This very important question of Succession Planning needs to be factored into your Business Continuity Planning strategy.  As part of Business Impact Assessment and Risk Analysis, you need to look for key areas of the business / organization where there is a key individual who has exclusive skill or knowledge which are vital to keeping the business running.  This could be in senior management or on the floor or in sales; it could happen anywhere in the organization.  When vital knowledge or skills are held by just one person, this is a risk to the business which needs to be addressed in your Business Continuity Plan.  Beyond planning for fire and floods, what happens if one of these key individuals suddenly is not there?  They could be snapped up by the competition or they could be run over by a bus; it doesn’t matter why, the fact is they were there yesterday but today they are not and because of that the key function they were performing is also not there.  What happens next is key to maintain the resiliency of your business or organization.  There needs to be an effective plan in place to keep this key process/function running.  Succession Planning means you have someone else being trained as a back-up for the key individual, some who may or will one day take over their role in the organization (an apprentice to the master, or expert-in-training).  The fact is, that effective BCP requires that you are not reliant on any one person to keep the origination operational.  This very important area should not be   overlooked when conducting the Business Impact Assessment which will fame out the requirements for the BCP.  Remember, people are your most valuable asset.

​For more information, check out:   
http://www.businesscontinuityuk.net/businesscontinuity/succession-planning-business-continuity

Today, we have mobile devices and cloud based systems and the number one threat these days are cyber-attacks; hacking, loss of data, data breaches, randsomware, loss of service…  Technology keeps evolving at an ever rapid pace and we have become even more reliant on electronic systems and services to keep our businesses alive.  This requires our Business Continuity Planning Strategy to also continue to evolve to keep up with the current times.  Just having a plan in place from a few years ago does not mean it is still appropriate for your business today.  Just a few years ago, it would have been acceptable to back up critical systems on CDs/DVDs/Tapes and store them off site in the event the system went down and you needed to access the information.   So you just loaded the CD/DVD/Tape into another computer and got what you needed. 
In today’s world, electronic systems perform many  tasks to support the critical functions for large and small businesses; such as customer service, ordering, accounting, payroll, inventory, taxes, shipping, communications, manufacturing, training, and the list goes on.
The questions to ask are – If these systems were to become unavailable, would you be able to continue to perform these functions some other way?  If not, how long could you wait until the interruption spelled serious trouble for your business?  What will it cost you (in terms of lost business, loss of sensitive data, loss of customer confidence) if a particular system was lost (for any reason)?  What would it cost you to put in a contingency plan to provide back up for this system?  These questions need to be asked on a regular basis, not just once, as the answers will change over time.
The answers to these questions will help drive the Business Continuity Planning effort to focus on key critical functions and come up with proactive plans to address the what-if scenarios so you will be prepared in the event of an outage. 
BCP planning for potential cyber-attacks involves close cooperation between the business owners and IT professionals or vendors in your organization.  It involves technical as well as procedural controls be put in place.  And it involves challenging these protections on a regular basis.  Tecnh8icla protections include such measures as firewalls, strong password requirements, encryption of data, etc.  Procedural controls include such measures as password aging (require frequent reset), limiting access of critical data to key individuals only, background checks of employees, policies on providing information, information protection policies (ex. Clean desk  - do not leave any paperwork on your desk when your leave your desk, Secure devices – company information cannot be transmitted over personal devices, Help Desk policy – individuals identify must be confirmed prior to resetting passwords or  providing any assistance to enable the individual to access the system, Internet policy – only allowed secure devices are allowed on the internet, Cell phone policy – no cell phones in areas where sensitive data / operations reside, etc.).  All of these control measures must be challenged on a regular basis as part of BCP testing and any vulnerabilities found must be remediated and the plan updated as needed to maintain a secure environment.
More information can be found here:
​http://www.eci.com/blog/15674-exploring-the-links-between-cybersecurity-and-business-continuity.html
​
http://continuitycenters.com/news/cyber-security-business-continuity-go-hand-hand/

The ISO standard also has requirements for auditing and ongoing monitoring. During the audit and BCP challenge testing, the results collected are not just pass/fail results but specific performance indicators which allow the organization to focus on specific areas of improvement. The goal of the audit is to ensure that the prioritized critical activities are maintained in the event of a disruption in operations or a disaster. This is basically a formal system for managing the business continuity plan, ensuring it works as intended, and implementing ongoing improvements to ensure its continued viability in the future.

For more information please check out this URL: http://www.praxiom.com/iso-22301.htm

A Business Continuity Plan (BCP) is a roadmap to enable a business to continue operations under adverse conditions, such as an unforeseen disaster or other unplanned interruption to the business.  This includes:

• Natural Disasters, such as: bad weather, flooding, earthquake, disease, etc.
• Man-made business interruptions, such as: labor strikes, power outages, arson, theft, terrorism, trade embargo, etc.
• Any other identified risk to the business, such as: critical supplier closes their doors unexpectedly

This is not the same thing as IT disaster recovery.  IT disaster recovery involves making sure your IT systems can continue to function and your data is still available in the event that your primary systems go down; if a fire wipes out your server room for example or a massive blackout disables your primary network routers.  Typically your IT service provider will provide you with options for backup hosting at other sites as part of Disaster Recovery Planning (DRP).  Large companies with big IT departments in different locations can manage DRP internally by having backup servers at different sites.

DRP is an important part of BCP, but BCP goes beyond just IT systems and looks at the entire business structure.  It is critical that the IT system continue to function after a disaster, but if there is no one available or able to use these systems then how will the business continue to operate?  BCP seeks to answer the big-picture questions such as:

• In the event of a disaster where will your people work from? 
• If downed trees and power lines cut off major roadways needed for distributing your product what will you do? 
• If a swine flu outbreak keeps 3/4 of your staff at home can your business still function? 

 
This is what BCP looks at; being prepared for the unplanned interruptions.  Making advanced preparations just in case of disaster is good business, but it does involve some cost, which can be significant.  This is where cost-conscious organizations and businesses with limited budgets have major concerns.  The result can be avoidance or undue risk-taking; hoping for the best because it just costs too much to be adequately prepared.  This need not be the case.  Spending a lot of money to set up a BCP does not make it more value added nor better for your business.  Taking a logical approach that makes sense for your business and understanding the risks does make a BCP more value-added.
 
To be effective and value-added the level of preparation needs to be evaluated against the potential risk. This is what a good BCP plan will evaluate. The plan needs to be created after carefully looking at each critical business operation and identifying the associated level of risk should this operation go down.  In addition, there needs to be a thorough evaluation of the options for maintaining business operations in the event of a disaster; i.e. backup or contingency plans.  Based on this evaluation (typically know as a Business Impact Analysis or BIA), an effective and realistic BCP can be created which will effectively help the business to survive and operate during an unforeseen interruption or disaster.

Electronic online systems are great at keeping information safe should a disaster like a fire or flood remove your access to your information stored at your site, or destroy it altogether.  Definitely for remediation of this contingency, it is advisable to have information safely stored electronically.  However, for some business interruptions scenarios there is a valid need to maintain the information the old fashioned way, printed on paper.  A few years back, a major hurricane passed through the area I was working in.  The effects of this storm were severe enough to knock out power to a large area for almost 2 weeks.  Not only was there no power to operate electronic devices, there was also not power to operate the cell phone towers (if they were even in any shape to work properly) and no power  to operate the ISP network, and no power for the landline phone system either.  I had charged up my cell phone like I was advised to do, only to turn it on and see No Bars…nothing.  No data, no phone, no land phone, no internet…nothing.  In this scenario, any online BCP plans were totally inaccessible thus of no value whatsoever.  Any activation strategies, recovery tasks, team strategies were lost. 
This is where having a paper system or a paper copy of the online plan is critical.  We rely very heavily on technology, but it only takes one gust of 75+ MPH wind to bring this all to a standstill and knock up back to 1940’s style communication.   So if there was no power and no communication via cell or via landline, what would have been the value of a paper BCP?  Here are some answers which a paper BCP could have enabled:

• Team communications – specify a meeting place for local individuals in the event of an emergency.
• Radio communications – identify HAM radio operators prior to a disaster and set up an emergency communications plan ready to activate.
• Critical information – copies of business critical information for key individuals.
• Transportation – maps to remote locations away from the disaster area.
• Back up sites - Addresses of alternate work areas. 
• Recovery plan and list of supplies needed for restarting key operations.
• Satellite phone numbers for key individuals.

Having any of this information helps to shorten the recovery timeline vs. waiting for access to the online system to be restored.   While it is commonly advertised that paper is the obsolete way of the past and has been replaced with automated online cloud based systems, there is and always definitely be an important place for paper documents.  Always factor in “loss of online systems” as one of the likely scenarios to be mitigated.  This can result from storms and power outages, or from man-made disasters such as hacking, viruses and cyber-attacks.  Nothing is disaster-proof, even your disaster recovery system.  Always be prepared.
Check out more detailed responses from a survey published asking about the importance of paper vs. online business continuity plans – very honest and informative:
http://www.continuitycentral.com/feature1111.html

For guidance, here is a guide for small businesses which walks owners and managers through the process to “disaster-proof” the IT systems in their business.  Please go to: https://dgtl.link/biz_continuity

A BCP is a great hedge against unforeseen business interruptions, but it does come at a cost.  Creating, revising and testing a BCP costs both time and money; time of employees spent writing and testing the plan, plus money spent on contracts with backup vendors and consultants.  This is when management begins to question the value of BCP and decisions need to be made to balance the scope of contingency planning against the cost.  At what point are you spending too much for the value you are receiving?
BCP development and implementation by an outsourced consulting company with can easily cost $100,000 or more depending on the scope of the plan and complexity of the organization. Developing your own BCP internally using a template or software incurs the cost of your resources (employee time X hourly rate or salary).  This may be more cost effective for smaller organizations with limited operations and locations.
Regardless of the approach taken, the true value is the remediation of potential losses vs. the cost of BCP.  The questions to ask are

• “How much does cost to be down for a day…for 5 days…for 10 days…?” and
• “What are the highest risk areas which will hit the bottom line the most and the fastest?”

These question are answered in the risk assessment and business impact analyses phase of the BCP creation.  If created appropriately, items identified to be of sufficient risk to the business will require contingency planning.  The scope and cost of contingency planning should be proportional to the risk.  For example, an informational website may not require the same level of redundancy and recovery time objectives as an order-tracking system.  This is evaluated by the business and supported by results of testing the BCP.  A consulting company or vendor may assist in developing the plan and providing the technical solutions, however active participation by resources within the business re required to effectively scope out the BCP, otherwise you could easily end up with costly contingencies which provide limited or no value.  The most fool-proof conservative BCP would always be to buy another entire full scale company complete with facilities and equipment and supplies…. So that if the primary site goes down, you just move everything over to the new site.  Sounds very safe but not at all realistic given the costs and effort required to pull this off.   The other extreme case is to do nothing and hope for the best.  The optimal approach is somewhere in the middle; remediate what really needs remediation and have back up plans for other areas which do not need immediate attention.  Only the business can determine this.  

1. The reasons for implementing the BCP are not supported at the top. 

I have been involved in organizations where BCPs were being implemented because either it sounded like the right thing to do or someone thought it was a good idea because the auditors were rescheduled to show up soon.  The problem was that senior management wasn’t really on board with this idea and therefore no one beneath them really believed this was worth spending the time or money on.  The result of this is a great looking set of documentation with very little behind it.  Example: BCP says “if the site is inaccessible, all employees work from home and we go to a contact manufacturing site.”  This sounds great but is this feasible?  If there is no IT infrastructure in place to enable everyone to work from home, and management in not willing to negotiate a contract for contingency services with a contract manufacturers, because both of these items have a cost, then the plan is doomed to fail if you really needed it.

2. BCP does not look at the entire business. 

Many organizations confuse Disaster Recovery Planning (DRP) with Business Continuity Planning (BCP).  DRP focuses on IT systems while BCP focuses on the entire business and organization.  It is great to be able to recover the IT systems, but if people are not available to use them nor manufacture products nor deliver them to customers, then the plan is not complete.

3. Owner of the BCP is not clearly identified.

 In order for the plan to be successful, there must be an owner who has the responsibility of managing the BCP.  The owner must also have sufficient authority to make business decisions for allocating resources to BCP related tasks, evaluating risks, and authorizing spending for BCP.  Hands-ion tasks such as documentation may be delegated to others but the owner has the responsibility to make sure the plan is maintained, up-to-date, and tested.  In many organizations, the owner is someone (or worse, several people) in senior management whose objective is “Just get it done! And don’t bother me with the details” and then they delegate all the responsibilities of managing the plan to other folks who do not have the authority to implement the plan nor approve the associated expense.  The result is similar to item #1 where you end up with a great looking set of documentation with no value behind it.  Sometimes, the owner is an IT person and then we get into the issues described in item #2 where the plan is heavily focused on DRP rather than looking at the entire business.

4. Inadequate BCP training

It is critical that all members of an organization are familiar with and have been trained on their role(s) within the BCP.  Just reading the documents may not be enough.  Some roles may require using different systems or accessing information from alternative sources or being familiar with alternate locations.  You need to be sure that in the event of a real emergency, there is no confusion about what to do.  Also with all the changes going on in businesses all the time, it is very important to train new people on BCP.  This is an ongoing process that must be kept on the front burner at all times.

5. Inadequate BCP testing.

The effectiveness of the BCP is dependent on the level and frequency testing.  It is not different than fire drills or emergency evacuation drills; you need to be familiar with the process and the best way to do this is to practice a simulated disaster drill. Organizations which do not fully embrace the concept of BCP typically do the minimum of testing to keep costs down and not take people away from doing “real work”. The result is that during a real emergency, you may find yourself in a situation which was not anticipated and as a result, precious time now needs to be spent figuring out how to resolve issues rather than executing the solutions.  Pay now or pay later; the more testing is done up front, the better prepared you will be.

6. Documentation is out of date.

BCP documents are living documents which take time to put together and time to review for accuracy. This time needs to be invested at regular intervals to ensure the documents still have correct information.  If the BCP is write, signed and filed away never to be looked at again until there is a disaster 5 years later, chances are that some if not most of the information is out of date.  Organization trees, phone numbers, addresses, suppliers, customers, account IDs, passwords all change all the time.  It is critical that as part of BCP, there is an allowance for time to be spent on a periodic review of the BCP to ensure it is current.  This can be annual, quarterly; whatever your organization determines to be appropriate but it must done or the value of the plan quickly decreases over time.

7. Inadequate time spent in the planning and evaluating of the BCP strategy.

To create a truly optimized and value-added BCP requires time and effort to analyze and evaluate information from many sources.  This is not something one person working by themselves can just zip out to get it checked off the list.  Even a large team of expert consultants cannot do this overnight by themselves. They must follow a careful process of interviewing all the key information holders in the organization to ensure all the critical factors are considered before making any recommendations for an effective  BCP.  These factors include the critical business process, risk factors, impact analyses, recovery time objectives, costs, logistics, and people issues (not necessarily in that order).  If any of these factors are skipped over or information is just assumed, then there is a real risk that the plan may not be adequate or it may cost more to implement that is really needed.  Nether outcome is acceptable.

8. Inadequate assignments of responsibility.

One to the key success factors to an effective BCP is to assign and distribute responsibilities appropriately.  If all critical responsibilities are assigned to one person, then the system will quickly get overloaded and the process will slow down, or worse some tasks will fail.  If no one is clear who is responsible, then there will be conflicting and unclear direction or no one will be addressing key issues.  There needs to be clear BCP leadership at a top level and then a logical distribution of responsibility at the tactical level .  One key item to consider is where there are multiple locations involved; does it make sense to have the BCP structured by function even though the functions cross different locations?  Or by site so that there is a local person available to provide direction as it is needed?  Also for every assignment of responsibility, there needs to be a primary person and a backup assigned.  This ensure coverage of this area in the event the primary person in unable to perform this function.

Having this knowledge provides very valuable insights to enable the creation of a robust yet cost-effective BCP.

A Business Continuity Plan (BCP) is defined as a roadmap to enable a business to continue operations under adverse conditions, such as an unforeseen disaster or other interruption (bad weather, flooding, power outages, labor strikes, or any other identified risk to the business).  Business continuity planning is a process of identifying the potential risks to your business and then evaluating how to prepare for these so that if they do happen, your business can continue to be viable.  This is not the same thing as IT disaster recovery.  IT disaster recovery involves making sure your IT systems can continue to function and your data is still available in the event that your primary systems go down; if a fire wipes out your server room for example or a massive blackout disables your primary network routers.  Typically your IT service provider will provide you with options for backup hosting at other sites as part of Disaster Recovery Planning (DRP).

DRP is part of BCP, but BCP goes beyond just IT systems and looks at the entire business structure; in the event of a disaster where will your people work from?  If downed trees and power lines cut off major roadways needed for distributing your product what will you do?  If a swine flu outbreak keeps 3/4 of your staff at home can your business still function?  This is what BCP looks at; being prepared for the unplanned interruptions.  Making advanced preparations just in case of disaster is good business, but it does involve some cost, so the level of preparation needs to be evaluated against the potential risk.  This is what an effective BCP plan will evaluate. The plan will look at each critical operation and identify the level of risk and the options for maintaining business in the event of a disaster.  Based on this evaluation (typically know as a Business Impact Analysis or BIA), an effective and realistic BCP can be created which will effectively help the business to survive and operate during an unforeseen interruption or disaster.  The critical elements of the plan must include not just the IT systems but also personnel/employees, communications, production, distribution and (very important) communications with customers, vendors, media, local authorities and governmental regulators.  If you do not pay your taxes or your bank loans because your records are under water, you may not be in business after the water level goes down. 

Big businesses have readily adopted this strategy and brought in consulting firms and purchased enterprise software to set up and manage BCPs.  This has created the biggest opportunity for disaster-planning consultants since Y2K. The down side is that the price tag for having a firm set up and manage a BCP can go into the $100,000’s.  For small businesses, this is too cost prohibitive but BCP is still critical and this should not deter small businesses from seriously thinking about what they would do in the event of a disaster.  

Rather than paying out big$$$ for a team of consultants or licensing enterprise software, small businesses can benefit from following the same logical thinking that the consultants use.  BCP firms typically come into a client with a standard set of templates (a basic generic roadmap for the BCP) which identifies all the potential risks and key operations in a business (paying vendors, manufacturing, customer service, regulatory filings, etc.).  The consultants then interview key individuals in each area and ask them how important each operation they perform is (how long can the business survive without it?).  Then they ask these same people what the options are to keep this operation going if a disaster happens (can you outsource it?  To whom? Can you buy extra supplies and keep them somewhere else?).  Then with this information, the consultants modify the standard templates as needed to suit the situation.  The final modified templates are presented as a customized BCP plan to the business management, who ultimately makes the decisions on what they will support in terms of what steps will be put into place and how much money will be spent.  The bulk of the specific actionable information in the BCP comes from the business, not the consultants.  The BCP templates provide a guide to prompt the appropriate discussions and ask the right questions.  So armed with a basic BCP template, a small business owner can perform this same procedure and come up with an effective BCP on their own or with the help of conscientious person (not necessarily a BCP consultant).  Although the process of setting up and managing a BCP seems very complicated and/or prohibitively expensive for small businesses, it does not need to be.  There are materials and resources available that would greatly help out the small businesses to be prepared for the unforeseen without the need to spend large sums of money.