As a software company involved in the Business Continuity Management industry for over 13 years, we are constantly collaborating and exploring new opportunities with organizations in the market for BCM software that are looking to create an effective program to meet their goals and objectives.
Based on our experience, we have concluded that the end-state of BCP should be the ability to respond to any disruption that impacts an organization's ability to deliver products & services. Disruption of that ability may be result from any an impact on any area of operations. Unifying Employee Health &Safely, Crisis Management, BCP, IT- Disaster Recovery Planning, Supplier Continuity Planning, Alternate Work-Area Planning, Integrated Notification and Incident Management - among other forms of contingency planning - can lead to a resilient organization, and provide tremendous advantages. We call this collaborative effort, "Unified BCM".
When evaluating our prospective audience, we can see that there are 3 groups into which they fit:
• Those who are creating a new program (20%)
• Those who have a program but have lost their way (30%)
• Those who have a mature BCM program but are looking to fill gaps in the program (50%)
Looking closer at each group, we have observed the following:
The New Program
Organizations that are implementing a new BCM program often begin by looking at standards from the DRII and BCI etc.
They stringently follow the BCM protocols and standards set forth by these certification organizations. Their focus often becomes structured 'checklists'. First the 'kick off' is initiated, followed by a Risk Assessment, a BIA, Strategy Development etc., etc. This 'cookie cutter' effect often results in each area of the lifecycle quickly becoming compartmentalized. Stakeholders and participants contribute to building the program, but they soon become disengaged due to a lack of understanding of the end state or goals of the overall program. As each phase has become separated - with little or no linkage between them - it becomes difficult to maintain participation and cooperation. The checklist may be completed but the result is too often nothing more than a ring binder full of lists.
These organizations search for BCM software hoping that it can guide them to success. But first, they have to determine what their goals are.
The Program that has lost its way
These organizations have tried a wide variety of different approaches and all ended up at the same point: a program that stumbles along, doing the same things over and over - without making real progress.
Departments and business units have often gone their separate ways; some using different methods and platforms to create their own 'siloes' of information, others providing only the absolute minimum cooperation, others resisting all entreaties. The result: no unified approach to the goal (and perhaps, a misunderstood goal). Both the business operations and IT sides usually fight their own individual battles, and when an incident impacts the entire enterprise, that separation diminishes the ability of the organization to respond with any confidence. Each area is working on their own 'version' of a plan - with little or no communication or collaboration. The program marches on - but it leads them down a path to uncertainty.
These BCM programs go in search of software hoping it will stabilize their program: provide centralized control, automation - and an ability to monitor what is happening (and not happening) among all the program participants.
But unless these organizations gain consensus on the goals and objectives of the program, and can get buy-in from all the participants (both business operations and IT), no software will help them gain control, or get them out of their current rut.
The Mature Program
Organizations with mature programs are usually looking to software to identify and bridge the gaps within their current programs.
Structures are already in place, plans are being updated, BIA's are completed regularly. The checklist is done. Now they are analyzing their gaps and figuring out how to bring all departments together towards one unified goal, with an Incident Management perspective. The question becomes 'How can we effectively respond to an Incident?'
During an incident, plans need be effective and actionable. The focus of the program shifts to how they can manage, monitor and measure the response. They assume that software will assist in decision support and assure that incident commanders and managers have the information they need to keep Incident response and recovery on the right track. They must be careful to understand the difference between what they need and what they want, in order to find the BCM software that best suits their unique requirements.
In all 3 cases, using software may help bridge gaps, cross silos and promote collaboration towards a Unified BCM program. The end state becomes one of a sustainable and viable program where the focus is on Incident Management. Programs should be living breathing entities on their own, not owned by a small group of individuals (or worse, a single individual).
Constant engagement and collaboration ensures that even when there are significant changes to assets (whether they be people, technology or processes), the effects no longer impact the program. A Unified BCM approach is what will effectively lead to organization resiliency.