This blog article talks about a step in the Business Continuity Planning (BCP) Methodology that I think is missing – and, I happen to think it is a pretty important step.
One of the greatest challenges in the BCP methodology is in establishing the program’s recovery objectives. Whether you label them as Maximum Acceptable Downtime (MAD); Recovery Time and Recovery Point Objectives (RTO & RPO); or some other creative anagram unique to your process, these program benchmarks are usually arrived at through a Business Impact Analysis (BIA) process or, at least, through some survey/interview with business managers and subject matter experts to establish what the critical business processes are; what timeframes they must be recovered; and what resources must be available in certain timeframes to enable our continuity or recovery of those processes. Does this sound familiar? I’m I right, so far?
But – you knew there was going to be a but – to achieve what end? I mean, we do a great job defining business continuity objectives, but do we do so against established business objectives?