|
|
 |
|
|
|
|
Feeling confident that your business continuity plan
covers everything? You would be surprised at what
can come out of the woodwork and bite you!
At the beginning of
2008 the UK got a
sickness bug called
the Norovirus. All of
a sudden, 100,000
people were going
down with it and
being advised to stay off work when
they should have been going back to
work after Christmas.
One result of this was that those
companies that had the technology in
place were immediately able to have
staff work from home instead of
spreading the bug at work.
At the time, Signify - the secure
authentication service - reported up to
18% more remote logins to corporate
systems in a three-day period. With GPs
recommending that Noro sufferers should
remain at home for 48 hours after their
symptoms had gone, for more
|
 |
 |
| The Norovirus: it looks pretty but the
effect can be ugly for your business! |
|
|
enlightened companies there was no excuse for their employees not to work from home while they were ‘in quarantine’.
The Noro virus lost millions of man hours for ‘UK plc’ but the impact on companies that have planned ahead for this type of event were minimised. Signify saw a surge in user login activity during the first few days of January compared to equivalent periods in previous years and put this down to people taking NHS advice to stay away from the office and simply logging into the corporate network from home and getting on with their work.
But the Noro virus was just the latest problem. Every 3-6 months there’s a significant national or regional issue that seriously affects a large number of people’s ability to get to work. These include floods, blizzards, train and tube strikes, terrorist threats and bomb scares, foot and mouth and avian flu. As a result, more companies are now taking measures to provide a short-term response, sometimes referred to as ICE - In Case of Emergency.
Employers that make provisions to
allow their staff to work flexibly away
from the office when an emergency
strikes are reaping the benefits. Most
organisations provide secure remote
access for a few senior staff and ‘roadwarriors’,
but the ability to give
everyone short-term secure remote
access to email, files and applications
really minimises the stresses and
business losses created by these short
term emergencies.
While it’s expensive for
organisations to build IT capacity inhouse
to cope with surges in traffic; the
new generation of Managed Service
Providers is well placed to help with
the scaleability and resources to meet
peaks of demand.
The only way to prove whether or
not a business continuity plan will work
is to test it. So how many businesses
are prepared to pull the plug on their
own telephone network (by disabling
their PBX) to discover just how robust
their business continuity plan would be
in the event of a real emergency? |
| |
‘The only way to prove
whether or not a business
continuity plan will work
is to test it.’ |
| |
| According to the latest research 69%
of organisations in the UK now have
some form of business continuity
plan. But how many of those plans
actually work? Have they been, and
are they being regularly tested? Are
they proven in a variety of potential
disaster scenarios? |
| |
Continuity Demand |
An increasingly fearful and risk-aware
business community has, finally, realised the need for business
continuity planning. This realisation
has been aided in part by government
regulation – such as the Civil
Contingencies Act which demands that
local authorities have contingency
planning, emergency planning and
business continuity management
solutions in place. Commercial
businesses were awoken to the need,
quite literally, by the huge explosion in
2006 at the Buncefield oil depot in
Hertfordshire.
The problem is that many of these
contingency plans remain untested. In
the event of a disaster, from data
corruption to the failure of the
telephone system, organisations have
absolutely no idea whether or not the
plan will work.
So what would happen in the event
of a failure of the telephone system? In
a major disaster the mobile network is
immediately swamped, taking that
option out of the equation. Even in a
less severe situation, while employees
can use their mobile devices how will
customers contact the organisation for the hour, day, even week if the
telephone system is down? |
| |
|
Of course the carriers do offer
business continuity options, primarily
for expensive non-geographic numbers
but also a limited solution for
geographic numbers. But the cost of
these solutions is very high. Indeed one
UK blue chip financial services
company pays in excess of £100,000 per
year for a business continuity solution
for its telephone system.
Unfortunately it cannot justify the £28,000 it would cost to test the system –
so the investment remains unproven.
An option from one of the carriers
offers the rerouting of a limited number
of DDIs to specific numbers – typically
20 or 25 from any consecutive block of
numbers. This enables the business |
|
 |
| If you can’t get to work the game is up. |
|
|
continuity plan to support the specific
needs of senior personnel for example,
rerouting to a home number, mobile or
alternative site. At a cost of £4,000 set
up fee and £4,000 per annum per set of
numbers, large organisations are
investing hugely simply to attain the
rerouting of numbers for key personnel. |
| |
Other Considerations: |
If you have an IP PBX system and are
making calls using voice over IP (VoIP)
make sure the system you choose is
capable of recording IP-based
conversations as well as ‘regular’ calls. |
| |
Costs: |
And as to the question of cost, when I
am asked, “how much would an
effective business continuity solution
cost for my business”, my answer is
always the same. “Probably an awful
lot less than the cost of picking up the
pieces and recovering from a ‘disaster’ -
should you be unfortunate enough to
suffer what is fast becoming an
inevitable event at some point in a
company’s life.” |
| |
| Users selecting business continuity
solutions should consider the
following:- |
| |
| • How long could our business
survive without access to a working
telephone? |
| • How much money would we lose if
we were unable to ‘trade’ for
1 hour?...1 day?…1 week?… or longer? |
| • How long do I have to invoke a
solution before my business is
severely impacted? |
| • How can I intelligently deliver
inbound calls to 100% of the
workforce affected by the ‘disaster’? |
| • How easy is it to establish and set
up different re-routing call plans that
can be administered and activated by
non-technical staff immediately
following a disaster? |
| • How easy is it to maintain and
update the alternative call plans as
staff join, leave, fall sick, transfer
departments etc? |
| • What can my carrier really provide,
at what cost, and with what level of
control? |
|
| |
| Business Continuity
Planning – The Steps |
| |
| Business Impact Analysis |
The first step in a sensible
business continuity planning
process is to consider the
potential impacts of each type of
disaster or event. This is critical -
how can you properly plan for a
disaster if you have little idea of
the likely impacts on your
business/organisation of the
different scenarios?
|
| |
| Contingency Planning
Template / Software |
| Creating the business continuity
plan itself is far from a trivial
undertaking. Every aspect of the
plan must be carefully managed
to ensure that it does not fall short
when most needed. Fortunately,
there are tools available to help.
Some people say that perhaps the
most impressive is the BCP
Generator
(www.bcpgenerator.com). This is
essentially an intelligent disaster
recovery plan template and guide,
greatly simplifying the entire
plan creation exercise. |
| |
| Contingency Audit and
Assurance |
| Having developed
the business continuity plan, it is
sensible to perform an audit... not
just initially, but at regular
intervals. This helps ensure that it
remains current, and that it
stands up to rigorous
examination. Equally important
are periodic checks on ‘business
as usual’ contingency practices. |
| |
| Risk Analysis |
| Having
determined the impacts, it is now
equally important to consider the
magnitude of the risks which
could result in these impacts.
Again, this is a critical activity - it
will determine which scenarios
are most likely to occur and which
should attract most attention
during the planning process. |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
