|
By Scott Ream
When requesting budget to improve your business continuity
plan, when a client seeks reassurance that your company will be
able to continue to meet it's needs, when a financial partner needs
to know that your company is prepared for possible business disruptions,
a "yardstick" by which to measure your level of preparedness could
prove invaluable.
Business continuity has evolved over the last 40+
years. The Business Continuity Institute and Disaster Recovery Institute
have published Professional Practice Standards to define and certify
Business Continuity Professionals. What the industry lacks is a
method by which an organization's Business Continuity Program can
be measured.
In January of 2002, the concept of a Business Continuity
Management Maturity Model was advanced in the CPM article, "How
Mature is your Business Continuity Program?". In this article a
6-level model, summarized below, was defined to describe how organizations
evolve in their implementation of business continuity competency
and capability.
Level 1 - Self-Governed - Business continuity
management has not yet been recognized as strategically important
by senior management.
Level 2 - Supported Self-Governed - At least
one business unit or corporate function has recognized the strategic
importance of business continuity and has begun efforts to increase
executive and enterprise-wide awareness.
Level 3 - Centrally-Governed - Participating
business units and departments have instituted a rudimentary governance
program, mandating at least limited compliance to standardized BCM
policy, practices and processes to which they have commonly agreed.
Level 4 - Enterprise Awakening - All critical
business functions have been identified and continuity plans for
their protection have been developed across the enterprise.
Level 5 - Planned Growth - Business continuity
plans and tests incorporate multi-departmental considerations of
critical enterprise business processes.
Level 6 - Synergistic - All business units
have a measurably high degree of business continuity planning competency.
Complex business protection strategies are formulated and tested
successfully.
Note: As with
any business process, if the supporting infrastructure is removed
or significantly diminished, the effectiveness of the BCM Program
will deteriorate and with it the company's state-of-preparedness.
Therefore a company can move up or down as changes dictate.
Also in the January, 2002 CPM article a project was
proposed to map the BCM Maturity Model Levels to the 10 Subject
Areas of the combined DRI / BCI Professional Practices standard.
A Working Team was formed as the instrument through which cross-industry
experience, consultation and advice could be harvested. In April,
2002 the Working Team, with volunteers and recruits, had its first
meeting.
Early in the mapping exercise the Working Team recognized
that the BCM Maturity Model needed a rigorous method for measuring
the performance Level achieved by an organization. The notion of
"Corporate Competencies" was considered. Each Corporate Competency
would categorize a critical attribute of an organization's ability
to create a sustainable business continuity program. In this manner,
we saw that we could create an "Organizational View" of the BCI
/ DRI Professional Practices standard. In essence, we saw the following:
Just as the BCI / DRI Professional Practices standard
defines a framework for measuring business continuity skill and
performance of an individual, the Corporate Competencies provide
a framework for measuring business continuity skill and performance
of an organization.
The following Corporate Competencies were defined:
Leadership - The commitment and understanding
demonstrated by executive management regarding the implementation
of a scaled, enterprise-wide business continuity program. As well,
the degree to which the "business case" for implementing sustainable
business continuity has been articulated to and understood by executive
management.
BC Awareness - The breadth and depth of business
continuity conceptual awareness throughout all staff levels of the
organization including consideration for the quality and sustainability
of the BC training and awareness program.
BC Program Structure - The scale and appropriateness
of the business continuity program implemented across the enterprise.
The degree to which the BCM Program matches the articulated "business
case".
Program Pervasiveness - The level of business
continuity coordination between departments, functions and business
units. The degree to which business continuity considerations have
been incorporated in other business initiatives/programs.
Metrics - The development and monitoring of
BCM Program performance. The establishment and tracking of a business
continuity competency baseline.
Resource Commitment - The application of sufficient,
properly trained and supported personnel, financial and other resources
to ensure the sustainability of the BCM Program.
External Coordination - Coordination of business
continuity issues and requirements with external community including
customers, vendors, government, unions, banks, etc. Insuring that
critical supply chain partners have adequate BCM Programs of their
own in place.
Having defined these competency categories, the Working
Team is now engaged in fleshing the detailed definitions for how
each of these Corporate Competencies is characterized at each Level
of the BCM Maturity Model. A first cut has been taken which summarizes
the "degree of engagement" of each Corporate Competency in terms
of a "High", "Medium" and "Low" degree at each Level.
In addition to the work just described, the Team is
developing organizational descriptors for each Level of the Model
within the context of each of the ten Professional Practices Subject
Areas. In this manner a matrix was born of the initial insights
of the Working Team members. The work on this matrix continues in
2003. For the moment, this matrix has been labeled "Program Execution"
and is being considered as the eighth Corporate Competency; however,
the entries in this subordinate matrix may be realigned to fit within
one or more of the other seven Corporate Competencies.
The work goes on …
Interested readers are invited to volunteer their time and expertise
to assist with this useful project. There are a number of goals
for this effort:
- Development of a "public domain" BCM Maturity Model framework
accessible to all BC practitioners and professionals. (To this
end, a representative of the BCI has joined the Board and is participating
in the Model's development).
- Development of an assessment "toolkit" which can be utilized
to objectively quantify where in the Model a particular organization
is today, what gaps exist and what next steps should be taken
to move the organization toward its next goal.
If you would like to assist with this on-going project,
consider joining the BCM Maturity Model Working Team. Contact Margaret
Langsett via email at Mlangsett@Virtual-Corp.net
or via phone at (973) 927-5454. Meetings are generally held via
conference call. The time commitment is minimal. Additional details
on the Model can be found at www.virtual-corp.net/html/bc_model.html
About the Author
Mr. Scott Ream is President and founder of
Virtual Corporation. He can be reached at (973) 927-5454 or via
email at SReam@Virtual-Corp.net.
The author wishes to thank the many members of the BCM Maturity
Model Working Team without whom this work would not be achievable.
BCM Maturity Model is a trademark of Virtual Corporation.
|
