Whether we’re willing to admit it or not, most of us in Business Continuity Management understand that our industry needs fixing. You may not believe it is fundamentally broken. Perhaps ‘broken’ is too extreme. Would ‘in need of repair’ make you feel better? Either way, something needs to change.
Don’t believe it? Then why is “How to Get Senior Management Support” perpetually a discussion topic at BCM conferences? “The ROI of Business Continuity” is endlessly discussed without resolution. Why? Why have the ranks of BCM professionals dwindled, (while ‘consultants’ have multiplied)? Those are just the obvious symptoms of a ‘profession’ in decline.
Are BCM practitioners destined to go the way of blacksmiths, wheelwrights and radio repairmen? There are some (especially those touting ‘the cloud’ as the path to BCM obsolescence) who think BCM as both a process and a profession are edging toward extinction. There are those who, like a character in The Magnificent Ambersons, believe that the cloud is “a useless nuisance, which had no business being invented.”, and that BCM as practiced today is all everyone will ever need, or should desire.
But those without their heads in the clouds – if you’ll pardon the pun – understand that not only is BCM vital to the resilience of their enterprises, but also potentially more valuable because of the cloud than in spite of it.
Before the cloud, you had two choices: back up you data so you can restore it in your own data center, or back up you data and have a contract with a DR provider to recover your IT systems and applications in their data center. The former assumes your data center is usable (truly, it assumes your ‘disaster’ is data-related, or device-related, not data center-related); the latter is expensive and not very flexible (if your hardware needs change, you’ve must update your contract to keep pace, an often impossible task).
Either way, recovery times – before the cloud – were generally measured in days, not hours. In today’s always-on world, few organizations can afford a 2, 3 or 4-day recovery time. That’s where the cloud has enhanced BCM. Unfortunately, the cloud can only recover systems and applications – not business processes, people, vendors or facilities.
Organizations whose leadership has been lulled into thinking that ‘The Cloud’ has made them immune to disruption are unlikely to be supportive of BCM (for obvious reasons). But at the same time, quick Recovery Time Objectives and short Maximum Acceptable Downtimes (MAD) can be used to demonstrate both the need and the delivery potential of BCM. Facilities, people and processes can’t be restored in the Cloud – and that’s where BCM has value
There are other places within the typical BCM program that have value. One problem with the BCM process as practiced today is the amount of time and other resources spent on ‘best practices’ milestones that add little or no value:
Practitioners spend hours, days – perhaps months – conducting Risk Assessments. Meanwhile the Risk Management Dept. (a standard fixture in most large enterprises) conducts ongoing Risk monitoring. Which one does the C-Suite perceive as true and valuable?
Even longer periods (up to an entire year) can be spent creating, implementing and reporting on a Business Impact Analysis – with results that are not up-to-date, or in the view of business leaders, entirely accurate.
So where is the value? Not in the process. It’s in the results.
Creating Plans has limited value. But Planning – thinking through what will be necessary to recovery or continue vital business processes – forces strategic thinking that can not only aid Preparedness, but may potentially enhance day-to-day operations.
Those completed Plans are just documents. But the exercise of those Plans – assuring that they are viable, that participants know their roles & responsibilities, and that communication channels function as designed – can reduce risk, improve resilience and raises the confidence level of both line managers and the C-Suite.
Worried about the future of BCM? Frustrated by lack of organizational visibility or cooperation? Starving for high level support? Stop focusing on the process and start promoting the value in your Business Continuity Program.
