Business Continuity Planning - Analyze

The purpose of Business Continuity Planning (BCP) is to ensure the uninterrupted delivery of product and services to your customers. In essence, its goal is to help you perform your daily operations in order to stay in business by preventing:

1. Loss of business to competitors
2. Supply chain interruptions
3. Injury to customers or employees
4. Loss of reputation

Another way to look at BCP is as a path to business continuity assurance, assurance that unplanned service interruptions caused by probable events are identified and planned for. A key phrase in this definition is "probable events." As we'll see as we move through the BCP steps, it isn't necessary to plan for every event your team can imagine. Probability of occurrence must be considered. For example, a business in Wisconsin would not plan for a hurricane while an organization in Florida might place hurricane planning near the top of its list.

Many people think of BCP as synonymous with Disaster Recovery Planning (DRP). Although DRP is important, it’s only one piece of effective BCP. The probability that your business will suffer a catastrophic event is much less than the probability of experiencing a failed server or router. BCP should be integrated into all business processes, a standard part of any technology project or implementation plan. So how does an organization achieve a reasonable and appropriate level of business continuity assurance? The rest of this series is focused on answering that question.

There are five steps to achieving business continuity assurance. They are shown in Figure 1.

The purpose of the first step is business analysis. This goes far beyond a simple analysis of your network infrastructure. It also includes the following:

1. An understanding of all processes that make your business function, including how those processes work together to produce business outcomes.
2. The identification of vendors and other business partners whose contributions to your operation are critical for product and service delivery. Include why and in it what manner you interact with each entity. It’s also important to record contact information as well as the existence of agreements that contain clauses dealing with interruption of deliveries, service, support, payments, etc.
3. A thorough understanding of your information processing infrastructure. It isn’t enough to understand your internal network. You must also understand how your network interfaces with those of your customers, banks, and suppliers. Your infrastructure assessment must include all required workstations, servers, storage devices, backup/restore systems, and communication services.
4. An understanding of which people are critical to your business. These individuals are often not on your management team. Rather, they are the people who work in the trenches every day. Their understanding of how to get work done is a key element in maintaining business continuity. Additional information about them, and the tasks they perform, includes:
   1. The existence of cross-training to ensure more than one person can adequately perform business critical tasks.
   2. An assessment of how to maintain business continuity if key people are unable or unwilling to participate in recovery operations.
5. The identification of vendors who will assist with your recovery. They might include:
   1. Computer hardware and software vendors
   2. Recovery site vendors
   3. Communication vendors
6. The creation of a contact list including all key employees. Contact information should include:
   1. Home address
   2. Home phone
   3. Cell phone
7. An assessment of all key support services, including:
   1. Email
   2. Voice communication
   3. Fax services
   4. Mail
   5. Shipping and receiving

Upon completion of the analysis step, you should have a clear view into the people, processes, and technologies necessary to continue delivering product and services. As we move to the next BCP step, we begin assessing the risk associated with the full or partial loss of one or more of them.

In Part 2, I'll discuss Steps 2 and 3.