Business Continuity Plan and Continuity of Operations Planning - Research Paper Example

Business Continuity Plan and Continuity of Operations Planning Introduction It is quite a task to roll out the plans of a business so that it is able to continue with its objectives. Business continuity can therefore be defined as the aspects that a business need to take care of like procedures, processes, decisions and activities so that a business can continue operating during turbulent times. This form of planning is about making proactive and reactive strategies to help any given organization avoid a crisis or disaster or to be able to go back to business as usual incase such crisis occur (Asnar & Giorgini, 2008). For a business to survive turbulent situations, two distinct components must be integrated; that is the continuity planning aspect and the continuity management aspect. Business continuity is a situation whereby the plan will be formulated which on implementation is likely to avoid operational interruption for the business or alleviate the business from disaster. The plan can perform the other function of bringing out the businesses from such crisis incase such events happen. The business Continuity plan that is prepared has to undergo a testing and exercise process to ensure that it will perform as expected. The second component is to devise a planning component for the continuity management, this has two impacts that is to ensure that the plan is always current and available; it also perpetuates the current management operation resilience and process availability to facilitate that the business operations take place at the minimum possible exposure to risk (Asnar & Giorgini, 2008). According to Business continuity plan (Version 2. ed.). (2008), the aspect of business continuity in any business is hence vital as it helps achieve several things for any organization. For success of any of these components, an investment in terms of effort, skill, and resource and staff commitment must be made in terms of engaging in the business continuity activities (Blyth, 2009). In any business continuity program there will always be a number of actual and expected outcomes and these are organization specific therefore unique to every organization. Some of the common outcomes expected on any company entail:- a deeper an clearer understanding of any organization since it involves planning on one hand and management of the continuity on the other side in a clear overview of the whole organization. These activities are not only important for BCP but also the other areas of the organizations development and management. Another common outcome is the development of proactive and reactive measures to help in the prevention of interruptions of organizational activities and recovery of business after interruptions of organizational activities respectively. BCM has the sole objective of making organizations operate at their maximum capability through identifying and implementing measures which if instituted can prevent interruptions, crises, and disaster from taking place (Darnell & Stern, 2009). On the other hand reactive measures also ought to be instituted to ensure safety incase the proactive measures fail, are overwhelmed or are bypassed mistakenly by some unforeseen happenings (World, 2002). Such measures have the role of returning the organization to acceptable levels of operations within the required time span after the happenings of a disaster or crisis. Lastly, BCM involves extensive analysis of organizational culture. Such analysis are conducted with the objective of employment of techniques that provides a cultural environment where employees are always made aware of risk as well as a familiarization on their individual responsibility to report such risks, manage and mitigate them (Blyth, 2009). What is a Business Continuity Plan? A business continuity plan is a guide to continue the operations of an organization when in adverse conditions or in crisis. Other organizations call it Continuity of operations planning (BCRP) while others still call it Continuity of Operations Planning (COOP) (Dennis & Yang, 2007). It identifies and deals with an organization internal and external threats providing an effective recovery plan for the organization, which helps it, maintain a competitive advantage and the integrity of any value system. According to SANS definition, “Business continuity refers to the activities required to keep the organization running during a period of displacement or interruption of the normal operation.” On the other hand, disaster recovery is the way of rebuilding one’s operations or infrastructure after a disaster has occurred. Designed from the above definitions, “Business Continuity Plan is a collection of process and information which is developed, compiled, and maintained in readiness for use in the event of any disaster or emergency occurring.” An emergency or disaster can happen at any time and unexpectedly hence the need to be prepared. Any business continuity plan is designed depending on the nature and size of the business o help in the minimization or disruption of disaster hence keep the business remain competitive (World, 2002). It is worthwhile to realize that most businesses today are technologically oriented. Again, with the emergence of e-business, it is difficult to survive without operating 24 hours 7 days a week and this translates into massive disaster to the operations of the business (Barnes, 2001). A business continuity plan replaced the traditional Disaster Recovery Plan (DRP), which focused largely on restoring any centralized data center due to the insufficiency that it exposed. As time passes, an even more comprehensive and advanced BCP will need to be installed in modern organizations for the sake of business continuity due to the establishment of critical systems and networks (Doughty, 2001). Business Continuity Plan is quite important mostly when a business faces a disruption or a disaster. The BCP covers the occurrence of events such as equipment failure, disruption of power supply or communication systems, human error, sabotage or strike and any other malicious software. With the divergence of the structure of any IT systems in any central processing to be distributed enables the companies data located across the enterprise (Wallace & Webber, 2004). Hence, it is insufficient to rely on IT department alone in business continuity planning hence all executives, managers and all employees must participate in such plans. Most of the time Business Continuity Coordinator or the Disaster Recovery Coordinator are the sole people responsible for maintaining a BCP though he should not be alone in planning the program. He only needs to do a review job of the program periodically by distributing all the relevant portions to the owner of the documents and ensure documents are argyle (Goh & Leo, 2004). What regulatory, statue requires a BCP? Several laws and regulations specify or imply the mandatory requirements of business continuity and disaster recovery planning (Goh & Leo, 2004). These entire legal requirements are highly variable depending on sectors and development issues including the focus and execution of the business continuity plan. It is vital to know that even in the event that business continuity is not clear in terms of the laws that govern it or the regulations. Issues can crop up such as those on data integrity and internal controls will call for additional demands for the sake of updating a BCP hence the availability of information. In as much as there is compliance that is required in terms the law BCP still needs to go beyond the minimum requirement through relevant planning and trainings. The trainings and developments depend on the industry, region, and impact analysis to keep the organization moving on (Goh & Leo, 2005). Organizational boundaries is clearly divided in two areas BC/DR and data security which enhances the development of strategies and tactics to help share the concerns about information security risks to aid an organization establish and execute a BCP (Goh & Leo, 2005). This therefore makes an organization remain liable for its systems and processes in terms of data irrespective of whether regulations does not specify the kind of Business Continuity Plan or how it is tested. It is also important to note that laws and regulations, shareholders and organizations expectations requires that organizations themselves exercise due care to make sure that required data is there. According to Gartner analyst, laws and regulations influence BCP in sectors such as health, finance, utilities, and the government as stated in the table below (Goh, 2006). Industry Law/Regulation Impact on BCP healthcare Health Insurance Portability and Accountability Act (HIPAA) of 1996 It requires data backup plan, DR plan and emergency mode operation plan. It also requires reasonable and appropriate measures relative to the size, complexity, and resources of the organization. Food and Drug Administration (FDA) Code of Federal Regulations (CFR), Title XXI, 1999 The law establishes the requirements for electronic records and electronic signatures. Government Federal Information Security Act (FISMA) of 2002, Title III of the E-Government Act of 2002 (PL 107-347, 17 December 2002) Executive Order on Critical Infrastructure Protection in the Information Age, 16 October 2001 The law mostly emphasizes data security rather than BC and DR. An important need to be addressed is the requirement that government is open and running during a crisis. COOP and Continuity of Government (COG). Federal Preparedness Circular 69, 26 July 1999 The law establishes minimum planning considerations for federal government operations. Finance Federal Financial Institutions Examination Council (FFIEC) Handbook, 2003-2004 (Chapter 10) The law specifies that directors and managers are accountable for organization wide contingency planning and for "timely resumption of operations in the event of a disaster." Basel II, Basel Committee on Banking Supervision, Sound Practices for Management and Supervision, 2003 This law requires that banks put in place BC and DR plans to ensure continuous operation and to limit losses. Utilities Governmental Accounting Standards Board (GASB) Statement No. 34, June 1999 The law requires a BCP to ensure that agency mission continues in time of crisis. Telecommunications Act of 1996, Section 256, Coordination for Interconnectivity. This law requires the Federal Communications Commission (FCC) to establish procedures to oversee coordinated network planning by carriers and other providers. How does a Business Continuity Plan fit with Continuity of Operations Planning? Continuity of operations planning is openly a good business practice. Such operations will facilitate that the critical business functions of an organization are effectively and efficiently executed irrespective of the circumstances (Goh, 2006). This is derived from the fact that fundamental responsibilities of both the public and private sector organizations to their stakeholders. It is open and quite in the public domain based on the years of experience that a series of emergencies and disasters can occur at any time some exhibiting signs of warnings while others do not. These emergencies can either be large or small ranging from accidents, natural disasters, military or terrorists, hardware failures and data center incidents. The eye openers are either 9/11 incident and the hurricane Katrina opened the eyes towards having any robust continuity capabilities and planning that aids firms to continue their essential functions through all emergencies (Snedaker, 2007). Business Continuity planning has helped organizations such as health and medical departments to be no more from disasters than other government entities (Goh, 2006). Therefore, the Continuity of Operations plan (COOP) will help organizations in the healthcare systems or the other medical facilities with continuity planning for their critical functions hence ensure their daily operations (Hiles & Barnes, 1999). The vital elements that such a plan is composed of include:- all the plans and process are established for all the readiness levels and all the essential business functions. Another element is the succession of key leadership position, how authority through an association of duties while safeguarding of any organizations resources and vital records. In the process of such planning, there must be an effective identification of continuity facilities, a plan of a communication system to eliminate redundant networks. A business continuity planning is a process that incorporates human capital and the process is incorporated through the same plan while testing it, training and conducting exercising activities on the human capital. The COOP also helps specify a plan for the devolution of all the necessary business functions, even after making and executing such a plan, another plan for reconstitution needs to be there even after the occurrence of the disaster (Kildow, 2011). The mode in which business continuity has shaped COOP is through the establishment of policy framework and guidance hence facilitating essential business functions of modern organizations and firms in the event that any manmade, natural or technological disasters that threatens normal business hence disrupting operations (Kildow, 2011). The COOP therefore facilitates the operations of the organizations to work with a significantly reduce workforce and decreasing availability of resources in conducing the business operations from an alternate working site in case the original site becomes hostile. Business continuity also assists COOP to be applied in organizations embrace he dependence on the computer technology (Hiles & Barnes, 1999). Any modern organization that suffers a IT or any form of business interruption like hardware failures or interruption in data from data centers should be in the verge of being prepared for the loss in their productivity and hence the ability to deliver required products. Such interruptions also have the possibilities of derailing the organizations in terms of how they relate with their publics in the sense that the delay in service delivery significantly resulting into negative implications which may be long lasting and far-reaching in terms of their consequences (Kildow, 2011). Does the plan have all areas involved in a Business Continuity Plan? My assessment of the business plan conclusively informs me that the Business Continuity Plan is composed of all the areas that are critical and fundamental. In preparing an effective BCP as described above entails a preparation of all the components of thee plan, then an identification is done together with the containment or mitigation strategies (Wallace & Webber, 2004). In case the mitigation strategies do not work there has to be in the same system a procedure of eradicating the disaster without harming the successes of the same, that is to say the the system in place should be in such a manner that it can take through the organization in a recovery session without impacting on its operations (Snedaker, 2007). The plan as observed should also detail a follow up technique that is quite feasible and can monitor the operations. The procedures identified above in some instances occur simultaneously with an objective of putting an organization in the state that they are prepared for the worst and do not get such in the state that they are faced by the worst possible scenario (Kildow, 2011). Planning for any possible contingency will ensure that any form of nasty surprise is met on the road. This is ensured through one, getting the needed sponsorship where all the employees are required to know and understand their roles well and such sponsorships must be renewable (Markova & Aula, 2007). Secondly, the BCP team must be defined in prior so that the pain that would result from the occurrence of any disaster is taken care of in advance. A team is streamlined through cross-organizational definition of goals and determination of leadership, roles, and responsibilities and determination of an appropriate team size. The next step is the definition of the BCP scope to help in determining the range in which I is able to extend its operations. The BCP should then be documented followed by a test and revision of the plan. The document is tested and revised given that it is called a living document given its ability to adapt to eventualities in terms of the changing risks and organizational shift (Markova & Aula, 2007). The seventh and last step is to integrate the BCP together with the other organizational roles like the DR so that incase a security incident occurs an organization is in the position of knowing when it should trigger a response. This incorporation includes a decision on which assets to build first to ensure that the business operations do not stall (Yeung, 2006). The relative programs ought to be developed fully and prioritization in terms of risk consideration is conducted. The overall objective is to ensure that the safety of the a business future is enhanced through taken care of mitigation of risks, protection of an organizations reputation hence achievement of compliance. The BCP components as stated above are much ready to help organizations move forwards and therefore needs urgent implementation for prosperity in the organization functions (Myers, 1993). Based on the research is the plan complete/viable? Based on the research the plan as defined above in terms of the components and adherence to laws and stated regulations the BCP is much viable (Arlington, 2004). This is because; the COOP Team is responsible for identifying devolution components triggering factors. Then the CEO will be informed of staffing levels in all the critical areas of the organization after which the management will initiate a pre-devolution assessment of risks and procedures. Should thre be a sufficiency in terms of staff required they will go ahead to conduct the missions and all the essential functions of the organization (Myers, 1993). The CEO should after that start an activation of pre-arranged devolution agreements of the BCP implementation process. After all the above, devolution will be triggered when the CEO determines that available staff and resources are sufficient to carry out or perform and maintain the organization has prioritized COOP functions and objectives. The intended revolutionized organization will be notified that the devolution exists and is likely to lead to a transfer of knowledge and resources necessary for devolution (Rittinghouse & Ransome, 2005). At that point, the CEO will begin procedures to draft devolution agreements in consultation with the Legal Counsel and the company’s Board of Directors. The key staff members of the organization to be involved in the devolution should be informed on how to access the organization COOP plan and all the related information (Yeung, 2006). The viability is further proved through reconstitution which is the process by which surviving and/or replacement organization’s personnel resume normal operations at the original or replacement facility (Snedaker, 2007). There are three tasks associated with reconstitution and they entail transitioning, coordinating and planning and outlining the procedures. Whether to reconstitute or not is largely based on: - The availability of personnel, The safety of the primary facility or the availability of a new site, IT capabilities of the facility, Financial resource concerns and any other issues that may arise (Rittinghouse & Ransome, 2005). Another proof is that after the happening of a disaster operations may be resumed in phases with the essential functions being given the first priority followed by other functions as resources allocation and personnel addition (Arlington, 2004). Information to be floated to the public for this entail: - The address of the new site if available, the list of available resources for moving equipment and personnel, and parking of commuter information for people returning to work (Rittinghouse & Ransome, 2005). Otherwise the plan is much viable hence should be implemented. References Arlington, V. (2004). HR's role in developing a business continuity plan. Washington, D.C.: Bureau of National Affairs. Asnar, Y., & Giorgini, P. (2008). Analyzing Business Continuity through a Multi-layers Model. Business Process Management, 54, 212-227. Barnes, J. C. (2001). A guide to business continuity planning. Chichester: John Wiley & Sons. Blyth, M. (2009). Business continuity management building an effective incident management plan. Hoboken, N.J.: J. Wiley & Sons. Business continuity plan (Version 2. ed.). (2008). Portland, Or.: Oregon Dept. of Environmental Quality. Darnell, D., & Stern, J. (2009). Developing an evacuation plan for the Obama presidential inauguration. Journal of Business Continuity & Emergency Planning, 3(4), 282-290. Dennis., & Yang, C. (2007). Bringing the Mobile Workforce to Business: A Case Study in a Field Service Organization. Management of Mobile Business, 2007. ICMB 2007. International Conference on the, 45, 39-39. Doughty, K. (2001). Business continuity planning: protecting your organization's life. Boca Raton: Auerbach. Goh, M. H., & Leo, Y. N. (2004). Implementing your business continuity plan (Student ed.). Singapore: GMH Continuity Architects. Goh, M. H., & Leo, Y. N. (2005). Developing recovery strategy for your business continuity plan (Student ed.). Singapore: GMH Continuity Architects. Goh, M. H. (2006). Testing & exercising your business continuity plan (2nd ed., student ed.). Singapore: GMH Continuity Architects. Goh, M. H. (2006). Developing your pandemic influenza business continuity plan (Student ed.). Singapore: GMH Continuity Architects. Hiles, A., & Barnes, P. (1999). The definitive handbook of business continuity management. Chichester: Wiley. Kildow, B. A. (2011). A supply chain management guide to business continuity. New York: American Management Association. Markova, M., & Aula, A. (2007). Conceptualizing How Usability of Mobile Services Affects Business Performance. Management of Mobile Business, 2007. ICMB 2007. International Conference on the, 6, 36-36. Myers, K. N. (1993). Total contingency planning for disasters: managing risk ... minimizing loss ... ensuring business continuity. New York: Wiley. Rittinghouse, J. W., & Ransome, J. F. (2005). Business continuity and disaster recovery for infosec managers. Amsterdam: Elsevier Digital Press. Snedaker, S. (2007). Business continuity and disaster recovery planning for it professionals. Amsterdam: Elsevier. Wallace, M., & Webber, L. (2004). The disaster recovery handbook a step-by-step plan to ensure business continuity and protect vital operations, facilities, and assets. New York: American Management Association. World. (2002). The Business Case for Sustainable Development: Making a Difference towards the Earth Summit 2002 and Beyond. Corporate Environmental Strategy, 9(3), 226-235. Yeung, H. (2006). Change and Continuity in Southeast Asian Ethnic Chinese Business. Asia Pacific Journal of Management, 23(3), 229-254-254. Read More