Business continuity initiatives should be able to meet management and customer expectations in case of a disaster. Here are some pointers to help you towards that goal:
1. Clear understanding of business processes
The key components, products, services, people, processes that are required to ensure that the business continues to deliver its most important and critical business function needs to be identified accurately. The business continuity team needs to have active management support to ensure that business continuity plans are aligned with management perspectives of criticality. Changes in products, services etc. need to be on the radar of the business contintuity team. The team needs to make timely and appropriate changes to the business contintuity plans based on current management perspectives of criticality of products, servicecs and processes.
2. Use language that employees can understand – do not confuse with BC jargon
The business contintuiy team, having read and assimilated books, articles and blogs on business contintuity, may fail to understand that terms like RTO, inter-dependencies, RPO etc. may not have as much meaning to the organization’s employees as it does to them. The BC team should attempt to get into the shoes of the employees being quizzed and focus the talk on operational performance metrics. How would your department function if laptops, desktops, servers etc did not function? What is the most critical function that your department performs? How many people are required to perform these functions? What kind of supporting services would they need to perform these functions?
3. Use realistic RTOs
If you take 2 hours for every backup, your RTO is not 2 hours. Typically, organizations start off with a full backup and complement with incremental backups. So, your incremental backup is what is taking you 2 hours. And a general rule of thumb is that it will take 50% more time to restore than to backup. Also, take into consideration the number of tapes that need to be used for recovery and the resultant tape contention that may arise. If your critical data is stored on 2 different tapes and these tapes the recovery process has an element of seriality that needs to be taken into consideration.
4. Inculcate a culture of Business Contintuity
Your departments may have robust business contintuity plans, good budgets, management support, dry runs being performed, compliance with various standards etc. But in the event of an actual disaster, the response from various departments might be different and may or may not meet set expectations. Only those departments where the impact of business decisions on BC is constantly evaluated and taken into consideration will perform as per management expectations.
Information Security, SSAE 16, ISO 27001, CISA, Cert-IN
Comments are closed.