Business continuity is much more than just a fancy word for "backup"--although some organizations treat it that way.
A comprehensive business continuity plan (BCP) provides a roadmap for continuance and/or restoration of mission-critical functions during and after a disaster, such as a fire, flood, storm or even a disease epidemic.
Your BCP must be thought-out, written down, and distributed to key personnel well ahead of any incident that could cause a disruption to your operations. Copies should be stored off-site--an obvious but often overlooked requirement. Here are 10 things a good BCP includes.
1. Analysis of potential threats
Your company's response to a disaster will depend on both the nature and the extent of the disaster. Some threats, such as a tornado or flood, may physically destroy your IT infrastructure.
Others, such as pandemic disease, affect human resources while leaving buildings and machinery intact. A cyberterrorism attack might bring down your network but not affect the functionality of the hardware or your personnel.
A bombing may destroy both human life and network components. A power outage could render your equipment unusable, but do no lasting damage. Thus your plan should cover contingencies for as many threat types as possible.
2. Areas of responsibility
A key component in any crisis management situation--which is what you have during and perhaps immediately after the disaster--is assignment of areas of responsibility and establishment of a chain of command.
This is no time to have department heads squabbling about who has decision-making authority. And remember that some types of disasters may result in loss of personnel (or some of your staff may be on vacation or out sick when the event occurs), so be sure to assign alternates in case some of the important players are not available.
Training of key personnel in disaster preparedness, incident management, and recovery should also be addressed.
3. Emergency contact information
Your plan should include up-to-date contact information on people and entities that may need to be contacted when a disaster occurs. This is no time to be scrambling for phone numbers.
Information should be included for both internal personnel (CEO, CIO, legal advisor, etc.) and external personnel and services (police, fire, ambulance, security services, utility companies, building maintenance, etc.).
4. Recovery teams
It will take teamwork to manage the crisis itself and to put things back together once the immediate crisis is over. The BCP should appoint members of a disaster recovery team (DRT) made up of specialists with training and knowledge to handle various aspects of common disasters (safety specialist, IT specialist, communications specialist, security specialist, personnel specialist, etc.).
The DRT members will work with emergency services during the disaster and should have access to equipment they'll need during an emergency (mobile phones, flash lights, hard hats, protective clothing, etc.).
A business recovery team is responsible for re-establishment of normal operations after the crisis is over.
5. Off-site backup of important data
Any good business continuity plan will address restoration of your company's important digital data if it is destroyed.
Too many organisations meticulously make backups of everything and then store those backups in the server room. If a fire, flood, or bomb destroys the building, that (often irreplaceable) data is gone, too.
You should store copies of important data on removable media that's kept at a different physical location or back it up over the Internet to a remote server, or both.
Just as important, key personnel should know where it's stored and have the keys, passwords, etc., to be able to restore it to get users back to a productive state as soon as possible.
Play video
There are currently no comments for this post.