Make a BC/DR Plan Easy by Avoiding the Common Pitfalls
Entirely too often, BC/DR planning leaves a bad taste in everyone's mouth, ends up being scrapped or never gets started at all. Often firms may trip into one of the many pitfalls associated with BC/DR planning and abandon the effort. And while there are many pitfalls lurking in the darkness, there is one - thought process overkill - that is the guillotine for a BC/DR plan, axing the project before the plan ever makes it to the drawing board. This article will provide the absolute basics to get you off on the right foot, avoid the more common pitfalls or get you through that pitfall that has killed your BC/DR planning.
Common Terms. Below are the most commonly used BC/DR terms. Oftentimes, the terms "BC," "DR" and "contingency plan" are used synonymously. However, understanding the key differences in these terms will help build a solid foundation in understanding BC/DR planning.
- Business Continuity (BC) - Comprehensive strategies ensuring the continuance of business operations (making money) in the event of a disaster. BC planning is the development of those strategies
- Disaster Recovery (DR) - The process by which a company recovers from a disaster (CSO Online 2006, www.csoonline.com/fundamentals/abc_continuity.html#1). DR planning is the development of the process
- Contingency Plan - Planning for a disaster
Disaster - An occurrence causing widespread destruction and distress (www.dictionary.com, 2006)
Common Steps in Developing a BC/DR Plan. Below is a list of some common BC/DR planning steps. More information can be found on how to specifically perform each of these steps by going to www.csoonline.com or any number of other websites. The local bookstore also has dozens of BC/DR-related books and help guides.
- Perform business impact or risk assessments to determine actions to be taken to ease the risks for possible disasters.
- Create a general contingency plan that overcomes a disaster risk to a level of loss the firm can tolerate.
- Educate and train employees.
- Establish an offsite meeting place.
- Test or practice the plan.
The Pitfalls of BC/DR Planning
In addition to encountering a pitfall in a regular planning project, some firms are rushed into making a plan at the last second. It seems that some firms are only interested in DR when there is an impending or recent disaster. This reactionary response may result in the rushed start of formulating a plan, which ultimately increases the possibility for encountering pitfalls. Below is a list of common pitfalls that occur on a regular basis.
- Incomplete or inadequate planning, including failing to perform a business impact analysis and failing to establish proper communication contingencies
- Failure to test the plan
- Failure to gain support for BC/DR planning, resulting in a lack of participation, resources and funding
- Failure to include the right team members when planning
- Belief that this is only an IT issue
- Lack of authority or ownership during a disaster
- Overkill - allowing the planning to explode into an unachievable project
Fear Factor. Several of the pitfalls listed above are usually found when fear is used as a planning initiator. There have been too many BC/DR seminars and publications that have "cried wolf" about some city being wiped off the map or some other really major, however highly unlikely, disaster that strikes right at the heart of an organization.
Not Just an IT Issue. Some organizations put the entire BC/DR planning on the IS or IT department. Believing BC/DR planning is an IT/IS-only issue is how you end up with great backups with no one or no place to work with them. Don't get me wrong, IT is critical, and a well-designed backup and recovery contingency plan is an absolute must! However, BC/DR planning is an operational part of all offices, departments and every employee.
Designate a "Go-To" Person or Team. If your organization has a professional dedicated solely to BC/DR planning, I think that is wonderful. If you don't have one of those professionals at your firm, a BC/DR leader or team with a clear team leader (and an alternate) needs to be established, preferably in another city. You must grant that person or persons with the authority to develop and maintain the plan and take charge during a disaster to help the business get back on its feet.
BC/DR Planning Is Never-Ending. A BC/DR plan is a living plan, meaning it is continuously changing to meet the needs of the firm. Continuous maintenance of a plan should be a part of the firm's regular administrative tasks.
Overkill. Just thinking about everything that needs to go into a comprehensive BC/DR plan turns people off. The work seems insurmountable! A BC/DR plan can mushroom into a massive project before you know it, and the details and endless tangents can bog down the planning. Overkill! Overkill occurs when a firm tries to take on too much too soon.
Take Baby Steps. Make the recovery planning processes generic in the beginning. Don't try to name every little thing that can happen. Rather, start with some basics of how to communicate, where to go and who should be on the reaction team when there is a significant event. For example, instead of attempting to make a contingency plan for each type of natural disaster, make a more generic plan that will be flexible enough to work during just about any natural disaster.
In one organization, the first BC/DR plan prepared for two major situations (power outages and/or inaccessibility to the office building) rather than specific man-made or natural disasters. The thought process was that if you can prepare for power outages and inaccessibility to an office, then you probably have a good enough plan to use for just about any significant natural and some man-made disasters.
Don't Make Risk Analysis Too Difficult. Risk analysis is often one of the primary areas where the overkill pitfall appears. When preparing the firm's first risk analysis, keep the analysis simple by asking some basic risk analysis questions and estimating the costs. For example, ask the following questions: What offices have a higher probability of disaster? How much would the organization actually lose for common disasters? What level of loss will be allowed? If the analysis seems to be bogging down the planning, move on and come back at a later time. However, be sure to come back and perform a more comprehensive risk analysis to determine if there are enough resources allocated for various advances in preparedness initiatives.
Don't Use Fear to Drum Up Support. Executives are tired of this approach. Try approaching the BC/DR plan as just another part of normal business operations. Also, don't let others' fears cause a reaction that would not be in the best interest of the firm. Overkill by spending on preparedness initiatives due to fear is very common. Spending money on expensive disaster recovery solutions needs to be directly matched with the business risk tolerances the firm establishes by doing a more in-depth risk analysis.
Don't Lose Steam. Organizations as a whole quickly lose interest in BC/DR planning when there is no disaster in the news. A good time to initiate a BC/DR planning project is while the topic is hot. But before letting too much time pass, make sure you establish a completed basic plan, including how people will communicate during a disaster. Remember to make working on the firm's BC/DR plan a regular part of normal business operations.
Communicate. Communication is the most important element of contingency planning. Establish a communication plan with backup ways to communicate. Before a disaster strikes, educate employees about how and when to communicate with the firm and what to do if all else fails with typical communication methods.
Always Stay Flexible. The firm must have a plan, but during a disaster it hardly ever works the way it was planned! Every disaster event is different and will require some critical thinking and reacting that sometimes deviates from the actual written BC/DR plan.
Safety First. Employees and their families come first. Try to take as much burden off those directly affected as possible. Be a hero and organize the rescue to help your fellow employees. There is no better satisfaction in disaster recovery than knowing your employees are safe. Overkill does not apply when it comes to people's safety.
Level the Field
Although looking out for pitfalls is a first step in BC/DR planning, finding and filling them prior to falling in will level that otherwise treacherous field so you can stroll across it with ease.
About our author . . .
Skip Lohmeyer is Director of Information Systems Operations for Ogletree, Deakins, Nash, Smoak & Stewart, P.C,, having served as a director of information systems for over eight years in the legal industry. In addition to his regular duties at Ogletree, he also serves as an adjunct professor of business and information systems at Southern Wesleyan University and consults on a regular basis, assisting organizations with technology decisions and project management. Skip can be reached at Skip.Lohmeyer@ogletreedeakins.com.