Printed In Winter 1996
The K.I.S.S. Method to BRPWritten by Richard Piellucci November 30, -0001
The first thing you need prior to development of a detailed Business Resumption plan is to obtain senior management commitment in verbal and financial forms. Without management sign-off, you will be wasting a lot of time documenting a plan that most probably will only be a dust collector (or a paper tiger).
Now that you have senior management convinced that a disaster plan is necessary, how about line managers. Many line and/or function managers are so busy with day-to-day operational activities that Business Resumption Planning is low on their priority list. You must obtain senior management’s support during meetings with line managers to convince them of the importance of Business Resumption planning.
The second item of business would be to select a contingency planning officer with significant company stature. This move would send the proper communication to the remaining line managers that senior management has placed a high level of importance on disaster planning.
Be sure to involve all critical business units in the disaster planning process for your company. Provide the forum for the various business representatives to discuss and document their plans and share them with all the other units. This methodology should produce a better coordinated disaster plan.
All business units should be operating from the same corporate wide Basic Assumptions to ensure continuity is Business Resumption planning. Plan for the major/worst case disaster.
If planning for the worst case scenario, anything of a lessor degree should be covered by your DR Plan.
- The Computer Center has been completely destroyed along with all equipment and documentation.-Backup tapes and documentation are stored off-site.
Many employees are injured or deceased.
All data processing support areas have been destroyed.
- Trained employees familiar with the critical business functions will survive the disaster to implement the Business Resumption plan.
- Telecommunications network control has been completely destroyed.
Each business function should develop their own assumptions/constraints to outline the environment that you may be operating under (more details than the Corporate assumptions/ constraints). You should key off on the Corporate assumptions/constraints.
Development of a comprehensive outline of assumptions/constraints will not happen overnight. This process evolved during time and should not be cast in concrete. When systems and procedures change, you should review the impact on your Business Resumption plan. The Basic assumptions/constraints of establishing your primary/critical functions/operations in the correct priority order is extremely important. If you don’t have your critical operations in the right sequence, you could jeopardize the business recovery efforts.
What are the basic objectives of sound Business Resumption planning?
Reduce to a minimum the probability of critical/essential services to the customer and ensure financial stability during the recovery phase of the disaster
- Provide a real sense of security.
- Reduce risk of delay or inability to operate.
- Ensure the reliability of backup systems.
- Provide a standard for plan testing.
- Minimize decision making time frames during the disaster.
You should identify the major costs associated with the positioning of your company to survive a major disaster and obtain senior management approval for the expenditures. Without the expense commitment up front, your Business Resumption plan may not be worth the paper it’s written on.
Ensure that your critical equipment vendors know what would be expected of them in a major disaster (get it in writing).
Review your critical operations and determine what equipment is essential to performing them in a disaster situation. Will you need more or less equipment or maybe different types of equipment under the disaster scenario. Meet with the equipment vendors and discuss your expectations and what they can accomplish in a disaster mode. Have vendors document their deliverables to the organization.
What helps get management’s attention is a real disaster (Hugo, earthquake, etc.) with real consequences and outcomes. Build on these situations.
Don’t just write a Business Resumption plan to satisfy regulatory agencies; do it to improve your company’s chances of survival.
Lessons learned from actual disasters (major or minor) prove invaluable for future development of workable disaster plans. We are becoming more and more aware that disasters can and do occur and we must provide for contingency plans to survive as an entity.
It’s not well enough alone for your Data Center to have a disaster plan if it does not interface with the individual business units of your company. It’s like building the Data Center plan in a vacuum. It may look good, but it won’t work. The most critical phase of disaster survival is the management commitment of human and financial resources to preposition your company to survive.
- INTRODUCTION - What is it you are attempting to accomplish and what are the basic parameters?
- What will be your initial response to the disaster?
- Your Contingency Operations will inform you on how the critical operations of the business group will process during a disaster. It won’t be business as usual.
- The Restoration Operations directs the recovery efforts from disaster assessment through the restoration of your original site.
Note: The team approach will work to your company’s advantage. (Review attached disaster organization chart.) Name your team leaders and individual team members prior to the disaster.
-The Management Support phase provides for the necessary administrative support during a disaster.
-The Maintenance and Testing portions of your plan speak for themselves. If you don’t do maintenance and testing, your plan will most probably not work.
For example, something as simple as an employee emergency contact list that is outdated will cause serious problems during initial phase of a disaster.
-The Training of Employees phase may be one of the most important steps you take to survive a disaster. Do it on a corporate level.
- Greater Disaster Prevention efforts will provide some reduction in potential disaster risks.
- How are you going to do your business when your place of business is gone/destroyed?
- Where are you going to relocate your critical business functions?
- How are you going to replace your destroyed records?
- How are you going to replace your destroyed equipment?
- How long will it take for you to relocate your new business?
- Where are you going to obtain employee replacements in a hurry?
- What would be the most devastating time frame for your disaster to occur? Plan on it!!
If you can’t answer most of these questions, you may not survive a major disaster.
Let’s spend more time preventing or reducing the potential of a disaster. "An ounce of prevention is worth a pound of cure."
- Does the building that you occupy have sound and well documented fire/emergency/safety procedures? Are fire drills conducted on a regular basis?
- Does the building have a sprinkler system?
- Are employees familiar with proper procedures to follow in an emergency?
- Do some employees have training in first aid emergency assistance?
- Do your telephones have emergency numbers recorded and readily available in all areas? (Building Security, 911 if applicable)
- Do you have bomb threat procedures?
Procedures will improve the chances of survival.
- Take ownership of development of Business Resumption Planning or it may not work when you need it most.
- Test, test, and retest your Business Resumption Plan until it becomes second nature to your BUSINESS RESUMPTION Team.
- There is not a company in the country whose plan for a major computer and business disaster will provide the same customer service levels that exist under normal conditions. (Data Center/Service Center and major business units)
- How long do you have to start processing your operations? That depends on the type of business you operate. (Banks two days maximum)
Communications can be your number one friend or number one enemy depending on how you use it during a disaster.
What if your telephone system was inoperative or inefficient during the disaster. How would you communication with the outside world?
Would cellular telephones work? Should they be assigned prior to disaster or after the disaster?
What about radio systems (with your own channels) as an effective method of communications?
How about beepers on key personnel?
Communications, internal and external, are critical to the very survival of your organization.
Produce your internal and external communication contact lists based on the most critical first. External contacts include vendors, customers, regulatory, suppliers and others.
With sound disaster pre-planning your communications will be more timely, effective, and efficient during the actual disaster. Be sure that critical fax numbers are known and documented by team members and other key personnel (internal and external).
Test your internal and external contact list on a surprise basis and document the results.
Crisis Management Team
To provide general leadership and direction during all phases of Disaster Recovery.
To evaluate disaster data received from the restoration Team Leader (Disaster Assessment Team) and decide if a disaster exists within the company. If the Crisis Management Team declares a disaster, the notification process and the Business Resumption plan (portions needed to survive) would be activated.
Disaster Assessment Team
To collect all pertinent information about the disaster and report findings in a timely manner to the Crisis Management Team.
Contingency Operation Team
Various business functions. Also, manage all of the critical operations during a declared disaster.
Management Support Team
To establish the Business Resumption command post and provide administrative support to the Crisis Management Team. Personnel issues (coordinated with Human Resources) are handled by the Management Support Team.
Restoration Operation Team
To identify the general activities required to restore the original business function. It directs the restoration efforts from disaster assessment through the restoration of the original business site.
Alternative Site Team
Responsible for the preparation of the temporary site to continue Operations (facility/ equipment/ furniture telephones). Coordinates with real estate, General Services, equipment vendors, and Telecommunications personnel.
Responsible for the transition to and from the alternative site.
Disaster Site Team
To monitor the restoration of the disaster site. Activities dealing with facilities and equipment will be handled with applicable vendors.
- Contacting personnel at the onset of a disaster (on the direction of the Management Support Team Leader).
- Maintaining an ongoing status of personnel (dead/injured team member or reserve).
- Maintaining a resource pool of all personnel (i.e., inactive in the recovery, but on call for participation.
- Coordinate all travel/lodging arrangements.
- Provide clerical staff to assist Crisis Management Team.
- Coordinate petty cash issues.
- Mealtime arrangements, if necessary.
- Coordinate payroll issues.
Some Key Points Regarding Business Resumption Organization and Teams
- Assign team leaders and members prior to any actual disaster.
- When possible assign team members by functional position instead of individual names.
- Ensure that all team personnel are familiar with their Business Resumption responsibilities.
- Conduct periodic reviews with team members to update BUSINESS RESUMPTION plans and perform walk throughs.
- Your Disaster organization should closely resemble the business organization that gets the job done on a daily basis.
Business Resumption Team Structure
Close coordination between all teams is absolutely necessary for a successful disaster recovery.
Other special type teams may be necessary depending on the type of business that you are developing the disaster plan for. All business units and the Data Center should coordinate their BUSINESS RESUMPTION planning activities to ensure that critical operations are fully covered.
It’s not how much money you spend in development of your Business Resumption plan that counts, it’s the main question of "will it work?". Build a workable plan that can be readily used in a real disaster, If the Data Center Computer Operations does not position itself to survive, the business units will most probably not survive.
Why Have a Business Resumption Plan in Your Organization
- Survive as a business entity.
- Maintain financial stability.
- Survival of various business functions.
- Continuation of critical business operations.
- Minimize the potential for loss given a business interruption of significant magnitude.
- Loss of customer base due to deterioration of service levels.
Did you notice that regulatory compliance was not included in the list of reasons for having a Business Resumption plan? Why? Because all the other reasons are much more important reasons for having a disaster plan that will work!
When all else fails the Business Resumption coordinator mails out his resume and moves on to greener pastures.
A Business Resumption coordinator that has done his job successfully will have little to do during the actual disaster. Review your insurance coverage and determine if you can recover with your current coverage.
Where you used to think of your business resumption plan as a type of insurance coverage, now think of it as a competitive business advantage.
Richard Piellucci is the Service Center Business Resumption Planning Coordinator for First Union National Bank.