What are the key components of a business continuity plan?

The first component of a BCP is to understand your critical services and stakeholders and then define which business processes must remain operational under duress and which can be suspended. During a crisis, there may be a period of overall inoperability affecting great portions of the local, regional, National or global environment, so take time to thoroughly scope out your business functions for different scenarios. If you run critical information systems, you should have RTO which is the overall time to bring a system back online via restoration, back-up systems geographically dispersed, fail-over sites, etc. to maintain system operations Similarly, is the RPO which is how often data is replicated to ensure effective recovery.

One common misperception is that the scope of any plan is fixed. The scope can change as the planning team agrees to meet the needs of the continuity planning team. During exercise and evaluation you may find either components or assets of the business you may not have known about. This is okay and a natural part of the planning process. Additionally, objectives should expand and contract as needed in your improvement plan.

Crafting a Business Continuity Plan (BCP) is like preparing a blueprint for navigating through storms. Pinpointing its scope and objectives is where it all begins. The scope clarifies which business areas, from specific teams to vital processes, are under the plan's umbrella, ensuring a thorough approach. The objectives lay out clear targets—minimizing downtime, protecting data, and keeping customer services afloat. These goals are designed to be SMART: specific, measurable, achievable, relevant, and timely. This strategic foundation not only aligns with the company's wider risk management strategies but also primes the organization to weather any disruption with resilience, keeping its core operations intact and responsive.

The Maximum Tolerable Period of Disruption and the RTO (which may or may not be the same) depend on the Business Impact Analysis. The BIA is also the basis for prioritization. These should not be decided ad hoc, but programmatically, using a predetermined algorithm and challengeable inputs. So the scope might be "Division Delta" because that's a logical business unit, but determining priorities for departments within Delta requires a completed BIA.

When selecting people for your Continuity Working Group, try to find those who actually want to be part of the program. Knowledge, ability, and authority will go so far - but if the person doesn't really buy in to the concept of continuity it can be like pulling teeth trying to get them involved. Sometimes it may take some ramp-up through relationship building prior to approaching them about joining the effort. Indirectly mention how continuity planning has assisted other organizations or departments (there are now plenty of examples post-COVID). Perhaps they will even come to you asking to be part of the team!

Stakeholder engagement is a critical part of developing a successful BCP. I spend as much time as needed to discuss with management, departmental leadership, and employees, their role in the plan. Additionally, you need to provide them with the appropriate level of resources and training so that when the time comes to activate the plan, the result is a smooth and organized cohesion of personnel, that ultimately keep your business operating at acceptable levels.

When looking at a post-Covid threat landscape, it is important to consider the fact that many businesses are now supporting telework. Some might decide that the greatest threat to the business is a cyberattack or long term power/communications disruption. The questions you should be asking yourself is who needs to be in the room when developing a Threat and Hazard Identification and Risk Assessment (THIRA). Having the right voices to to speak towards your true threat landscape is practicing good, whole community planning.

The most effective approach to risks is to take an all-hazards approach. For example, I don't care if my building is flooded, overrun by radioactive rodents, or a smoking hole in the ground, because the impact to my business is largely the same; I can't use it. So my planning centers around that problem. Thus, the fire, flood, and earthquake listed above all come under "site disruption," and I move forward from there. Having four or five categories to plan for, rather than an infinite number of possible causes, keeps my BCM program straightforward and usable.

No one experiences recovery with out a disaster, some are bigger than others. Reconstitution or making the determination for permanent relocation is an important decision. It is critical to consider the employees mental health in this decision. Taking employees that have no doubt experienced disruption in there employment and most likely personal lives may be in need of long term mental health support. More often than not, this is something planners forget about whole sorting through the nuts and bolts of the planning process. Don’t forget to be human out there folks and it’s okay not to be okay. ??

Strategies must be effective, *cost*-effective, and realistic. As a rule, a 150-person company is simply not going to maintain a full-on hot site, for example. Also, remember that personnel disruption and vendor disruption can interrupt your operations as effectively as a flood or a system crash, and plan fir those, too.

Yes! An untested plan is almost no plan at all. It's also essential to review the plan, line by line, at least annually. If your locations, vendors, applications, etc. have changed, your plan needs to change, too. If your tests are always showing rousing successes, you may not be testing hard enough. Without disrupting production, plan your tests to run for at least half a business day, if possible. How hard / often you test is based on the BIA. If you have two data centers, consider having your application not just fail over from your Queens center to your Qatar one temporarily, but run it from there until the next exercise. Obviously, have other applications move from Qatar to Queens, so not everything is run out of one center.

Business continuity is great when paired with an effective occupant emergency plan (what to do for employee evacuation and immediate facility based response) and an Emergency Operations Plan (what your agency/business is doing during the disaster to support the jurisdictional response). Happy planning and feel free to reach out if you have any questions.