• Senior Management wants to know what is impacted, what the response is, what the expected outcome is and when operations will be back to ‘normal’.
• Line managers who are indirectly impacted want to know when they can get back to business-as-usual.
• Employees want to know what they should do, where they should go and how long the situation is expected to last.
• Customers want updates on the status of delivery of products & services.
• And the media may be clamoring for an explanation, or at least status updates.

When information is not forthcoming, those stakeholders will assume that nothing is being done.

Communications must be part of the Incident Response Plan.  It can’t be left until a disruption occurs.  Having a separate Crisis Communication Plan may be helpful – as long as it integrates thoroughly with the Incident Response Plan.

Automated notification tools can greatly enhance the Communication Plan.  The ability to reach a large audience quickly, schedule delivery of messages in advance and leverage multiple channels of communications – Voice, Txt, SMS, email – concurrently make manual Call Trees and lists seem prehistoric.

Communicating on both a periodic basis and on an “as needed”-basis are both important ingredients in effective Incident Management.

Communication planning associated with Incident Response, may be divided into broad groups:

Updates – From the time the incident is first logged until the incident is officially closed, there is a constant need for communications to ensure timely and effective response.

• The communication plan starts with notifying the Incident Management team, the appropriate incident response and disaster recovery teams and any external providers associated with business continuity operations – to put these teams on alert or standby.
• There must be procedures to activate the Business Continuity and IT Disaster Recovery teams once the disaster declaration has been initiated and their response plans are activated
• The plan should also include periodic roll-calls to catalogue the personnel currently involved with the recovery, restoration and resumption activities – and those personnel available to assist when needed.

Collaboration – Efficient response requires frequently updating the status of task execution – both among responder teams, and between responders and Incident Management teams.  Collaboration among the teams involved in the restoration activities is critical to restoring vital operations within the defined RTO targets.

Murphy Law always applies during a crisis: anything that can go wrong will go wrong.  There will be all sorts of unanticipated issues that may disrupt the recovery process. Issue resolution requires collaboration among many stakeholders and teams:  Incident Managers, Finance for ad hoc spend approvals, Logistics for travel & living arrangements or additional space, etc.  How issues will be reported – and how responsibility for resolution and status communications will be handled – must be premeditated and planned.

Reporting – We all see the ‘rubbernecking’ that causes congestion whenever there is an accident on the highway.  That’s just human nature. Humans are naturally curious; they need to know everything that happens around them and are looking for information.

During a business disruption, if this hunger is not satisfied, stakeholders (and the curious) will assume that nothing is happening.  Or worse, you will be inundated by a monsoon of phone calls until their need for information is satisfied.

The Communication Plan must anticipate these demands and include processes and procedures to push updates of the status of recovery efforts on a periodic basis – rather than fight the battle with those trying to pull information from Incident Managers.  Making this ‘push’ with real-time, dynamic updates will reduce the ‘pull’ of outside inquiries – letting Incident Managers concentrate on resolution, not answering repetitive inquiries.

Crisis Communications – The terms “Crisis Management” and “Incident Management” are often used to mean the same thing.  It’s more efficient to think of an ‘Incident’ as one that impacts operations, and a ‘Crisis’ as one that impacts brand, image and markets.  Often, an Incident leads to a Crisis.  So Crisis Communication needs to be a part of both.  And Crisis Communications is an entire industry by itself.  We will write a separate blog specifically about Crisis Communications sometime in the near future.

Stakeholders: Every incident impacts stakeholders, and each incident will have different stakeholders.  Identifying those critical stakeholders and targeting communication to meet their individual needs is an important process.  Whether it is part of the Crisis Communications plan, or of the Incident Management plan itself, stakeholder communications, like Reporting, will reduce their need to ‘pull’ status information, and will keep those awaiting assignment aware of their status.  Stakeholders may include responder teams, Crisis Managers & communicators, internal & external business customers, senior managers, boards of directors, regulators, suppliers, neighbors and more.

Incident Management involves efficient allocation of finite resources, timely restoration of functions or IT services, and as a goal, ensuring an effective Incident response. Message contents will change with the situation, but the Communication Plan must account for both periodic updates and real-time dynamic information pushed to participants and stakeholders.  The Communication Plan is the glue that will hold all the pieces together – the people, the tasks and the timeline.

Toronto, ON

eBRP Solutions Network, Inc. (eBRP) completed the Business Continuity Management version of a cricket or hockey “hat trick” after being named winner of the inaugural BCI European Business Continuity Product Provider of the Year award.  This is the 3^rd BCI Regional Award garnered by eBRP in 2013.

In March, eBRP was named winner of the Product Provider award in North America, presented in Orlando, FL.  On May 29^th eBRP picked up the same for the Middle East at a ceremony in Dubai, UAE.

The award presentation cited eBRP for “what sets this product (eBRP Suite) apart is its capabilities as an Incident Management toolset. While other BCM software stops at plans, this extends its full capabilities to managing response.”

The BCI European Awards were presented at a ceremony in Brussels, held in conjunction with the BCI Executive Forum.

“We are exceptionally gratified to have eBRP Suite recognized in this manner by professionals in the European Business Continuity industry.” said Sibel Misirlisoy, eBRP Sr. Mgr., Global Operations.  “Winning a single award this year would have been satisfying; winning three validates all of the hard work the eBRP Team has devoted to maintaining eBRP Suite’s leading-edge capabilities.”

All of this year’s Regional Award winners are finalists for the BCI Global Awards 2013 which take place on November 6th in London as part of the BCM World Conference and Exhibition 2013.

About eBRP Solutions
eBRP Solutions is the leading provider of automated Business Continuity Management (BCM) Planning software. Its flagship product – eBRP Suite – is a complete package of easy-to-use, web-based utilities that address the entire BCM lifecycle.  eBRP Suite is used by government agencies, municipalities,  non-profit organizations and businesses, including many Fortune 100 companies, on five continents. Available in either a self-hosted or SaaS configuration, eBRP Suite provides the flexibility and scalability to meet the needs of any organization – regardless of size or BCM maturity.  Licensed for Unlimited Users, eBRP Suite assures a fixed total cost of ownership.  The company is headquartered in Toronto, Canada. Visit eBRP Solutions on the web at http://www.eBRP.net or email us at info@eBRP.net . Follow eBRP on Twitter at https://twitter.com/eBRPsolutions and check out our LinkedIn company page at http://linkd.in/XKqm4b

About The BCI
Based in Caversham, UK, the Business Continuity Institute (BCI) was established in 1994 to promote the art and science of business continuity worldwide and to assist organizations in preparing for and surviving minor and large-scale man-made and natural disasters.  The Institute enables members to obtain guidance and support from their fellow practitioners and offers professional training and certification programmes to disseminate and validate the highest standards of competence and ethics.  It has circa 8,000 members in more than 100 countries, who are active in an estimated 3,000 organizations in private, public and third sectors.

Translations:

This year’s UGC will be filled with informative and educational opportunities – including BCM Industry guest speakers, eBRP Customer presentations, breakout groups and peer Panel Discussions.  Architects and developers of eBRP Suite will also be showcasing their latest – and upcoming – features and innovations.  Thursday will include a half-day, hands-on Exercise for all participants.

The UGC is also a terrific forum for networking with other eBRP Suite users and industry peers, plus an opportunity to interact with the architects and developers who continue to enhance and make eBRP Suite an award-winning, industry-leading BCM platform.

Of course, all work and no play makes for a dull conference.  There will be after-hours fun activities too, including a gala dinner featuring music & dancing with eBRP’s “house band” – The Responders.

Attendees will earn CEAP points toward DRII certification for attending – and additional points for speaking and panel discussion participation.

We’re excited.  And we’re looking forward to seeing many eBRP customers, hearing about their experiences and sharing our vision of eBRP Suite’s future impact on their Business Continuity Management programs.

Those unable to attend can keep tabs on the proceedings by following us on Twitter (@eBRPSolutions) or following #eBRPUGC13.

Check back later: we’ll post photos of the event.

As part of replacing that old legacy DRP software, you must consider what to do about your existing data:

• Can it be migrated into another, new BCM software product?
• Has it been done before?
• How will it be done? (How long will it take?  What resources will it require?)
• What are the challenges to the migration effort?
• Will there be a loss or gain in value from the migration?
• What is your vision for the end-state of your existing data in the new tool?

Fact: there is no data migration Magic Wand.  Don’t confuse “document migration” with data migration.  Anyone can move your MSWord-based plans from one place to another.  But moving your BIA results, teams, dependencies and other relational information will be as complex as the form and format where it sits presently.

Based on our experience migrating data from many legacy BCM software products, a typical data migration effort may take as long as 3 calendar months and involve daily touch points between the vendor and the customer’s BCM administrators.  The data migration timeline and work effort will depend on what you have, how existing data is housed, and what your goals are.

Basic data migration involves a series of activities.  I can’t vouch for how every BCM software supplier does it, but here’s how we do it at eBRP:

Analysis: Every migration effort is unique, and a project plan must be created to achieve the desired end-state. Our Business Analysts review the source data-stored and break it into data packets that can be imported into the new system.  In many cases the legacy data may be broken into 30 or more components for import,  such as – locations, departments, staff, vendors, processes, IT services, Technology sub-systems, supplies, resources, plans, tasks, teams, etc.

Extraction: Based on the Source Analysis, scripts are created to extract data into structured files that can be used to import the data components into the new tool.

Shaping: A ‘like-to-like’ migration, from the old system to a new system, is probably the easiest form to manage.  But a critical question must be asked: what value is achieved by moving to a newer system if everything remains the same?  Implementation of ‘data shaping’ during the migration process – changing the information architecture and applying updated business policies to old data – can result in more than simply maintaining the status quo.  Data shaping is like melting down a gold bracelet and pouring it into a new ring mold – the relevant legacy data is extrapolated to fit the current state of the business.

Deployment:  Based on the existing data structure of the target software, the data migration is broken into phases.  Each data component, (locations, employees, Teams, Business Processes, plans, etc…) is imported one at a time. With the new ‘data shaping’ parser in place, the data is extracted from the old database into the new tool. The legacy data, now shaped with the current business policies, is represented in the new tool in its desired state.  Why bother to break the database into components?

Validation: Each migrated data component must be validated and signed-off on before cycling back to migrate the next set of data. One error can be compounded when matched with successive data components.  By assuring that the migration of each data component is valid, the chances of compounded errors are virtually eliminated.  We don’t believe in ‘trial and error’ – we believe in trial and validation.

End state: Because the desired end-state is known from the beginning, the process of migrating the legacy BCM software data into the new tool, data shaping, validation & sign-off should result in matching expectations.

The migration from a legacy database must be an interactive effort. The key thought process is ‘what is the desired end-state’ of the migration?  Thoroughly considered and well-planned, the migration can ensure that the prior years spent planning are not lost, while leveraging features of the current BCM software tool to create a viable & sustainable BCM program.

If your legacy BCM software is no longer meeting your needs, you aren’t stuck.  All the planning efforts you’ve made can be migrated to a new, more effective tool.  Just make sure any prospective new BCM software vendor is capable of data migration – not just document migration.

“Preppers” (those anticipating the end of the world who stockpile guns, food, camouflage gear, bottled water and the like in expectation of Armageddon), have it easy.  They simply buy and hoard as much as they can manage.  They think they know what will happen – they just don’t know when – so they amass as much as they can afford.

Business Continuity Planners face a more complex dilemma:  they don’t know what will happen, when it will happen, how severe it will be, or how long it will last.

Conventional thinking (I stop short of calling it ‘wisdom’) drives some of those Planners to ask their organizations to specify what they’ll need in the event of some business disruption – and how much more they’ll need over time (assuming that unknown ‘event’ lasts more than a day or two).

It seems to me that such requests – and the resulting date – are questionable, if not invalid.  How can I say that?  I’ve had nearly 20 years of experience in the Business Continuity industry (as everything from a participant to a planner to a consultant).  And I’ve seen lengthy surveys that ask for exactly that – and result in highly suspect data.

Corrupting the BIA

Suppose you’re a Department Manager.   You’ve been asked to complete a BIA survey.  You encounter the following question:

“In the event of a disruption to your facility/department/function/process, please complete the following chart for each required resource:”

How do you answer?  For Day one, you estimate the minimum number of people you’ll need (and the resources they’ll need to function) if things go south.  You don’t know for certain – but at least you can make an educated guess.  The rest is pure speculation.

How can anyone fill in the chart factually?  After all, the BIA is collecting preliminary information.  No one has yet begun to think about Recovery strategies, or Alternate sites.  How is someone supposed to fill in those boxes when they don’t have a Recovery Strategy?

Basing Planning on Conjecture

The same table might appear in a Business Continuity Plan Template. By this time (hopefully) one or more Recovery Strategies have been determined.  So you might assume the Plan owner could complete the table factually.

Let’s take a hypothetical Plan involving a Critical Business Process working out of a single location.  Strategy: Move to an alternate site (another facility some acceptable distance away).  So how does that Plan Owner fill in the Table?  They can make a factual judgment of the number of people they’ll need on Day one – and the Resources they’ll require.  After Day 1?  It depends…  On whether it is a local or regional disruption; will he have people who can’t travel?  If it’s a local disaster, will she have people who won’t travel?  Or whether it’s an IT or Network problem; will he need the same number of people if the Application or Network has an RTO of 72 hours – or 2 weeks?  Or if the problem impacts Customers directly; will the need for her Process still be as great?  The list of ‘what-ifs’ is endless.  And all of them impact the numbers in the Table.

So what does those poor Plan Owners do?  They guess.

Compound Errors

Whether the data comes from BIA’s or Plans, somebody’s responsible for totaling up all the Resource requirements in those Table, and converting them to a single table (probably by Location).  Without a relational database, or a BCM software tool, that’s a lengthy job.  But one way or another, the results get tabulated.

The Facilities people are given the workspaces and furniture they’ll need to have available when locations are used as Alternate Sites.  IT gets its lists of required PC’s, phones, printers and other technical equipment.  And all of it is complete balderdash!  It’s a classic case of ‘garbage in, garbage out’.  Ask everyone who completes a BIA, or fills out a Plan Template to speculate about what they’ll need at some uncertain date in the future, under unknown circumstances.  The result is nothing but guesswork.

If that collection of guesswork forms the basis of planning for Recovery, the effort is wasted.  The house of cards built with speculative data is bound to fall the first time it is needed.  It’s this simple: You cannot build Plans on data that was derived by guessing.  And when those guesses came from 10, 50, even 200 respondents or more, the unreliability of the data shouldn’t even be in question.  Run from it.  Fast.

If you use ‘assets over time’, stop.  It’s an exercise in futility.  It is very seductive (it looks like such a pretty tool!), but like the Venus flytrap, it is deadly.  So what CAN you do?

Rely on facts:  What Resources do you rely on today?  What’s the minimum amount of those resources you’d require on Day 1 of any disruption (pick the worst case if you like)?  Those two questions supply both ends of the requirement.  Resources after Day 1 can be worked out on the fly (when the parameters of the situation are known).  You’ve got a place to start, and the worst possible case.  You can deal with that – at least it’s factual!

You might also consider the 6 Steps advocated by my colleague in his Method to the Madness blog.

Having been around for a while, having played the roles of a Disaster Recovery Planner, BCP consultant, BCM software architect and evangelist for a BCM solution, I understand this desire for easy use syndrome – it’s an appeal to preserve the status quo, without rocking the boat, or breaking the comfort zone cocoon – in the face of technology.  It’s more of a plea for mercy than a request for help.

Most BCM programs have champions –  some seen & heard, some invisible yet viable – but the common theme is that they are personality driven.  At the ‘kick-off’ of the BCM program, they engage representatives of the various businesses to help create a BCM policy. This half-day ‘kick-off’ meeting is often a monologue designed to get the business continuity relationship (BCR) representatives to agree to a previously conceived BCM policy framework. Everyone enjoys a boxed lunch and retreats to their cubicles.

Compliance-driven BCM programs have policies, governance models, frameworks and defined workflows. These programs typically involve a representative or two from each business unit.  They are tasked to complete fill-in-the-blanks surveys once or twice a year, and maybe participate in an annual test or exercise. This operates much like a traditional circus, with its ring-master, clowns, artists and a few animals in cages outside. Everyone has a fixed role, an act of fixed content and duration – whether it putting lions through their paces, jumping through hoops or walking the high wire.  At the end of the show the ringmaster gets the applause and takes the bow.  The traditional circus never changes. It goes from city to city performing exactly the same show.  It is the same way with BCM programs created by industry ‘personalities’ – as they go from one organization to another setting up the same “circus” over and over.

A progressive BCM program is more like the modern iteration of the circus – the Cirque du Soleil; an orchestration of action, color, costume, music and lights. It engages & empowers the participants. It creates excitement as participants interact with the audience. And it creates more than sheer amusement. The orchestration is complex, split into many interconnected piece parts – but there is an underlying blueprint, a traditional story being told. The entire crew is on the stage when it comes time for the applause. The show changes frequently and appeals to audience tastes.

An organization with a progressive BCM mindset engages, empowers and excites all its stakeholders.  In such an organization there is often no single ‘ringmaster’. The program is a cooperative effort – of Business Continuity Planners, Disaster Recovery Coordinators, Crisis Managers, Supply Chain Incident Managers, Incident Commanders, Resiliency Managers and more – each working in their own sphere of influence but unified in an enterprise blueprint.  They are not looking for a simple, easy-to-use solution.  They understand that their organization is complex. The solution must also be complex, but needn’t be complicated.  When the goal is to repeat the same thing over and over – with improved efficiency – then ‘easy-to-use’ becomes a necessity.  When the goal is improving the program, then ‘easy-to-use is a nice to have – but not at the expense of denying the complexity of the organization.

Have you ever seen a vendor advertise hard-to-use software?  BCM software vendors do NOT live in a bubble, unaware of customer needs and oblivious to fundamental requirements.  Those vendors fund a large portion of the BCM industry trade shows and associations that provide forums for information exchange.  Most vendors feature development roadmaps that are based on suggestions from customers, industry consultants and feedback from trade shows and prospects.  BCM software vendors don’t think there’s ‘a sucker born every minute’; the competition is stiff, so those who don’t adapt to changing needs don’t succeed.

Yet the demand by some BCM managers for easy-to-use software is not rooted in their concern for end-users. Today’s BCM software tools have made giant leaps, and evolved into forces that may threaten those manager’s perception of how BCM programs should be run (hint: the same way they’ve been run for the past 20 years!).

Demanding that BCM software suppliers ‘dumb-down’ their products is self-serving self-preservation which can only result in an ineffective BCM program. We are not buying their arguments.

eBRP Solutions Network, Inc. (eBRP) has been named winner of the Business Continuity Institute (BCI) 2013 Middle East Business Continuity Product Provider of the Year award for its flagship Business Continuity Management software eBRP Suite.

The awards ceremony, sponsored by the BCI, was held May 29th at the Middle East BCM Summit in Dubai, UAE, to recognize “the talents and achievements of some of the best BC professionals and organizations working in the Middle East Region”.

This is the second such 2013 BCI award for eBRP, which captured the BCI’s North American award for Business Continuity Product Provider of the Year, in Orlando, Florida in March.  eBRP is also among the finalists for the same award in both Australasia and Europe, which will be awarded later this year.

eBRP was recognized for “being a Thought Leader in BCM”, according to the BCI announcement.  “What sets this product apart is its capability as an Incident Management toolset. While other BCM software stops at Plans, eBRP Suite extends its focus to Response, and empowers BCM Professionals to create value and meet the challenges of business change.”

“We are honored to have eBRP Suite recognized by our peers in the Middle East for its ability to deliver value to Business Continuity programs in the region.  The award publicly verifies what our customers already know: that eBRP Suite can help them gain efficiencies, expand their capabilities in BCM planning, and deliver the information necessary to respond effectively to any disruption of their day-to-day operations”, said Jim Mitchell, an eBRP Director.  “We are also extremely proud to have been named Business Continuity Product Provider of the Year on two continents so far in 2013.”

About the BCI: Based in Caversham, UK, the Business Continuity Institute (BCI) was established in 1994 to promote the art and science of business continuity worldwide, and to assist organizations in preparing for and surviving minor and large-scale man-made and natural disasters. The BCI has more than 7,000 members, in over 100 countries, in an estimated 2,750 organizations in private, public and third sectors. http://TheBCI.org

About eBRP: Headquartered in Toronto, Canada, eBRP Solutions Network, Inc. is the leading provider of automated Business Continuity Management (BCM) planning software.  Its flagship product – eBRP Suite – is a complete package of easy-to-use, web-based utilities that addresses the entire BCM lifecycle.  eBRP Suite is used by government agencies, municipalities,  non-profit organizations and businesses, including many Fortune 100 companies, on five continents.  Available in either a self-hosted or SaaS configuration, eBRP Suite provides the flexibility and scalability to meet the needs of any organization – regardless of size or BCM maturity.  Visit eBRP Solutions on the web at http://www.eBRP.net or email us at info@eBRP.net.  Follow eBRP on Twitter at https://twitter.com/eBRPsolutions and check out our LinkedIn company page at http://linkd.in/XKqm4b

Translations:

LinkedIn, Twitter and BCM tradeshows are constantly flogging ‘How to get Senior Management Buy-in”, or “How to show BCM ROI”.   The simple answer is: show value.   Business Continuity Programs can deliver value. I base that statement on my own personal experience. You can transform any BCM program in to an exciting, viable and sustainable program with some tweaks (perhaps a few more tweaks for some programs than for others).

As a Business Continuity leader, you can’t do all the work yourself.  The information your program needs is in the hands (and brains) of stakeholders throughout your organization.  You need to get people to participate in your BCM program.  So give them a reason – a reason that has value for them, not just for you.

Personally, I will only share information if I perceive that the information is helping create something useful.  I need to feel engaged.  Show me how my information provides missing pieces in the program jigsaw puzzle and I will happily cooperate and be a willing participant.

Don’t bog people down in the BCM process.  Instead of a big project kick-off data gathering session, break it into smaller, shorter workshops.  Begin each workshop by showing what has been achieved with the data gathered previously – and how new data that you’ll ask for in the workshop will fit into the whole picture.

Make each of the business stakeholders feel that they are the most important cog in the program. Respect them and respect their time. Keep meetings brief.  Avoid lecturing them on basic BCP 101. You need them to participate because they have information critical to your program.  Help them understand that.  Make them feel they have a stake in the program. Their information is critical.  Information is power. Make them feel empowered.

Just because some BCM industry ‘best practices’ list program components in a particular order doesn’t mean that’s the only path you can follow.  Linear program development – where the entire organization’s Risk Assessment has to be completed before you start the BIA process which, when completed, let’s you move on to strategy development, et al – is boring (and not very productive).

Linear progress at the organizational level may be easy, but it disengages the business stakeholders with long periods of idleness and disconnection.   If I only participate in BCM once or twice a year (when I update my Plan, or complete another BIA, or participate in a test) I tend to forget what I knew.  I’ve lost that sense of engagement.  I no longer feel empowered.

Instead, try a ‘spiral’ approach: complete the entire BCM lifecycle (including testing) for a single group (perhaps the most critical Business Process), then for the next larger, or most critical group, scaling in steps, getting bigger and better in each round.   The spiral cycle runs faster.  There are shorter gaps between phases.  Nobody loses interest.  And everybody sees progress made – and understands the value of that progress.

If you’ve got the staff (and the stamina), run multiple groups through the cycle simultaneously, but not concurrently.  While one is working on Risk Assessment, another is in the BIA phase, another in Strategy development, etc.  What you learn from one group may be relevant to another.  And management will see that you are constantly making improvements (if you make an effort to include them – even if only via dashboard reports).

Make the program exciting.   You’re a BCM professional.  If you didn’t find it exciting, you’d have a hard time getting out of bed in the morning.  Try to rub some of that excitement off on your stakeholders.

• Help them feel engaged.
• Help them become empowered.
• Help make the program exciting.

Those tasks may not be in your job description, but on the path you need to follow if you truly want to help make your organization prepared to respond to any disruption.

It is imperative that the Business Continuity planning process (which includes IT Disaster Recovery planning) be guided by some basic Incident Management requirements to assure plans will be viable and manageable during a real business disruption (not just during an artificial exercise).

Actionable Plans

The primary purpose of a Disaster Recovery or Business Continuity Plan is to restore assets or operations within defined Recovery Time Objectives (RTO). Plans that are not focused on restoring services or assets are irrelevant at the time of a disruptive incident. Business Continuity Plans which are intended to facilitate Incident Response should be designed for execution.  These ‘actionable’ plans contain 3 basic elements – Who, What & When:

• Who is assigned responsibility to complete the task? It is extremely important that Incident Managers know who is responsible for executing the task to ensure that those resources are available.
• What is the sequence and order of tasks? What tasks have precedence; those which need to be completed prior to starting other tasks? Once this sequence is known, it is possible to identify critical tasks that require more focus or resources to ensure that successor tasks are not delayed.
• How long will each task take to complete?  Since the focus of the plan is to restore assets within a pre-defined RTO, understanding how long completion of each task will take is critical to managing the incident response.

Assignment by Skillset

During the planning phase, as plans are being built, the responsibility for executing each task should be assigned to a group or team based on the ‘skills’ required to complete the task. This will ensure that there are adequate resources available to whom to assign the task.  To reduce the risk of resource inadequacy even further, include geographically-diverse members in the group or team – just in case.

Collaboration

Because multiple plans might be invoked simultaneously, and because some tasks will be dependent upon the completion of tasks in other plans, the planning process must address the need for dynamic, real-time collaboration between Incident Managers and the many responder teams. Mechanisms should be in place to alert teams in real-time when their tasks are ready to be started, or if the projected status of the task has changed.

For this collaboration to be effective, some sort of critical-path-tracking system must be employed.  In a perfect world, this would be an automated workflow that dynamically updates the To-Do task list of each responder based on their role in the recovery process. The manual workaround to facilitate this type of collaboration is a conference bridge, a supply of colored Post-it® Notes and a conference room wall festooned with plan execution Gantt charts.

In either scenario, those Gantt charts are important.  Lack of knowledge of the interdependence of plan tasks, and the time required to complete each task, leaves Incident Managers completely in the dark – or at least grasping frantically to maintain an understanding of what’s going on with the 10, 30 or 100 plans in progress.

Control Workflow

The tasks and the workflow within Business Continuity Plans should be capable of change at the time of an incident.  Incident managers should have the ability to have responders ‘skip’ tasks if the situation calls for it, or put some tasks on ‘hold’ for reasons beyond anyone’s immediate control.  Planning which includes the ability to control plan workflow ensures that the same plan can be successful in a real incident as well in a BC or DR exercise.

Issue Management

No matter how well plans are constructed.  No matter how often plans are tested. When multiple plans are concurrently activated, and many responders are involved in the restoration process, issues are bound to arise.  The planning process must define issue-handling, escalation and resolution protocols to ensure that restoration processes can continue smoothly and that the resolution of issues will be handled on a timely basis.

To facilitate robust and effective Incident Management capability, the Business Continuity planning process in an organization must develop plans that are truly flexible, viable and executable. Planning and building plans with Incident Response in mind is critical to building a resilient organization.

When an “Incident” occurs, the only information that is immediately known is that some asset has been impacted or disrupted.  Whether it’s a damaged building, a corrupted IT application, transportation disruption, supplier failure or anything else, this information is the seed around which the Incident response is crafted.  As the incident unfolds over time, more and more assets might become impacted.

A single impacted asset can lead to other downstream dependent assets being impacted as well.  Understanding this casualty chain is critical to effective Incident response. Impaired access to your facility might impact your employees’ ability to work from their regular work-areas, which in turn might impact multiple business operations, which could lead to customer services being disrupted.

Impact Assessment

The first step in the Incident response process is the assessment of impacted assets. The first level assessment should be easy (what is directly impacted?).  But a full Impact Assessment needs to take into consideration the secondary impacts: identifying both upstream and downstream dependencies of those directly impact assets – as well as the casualty chain. Once those impacted assets are catalogued, there must be monitoring and periodic re-assessments of dependent assets must be implemented.

Notifications

Begin notifications:

• Notify all members of the Incident Management Team
• Notify the Crisis Management (Public Information) Team
• Notify & invoke the teams associated with the restoration of impacted assets/operations

These responder teams might be activated to respond to the Incident, or put on standby for later activation. Use of an Automatic Notification System will be greatly beneficial – enabling the use of multiple media (email, voice, SMS, etc.) to reach the responder teams. Most of these systems include a feature which can poll identified responder team members to catalogue their availability to participate in the restoration efforts.

Current Capabilities

Identify the current operational capabilities – based on the impacted assets.  Can the affected business functions be transferred to another site? Can the application be failed over to alternate infrastructure? Can the process improvement team be told to stay at home, so their work area can be temporarily assigned to a more critical operations group?  Can critical supplies be delivered by alternate supplier?  The current capability assessment provides Incident Managers with critical information they need to help determine how to effectively respond.

Time-Sensitive Operations

Review the impacted – and non-impacted – business operations for time-sensitive or ‘peak period’ implications. Identify operations that are critical based on the month-of-the-year, week-of-the-month, day-of-the-week or time-of-day. Events such as financial year-end processing, a critical marketing campaign, the day-end cash settlement process or the launch of a much-publicized product or service, while not categorized as mission critical, might still require an immediate response and recovery.

Allocable Resources

Review the response plans (which are built on ideal conditions & assumptions) and catalogue the minimum resources required for effective restoration.   Identify the resources that are available at the time of the incident which the crisis managers would then allocate to restoring the critical business operations.  These resources may include personnel, work-areas (facilities), IT services, equipment and supplies. Also review available ‘surge’ capacity that could be commandeered as usable resources to aid in the restoration effort.  Examples of these ‘surge’ capacity resources could be unoccupied seats/work-areas in other facilities, skilled personnel who have not been factored in in the planning process, or excess telephone ports that may be used for restoring customer support functions.

Conclusion

The Assessment phase identifies what is impacted and what resources are available to respond to the disruptive incident. Based upon this information Incident Managers can craft a strategy to allocate the resources for execution of critical the business continuity plans.

Upcoming blogs will address the ‘how to’ of more aspects of the Incident Management process.