Emergency Planning and Business Operations Continuation

With respect to emergency plans, accounting for a business interruption, no matter how big or small, may be the most important task a company undertakes. Being prepared to recover from a business interruption and readily continue daily operations can determine the survival of a company following a large-enough disruption

An entire industry exists today for managing business interruptions. Specially-trained personnel are available, including those with college degrees and advanced educational certifications. Continuity plans are all-encompassing and cover both short-term and long-term disruption planning for critical business operations that must continue for the health and survival of the organization. This planning consists of pre-disaster planning (contingency: functions connected to business operations) and post-disaster planning (recovery: functions related to information technology)

There is a fundamental shift in focus when beginning the Business Operations Continuation (BOC) planning process as a part of general emergency planning. BOC focuses on maintaining the vitality and overall health of the organization after a major interruption, and not on physical facility protection or daily occupant needs

BOC planning is a process that includes:

  • business operations analysis
  • technical operations analysis
  • developing the recovery plan
  • writing the plan

Business Operations Analysis

This process is used first to identify critical business operations and procedures that, if interrupted, would directly affect the financial well-being or service commitments of the organization. Second, it identifies the consequences of an interruption. Third, it estimates projected recovery times for critical business operations. This analysis guides a company in establishing priorities and recovery procedures

Technical Operations Analysis

With the rapid growth of technology, many BOC plans become outdated in a very short period of time. A quality plan will be detailed enough to ensure the resumption of business operations, yet flexible enough to accommodate technological advancements. When considering at the technical side of a company, there are four areas to consider:

  • data storage and backup
  • recovery processes and timetables
  • capturing programming modifications
  • unique systems identification

Data Storage and Backup

Reviewing data storage and backup procedures may be one of the most important tasks performed while writing a plan. Make sure to identify all alternate locations for data, such as offsite tape-storage sites. Validating the data being backed up should also be part of the plan; in other words, verify that the backup tapes actually contain copied data. If the backup procedure is not working, the company may be storing blank tapes at an off-site location. A determination of backup intervals and a backup window will also need to be identified

Recovery Processes and Timetables

Many systems and processes involving programming and storage media are essential to computer operations. Identifying those critical processes that must be recovered can be challenging and time-consuming, but it is necessary. Developing an accurate recovery timetable for the technical aspects of a business will set the stage for projecting a reasonable recovery expectation. The recovery timetable should include the contact information for the system suppliers or data recovery systems

Most organizations have established recovery plans for their technical operations. Refining these recovery processes during the BOC plan development process will strengthen the BOC plan. (It is important to note that, every time you update or review the plans, you are refining them.)

Capturing Programming Modifications

Many business organizations utilizing off-the-shelf software make a reasonably large number of modifications either to function more efficiently within their systems framework or for formatting purposes. These changes or modifications should be captured and made part of the BOC process. The number of hours expended to make these software modifications may have exceeded the initial cost of the software being utilized. Additionally, some end users may have programming access that allows them to make software modifications, and data may not be able to run across the platform until the modifications are in place or the data has been reformatted

Unique Systems Identification

At first glance, one would assume that all equipment being utilized is onsite and located within the data processing center. With the advancement of technology and the ever-changing work environment, systems small and large are being located outside of business facilities. The age of high-speed Internet has made off-site storage of systems feasible, and unnoticeable to the end user. Failing to identify these systems can mean that a critical area of business operation may not function for an extended period

Developing the Recovery Plan

Developing a recovery plan should be a methodical process that requires commitment by the company management team to create a quality and usable document. Remember, commitment starts at the top before it can work its way down. With this in mind, an introductory document from the president or senior management will help to secure the commitment needed for successful completion of these documents. Businesses should test their plans with a dry run at least every 12 months

The recovery-plan development process can be broken down into three important steps:

  • Identify critical business functions: What is a critical business function? A critical function is a procedure or information that, if interrupted directly or lost, may affect the business’s financial stability, necessary operations, and/or service commitment, or create a liability exposure. These functions must all be identified in the plan.
  • Capture technical functions: Technical functions include all information technology resources that directly or indirectly support critical business functions. All of these technical functions need to become part of the recovery effort. This step should not occur prior to the previous step—thus, using the building block approach. Recovery procedures will need to address software, data, and the system platforms on which they operate
  • Establish recovery priorities: No single standard recovery priority listing will work for all businesses. If business operations are heavily reliant on facility structures, facilities will be the priority. On the contrary, if business operations are systems-driven, and the facility occupant can perform the work remotely, the priority would be the technical functions, and facilities would be last. The following business functions must be prioritized
  • facility recovery
  • recovery of business processes
  • technical data and systems recovery
  • other recovery procedures

Writing the Plan

Once the priorities and procedures are developed the plan needs to be written and distributed. Every critical business function identified should have an individual BOC plan. The general plan structure and format should remain consistent across all business functions

This article is excerpted from BOMI International’s Design, Operation, and Maintenance of Building Systems, Part II. The guide can be purchased by calling 1—800—235—2664, or by visiting www.bomi.org.