|
If satellite pictures of hurricanes don't get CIOs thinking about business continuity, reams of regulations enacted because of events such as the 9/11 terrorist attacks should. Government or private organizations in industries from health care to financial services require CIOs to have plans for safeguarding critical financial or customer information, making continuity planning even more important.
For example, the Governmental Accounting Standards Board requires a business continuity plan for all government entities that operate utilities "to ensure that agency mission continues in a time of crisis," says Noakes-Fry. The Federal Financial Institutions Examination Council holds directors and managers of financial firms accountable for contingency planning and, in the words of the council's mandates, "for timely resumption of operations in the event of a disaster." For health care providers, the Health Insurance Portability and Accountability Act of 1996 mandates data backup, disaster recovery and emergency mode operation plans.
Even when a regulation or a high threat level doesn't specifically require a company to have a data backup or business continuity plan, insurers or lenders may insist on such plans before extending coverage or credit to a company, says Noakes-Fry. "It's really part of due care" in running the business, she says.
While there's no decisive factor that determines whether or when a company should consider using software for its business continuity planning, companies in the midmarket have a newfound sense of urgency to use it.
Harris Nesbitt Corp., an investment banking firm with a 400-person New York office, which is part of the $265-billion BMO Financial Group based in Toronto, began looking for business continuity planning software over the past year in the face of "significant regulatory requirements for broker-dealers to come up with executable, robust recovery plans," says Tom Avansino, vice president of security and business planning. Regulations aside, Harris Nesbitt understands the effects of a disaster. From their offices, Avansino and other employees could see the South Tower under attack on 9/11.
For the American Trucking Association, a 225-person trade association with offices in Alexandria, Va., and on Capitol Hill, working near potential terrorist targets means the possibility of business interruption is "always on our minds," says John Charles Quinn, vice president and chief technology officer. He used business continuity planning software "as a mechanism for guiding and documenting" the development of his business continuity plan.
Everyone on Board |
Ask a business continuity planner what his biggest challenge is, and the answer won't be hardware or software, but people: Getting everyone in the organization to contribute time and knowledge to help develop the plan.
"This isn't just an IT effort," says John Dunbar, CIO at EMS Technologies Inc., a manufacturer of wireless and other communications hardware. The plan will affect, and needs input from, other departments such as human resources, public relations, financial and legal, he says, "so they need to make sure to understand it."
"One of the most important things I learned was to get as many people on board as possible and stay in constant communication with each head of each department," says Dan Bullock, IT information security officer at the Bank of Whitman, a community bank in Colfax, Wash., with 150 employees and total assets of $400 million. "No one person will know what are the important, mission-critical items the bank needs to function correctly."
Busy as they are with their existing jobs, "nobody wants to do the preliminary work" of creating a business continuity plan such as filling out questionnaires about assets and business processes, and ranking their importance to the company," says Gartner's Kristen Noakes-Fry. But requests to do so carry far more weight when the recipient knows the CEO is expecting the results, she says.
--R.L.S.
|
Software Is Just the Beginning
Organizations that invest in business continuity planning software won't get their money's worth if they don't get buy-in from the people who are supposed to use it. Many employees are too busy to give business continuity the attention it deserves. Getting input from users in every department within the business is crucial because employees are in the best position to know which information and systems are vital to keep the business up and running. But getting cooperation from employees is often the most difficult part of any business continuity project and typically requires senior-level involvement (see "Everyone On Board," at right).
Given that many of the planning packages have the same basic features, customers say ease of creating the plan, changing it as conditions warrant and even finding the plan when a problem arises are the most important factors to consider when choosing a software package. The resulting plans also need to be easy to read and understand "by somebody who is not operating at 100%" because he's reeling from the effects of a disaster, adds Noakes-Fry.
As with any plan, "it's not effective if people don't use it -- and use it easily," says John Dunbar, CIO at EMS Technologies Inc., a $300-million manufacturer of wireless, satellite and defense communications hardware based in Norcross, Ga. The company used TAMP's DRS software and TAMP consultants to create, test and update its continuity plan.
Some vendors have taken pains to make their systems easy to use. For example, TAMP's DRS allows business users to enter information such as lists of key systems and key business processes using everyday Windows office productivity applications, and even provides a wizard-type interface that guides users through the data-gathering process. One of the main reasons the American Trucking Association's Quinn chose DRS, he says, "was that it worked so nicely and integrated so beautifully with Microsoft Office, which everyone here knows how to use." At Harris Nesbitt, the templates within DRS helped the company organize recovery and business continuity information that had previously been scattered among earlier plans, and they allowed the company to develop a new plan in about three months, says Avansino.
Users and analysts say it's important to make a single person accountable for the process to ensure that business continuity efforts stay fresh. And to succeed, that person must have the full backing of the business owner or senior management. "This is one of those things that can drag on for months if you don't really focus on it," says Dunbar.
In a true emergency, everyone will realize it was time well spent.
|
 |
|
|
