This perspective provides an overview of the Business Continuity Institute’s Professional Practice 6 (PP6) – Validation, which is the professional practice that “confirms that the Business Continuity Management (BCM) program meets the objectives set in the Business Continuity Policy and that the organization’s BCM program is fit for purpose”. Business continuity practitioners should perform validation activities after documenting response and recovery plans for their organizations (for more on planning, read our perspective on PP5 – Implementation). Continue reading
As business continuity professionals, we tend to gravitate to the activities where we think we can deliver the most value. This often takes the form of the business impact analysis, helping management come up with strategies that minimize risk, and documenting these strategies into plans. Ensuring that a business continuity program employs effective training approaches and engages business process owners, unfortunately, often plays “second fiddle” to other activities. One only needs to browse any of the top business continuity and disaster recovery related publications to see this disparity. Searching for “business impact analysis” or “business continuity plan” yields substantially more results than “business continuity training.” Yet without effective training, all that hard work will likely either fail or not perform to desired standards during a real disruptive incident. Continue reading
This post is part of the Business Continuity Awareness Week (BCAW) 2015 flashblog. To learn more about The BCI and BCAW 2015, visit the website or follow the discussion on Twitter via #BCAW2015 and #TestingTimes.
Exercising. Whether you’re talking about hitting the gym or testing your business continuity strategies and plans, I’ve come to find that no one likes hearing this word. The typical reaction and excuses are similar, too: I don’t have the time; I have better things to do; I just don’t see the value.
Well, okay… the last one pertains a bit more to business continuity, but I’m sure you get my point. Continue reading
Practice—it’s a key to success in any pursuit. Whether it’s within sports, hobbies, or business, practice is integral to fostering success, and business continuity planning is no exception. Arguably, the most effective way to practice implementing business continuity plans, processes, and strategies is by performing exercises. Not only will a good exercise improve preparedness, it will also socialize business continuity planning among the organization’s key leaders and demonstrate the value of business continuity planning. However, many exercises fail to “impress” and meet the goals of socializing capabilities, building competencies, and identifying opportunities for improvement. Within this perspective, we’ll take a look at some of the key causes and simple fixes that will allow business continuity practitioners to plan for and facilitate an engaging, beneficial business continuity exercise. Continue reading
Most organizations that have experienced a crisis would likely agree that advance planning is critical to enabling an effective response. When a disaster impacts several sites simultaneously, it makes coordination even more chaotic, so the importance of a defined structure increases. Organizations with multiple facilities or sites, especially those within “at-risk” regions, should take proactive steps to prepare their organization for events that require a widespread and coordinated response. Specifically, these preparedness steps include enabling coordination, communication, and adherence to organizational policies in advance of a disaster to ensure all sites implement appropriate response procedures. This article summarizes best practices that help enable sites to work together and execute common, approved response strategies to minimize impact and reduce confusion. Continue reading
Since 2005, Avalution Consulting has performed hundreds of business continuity exercises with organizations in every major industry and sector throughout the United States. No matter the scope of the exercise or the level of complexity, several key elements enable the successful outcome of this important component of the business continuity lifecycle. This perspective shares some of our lessons learned, highlights the importance of exercising and provides insight into our time-tested exercise methodology.
Nearly every business continuity standards and regulatory body recognizes the need for exercises to validate and continually improve continuity plans, including the National Fire Protection Association (NFPA), the British Standards Institute (BSI), and even the Federal Financial Institution Examination Council (FFIEC). Exercising is also one of the most visible activities in which a business continuity practitioner is involved; it’s where the rubber meets the road. Continue reading
As with most things in life, one should expect that some business continuity professionals are, and will continue to be, more effective in their role than others. But, why? What skills and attributes determine who will and won’t be most effective?
Based on our work with hundreds of business continuity professionals around the world, we’ve identified the top ten attributes – organized in no particular order – that increase the likelihood of being successful in a preparedness-related role. Continue reading
New and emerging business continuity standards highlight that personnel should be “competent” in performing their business continuity responsibilities. This may seem like an obvious statement but it can be an area in which organizations often forget to focus. Business continuity practitioners and their sponsors that read BS 25999-2 (which summarizes this requirement in Sections 4.2.5 and 4.3.1) often ask two questions specific to the concept of competency:
- What exactly does “competent” mean?
- Who does this requirement apply to in our organization?
One of the most visible and essential elements of a business continuity program is exercising. Performing exercises enables the organization to validate and improve business continuity capabilities and plan documentation. It is typically recommended that exercises occur at least once a year for every plan, process or procedure, although the actual schedule should consider organizational change and the criticality of the product or service recovered. As organizations are often resource-constrained (e.g. time, money and skills), a number of different types of exercises exist to meet stakeholder requirements while still addressing organizational constraints (see graphic below). Continue reading
Driven by recent industry demands for a common, generally accepted framework, British Standard 25999 originated as an attempt to provide an industry-wide process that was consistent in regards to business continuity analysis and response techniques. The British Standard Institute met this demand by convening a committee of professionals with experience in several different fields of business from around the world. It was this diverse group of professionals that developed a widely reaching yet actionable set of guidelines and processes. Continue reading