A purely pre-packaged or methodical approach to business continuity (BC) planning does not pass muster anymore, as threats and risks to businesses are evolving at an unprecedented pace. In respect to natural and human-inflicted disasters, in the past, many companies had relied primarily on public emergency response infrastructure. However, the number of large and medium-sized global enterprises that employ dedicated BC professionals and BC technology platforms has grown by orders of magnitude in the last decade.
A successful BC platform will merge human capital, business processes, corporate assets, and policy into a consolidated framework that is managed and maintained by a scalable and customizable BC-centered dashboard. The dashboard will have to make use of a wealth of up-to-date data about the state of the business and account for many types of company assets and potential risks to those assets. BC dashboards should be able to proactively reduce the possibilities of a crisis from occurring; however, if a disaster does strike, the dashboard must be able to don a reactive frame of reference and aid in all facets of a response and recovery effort.
For this article, let us focus on primarily on the “reactive” end of business continuity (typically known as crisis management or incident management), starting with a categorized list of the critical reactive measures that BC managers must use to drive all disaster response and mitigation tasks:
- Assets affected: What is in peril? What is the impact: the potential cost in terms of money, life, environment, reputation, etc.
- People affected
- Business processes affected
- Recommended response in accordance with policy
- Intervals of time
- Quantity of information
- Distribution lists- who needs to know
- Security of information
- Updating of information by responders, war room, command center etc.
- Means of information dissemination
A business continuity technology platform must facilitate the communication between rapid response teams (field personnel) and those managing the situation from a command center facility. Most importantly, a BC dashboard must be able to integrate in real time with all platform components so that careful direction and supervision can be provided and reported to all interested parties; it will couple policy with action; the interface will consolidate event status and communication and put all information in the correct context so that speculation and misinformation (so commonplace in emergency situations) is minimized. Moreover, the implementation must be architected so that is able to balance the accuracy of information with timeliness—without a doubt this is the biggest challenge for BC command centers, as this tradeoff is always inevitable when you are in midst of a code-red situation. Critical decisions based on instinct and gut will have to be made without full information.
In his Leadership Primer, Colin Powell, the former U.S Secretary of State, sums up his methodology for dealing with this conundrum: “Use the formula P=40 to 70, in which P stands for the probability of success and the numbers indicate the percentage of information acquired…Once the information is in the 40 to 70 range, go with your gut." Having robust disaster recovery and response plans/policy and transparency into corporate assets coupled with a thorough understanding of the hierarchy of risks they face, will help ensure that these crucial determinations will be educated decisions to be best degree possible when not enough facts are known to be “100 percent sure.”
The best BC dashboards will be able to integrate tightly into a platform that supports a variety of communication systems and protocols over a potentially large geographical area, as response teams and command center personnel will be physically scattered for maximum security and fault tolerance. Because phone systems and other land-line based networks can be overtaxed to the point of collapse during the initial phase of a crisis, BC technology platforms must be open and flexible and take advantage of satellite and web-enabled messaging options. Care must be taken though to make sure that mobile and handheld voice/text messaging options are really bullet-proof. (Case in point: During the Sept 11th terror attacks on the World Trade Center in New York City, my mobile communications devices were rendered useless due to the destruction of huge antenna towers at the top of the Two World Trade Buildings. A hastily purchased AM radio then became my only means of receiving information on the situation as it developed.) In addition, BC communication strategies for larger companies will need to be formulated to include external contexts of communication and dispatch—vendors, customers, the press, and regulatory agencies may have to be part of a lengthy communication queue in the event of a disaster.