Business Continuity Planning

Business entities today exist in a highly competitive world. They are constantly innovating to meet their business objectives of providing essential and unique services to their customers. Technology advances have enabled them to achieve their varied strategies. And yet, the threats of disaster, on account of business interruption, are not extinct – in fact, they have also evolved along with the technology. Business interruption does happen – but what is of significance is, how much of the consequences of such interruptions can the business afford? Business Continuity Planning is the act of pro-actively working out a way to prevent, if possible, and manage the consequences of a disaster, limiting it to the extent that a business can afford.

There are various threats and vulnerabilities to which business today is exposed. They could be:

• catastrophic events such as floods, earthquakes, or acts of terrorism
• accidents or sabotage
• outages due to an application error, hardware or network failures

Some of them come unwarned. Most of them never happen. The key is to be prepared and be able to respond to the event when it does happen, so that the organization survives; its losses are minimized; it remains viable and it can be “business as usual”, even before the customers feel the effects of the downtime. An effective Business Continuity Plan serves to secure businesses against financial disasters. The bonus — customer satisfaction, enhanced corporate image and no dip in the market share.

One of the biggest challenges in continuity planning is identifying and protecting essential elements. An effective plan must be departmentally broad, and consider the needs of the entire enterprise. The goal is to understand what is critical, and to encompass all of the necessary parts (personnel, network, platforms, applications and data) when evaluating the components that support critical processes.

General steps to follow while creating BCP

• Risk assessment

Risk assessment is the exercise of identifying and analyzing the potential vulnerabilities and threats. Each of these areas should be looked at in the light of the business and the exact possible source located. The end result of the Risk Assessment should be a risk-benefit analysis statement giving the exact threats, and the estimated exposure together with the contingency and mitigation actions required, and also the benefits arising out of covering the risk. This statement should also delineate any assumptions or constraints that exist.

• Business Impact Analysis

Business Impact Analysis (BIA) is essentially the process of identifying the critical business functions and the losses and effects if these functions are not available.

• Approval

Obtain the commitment of the management and all the stakeholders towards the plan. They have to set down the objectives of the plan, its scope and the policies.

• Implement

The BCP project team must implement the plan after it has been approved by the management.

Business Continuity Planning should include strategies on:

• Prevention
• Response
• Resumption
• Recovery
• Restoration

Prevention aims at lessening the chances of the disaster happening.

Response is the reaction when the event occurs. It must stem further damage, assess the extent of damage, salvage the business entity's reputation by providing appropriate communication to the external world and indicate a possible recovery time-frame.

Resumption involves resuming only the time-sensitive business processes, either immediately after the interruption or after the declared Mean Time Between Failures (MTBF). All operations are not fully recovered.

Recovery addresses the startup of less time-sensitive processes. The time duration of this naturally depends on the time taken for resumption of the time-sensitive functions. It could involve starting up these services at an alternate location.

Restoration is the process of repairing and restoring the primary site. At the end of this, the business operations are resumed in totality from the original site or a completely new site, in case of a catastrophic disaster.