Of course, what we really mean is rightsizing the services a business continuity consultant can provide. How much or how little an organisation decides to involve an external consultant will depend on the extent of business continuity planning needs, and how that organisation is set up to handle them. Ideally, you’ll leverage the involvement of a business continuity consultant to get the most benefit for the least outlay, keeping the decision-making process flexible according to needs and resources. However, there’s one situation where you’ll often get more “bang for your buck” by bringing in a consultant.
(more…)
Posts Tagged ‘Business Continuity Consulting’
Rightsizing Your Business Continuity Consultant
Tuesday, January 17th, 2012Don’t have time for Business Continuity Management? Then why not outsource it!
Wednesday, October 13th, 2010Ensuring continuity of your business functions, processes and critical IT systems and applications, along with the decision making in a time of crisis cannot be completely outsourced; there will always be responsibilities owned by the board, executive team and operational staff members. However, a great deal of the co-ordination and maintenance can be outsourced for considerably less cost than hiring a full-time Business Continuity Manager. A commitment to ongoing maintenance of your business continuity plan not only ensures that it is current and usable, but also assists with meeting regulatory and audit obligations.
OpsCentre tailors a Business Continuity Managed Service to meet suit any level of requirements and budget and can include activities such as:
1. Conducting regular reviews and updates of all business continuity and IT disaster recovery documentation to ensure it is current
2. Ensuring ongoing IT and business change management and project implementations consider Business Continuity implications and that the plans and strategy are kept in alignment with an evolving organisation.
3. Co-ordinating periodic refreshes of the business impact analysis and risk assessments
4. Scheduling regular desktop exercises and live tests of the business continuity plan
5. Providing induction training for new staff, maintaining training materials and training your trainers
6. Providing ongoing mentoring and training for key staff in their business continuity roles
7. Chairing a periodic Business Continuity Steering Committee and tracking progress of resulting action items.
8. Crisis support in the case of a business interruption incident
9. Providing co-ordination and facilitation assistance during actual disaster events or major incidents.
We cater to all levels of client needs: from basic quarterly maintenance tasks to 24×7 standby support; helping co-ordinate an incident response whenever it may happen day or night. Using our skilled and experienced team means you also gain access to the latest methodologies, industry research and continuity planning standards that we continually work with.
Talk with OpsCentre’s Director, Rod Crowder today to discuss your needs and we can build a business case to show how you can achieve more and save money compared to hiring an in-house resource.
Business Continuity Planning for Small to Medium Enterprise
Wednesday, March 17th, 2010Consider the scenario of losing your primary premises due to fire. Can you answer these questions?
- How much revenue would you lose being out of action for a day, a week or a month?
- Have you got an alternate location to operate your business from?
- Is your data regularly sent off site and ready to be restored into backup systems?
- What are your critical paper records and how do you continue to operate if they were destroyed?
Every business, regardless of its size, should be confident in the answers to these questions and should be making an informed choice about the cost of implementing business continuity strategies and IT disaster recovery solutions versus the risk\cost of not doing anything.
Small to Medium Enterprise (SME) often don’t have the budget or resources to spend months implementing a business continuity project. But SME’s still have a need for BCP, just as much as bigger organisations. Quite often all of the physical resources, especially IT equipment are concentrated in the one location which can increase the risk. Sometimes without dedicated IT staff, the backup and restoration practices may not be sufficient to help them recover from a loss of premises type incident.
At OpsCentre we’ve refined the art of the ‘Quick Start’ BCP and can deliver a business continuity plan for suitable small to medium enterprises within 1-2 weeks. If your organization needs assistance with getting a business continuity plan in place we can help. Contact us and let us know what you need.
Business Continuity – Is your business ‘Recovery Ready’?
Wednesday, March 3rd, 2010Do you know the answers to these questions for your organisation?
1. How would we continue to function in an extended building evacuation such as a power outage or flood in the basement?
2. Who are our most critical customers and how would we contact them?
3. What is our current IT Disaster Recovery capability? How long would it take to restore our most critical systems, applications and data?
4. Do we outsource critical business functions to third party organisations services? What if they were to fail.
5. Do our staff know how to get out of our building safely, where to go, and how do we account for them?
6. In the event of a disaster, would we need to implement manual workarounds to cater for reduced staff numbers, loss of IT systems, or denial of access to our building?
OpsCentre recommends undertaking a Readiness Assessment to identify where you are exposed and the possible impacts. If you would like assistance with evaluating the health of your business continuity program, we would be happy to assist. Don’t forget we are offering a complimentary initial consultation from which you will receive an ‘actionable’ health check report.
Click here for more information about the OpsCentre complimentary consultation.
OpsCentre offers complimentary Business Continuity Consultation
Monday, February 8th, 2010OpsCentre is pleased to announce the launch of our COMPLIMENTARY Business Continuity Consultation offer. For a limited time we are providing a complimentary consultation, to Australian Businesses valued at $495.
The Business Continuity Consultation assesses the effectiveness of your organisation’s Business Continuity Program. If you don’t have one in place, the assessment will identify the level of exposure and the critical elements required to ensure your organisation can recover effectively from a major incident.
For more information click on this link… Business Continuity Consultation
Or contact us now on 1300-bc-plan to book in your complimentary consultation.
Top 5 things to look for in a Business Continuity Consulting provider
Wednesday, February 3rd, 2010The linked article here by Richard Jones of Burton Group in the US whilst written in 2008 is worth revisiting because it describes some useful tips on how to get the right staff for Business Continuity Planning. The article describes what you need in an internal BCP leader and how to find the right BCP consulting firm.
To summarise, the top 5 tips for finding the right Business Continuity Planning Consultants are:
- They should be able to produce a reference list of nearly all of their clients.
- They should clearly state their billing structure so there are no nasty surprises or sub-standard deliverables.
- They should be able to service all of your business locations.
- They should have experience in your type of business or at least a wide variety of industries rather than just specialising in just one vertical market.
- They should provide training, mentoring and tools to empower the organisation to continue the process internally.
So how do we stack up? OpsCentre is confident that we can tick all of those boxes.
Point 5 is something we feel really passionate about. At OpsCentre we don’t want to leave you with a set of documentation that gathers dust on the shelf. We want to help embed business continuity into the organisational culture so that there is a continual improvement cycle and evolution towards maturity of business continuity within that organization.
Read the full article here.
7 Habits of Highly Effective Business Continuity
Friday, January 29th, 20101. The Senior Executive actively supports Business Continuity
The CEO\Director\General Manager that believes in and wants a functional Business Continuity program in place is a critical success factor.
To have a senior Executive that is responsible for setting the priorities and vision for the organisation to stand behind BCP and communicate this to the staff is a powerful change motivator.
2. A Whole of Business Approach
A business continuity program that prioritises the organisation from the Executive’s birdseye perspective as well as analysing business impacts across all business functions in a consistent manner will lead to a better informed business continuity strategy being proposed. It allows the Executive to see the requirements of the business in a single snapshot and make a cost benefit justified decision on the level of continuity required.
3. A Single Point of Business Continuity Management
Someone needs to be responsible for BCP at an organisational level. It needs to be in their job description and a priority for them, otherwise it runs the risk of falling between the cracks. With one person accountable for co-ordinating, aggregating, monitoring the overall Business Continuity program and reporting to the Executive, the program is more likely to stay visible and maintain momentum.
4. Testing, Testing, Testing
Business Continuity should be viewed as an ongoing continuous improvement program. And as such testing is vital. It highlights flaws and validates assumptions in your business continuity plans, giving opportunity to improve them. Testing builds confidence and competence within the business continuity team as it brings home how the strategy would actually work in a variety of scenarios and how the roles will interrelate. An untested Business Continuity Plan cannot be considered viable.
5. Embedding BCP into job descriptions and procedures
The various BCP roles such as BCP Manager, Command Team Leader, Business Unit Leader, etc should be written into position descriptions so that it is very clear that is a part of the responsibilities of the staff members. Procedures for new projects, business changes and IT changes should include provision for ensuring the change has BCP/ IT Disaster Recovery aspects taken into account. All changes should have an impact analysis conducted that includes impact on BCP/IT Disaster Recovery procedures.
6. Starting on the right foot
An induction training package that briefs new employees on the Business Continuity and Emergency Management strategies and plans in place is a great way to start them off on the right foot, highlighting the importance of this to the organisation.
7. Maintenance
The person responsible as BCP Manager should be tasked with ensuring maintenance of the documentation occurs on a regular basis. Outputs from changes and testing sessions all need to be fed into the plans. Periodically the BIA should be revisited and organisation’s prioritisations and maximum tolerable outages reviewed.
What type of Business Continuity Recovery Site do you need?
Monday, January 11th, 2010The Recovery site is sometimes also referred to as the Alternate Site, Standby Site or Fallback Site.
Recovery sites can function purely as a standby data centre for your IT systems or they can be for business recovery as well, with desks, phones, desktop computers, meeting rooms and other facilities.
The data centre equipment and also the business recovery seats can be dedicated, by that meaning, totally reserved for your use only or shared, meaning first come first served in the event of a disaster. Which is why the ratio of clients to equipment is important as is the formula for how many clients from a given geographical area they subscribe to their ‘shared’ facility is as well.
One key decision when determining the most effective Business Continuity Strategy for an organization is the maximum readiness level of the recovery site (cold, warm, hot) that is required.
A cold recovery site is a facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware, telecommunications equipment, communication lines, etc. This scenario has the longest lead time to restoring live services because the equipment must be provisioned and setup after the event.
A warm recovery site is a site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of going live after additional provisioning, software or customization is performed, and the restoration of a database backup into the environment.
A hot recovery site is a facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems. Typically the organization’s data is synchronized to the hot site so that it can be switched across into live operation in a very short time, almost instantaneously in some instances. Because the data is mirroring at the data centre instantaneously or very frequently, the level of data loss in this scenario is usually minimal.
How to determine which type of recovery site is right for you?
Arising from your Business Impact Analysis, the Maximum Tolerable Outage for your business functions will give you the requirements by when the systems need to be up and running. The Recovery Point Objective, or the amount of acceptable data loss will help to inform these requirements as well. The right balance needs to be struck between the cost of the recovery solution and the cost of data loss, delays and downtime if you had to wait days or weeks to recover the systems.
This is why a wholistic, comprehensive Business Impact Analysis, involving the right business stakeholders and sponsored by Executive management is essential in order to determine the business continuity recovery strategy for your organization.
Business Continuity Terminology – What’s the difference between MTO, RTO and RPO?
Sunday, January 3rd, 2010A common query that we come across in business continuity consulting is, ‘what is the difference between MTO, RTO and RPO?’
MTO is the Maximum Tolerable Outage
The Maximum Tolerable Outage for a critical business process represents the maximum amount of time that an organization can survive without the business process in any form (manual or automated). Defining the MTO for a process gives you the deadline for when this process must be up and running in some form or another.
The BCI describes MTO as ‘At what point in time do you need to either recover your business process, or invoke contingency procedures to prevent you from meeting your business objectives\targets.’
RTO is Recovery Time Objective
Recovery Time Objective is essentially the timeframe requirement for how long it should take to recover from the time of declaring the disaster (not the time of the actual incident) to when the critical process or system is available to users.
RPO is the Recovery Point Objective
The Recovery Point Objective describes the age of the data you want to restore in the event of a disaster. For example if your RPO is 6 hours, you want to restore systems back to the state they were in no longer than 6 hours ago. This dictates your backup requirements, in this example you must be making data backups at least every 6 hours. Any data created up to the 6 hour RPO will be lost and will need to be recreated during your recovery process (if possible).
OpsCentre offers Recession Buster ‘Quick Start’ Business Continuity Planning
Thursday, December 31st, 2009This program is ideal for the small to medium enterprise. It is a fixed fee, fixed scope project that provides a complete solution in the fastest possible timeframe. It can usually be completed within a 1-2 week period.
We utilize our consulting experience and best-practice materials to adapt a business continuity strategy to suit your business.
We can offer these services for business continuity and also IT disaster recovery or pandemic planning.
More details in the service overview download section of our website. PDF’s available to download under Quick Start.
What is the difference between disaster recovery and business continuity planning?
Tuesday, December 29th, 2009Persons new to recovery planning often find it difficult to differentiate between Business Continuity and Disaster Recovery. In its simplest form, Business Continuity differs from Disaster Recovery in that its focus is on people and the continuation of business processes and objectives rather than the availability of IT systems and infrastructure.
Business Continuity Planning deals with taking pro-active measures to ensure continuity of business as well as plans to manage the response and recovery from a business interruption. The Business Continuity Plan would include a plan for the Command Team who will co-ordinate and oversee the response as well as sub-plans for the business units.
The IT Disaster Recovery Plan supports the recovery effort by detailing the IT system recovery priorities and time constraints, plans and strategies for recovery as well as detailed restoration procedures. The priorities and time constraints need to be driven from the business continuity requirements identified in the business impact analysis.
Of vital importance is getting Business Continuity Plans and IT Disaster Recovery Plans to dovetail in and work together to support one another in a recovery effort.
Need help integrating the pieces of the puzzle? Disaster Recovery and Business Continuity Consulting
‘Tis the season to get a Pandemic Plan in place
Thursday, December 17th, 2009If you didn’t add a Pandemic Plan section to your Business Continuity Plan last time around, now is a great time to get one in place, in the downtime between flu seasons.
Now that the Southern Hemisphere has weathered the flu season during the Swine Flu H1N1 pandemic of 2009 it seems like the worse is behind us, although many talk of a second wave of more virulent flu next year.
Either way, having some basic pandemic plans in place in your organization is prudent risk management and some of the counter-measures make sense for business-as-usual times as well to reduce spreading of any contagious illnesses and thus employee downtime year round.
One thing is for certain, pandemic planning will stay on the radar for risk and audit, to ensure that organizations are more pro-actively prepared for next time.
Influenza pandemics have occurred at irregular intervals throughout history with three occurrences within the last century: 1918 (‘Spanish flu’), 1957 (‘Asian’ flu) and 1968 (‘Hong Kong’ flu). The 1918/19 pandemic is estimated to have caused over 20 million deaths world-wide.
A key reason that Pandemic Planning stands out from normal Business Continuity Planning is rather than a single ‘trigger event’ like a disaster incident occurring and then invocation of your action plan, for a pandemic there is a staged ramp up. There should be several action plans in place for the organization, one for business as usual times, and further to be activated when key indicators are triggered in your organization, geographic area or by the Government altering their official ‘alert’ level.
Creating a pandemic plan for your organization doesn’t need to be a massive undertaking. Previous work you have done on business continuity can be leveraged, as can the previous work that OpsCentre has done in creating such plans for other clients.
Now that we all have the experience of how things progressed with the 2009 pandemic, we can use OpsCentre’s pandemic planning framework to create action plans that draw upon this experience and balance the realistic risk with level of response required.
Now is the time, when we aren’t all in the midst of a crisis to get those pandemic plans added to your business continuity management program.
Does your Business Continuity Plan rely on teleworking?
Friday, December 11th, 2009CSO Online article highlights the results from a recent Telework Exchange research report, finding organization’s expect staff to work from home in a pandemic but do not provide adequate resources for them to be able to do this.
Full article at CSO Online
The teleworking provisions in your Business Continuity Plans must be included as part of your test regime to ensure that this aspect of your plan will work as anticipated.
The Business Case for Business Continuity Management
Wednesday, December 9th, 2009It is commonly the case that Business Continuity is on the agenda due to external regulatory or audit requirements and this provides sufficient impetus for a Business Continuity Implementation. With or without these external pressures, a business case for the cost of implementing and maintaining business continuity will need to be created.
Below are some benefits and justifications that can be examined when establishing a business case for implementing and maintaining a business continuity program:
- The cost of not doing anything. What is your organisation’s level of exposure to business interruption risks? These may include Hardware Failure, Human Error, Natural Disaster etc. Calculate the true cost of downtime should your business suffer an interruption and what the likely timeframe is for recovery in your present situation. Eg. Unproductive staff costs, loss of revenue, loss of critical data and equipment, damage to the organisation’s reputation and the opportunity for your competition to take market share.
- General organisational resilience due to being risk aware and implementing mitigating actions, leading to reduced downtime.
- The Business Impact Assessment (BIA) phase of a business continuity program can help to find areas of process inefficiency that can be addressed.
- Cost savings that may be possible through server rationalization using virtualization technology.
- Reduced customer churn if they are subject to less service interruptions.
- Enhanced market position. It can give you an edge over your competition if you can provide assurances of continuity and service.
- Audit or regulatory compliance. Less exposure to compliance problems.
- Avoidance of penalties or fines for non-compliance with deadlines eg. Payroll within a certain timeframe according to an award or providing services to your customers within the terms of a Service Level Agreement.
It is also critical when developing a business case for implementing and maintaining a business continuity program to include the up-front costs of implementation eg. Consulting, internal staff time, establishment of IT systems as well as recurring costs such as leasing of recovery seats, software licenses and internal staff time for ongoing maintenance of the plans and conducting testing.
Business Continuity Testing Isn’t a Pass or Fail Exercise
Wednesday, November 18th, 2009Business Continuity Plans (BCPs) need to be regularly tested and updated to ensure accuracy and effective recovery in the event of a disruption.
Testing (sometimes referred to as Exercising) shouldn’t be viewed as a Pass or Fail exercise as every test is an opportunity to find potential problems with your plan and to have an opportunity to rectify them.
We view testing as an opportunity to continually evolve not only the strategy and plan documents themselves but to build the competence of the key staff members involved. A regular BCP test will help to embed the skills required to effectively manage a business interruption.
Once you’ve mastered the basics of testing your business continuity plan, put your strategy to the test by seeing if it can hold up in a variety of circumstances. It also helps to engage the interest of the business continuity team members if the test scenarios are dynamic and evolving.
Some ideas on how to keep your testing fresh and continually improving are to try some different ‘incidents’ such as a catastrophic loss of premises, extended power failure resulting in denial of access to building or loss of significant staff due to a pandemic.
Other ways to put your plan through its paces is to throw in a complication such as the unavailability or loss of a key recovery staff member Eg. The IT Recovery Co-ordinator or the Command Team Leader. Other complications could include, mobile phone telecommunications being unavailable.
A robust business continuity plan and the business continuity team should be able to respond to these challenges.
Most importantly, to ensure you are getting value out of your testing process, ensure someone is assigned the responsibility for noting down issues and action items for rectification arising from the test and for following up to make sure they are completed.