Spring World 2015

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

DRJ Blogs

DRJ Community Blogs
Category >> DRJ Blogs
Oct 29
2013

Hurricane Sandy One Year Later

Posted by Vicki Thomas in hurricane sandy

Vicki Thomas

Today, Oct. 29 marks the one year anniversary of Hurricane Sandy. This was the most devastating storm of 2012 and the second most expensive in the history of the United States. 

A quick online search reveals a range of opinions, facts and photography collections that tell the story of Hurricane Sandy. Lives were lost. Homes were destroyed. Livelihoods were crushed. People have started to recover - some areas of the Eastern Seaboard are in "better" condition than they were before the Superstorm Sandy hit. 

Oct 28
2013

A great honor

Posted by Annie Searle in Untagged 

Annie Searle

Events near the end of October have a way of forcing me to choose among equally enticing prospects.  Rather than attend this year's Executive Women's Forum in Scottsdale, I flew to Reno to help present the 2013 Hall of Fame Awards & Gala for the International Network of Women in Emergency Management and Homeland Security.  The event is only three years old.  I was honored and amazed to be inducted in 2011, along with Eleanor Roosevelt and Clara Barton.  Last year's inductees were splendid.  And this year, we kept the bar high.
Two distinguished Washingtonians were honored:  Mary Schoenfeld, a pioneer in the field of emergency management and school crisis management.  She's been in the field over 30 years and has written 5 books and countless articles. She is an inspiration to each of us.  Here, she is pictured in the president of inWEM, Dr. Jacqueline McBride, who also hosted the evening's festivities.
Also honored in memoriam was Ben Dew from FEMA Region Xand prior to that, Washington State emergency management.  He is the author of the strategy we now call "Neighbor Helping Neighbor."  More than one person remembered him and his "Never give up" mantra during the evening.
And there were others who received awards that evening as well, including four of the women pictured below.  Left to right:  Judge Renee Cardwell Hughes (Red Cross), Cheryl (on behalf of Delta Sigma Theta), Fire Chief Toni B. Washington, Dr. Meloyde Batten-Mikens (2012 awardee), and Fire Chief Debra Prior.
Here's Mary Anne McKown, author/synthesizer extraordinaire for some of our finest national documents, including the National Response Plan, the National Response Framework, and the National Emergency Communications Plan.  That's just a small taste of the work she began when she left Booz Allen become a government employee after 9/11.
Different stories for each of the awardees, but overall you could say that each of these women understands public service, the notion of giving back on behalf of something larger than yourself, and a keen desire to leave the world a better place.

Oct 25
2013

Government shutdown does not halt growth of data

Posted by Jarrett F Potts in Government as risk , DR , Data Backups , Data

Jarrett F Potts
During the shutdown, slowdown or whatever you call it, did you stop using your phone, sending emails or going to work? No. For the majority of us, the only thing that actually shut down was our goofy government and wonderful representatives (all of them). The fact is, the rest of the world just kept on working. We did not have a choice.

 Funny thing. This living being that is “big data” kept growing while we continued feeding it with our day-to-day use of electronics. You used Facebook and the bank and everything else. 

 Here’s the real question. Did the IT departments of the banks and Facebook shutdown too? Did all the data protection solutions in play stop working because the government decided not to do its job? Again, the answer is no.

Oct 23
2013

Disaster Recovery Compliance for Credit Unions– Impact, Testing and Analysis

Posted by Adnan Raja in Untagged 

Adnan Raja

 A disaster recovery plan protects a business's IT infrastructure and allows this infrastructure to recover quickly during a disaster. A recovery plan specifies the steps that a business needs to perform during a disaster and is typically kept in written form and in a secure environment. A DRP covers natural disasters such as hurricanes or earthquakes that physically damage the infrastructure or impair the ability of personnel to take appropriate action. It can also protect a business from man-made disasters such as acts of terrorism or equipment failures.

Oct 19
2013

Getting off the Roundabout

Posted by Ken Simpson in Thinking beyond ...

Ken Simpson

This is my first post on the DRJ blog, I appreciate the invitation to contribute and hope the readers derive some value from my contributions.

My primary aim will be to promote, or at times provoke, discussion. So I am going to link together an “opinion piece” on the blog with a discussion on the DRJ LinkedIn group. Sometimes it might even start the other way around!

Oct 18
2013

12 Tips, Trips & Traps: The Business Impact Analysis (BIA)

Posted by Alex Fullick in Business Impact Analysis , Business Continuity Management , BIA

Alex Fullick
Business Continuity Management (BCM), like most corporate programs, is often plagued by common mistakes; these common mistakes also apply to the Business Impact Analysis (BIA. The following are some common mistakes that need to be addressed to ensure that the BIA is effective: 1. Minimal Management Support – Senior management must buy in to the need for continued maintenance of the BCP program. The program requires on-going resources to ensure that the program is funded and there are dedicated resources assigned across the organization. The people who head up the BCP program must have the requisite training, as well as the skills to provide leadership, prioritize tasks, communicate with stakeholders, and manage the program. 2. No Timely Follow Up of Results – A BIA is conducted almost always in support of an enterprise-wide business continuity program. The real value of a BIA is the follow-up activities that lead to effective recovery strategies being implemented based on the BIA priorities of the business processes. Occasionally, so much effort and cost is put into the BIA that business continuity planners never get around to fully implementing the follow-up recovery strategies and plans. Without the implementation of these follow-ups, the value of the BIA becomes wasted. 3. No Agreement on Scope (Level of Detail) – This level of detail can span an entire spectrum. On one end, some BIAs will contain relatively little detail to provide a higher-level executive view of the analysis. On the other end, and far more prevalent, are BIAs that include for each business process its corresponding input dependencies, output dependencies, recovery point objectives, recovery time objectives, and financial impacts. The common mistake here does not involve selecting the right or wrong level of detail – what’s appropriate for one company may be totally inappropriate for another – but rather, failing to reach agreement among all relevant parties as to what level of detail best meets the requirements that are driving the BIA in the first place. 4. Minimal Executive Support – One of the factors that most influences the relative success of a BIA is the degree of executive support offered at the outset. The kickoff process usually consists of two parts: a widely distributed email and an initial presentation. The email should come from the highest level executive sponsoring the BIA and should be distributed to all parties who will be participating in the effort. The email should emphatically voice the executive’s support for the project and insist on the support of al participants, particularly during the interview process. 5. Poor Questionnaires – An important step of any BIA is the collection of data from business units. The manner in which this data is asked for often spells the difference between a full, timely and meaningful collection of data, and one that is delayed and incomplete. One of the best ways to avoid this situation is to develop survey forms that are thorough enough to capture all relevant information and simple enough for business users to complete quickly and easily. 6. Lack of Preparation for Interviews/Workshops – Interviews are the cornerstone of a successful BIA, yet few planners prepare adequately for them to ensure their effectiveness. Interviewers need to learn as much as they can about a given business unit prior to the meeting, including a thorough review of the respondent’s survey. 7. Lack of Critical Focus – Analysts frequently make the mistake of asking business users ‘what are the most important business processes within their department?’ The reason this is a mistake is because virtually all critical business processes have a large degree of importance and value – otherwise they would not be designated as critical – resulting in less likelihood of it being easy to prioritize processes according to value or importance. A much better question to ask is ‘how long can a business process be idle before major impact is felt? 8. Focusing on the Tools Instead of the Process – Some analysts who conduct BIAs become very focused on the tools they will be using in the collection, compiling and analyzing the data provided by the business users. The emphasis often shifts inappropriately from the process being used, to the automation that can be applied to the process. There is an inherent flaw in this approach. If a poorly designed manual process that is being used to collect and analyze the data suddenly becomes automated, what you typically end up with is a poorly designed automated process. 9. Ineffective Interviewing Technique – I have known more than a few BIA analysts who preferred to rely solely on surveys, questionnaires and emails to collect needed data. The example previously cited concerning the over-focus on tools shows how this can less than desirable results. Analysts often say that setting up interviews can be more hassle than it’s worth. They will mention how interviews often start late, or may be cut short, or have to be re-scheduled, or cancelled altogether. In my experience, the real reason some BIA analysts try to steer clear of face-to-face meetings is that they tend to use ineffective techniques when interviewing business process owners. 10. Insufficient Results Analysis – Analysts conducting a BIA collect a wealth of information during the course of their efforts. But the value of this information is sometimes diminished by poor or incomplete analysis of the data. Analysts need to look for trends, patterns, relationships and discrepancies among and within the data to ensure a thorough and meaningful analysis. 11. Unclear Presentations – Data that is thoroughly collected and well analyzed is sometimes de-valued by an unclear or confusing presentation of the information and results. Managers in general and sponsoring executives in particular, expect BIA analysts to summarize their results in high-level presentations that are succinct and effective. Unfortunately, this does not always happen. Analysts gather a huge amount of data in the process of conducting BIA. In compiling and analyzing this data, analyst sometime err on the side of presenting too much information rather than too little. 12. Undefined Scope – Often, the BCP focuses entirely on system restoration. Resumption of business needs to include the people and processes required to resume operations. Many BCP programs are headed up by IT departments. ‘Tunnel vision’ can often cause these departments to focus on system recovery and not take the people issues into account. During an event, the people issues are often the most difficult to resolve. The scope of a business impact analysis (BIA) pertains to the number of business units, such as Finance, Administration and IT, which will be participating in the effort. Don’t let your BIA efforts fall to the wayside; make sure you have strong BIA approach and you’ll end up with a strong BCM / DR program. (C) StoneRoad (A.Alex Fullick) 2013Alex Fullick is the author of several books including the latest, "Business Impact Analysis: Building the Foundation for a Strong Business Continuity Program"  (Available at www.amazon.com or www.stone-road.com/shop.)
Oct 18
2013

A pair of debriefs

Posted by Andy Osborne in Exercising and testing , Business Continuity Management

Andy Osborne

By Andy Osborne, Consultancy Director at Acumen

It's fairly standard practice to hold some form of debrief at the end of an exercise or test, which is a very sensible thing to do. It helps to ensure that any issues and actions arising are captured and it's a good way to obtain feedback from the participants on how they thought things went. But some debriefs are a bit on the, well, brief side. Because it comes at the end of what can sometimes be a lengthy or challenging, sometimes stressful, session, it can be all too easy to make the debrief too brief. There can be a temptation to let people "get away" so that they can return to their day jobs. But the danger is that, once they do so, all the good stuff that the exercise teased out will be forgotten within a couple of weeks or, at best, vaguely remembered but not given the attention it deserves.

That's not to suggest that the debrief should be overly lengthy, just that sufficient time should be allowed  to ensure that everything that needs to be captured is, so that a follow-up action plan can be agreed.

And, whilst it may seem like a bit of a luxury, it can be very beneficial to hold two debriefs - a "hot" debrief immediately after the exercise or test and a second, "cold" debrief a couple of weeks later, after the proverbial dust has settled. Go on, be honest, how brief are your debriefs? And how many do you do? If you don't already do so, why not give the double-debrief a try after your next exercise or test and see what the results are like?




Oct 15
2013

Welcome to the revolution: Data protection the easy way!

Posted by Jarrett F Potts in data protection disaster recovery , Data Protection

Jarrett F Potts

When did data protection get to be such a pain? We all know that data is growing quickly and that the types of data are constantly changing, but that doesn’t change the basics of storage management. The old rules still apply, leaving some IT professionals wondering what really has changed and how those changes affect their shop.

Oct 14
2013

Planning for Every Scenario is “for the Birds”

Posted by Courtney Bowers in Business Continuity , Avalution Blogs

Courtney Bowers

By Stacy Gardner, Avalution Consulting
Originally posted on Avalution Consulting’s Blog

Why “Chicken Little” and “Black Swan” Planning is NOT the Way to Respond to Recent Catastrophic Events

Oct 11
2013

Earthquake planning

Posted by Annie Searle in Advice From A Risk Detective

Annie Searle

In yesterday's operational risk seminar that I teach at the University of Washington, our guest speaker was UW seismologist and information scientist Bill Steele.  In the first hour of class, he used a presentation he had recently made to state government on the development of an alert system that could mitigate certain types of public safety issues during an earthquake.  I've seen parts of the presentation before, and was struck again by the message that is driven home: disaster preparedness reduces costs over the long run.  And it may also reduce business interruption costs by as much as 20%.  Despite these facts, we are a long way from having an effective earthquake alert system in this state that could provide up to 3 minutes of warning before we felt the shock; and that could also be used to stop trains and elevators, and alert schools so that children could drop, cover and hold.

In our seminar the previous week,  I had talked about neuroscientist Tali Sharot's book, The Optimism Bias: A Tour of the Irrationally Positive Brain.  For those of you who might be curious, I've included a link to her TED talk.