The role IT plays in DR and BC
What is a business continuity plan?
A business continuity plan details the plans, processes and systems that you have in place to ensure that a company is in a position to mitigate and overcome threats. The objective is to enable ongoing operations both during and after the disruption, while minimising loss of operational capacity, data and finances. It is concerned with prevention, recovery and resilience and will:
- Comprise a business impact analysis (BIA)
- Be heavily influenced by operational priorities
- Include physical and technological infrastructure
- Work with real data
- Be meticulously documented
- Adhere to strict testing criterion
- Be tested regularly
In most organisations, a project management team comprising senior figures from key operational areas, plus business continuity experts, will formulate and own the business continuity plan.
A business continuity plan is work in progress
The best business continuity plans will never be “complete” – which makes sense considering the world around us constantly changes. In fact, approaching them as fluid, flexible and temporary as opposed to a box checked off is a principle factor in achieving effectiveness.
Take the philosophy of kaizen – translated as “continuous improvement” – pioneered by automobile manufacturer Toyota. No process can ever be declared perfect, but it can always be improved. All team members are empowered to constantly look for ways to improve, with a focus on what should be done, rather than what can be done.
Despite being open-minded and to a degree, open-ended, continuous improvement requires the setting of clear objectives and targets – it is committed to resolving any problems or threats in a candid, disciplined fashion. Applying this practice to business continuity will undoubtedly ensure your plan is in keeping with the real world and evolving challenges, and never be trapped in an ineffectual bureaucracy vacuum.
Business continuity and operational resilience
If the coronavirus crisis has taught businesses one thing, it’s that there’s more than one way to make things work. As continuity plans have kicked in, those with the most flexible and robust provision have been able to carry on operating, despite significant disruption from many sources.
The underlying principle here is that of “operational resilience”. Effectively the end goal of business continuity, operational resilience is a set of capabilities, processes, systems and staff behaviour that allow you to alter operations when the world around you or business conditions change. And if you can alter, you can continue albeit sometimes in a slightly different fashion.
Is operational resilience the new business continuity?
In today’s digital world, operational resilience is undoubtedly rooted in IT. Take the global pandemic, for example. Remote working and communication technologies were (and continue to be) fundamental to our capacity to keep going. We always knew that technology empowered a different, more flexible way of working. But up until recently, this had been a peripheral issue that came in waves of interest.
As such, leading experts in the business continuity field are asking whether we’ve reached a tipping point for true operational resilience. Is now the moment when senior management teams change their approach to technology, its relationship with business continuity and resilience and how they spend on it? In the new world of continuity and resilience, we predict that strategic business continuity teams will form, continuously looking at opportunities for diversification and reinforcement – with IT and technology being central to creativity, effectiveness and sustainability.
Business continuity from an IT perspective
We all have business continuity plans. But there is a key difference between those that do and do not champion IT and embrace new technologies as a core component of BC. That of surviving, versus thriving. There has been evidence that investing in IT, taking an agile approach, and heavily integrating with operational continuity has put companies in a much stronger position and allowed them to keep ahead of the curve. This is particularly true for manufacturers, retailers, finance and non-profits.
Traditionally, the IT aspect of BC is disaster recovery (DR), which you can read more about below. But now, organisations are widening their focus from systems and data recovery and the cloud. We expect industries to examine how their IT systems can better help people and operational processes work together, be more resilient and perform better in a change of circumstance.
For example, ensuring that customer service, production and distribution systems and staff can still interact following a power outage, or having training in place for running a skeleton system in manufacturing should the main server be damaged. Recovering data and systems alone is no good if critical business process is neglected.
How are business continuity and disaster recovery connected?
BC and DR are mutual partners. BC covers the plans you have in place to mitigate disruption to business-critical functions and DR is the IT aspect of this. DR is concerned with maintaining and recovering technology infrastructure – especially servers, connectivity, data and applications – and the goal is to quickly resume mission-critical IT should it be unavailable for any length of time. You can read more about DR here or about how BC and DR are connected here.
What is the difference between business continuity and service continuity?
BC and DR are often mistaken as being different terms for the same thing. The same applies to service continuity, which has been a major focus for many companies trying to push through the immediate aftermath of panic buying and lockdown restrictions.
Think of service continuity as the bare minimum that a BC plan needs to deliver – it might keep you going for a short time, but really is a temporary measure. Service continuity ensures that minimum levels of business continuity related technology services are always available to reduce operational risk to an acceptable level. With the pandemic solidifying the importance of resilience, businesses should reassess how much of their BC planning could be categorised as “service continuity” and focus on adaptability, agility and flexibility instead.
What IT infrastructure needs to be included in a business continuity plan?
Following a BC consultation, implementations may be made in the following areas. Network, connectivity, cloud and virtualistion are particularly critical to modern, resilient business continuity provision.
- Hardware and break/fix
- Network and connectivity
- Databases and storage
- Cloud and virtualisation
- Helpdesk support
Business continuity and cloud computing
The cloud is transforming how business-critical applications and data are accessed and stored and its benefits are undeniable from a business continuity planning perspective. Most importantly systems, applications and data can be accessed from anywhere at any time which enables safe remote working and maintenance for large numbers of the workforce. Cloud solutions such as private cloud platforms and Software as a Service deliver a more effective approach to managing incidents and allow for quick movement and ultimately, a more sustainable operation.
Unsurprisingly, in light of recent events, organisations that were previously hesitant to move some or all of their IT provision into the cloud are now citing that cloud technologies are very much on their agenda – from online backup to application hosting and communications – for the following reasons:
Resilience – Private cloud and SaaS solutions are meticulously maintained utilise dual data centre redundancy to ensure maximum availability and uptime, so IT is always there when it’s needed
Performance – The cloud is powered by the latest technology that is continuously upgraded by third parties. This means that customers (i.e., you) benefit from enhanced performance and the ability to handle large workloads without issue
Flexibility – Systems, apps and data are accessible from any device you wish, from anywhere in the world at any time, so you can be as productive as possible and continue servicing customers
Security – Private cloud platforms deploy robust cybersecurity and can be configured with watertight permissions and accessibility policies along with data encryption
CapEx spend – Pay for what you use cloud platforms are available and classify as CapEx investment, so you may be able to commit more IT budget to BC planning as a result
Scalability – The cloud is never truly fixed, so when business or market conditions change, you can quickly adapt your IT provision
How often should you review a business continuity plan?
As discussed, approaching your BC plan with the kaizen principle of continuous improvement will help it remain fit for purpose and poised for the most disruptive and relevant challenges of the day. We recommend scheduling quarterly review sessions but with the understanding that plan is always subject to change. We also advise revisiting the plan following every near-miss or adverse event, such as the coronavirus crisis
But we must stress. During the pandemic, it is important to not take your eye off the ball in other areas of your business. This is when things will go wrong. Being continuously engaged with the BC plans keeps you aware of what’s going on in your environment and helps you better prepare for what is likely to hit you next.
What changes should you make to a BC plan following coronavirus?
The terrible situation has shown where some companies can come out fighter stronger, rather than just coping or muddling through an admittedly unprecedented time. Experts believe that now is the time to look at new opportunities and possibly permanent changes – with IT implementations, reconfigurations, and integrations central to updated plans. It is predicted that these five key changes will define the future BC planning landscape:
- Reviewing priorities, i.e. is automation, private cloud or other forms of digital transformation now higher on the agenda
- Considering new ways to spread risk, including any implementations or training involved
- Reevaluating testing criterions and “what good looks like”, i.e. resilience over service continuity
- Redistributing BC spend, with more budget being funneled into technology that enables improved efficiency, agility and adaptability
- Approaching from a cost-saving angle, such as gradually reducing office-based heads and associated on-premise infrastructure and OpEx spend
All in all, a plan should focus on intelligently fine-tuning the basics with the power of modern IT, so that resilience becomes standard, and businesses never need to hit that metaphorical big red button when something inevitably goes wrong.
If this article has got you thinking about your own BC provision, take the next step and speak to K3 about how IT can best support your business continuity plan and practices. Call us on 0844 579 0800, email firstname.lastname@example.org or complete a contact form here.