Establish a business continuity team to get the full picture
Business continuity teams provide insight and focus that can keep an organization on its feet when disaster strikes. Don't rely on a disaster recovery team to reduce downtime.
Business continuity and disaster recovery are grouped together by many organizations, but the teams in charge of these operations serve different purposes. Along with a disaster recovery team, an organization needs a designated business continuity team to get back on schedule ASAP when a crisis occurs.
Resilience comes up along with business continuity. Organizations have started to focus on broad approaches to business continuity and resilience. One such place, said David Gregory, senior research director at analyst firm Gartner, is the Financial Conduct Authority. The FCA, a regulator for financial services firms and financial markets in the U.K., is concerned that organizations will lose full perspective on interdependencies within an organization without a deeper look at the role of business continuity (BC). This is crucial to recovery and resilience, Gregory said.
"We have been saying this for a while; DR is only one small element in BC," Gregory said.
Business continuity isn't just a facet of DR. Disaster recovery plans ensure a business can get back on its feet after a crisis occurs. Business continuity plans ensure the organization can keep operations running during a crisis and reduce downtime. As the threshold for acceptable downtime plummets, a dedicated business continuity team should be a high priority for any organization.
Create a knowledge base within the BC team
A business continuity program requires a focus on service delivery. An organization must identify which of the IT services it provides are critical and how. Then, look at the dependencies that go into the delivery of those services and which IT applications are part of the dependency.
DR is only one small element in BC.
David GregorySenior research director, Gartner
"What we always talk about is that you should make sure you have a joined-up response," Gregory said. That means a business continuity team incorporates people from roles across the operation, such as HR, finance, legal and facilities.
The specific roles and the required skills for a business continuity team depend on an organization's situation and goals, Gregory said. For example, once an organization has identified a recovery strategy and priorities, it can start to designate leaders within that strategy. Anyone who the business names as a responder for a crisis needs training to carry out that role, he said.
"They need to have great knowledge of the organization and of what constitutes a disruption, and they should be trained and be participating in exercises to test the plans," Gregory said.
Business continuity team membership must include management, where appropriate, so when there are major issues around the scale or duration of a disruption, someone can make high-level decisions, even under pressure.
Less formal, but also important, are designated BC champions at various levels in the organization. Business continuity champions take on leadership roles during a disruption. Organizations should also empower others within the company with the skills required to respond. This can be done with an established business continuity framework or plan, Gregory said.
Set priorities based on business needs
Organizations must identify critical deliverables, priorities for recovery and any relevant recovery objectives. This information advises different sets of people within the organization and guides their response, Gregory said.
This kind of preparation can not only instruct the IT team about their recovery strategy and how they need to prioritize tasks, it can also inform the business team of the manual workarounds they may need and the "decisions and communication strategies that may need to be employed while recovery is underway," Gregory said.
BC teams should be mindful of organizational politics, said Greg Schulz, senior advisor at analyst firm StorageIO. There could be pushback about "the way we have always done it," as well as different interests and priorities in different parts of the business, Schulz said.
The business continuity team is likewise driven by the nature and character of the business. Schulz asked: "Is the focus mostly on IT and records management, or have people incorporated a focus on the whole business?"
Use business continuity as a chance to adapt
Business continuity strategy can also evolve due to specific disasters, such as the COVID-19 pandemic. Along with broader business continuity plans, many organizations began to focus more on the health, safety and well-being of employees. Because there is a cost associated with business continuity, BCDR and crisis management planners need to consider the real business needs and the scale of the plan. Some businesses can tolerate downtime with little impact, while others must be up 24/7.
The business continuity team may also have other forms, said Naveen Chhabra, senior analyst at Forrester Research. "Typically, in a larger enterprise, there would be an enterprise risk group or team, and the people in that group typically identify risks and then work with the line-of-business people or the function leaders to identify the best mitigation strategies," he said.
While IT organizations usually have their own DR plans, "they should not stand in a silo," Chhabra said. As a general practice, organizations should undergo a business impact analysis and risk assessment. These assessments use information about the organization's current state and inform a framework for business continuity.
"Think of BC as the big umbrella that covers DR and crisis management, too," Schulz said.
