The need for training business continuity teams is well recognized by the business continuity industry. Certification courses, seminars, professional practice standards, and other authoritative bodies explicitly state requirements for training business continuity teams. However, these prescriptions call for training those individuals who have been charged with the development of the plan. Furthermore, the recommended training appears to be restricted to the plan development phase.
The fact of the matter is that business continuity teams need training at four distinct phases of business continuity plan development process, namely pre-planning, planning, post-plan development, and pre-exercise phases. On-going training and education is imperative for those individuals in an organization, who will be involved not only in the development and implementation of the business continuity plan, but also in exercising, evaluating, maintaining, and executing the plan.
In this paper, we present approaches to provide training for business continuity teams during all of the above four phases of business continuity planning. We provide the desired elements of training as well as the target audience groups for each of these four phases. We also emphasize that many of these training requirements may need to be met on an on-going basis, rather than a one-time effort.
A Framework for Training Business Continuity Teams
As argued earlier, our framework for training business continuity teams is premised on the need for on-going training during all relevant phases of business continuity planning. In developing our framework, we clarify the concept of business continuity teams as follows:
1. The business continuity teams are developed based on the critical business functions identified during the business impact analysis. These teams include those which are held responsible for the continuity of critical business functions as well as recovery and resumption of critical support functions and vital records.
2. The second concept to be clarified relates to the team membership. The team members typically develop, implement, exercise, evaluate, and maintain the plan, and execute it if necessary. However, it also may be deemed necessary to include other employees of an organization as either additional team personnel based on plans and procedures, or as alternates in case primary team members are unavailable for business continuity plan execution.
Given these clarifications of team membership, our framework, presented in Table 1, identifies the elements of training and the target audiences for the various elements during the respective business continuity planning (BCP) phases.
Pre-Planning Training and Awareness
Training for selected and potential BCP team members should begin from the very beginning. At this stage, it is likely that the BCP planner/coordinator has undergone formal, professional, and/or certification training. The knowledge that the planner has gained from this training must be transferred to BCP team members in a manner that is relevant to the business unit's core processes. Furthermore, the training should emphasize elements listed in Table 1. These elements include general overview of BCP and how it relates and augments corporate policies and procedures, objectives and assumptions in BCP, an overview of liabilities and regulations pertinent to the organization, business guidelines and an understanding of the core business processes. and a conceptual understanding of critical business functions, support technologies, and vital record requirements. These elements are essential foundations upon which all BCP teams may begin to build business continuity plans.
Planning Methodology Training
Upon completion of the pre-planning awareness training and gaining commitment from the selected and potential BCP team members, the training may now focus on specific procedural aspects of developing and implementing the BCP. At this stage, the BCP team members should be trained, first and foremost, in the area of project management, which is essential for successful BCP development. This phase of training should then proceed to BCP development methodology selected for the organization, a review of documentation standards, and necessary training in software, if selected for developing the BCP.
The benefits from planning methodology training include:
- Adaptation of appropriate project management methodologies and tools, if any.
- Clear understanding of BCP terminology throughout the organization.
- Utilization of an accepted methodology throughout the organization.
- Enforcement of documentation standards throughout the organization, and
- Software training, if necessary.
Plan Role and Responsibility Training
At this phase of training, the premise is that the BCP has been developed and implemented. This means that the necessary teams have been established and team members have been identified, with approvals from senior and functional area management. The teams typically include the emergency management team, BCP teams for business functions, and BCP teams for support functions (such as facility team, data center team, telecommunications team, etc.). Alternate BCP team members and support personnel are also identified at this stage. All of these individuals need training with regard to the provisions in the BCP. Although we recognize that these team members have developed and implemented the plan, training is essential in order to gain an understanding of the plan from several perspectives. These include:
- The team members specific role and responsibilities in the execution of the plan;
- Interdependencies of individual units' plans;
- On-going evaluation and maintenance of units' BCP; and
- A thorough understanding of the team checklists of procedures, including notification procedures.
As shown in Table 1, the elements of this phase of training for the various BCP teams include: role of team leaders and team members, including alternates, business continuity plan provisions (who, what, when, where, and how), notification procedures, BCP event logging procedures, on-going BCP evaluation and maintenance procedures, and post-execution review procedures.
At this stage of training, all phases of BCP have been completed and BCP team members are well trained in their roles and responsibilities in the plan. The organization must recognize, however, that exercising the plan is essential for verification and validation of the strategies and procedures in the BCP; after all, an untested plan is worth only the paper it is printed on! While exercising the plan, in its own merit, provides unique and valuable training for the BCP team members, training must be provided with regard to the 'why' and 'how' of exercising the plan. After all, most BCP team members may never have gone through an exercise of this type. Furthermore, the value of such exercises, with little or no direct productivity gains, must be demonstrated through formal and relevant education, in order to gain support from team members as well as management.
Table 1 presents elements of pre-exercise training, which include: testing methodology and scheduling, developing objectives of exercises and scenarios, plan modification and update procedures subsequent to and based on the results of the exercises, and auditing and evaluating the business continuity plan.
This paper has presented a formal framework for a four-phase training program in conjunction with generally accepted phases of business continuity plan development. The conformance between BCP phases, as prescribed in DRI Intemational's certification courses and the four phased BCP team training program is shown in Figure 1.
Four-phased BCP Team Training Program
The framework identified the four phases to be pre-planning awareness training, planning methodology training, BCP role and responsibility training, and pre-exercise training. We have also identified the elements and target audiences which should be the focus of each of the four phases of a formal training program for BCP teams.
Dr. Raja K. lyer, Ph.D., CBCP is an Associate Professor of Information Systems and Management Sciences at the University of Texas at Arlington. He has over 23 years of business and academic experience, and has served as an instructor for the Disaster Recovery Institute International, where he also serves as a member of the Certification Board. Dr. lyer has lectured extensively on crisis management, disaster recovery, and business continuity planning and has provided consulting and on-site training services to several companies.
Mr. Rodolfo Garcia Diez, CBCP is a Vice President - Strategic Planning and Manager with a leading brokerage firm for the past 17 years. For the past three years, he has been responsible for developing and implementing the business continuity plans and strategies for one of the firm's major product areas.Printed In summer 1997