Lockdown? Shelter-in-place? Hold and Secure?

Pop quiz!

You are the Chief Emergency Warden of a workplace two blocks from an escalating protest. The crowd could become unruly and shift toward to your building. You decide to lock the exterior doors, close blinds, advise employees of the situation and ask them to remain indoors, away from exterior windows, until the protest has been resolved. You place signs in the main doors advising that your business is closed until further notice.

Now, from the list below, which procedure did you just perform?

  • Lockdown
  • Shelter-in-Place
  • Hold and Secure

Chances are, regardless of which you chose, a significant number of your peers will have chosen something else. Your answer was likely determined by some combination of your organization’s own terminology, when and where you were trained in emergency management, and your role within emergency management.Picture Blog May 2015

The inconsistency of emergency management terminology across industries, geography, and various schools of thought may create additional confusion or miscommunication during an emergency, thereby placing people and property at risk. We, as an industry, should strive for common terminology among roles and organizations to mitigate this risk.

Vanguard EMC’s presentation at the upcoming DRIE Ottawa’s 2015 Annual Conference will address this inconsistency and will appeal for a push toward standardization in terminology across the industry.

How do you define these terms? Which publications do you consider ‘authoritative’ on EM terminology? Have you witnessed inconsistent communication cause harm in your organization? Please comment below or join us June 3rd in Ottawa!

(My answer: Hold and Secure)

Advertisements

Improve your Business Continuity Strategies tip 2 – Examine alternate strategies

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

Your program is now moving along smoothly. The risk evaluation and the business impact analysis (BIA) have produced valuable information and senior management has signed off on your recovery time and return point objectives.  Now you must establish how your organization will meet these objectives. These ten tips will hone your skills at devising business continuity strategies for your organization.

Tip # 2 Examine alternate strategies that could meet the BIA requirements

Prepare to make recommendations by reviewing the various types of recovery alternatives. Begin by examining the following traditional recovery methods:

  • Alternative site or business facility
  • Cold, Warm or Hot Sites
  • Drop Ship/Quick ship agreements
  • Manual Procedures
  • Mitigation
  • Mobile Trailer
  • Reciprocal agreements
  • Work from Home

This list is not exhaustive and your search should not be limited by it. Review internal assets for use in the recovery.  Search out external business resources using tactics such as Requests for Information (RFI), queries and professional organization reviews.  Validate your understanding with other business continuity professionals.

Discuss business continuity strategies with vendors that provide critical goods and services to your business. How do they plan to service you? Can you leverage their continuity strategies?

Return tomorrow for our next tip on Business Continuity Strategies.

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 10 – Participant Review

These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #10 Give participants a chance to review your analysis of the BIA results before submission

Participants need to verify the report. With additional time to think, people may have changed their mind on key conclusions, information could have been misconstrued, or simply overlooked.

Do not publish the entire BIA report in the business continuity plan.  A prioritized list of your business functions should be available somewhere in your plan; typically an appendix.

A business continuity plan based on a poorly researched or a phantom BIA will not have any relevance to the way that your organization operates.  A strong and focused business impact analysis will provide the data needed to evaluate business continuity strategies and build a credible plan.

Return tomorrow for discussion on Business Continuity Planning and the Incident Management System.

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 8 – Understand client expectations

These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #8 Sound out key clients regarding their expectations

Performing according to clients expectations is important to maintaining their business long-term.  Local clients, who may be impacted by the same event, may have lower expectations than national or international clients. If the incident isn’t large enough to make national news, do not expect clients on the other side of the country to be sympathetic or patient! They will find another supplier quickly. Bringing clients back after they have been disappointed by your organization can be very difficult.

Some customers may have service level expectations built into their contracts.  Determine what would be the impact on your organization if these levels are not maintained. Having an inventory of these contractual obligations will help planners prioritize after a disruption.

Priority should be given to restoring functions were service disruption will cause clients the most pain. For example: a delay in the new release of a product will postpone revenue but not providing customer support could irrevocably damage your customer relationship.

You are part of a complicated supply chain.  The BIA should outline how your product or service fits in and what the repercussions of a disruption would be to your customers and their customers.

If your Risk Analysis has revealed that you depend upon a single client for much of your business, this client’s return time expectations must be well understood.  Depending upon the strength of your relationship with this client, you might want to meet with their continuity planner or risk manager or involve them in your BIA survey or interviews.

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 7 – Manual Processes

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #7  Question staff on manual aspects of operations 

Every organization applies mechanized systems for a wide variety of tasks. Following an interruption, it may be advantageous to use a manual method for a short period of time. Manual methods can be effective as a stop-gap measures while waiting for a formal recovery strategy to come on-line. Ask BIA participants what could be done with a pad, pen and a telephone. Discuss other manual procedures.

Return tomorrow for our next tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 6 – Past experience

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #5 Determine if previous events have resulted in an operational interruption

Find out if the organization has had an outage previously. Delve into their response, recovery and impact.

  • How long did it last?
  • What was the financial, operational or reputational impact on the organization?
  • Who took charge?
  • How did upper management feel about the event? Employees? Clients?

Use this experience to start participants thinking about the duration before an interruption becomes intolerable.

Return tomorrow for our next tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 5 – Concentrate on Consequences

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #5 Focus questions on the consequences of non-performance

Avoid questions that speak about value or importance and concentrate on time-sensitivity and prioritization; the topics in Tip 3 should always be the focus of BIA data collection. Don’t ask questions for the sake of asking; every question must be pertinent to the ultimate recovery solutions in the recovery plan. Alleviate any concerns about how the information will be used by explaining how the results will constitute the input to the development of recovery strategies. Explain that resources could be substantially limited by a disaster and priority will be given to time sensitive functions but ultimately all functions will be brought back.

For each business function you will need to explore:

  1. How much data stored on computers can be lost. The answer will establish the Recovery Point Objective (RPO) or the tolerable amount of data loss measured in minutes, hours or days.
  2. How far under normal operating levels the function can operate during a disaster. This will give you a Minimum Service Level (MSL) or the level to which the process must be recovered during the recovery period. It is worth noting that the MSL can be a value expressed as a percentage above the normal level of operations; examples might be found in civil response organizations that will increase their capacity following a disaster.
  3. RTO:  This determines the Recovery Time Objective or the period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day).

Each function should be placed within a Recovery Time Objective category.  Define the category according to a restoration time frame (e.g. within 2 hours of a disaster) and prioritize the functions within each category. Prioritization should take into account dependencies, reputation issues and client expectations. The RTO is the primary determining factor when examining recovery strategies.

Return Tuesday for our next tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 4 – Facilitated workshops

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #4  Conduct interviews or facilitated workshops

Sending BIA questionnaires to employees can lead to widespread confusion because respondents may not comprehend the context of the question or may provide information based on emotion rather than fact. If a questionnaire is the only option, prepare an accompanying guide. Test the guide with a control group before its widespread distribution.

For the first BIA conducted within an organization, a facilitated workshop is recommended. Conducting interviews or facilitated workshops allows the BIA team to clear up any confusing language and clarify questions.  They are available to answer any inquires, set expectations and raise awareness. Interviews and workshops also allow the BIA team to drill down on any surprising or inconsistent information. Remember that every question should provide information that will be used in the business continuity plan.

Return tomorrow for our next tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 3 – inventory of business functions

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #3  Create an inventory of business functions within the scope

Prepare the inventory based on the most recent organization chart. Before moving ahead, validate the list of business functions with department leaders or the BC Steering Committee. For each business function you will need to determine where it occurs, who can perform it and what technology and information it requires. Dependencies and vital resource requirements must be determined. Format the data to collect into a list: RTO, Priority within the RTO, RPO, MSL, Dependencies, and Resources. Flowcharts should be used to get a strong understanding of how the functions are connected. Simple spreadsheets can be used to contain and sort through the information.

Return tomorrow for our final tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

Improve Your Business Impact Analysis tip 2 – executive commitment

A successful Business Impact Analysis (BIA) will harness knowledge from throughout the organization to compile accurate comprehensive data needed create practical business continuity plans. These tips will help the business continuity management professional focus their efforts on collecting valid data from credible sources.

Tip #2 Obtain written executive commitment for the BIA

Many people in your organization will be involved at this stage.  To obtain their valuable time and cooperation a short letter or e-mail from your executive sponsor can be very effective. This can be attached to the survey or invitation to a workshop or distributed to each participant individually.

Have the executive sponsor sign off on the scope and objectives of the BIA as well as on every milestone as it is reached. Course corrections along the way will ensure that you arrive at the right destination.

Design a methodology to gather the information required to fulfil your objectives. Test the methodology with a small team to help validate the data gathering process.

Return tomorrow for our final tip on Business Impact Analysis (BIA).

(For more information on DRI’s professional practices please read Professional Practice One – Program Initiation and Management DRII Professional Practices  June 1, 2012 Version 1)

  • Be Prepared

  • Professionals

  • Categories