Developing the BC Plan

After you define the scope of the BCP project and develop the Business Impact Assessment (BIA), Criticality Assessment, and Maximum Tolerable Downtimes (MTDs), you know

What portion of the organization is included in the plan.

Of this portion of the organization, which business functions are so critical that the business would fail if these functions were interrupted for long (or even short) periods of time.

The general degree of impact on the business when one of the critical functions fails. This idea comes from quantitative and qualitative data.

The hard part of the Business Continuity Planning project begins now: You need to develop the strategy for continuing each critical business function when disasters occur, which is known as the Continuity Strategy.

When you develop a Continuity Strategy, you must set politics aside and look at the excruciating details of critical business functions. You need strong coffee, several pizzas, buckets of Rolaids, and cool heads.

Making your BCP project a success

For the important and time-consuming Continuity Strategy phase of the project, you need to follow these guidelines:

Call things like you see them. No biases. No angles. No politics. No favorites. No favors. You’re trying to save the business before the disaster strikes.

Build smaller teams of experts. Each critical business function should have teams dedicated to just that function. That team’s job is to analyze just one critical business function and figure out how you can keep it functioning despite a disaster of some sort. Pick the right people for each team — people who really understand the details of the business process that they’re examining.

Brainstorm. Proper brainstorming considers all ideas, even silly ones (up to a point). Even a silly-sounding idea can lead to a good idea.

Have teams share results with each other. Teams working on individual continuity strategies can get ideas from each other. Each team can share highlights of its work over the past week or two. Some of the things that they say may spark ideas in other teams. You can improve the entire effort by holding these sharing sessions.

Don’t encourage competition or politics in or between teams. Don’t pit teams against each other. Identifying success factors isn’t a zero-sum game: Everyone needs to do an excellent job.

Retain a BCP mentor/expert. If your organization doesn’t have experienced business continuity planners on staff, you need to bring in a consultant — someone who has helped develop plans for other organizations. Even more important than that, make sure the consultant you hire has been on the scene when disaster struck a business he or she was consulting for and has seen a BCP in action.

Simplifying large or complex critical functions

Some critical business functions may be too large and complex to examine in one big chunk. You can break down those complex functions into smaller components, perhaps like this:

People: Has the team identified the critical people — or more appropriately, the critical sub-functions — required to keep the function running?

Facilities: In the event that the function’s primary facilities are unavailable, where can the business perform the function?

Technology: What hardware, software, and other computing/network components support the critical function? If parts or all of these components are unavailable, what other equipment can support the critical business functions? Do you need to perform the functions any differently?

Miscellaneous: What supplies, other equipment, and services do you need to support the critical business function?

Analyzing processes is like disassembling Tinkertoy houses — you have to break them down to the level of their individual components. You really do need to understand each step in even the largest processes in order to be able to develop good continuity plans for them.

If a team that analyzes a large complex business function breaks it into groups, such as the groups in the preceding list, the team members need to get together frequently to ensure that their respective strategies for each group eventually become a cohesive whole. Eventually these groups need to come back together and integrate their separate materials into one complete plan.

Documenting the strategy

Now for the part that everyone loves: documentation. The details of the continuity plans for each critical function must be described in minute detail, step by step by step.

Why? The people who develop the strategy may very well not be the people who execute it. The people who develop the strategy may change roles in the company or change jobs altogether. Or the scope of an actual disaster may be wide enough that the critical personnel just aren’t available. Any skeptics should consider September 11 and the impact that this disaster had on a number of companies that lost practically everyone and everything.

Best practices for documenting Business Continuity Plans exist. For this reason, you may want to have an expert around. For $300 an hour, a consultant can spend a couple of weeks developing templates. But watch out — your consultant might just download templates from a BCP website, tweak them a little bit, and spend the rest of his or her time playing Angry Birds. To be sure you get a peach of a consultant, do the old-fashioned things: check his references, ask for work samples, see if he has a decent Facebook page. (We’re pretty sure we’re kidding about that last one.)