|
By Monica Zein, Sally Cohn, and Tracy Broadway
It is often thought that Business Continuity Planning is a project
with a finite ending. Not so! Creating the Business Continuity Plan
is just a part of developing a business recovery program. The process
also includes evaluating costs, selecting an alternate site(s),
making employees aware of the Plan, updating the Plan and testing
the Plan on a regular basis.
Once the support of management is obtained, a company can assign
this process to an employee or hire a consulting firm. A mistake
often made is assigning disaster recovery to a person with an existing
full workload or a person who is not in the position to confront
managers on corporate political issues, such as defining a department's
criticality during a disaster. Many managers do not want to admit
they could get by with fewer people, even for a short period of
time. Traditionally, disaster recovery was often assigned to IT
personnel; however, since disaster recovery focuses on business
unit recovery as well as the recovery of systems, companies are
often assigning these duties to employees from operations.
There are many types of plans, but the most comprehensive for the
continuation of business is the Business Continuity Plan. The BCP
addresses the requirements and actions needed during a disaster
to continue business by combining an information technology disaster
recovery plan and a business function recovery plan. An IT disaster
recovery plan addresses the firm's systems recovery, such as computer
back-up, communications (telecomm and data) and other IT systems
at the facility. A business function recovery plan details how the
company's employees will continue its operations in the event of
a disaster.
Before you start a plan, a Business Impact Analysis (BIA) should
be conducted. A BIA establishes the scope of the Plan and determines
how the company's employees will continue its business by defining
critical resources and recovery timeframes acceptable by management.
Each company must select its criteria for business recovery timeframes
based on its own perspective of "how long is acceptable for the
company's business operations to be down." Since the events of 9/11,
corporations are no longer limiting the scope of the Plan to a disruption
at their physical location, but are beginning to consider the possibility
of regional outages and appropriate recovery strategies.
Once the acceptable downtime is determined, the Plan can be developed.
The goal is to compose a document that details the procedures and
resources necessary to restore critical business functions within
the recovery timeframes. This includes, but is not limited to, relocating
the necessary employees, restoring the critical applications required
to conduct business functions, transferring the company's critical
phone numbers to an alternate site location and ensuring that the
necessary equipment and supplies are available at the alternate
site. Supporting documentation, such as important third party and
vendor contact information, is also included in the Plan.
Once the Business Recovery Plan is developed, it is important to
remember that it is a "living document" and will need to be reviewed
and updated on an ongoing basis as the size and requirements of
the company change. Maintaining the Plan and making your employees
aware of the Business Recovery program for your company are important
to ensuring that the Plan remains viable to your recovery needs.
About the Author
Monica Zein, Sally Cohn, and Tracy Broadway
are with CAPS Business Recovery Services, a total business recovery
solution company located in Shelton, CT. CAPS offers consulting
services in all phases of Business Continuity Planning, RecoveryPlanner,
an Internet based software planning tool and Hot Site Facilities
in the Northeast. For more information on this subject, call (203)
925-3900 or visit www.capsbrs.com
|
