BCP – Stage 2 – Understand Current Capabilities & Core Resources
During the first step of Business Continuity Plan development, we established the organisation’s priorities and thresholds for disruption – based on considerations such as customer goodwill, revenue and contractual commitments. This next stage of development ensures that we have a foundation of intrinsic capabilities to meet those priorities and mitigate the exposures related to a failure to meet them.
This step can be described as the ‘Dependency Analysis’. In its simplest form, it is the understanding of what parts of an organisation’s infrastructure categorically need to be in place so that operational priorities can continue at an acceptable level.
These ‘dependencies’ fall into four main categories:
- Information Technology – the critical systems and communications systems that we need.
- Workplace – The premises and any specialised equipment required.
- People – the skills and number of employees we need to perform critical activities.
- Supply Chain – the stock, raw materials and logistics we need to market our products.
This information needs to be understood so that we can:
- Understand the resources most critical to recovery and continuance.
- Ensure that we understand how robust these dependencies are and whether they can be effectively recovered to mitigate the risks associated with operational disruption.
- Understand what parts of the organisation need to provide input to develop our business continuity capabilities further.
The identification of priorities and tolerances helps us understand what we will need in various disruption scenarios and who needs input into confirming and building our recovery capabilities. The assessment of core resources establishes whether we have the intrinsic capability to meet those priorities following a major disruption.
To complete this step, we need to collect information as follows:
Phase 1 – Identify recovery needs
- What systems and other resources need to be available to perform the activities that deliver our operational priorities? In addition, when do these systems need to be recovered or made available?
- These may fall into several categories:
- Information systems
- Workplace – whether an alternative site is required or whether remote working is an option (typically, there is a blend of both)
- Minimum staffing levels
- Supplies and any specialised equipment
Phase 2 – Obtain assurances of capabilities
- Ensuring that there is the capability to recover or restore these resources in line with recovery needs.
- Aligning the different parts of the organisation responsible for managing these resources and ensuring they can meet the required recovery requirement.
- If there are shortfalls, decisions may be required to close these gaps.
This step requires gathering considerable information from several areas of the organisation. A good plan is required to understand how this is accomplished and how to collate the information. Below is an example of data that we gathered in Phase 1—understanding the organisation’s priorities. It shows the priorities and how their perceived interruption thresholds ‘flow’ through to create a more detailed picture of core capabilities.
Example:
In this simplified example, the priority services are identified, and the exposures and tolerances of each service are established. Next, the Recovery Requirements section details the systems and equipment required and their recovery ‘window’. Any shortfalls have been highlighted for further consideration and discussion.
In this hypothetical example, the organisation is in reasonable shape. There is sufficient capacity to provide physical accommodation and support remote working.
Next week, we will focus on Stage 3 and discuss in more detail how to develop the response and recovery plans. If, in the meantime, you have any questions about this document or any other enquiry about your BIA or BCP plans, please do contact our experts in ADAM Continuity. A summary of all the key steps in developing a BIA and BCP can be found here.