Business Continuity Planning 101
Sep 05, 2018 12:52PM ● By Emily Stevenson
By Emily Bentley, J.D.
Program director and Senior Lecturer, Online Disaster and Emergency Management (DEM) Bachelor of Arts program at Columbia College
A fire occurs in the building that houses your company. The fire is on another floor, and the activation of sprinklers throughout the building and firefighters’ efforts mean your office space, equipment, files, marketing materials, and inventory are not only smoky but also soaked.
Clean up and restoration of IT infrastructure takes a couple of weeks, and staff won’t be able to work there until the mess is cleaned up. Each day the business is not operating, it is losing money, productivity, and possibly customers and reputation. How does the company keep functioning during this time?
Business continuity planning is planning ahead of time for how a company or organization will continue to provide its key services or functions when normal operations are disrupted for an extended period. Many types of hazards or situations can result in disruption of business functions, such as severe weather (e.g. floods or tropical storm systems), fire, or cyber intrusion. It makes sense for an organization to plan ahead for these types of disruptions so it can continue or quickly resume its work and maintain its position in the marketplace.
Because we cannot predict when a disruption will occur, continuity planning should be addressed now, on a “blue sky day,” when the company can calmly consider possible risks and the consequences they might cause. A hazard can happen at any time and without notice or can be slow-developing with time to monitor and prepare. The business continuity planning process is not difficult. However, it requires a contribution of time and focus from executives and team or unit leaders who are knowledgeable about the business’ operations and who can work together as a continuity planning and implementation team.
A key first step in continuity planning is identifying the organization’s essential functions. What are the key services or functions the company provides or performs that it needs to keep performing to maintain the success of the business? It may help to consider how long the company can go without performing a function before significant adverse consequences (such as health and safety risks, lost revenue, or damage to reputation) result. For example, how long can your company go without communicating with clients or suppliers? If the company provides goods or services, how long can it go without making or providing those before there are negative consequences for revenue or the company’s relationship with customers? These types of questions can help identify and prioritize essential functions.
Once essential functions are identified, the organization’s continuity team will want to identify the components and resources needed to keep those essential functions up and running or to resume them quickly if they are disrupted. Elements to consider include:
order of succession and delegation of authority (for decision making and leadership if day-to-day leaders are not available);
communications capabilities and backup/alternate modes of communicating (internally and externally);
human capital: personnel (including cross-training as needed);
vital records and data (including contact information for personnel and key suppliers);
equipment and supplies;
alternate operating facilities or locations;
whether any functions can be outsourced or provided by sister or parent organizations in a long-term disruption; and
reconstitution (transitioning back to normal operations).
As with any plan, it is vital that personnel regularly review and train on continuity provisions. Humans perform much better under stress if they have thought ahead of time about actions they may need to take and decisions they may need to make.
Details on the elements of continuity planning can be found online (such as at https://www.ready.gov/business/implementation/continuity), in books on the subject, and in federal guidance like the Continuity Guidance Circular (2018). Business continuity plan (BCP) templates also are available online and through business publishers.
It is important to find a format that is relevant and that fits the size and complexity of the company as well as the capabilities of the team who will develop and implement the plan. The most effective approach is to make use of the template as a tool or guide to build a plan that reflects and serves the specifics of the company. In other words, even using a template, a company and its continuity team need to think critically about critical business functions and the operations and capabilities that support those functions.
Medium-size and some large companies sometimes contract with a consultant to assist with development of the organization’s BCP. BCP certifications, such as those offered by Disaster Recovery Institute International (DRI) and Business Continuity Institute (BCI), can be helpful indicators of a consultant’s qualifications. Some certifications focus on information security and data recovery; it is helpful to note that the term “business continuity” refers to operational continuity broadly rather than only information technology or data recovery.
For an individual business, continuity planning helps protect revenue streams, reputation, and workforce stability. In a broader sense, continuity planning also affects the resilience of the community as a whole by improving the continuity of employment, economic drivers, critical infrastructure facilities, key resources like energy, fuel, water, and food supplies, and emergency and medical services. Bottom line: it’s good business.
Emily Bentley, J.D., is program director and senior lecturer of the online Disaster and Emergency Management (DEM) Bachelor of Arts program at Columbia College. She also provides emergency management and preparedness consulting services. [email protected]
Program director and Senior Lecturer, Online Disaster and Emergency Management (DEM) Bachelor of Arts program at Columbia College
A fire occurs in the building that houses your company. The fire is on another floor, and the activation of sprinklers throughout the building and firefighters’ efforts mean your office space, equipment, files, marketing materials, and inventory are not only smoky but also soaked.
Clean up and restoration of IT infrastructure takes a couple of weeks, and staff won’t be able to work there until the mess is cleaned up. Each day the business is not operating, it is losing money, productivity, and possibly customers and reputation. How does the company keep functioning during this time?
Business continuity planning is planning ahead of time for how a company or organization will continue to provide its key services or functions when normal operations are disrupted for an extended period. Many types of hazards or situations can result in disruption of business functions, such as severe weather (e.g. floods or tropical storm systems), fire, or cyber intrusion. It makes sense for an organization to plan ahead for these types of disruptions so it can continue or quickly resume its work and maintain its position in the marketplace.
Because we cannot predict when a disruption will occur, continuity planning should be addressed now, on a “blue sky day,” when the company can calmly consider possible risks and the consequences they might cause. A hazard can happen at any time and without notice or can be slow-developing with time to monitor and prepare. The business continuity planning process is not difficult. However, it requires a contribution of time and focus from executives and team or unit leaders who are knowledgeable about the business’ operations and who can work together as a continuity planning and implementation team.
A key first step in continuity planning is identifying the organization’s essential functions. What are the key services or functions the company provides or performs that it needs to keep performing to maintain the success of the business? It may help to consider how long the company can go without performing a function before significant adverse consequences (such as health and safety risks, lost revenue, or damage to reputation) result. For example, how long can your company go without communicating with clients or suppliers? If the company provides goods or services, how long can it go without making or providing those before there are negative consequences for revenue or the company’s relationship with customers? These types of questions can help identify and prioritize essential functions.
Once essential functions are identified, the organization’s continuity team will want to identify the components and resources needed to keep those essential functions up and running or to resume them quickly if they are disrupted. Elements to consider include:
order of succession and delegation of authority (for decision making and leadership if day-to-day leaders are not available);
communications capabilities and backup/alternate modes of communicating (internally and externally);
human capital: personnel (including cross-training as needed);
vital records and data (including contact information for personnel and key suppliers);
equipment and supplies;
alternate operating facilities or locations;
whether any functions can be outsourced or provided by sister or parent organizations in a long-term disruption; and
reconstitution (transitioning back to normal operations).
As with any plan, it is vital that personnel regularly review and train on continuity provisions. Humans perform much better under stress if they have thought ahead of time about actions they may need to take and decisions they may need to make.
Details on the elements of continuity planning can be found online (such as at https://www.ready.gov/business/implementation/continuity), in books on the subject, and in federal guidance like the Continuity Guidance Circular (2018). Business continuity plan (BCP) templates also are available online and through business publishers.
It is important to find a format that is relevant and that fits the size and complexity of the company as well as the capabilities of the team who will develop and implement the plan. The most effective approach is to make use of the template as a tool or guide to build a plan that reflects and serves the specifics of the company. In other words, even using a template, a company and its continuity team need to think critically about critical business functions and the operations and capabilities that support those functions.
Medium-size and some large companies sometimes contract with a consultant to assist with development of the organization’s BCP. BCP certifications, such as those offered by Disaster Recovery Institute International (DRI) and Business Continuity Institute (BCI), can be helpful indicators of a consultant’s qualifications. Some certifications focus on information security and data recovery; it is helpful to note that the term “business continuity” refers to operational continuity broadly rather than only information technology or data recovery.
For an individual business, continuity planning helps protect revenue streams, reputation, and workforce stability. In a broader sense, continuity planning also affects the resilience of the community as a whole by improving the continuity of employment, economic drivers, critical infrastructure facilities, key resources like energy, fuel, water, and food supplies, and emergency and medical services. Bottom line: it’s good business.
Emily Bentley, J.D., is program director and senior lecturer of the online Disaster and Emergency Management (DEM) Bachelor of Arts program at Columbia College. She also provides emergency management and preparedness consulting services. [email protected]