Business continuity (BC) is about bringing
back your business post crisis or a disaster situation. Business continuity is
about managing ‘black swan’ events in your organization – something that you
never expected.
Here are the key requirements that ISO 22301
demands that must be done to demonstrate a formal business continuity
management system leading to successful certification.
Step 1 – Business Impact Analysis (BIA) – BIA is the assessment of what is most
important of to your business and how long can you survive without it without
losing any revenue. If you are a Bank you may say my customers are unwilling to
wait outside the ATM if they are not getting cash. Apply the same logic for
your customers and ask them to how long can they wait. You have two values from
this analysis – Your Revenue generating
services (RGS) and maximum acceptable outage(MAO). Both of these – will
determine your business continuity plan (BCP). They will answer ‘what to
restore’ and ‘how fast’?
Step 2 – Risk Assessment is the assessment of
how prepared are you for ensuring availability. It identifies your single point
of failures in all four capabilities – namely site outage, people or skill
outage, technology outage and vendor outage. It questions are you are prepared
or you need a plan. The flaws identified are fed into a plan strategy.
Step 3 – Business Continuity Strategy is your
choice based on budget of what you wish to address. This is also a choice where
a likely failure is imminent. For each outage scenario – there are options. For
example for technology outage – you have redundancy, cold site, warm site and
hot site.
Step 4 – Business Continuity Plans including
incident management structure – who will invoke the plans, incident wise plans
and continuity plans based on outages – reflect the list of plans against each
scenario , who will do what, and how fast we will recover. Documented plans reflect
your organizations’ formal approach. No documentation = no certification = no
formal ‘intent’.
Step 5 – Business Continuity Testing the
above list of plans is the next step as well as most crucial. No testing = No Business
Continuity. Testing approaches start from Table Top exercises (least expensive)
to Switching off the mains (most expensive) – all options are available
depending upon the confidence you wish to have. Additionally test whether your
plans will ensure the same time as defined in the MAO.
Step 6 – Internal Audit – If you are seeking
ISO 22301 also perform an internal audit against all requirements as well as
compliance against the MAO objectives will ensure the auditors do not question
your overall business continuity objectives.
Step 7 – Communication and training are
additional elements to ensure your Rate On Investment on Business Continuity.
More People awareness equals more aware ‘junta’, thereby ensuring least
opportunity of failure.
User questions & answers