Develop a comprehensive business continuity program to prepare for emergencies

The state of business continuity and disaster recovery planning is dismal in most organizations and nonexistent in many. Most plans in place simply won’t work. This is not surprising since disaster recovery hasn't been given sufficient consideration; until now, it's been among CIOs’ lower priorities.

The terms business continuity and disaster recovery are used interchangeably in the industry, but are not exactly the same. We view the terms in a hierarchical perspective for the purposes of ensuring continuity of your key business processes, delivery services, and IT services. IT disaster recovery is a significant component of business continuity, but you must consider more when planning for expected events.

In an emergency, there are many continuity requirements within the organization’s business and services covering processes, facilities, personnel, and others. IT and a variety of business units across the organization must work in concert, both in planning for continuity and in its execution.

Today, the disaster recovery capabilities in many organizations contribute little to their real objectives and operations. But with rising threats to our socio-politico-economic infrastructures, government and business leaders are more aware of their dependencies and risks regarding information technology. They're recognizing the extent of their vulnerabilities, and are becoming more amenable to allocating resources to reduce their risks. There is now a window of opportunity to gain control of business continuity and disaster recovery and build programs that contribute to desired business outcomes.

The challenges
When organizations think about disaster recovery, they commonly think about technology—tape backup systems, storage systems, and hot sites. Technology, particularly high availability technology, is an important part of business continuity and disaster recovery. However, there is more—much more. You need a way to ensure that plans are relevant and realistic, accurate and up to date, workable and manageable, and cost-effective.

You'll want to build and manage a process to ensure that business continuity strategies, plans, and procedures are always appropriate. You'll have to manage business continuity as a service to ensure the business gets what it needs, when it needs it, at a reasonable cost.

The business continuity framework is a way to ensure that key aspects of the business, service delivery, and technology infrastructure, including the business continuity process, are assessed, built, and managed in a comprehensive and logical manner by placing emphasis on process, technology, and organization.

The diagram shows one manifestation of the assess-build-manage model. Key components of the business continuity framework include the following.

Business impact analysis
Business continuity planning depends on a clear understanding of business processes and data and associated risks. The business continuity process formalizes procedures to (1) identify important business processes, data, and technology infrastructure; (2) identify associated risks and impact; and (3) develop scenarios and business continuity strategies. With formal procedures, you can ensure business continuity strategies are evaluated and updated continuously.

Service management
Business continuity is a service and must be driven by service levels. These include descriptions of continuous (no downtime allowed) and resilient (some downtime allowed) systems with time-to-restore and point-of-restoration metrics.