During the first step of Business Continuity Plan development, we established the organisations priorities and thresholds for disruption – based on considerations such as customer goodwill, revenue and contractual commitments. This next stage of development ensures that we have a foundation of intrinsic capabilities to meet those priorities, and mitigate the exposures related to a failure to meet them.
This step can be described as the ‘Dependency Analysis’ and, in its simplest form, it is the understanding of what parts of an organisation’s infrastructure categorically need be in place, so that the operational priorities can continue at an acceptable level.
These ‘dependencies’ fall into four main categories:
- Information Technology – the critical systems and communications systems that we need.
- Workplace – The premises and any specialised equipment required.
- People – the skills and number of employees that we need to perform critical activities.
- Supply Chain – the stock, raw materials and logistics that we need to bring our products to market.
This information needs to be understood so that we can:
- Understand the resources most critical to recovery and continuance.
- Ensure that we understand how robust these dependencies are and whether they can be effectively recovered to mitigate the risks associated with operational disruption.
- Understand what parts of the organisation will need to provide input to further develop our business continuity capabilities.
The identification of priorities and tolerances helps us to understand what we will need in a number of different disruption scenarios, and who needs to have input into confirming and building our capabilities to recovery. The assessment of core resources establishes whether we have the intrinsic capability to meet those priorities following a major disruption.
To complete this step we need to collect information as follows:
Phase 1 – Identify recovery needs
- What systems and other resources need to be available to perform the activities that deliver our operational priorities. In addition, when these systems need to be recovered, or available.
- These may fall into several categories:
- Information systems
- Workplace – whether an alternative site is required or whether remote working is an option (typically there is a blend of both)
- Minimum staffing levels
- Supplies and any specialised equipment
Phase 2 – Obtain assurances of capabilities
- Ensuring that there is the capability to recover or restore these resources in line with recovery needs.
- Aligning the different parts of the organisation responsible for managing these resources and making sure they are capable of meeting the required recovery requirement.
- If there are shortfalls, decisions may be required to close these gaps.
This step requires a considerable amount of information gathering from several areas of the organisation. A good plan is required to understand how this is accomplished, and how to collate the information. Below, is an example of data that we gathered in Phase 1 – understanding the organisations priorities. It shows the priorities and how their perceived interruption thresholds ‘flow’ through to create a more detailed picture of core capabilities.
Example:
In this simplified example, the priority services are identified and the exposures and tolerances of each service have been established. Next, the Recovery Requirements section details the systems and equipment required and their recovery ‘window’. Any shortfalls have been highlighted for further consideration and discussion.
In this hypothetical example, the organisation is in reasonable shape. There is sufficient accommodation capacity to provide physical accommodation and to support remote working.
Next week we shall focus on Stage 3, discussing in more detail how to develop the response and recovery plans. If, in the meantime, you have any questions around this document or any other enquiry with your BIA or BCP plans then please do contact our experts in ADAM Continuity. A summary of all the key steps in developing a BIA and BCP can be found here.