get me wrong, they just aren’t the ‘face’ of the organization. Often they will speak in terms that the public either don’t understand or don’t want to hear. The public wants to hear what the situation is and what the organization is going to do about the crisis, not the legalities it’s taking to find blame (which is what the lawyers will be trying to do to wither minimize or remove the burden off the shoulders of the organization).