How do you benchmark and compare your business continuity plan with industry standards and best practices?

A great way to start this process is to perform a Business Continuity Program Maturity Assessment. An Assessment lets you objectively see what your starting point is, so you can make realistic decisions when defining the project scope and objectives.

It is easier said than done - setting BCM Objectives is not easy. Here I give some samples to make it easy for you: A. Ensure xxx is resilient against major disasters or crises B. Ensure the safety of employees and visitors in the office buildings C. Mitigate threats or limit the damage that threats can cause D. Have advanced preparations to ensure that critical business functions can continue E. Have documented plans to ensure the quick, effective execution of recovery strategies for critical business processes F. Ensure a harmonized approach to Business Continuity Management across xxx G. Implementation, maintenance, and improvement of BCMS in alignment with the International Standard ISO 22301:2019 more in next...

When we help clients benchmark their programs, we use the ISO22301 as the standard for comparison. We go through seven different areas of BC Program Management and gauge the client's alignment with the ISO22301 recommendations. Whether you use ISO22301 or some other standard, picking a set of best practices is a vital step in improving overall program maturity.

.. continuing with sample objectives of the BCMS: H. Be compliant with all applicable legal and regulatory requirements I. Take care of the expectations of internal and external interested parties with respect to business continuity J. Become a reputed leader of BCM practice and a role model for other organizations in the yyyy Industry. K. Ensure protection of the investors' interests in case of any disaster L. Establish and utilise synergies between various programs like BCMS, Quality Management System (QMS), Information Security Management System (ISMS), Environment Management System (EMS), Energy Management System (EnMS), Employee, Health and Safety EHS), Environment, Sustainability, and Governance (ESG) etc.

In my experience, comparing a Business Continuity Plan (BCP) with industry standards and best practices is about ensuring it’s robust and reliable. I’ve often benchmarked plans against frameworks like ISO 22301 and lessons from industry leaders. This involves assessing critical aspects like response time, risk coverage, and recovery processes. It’s also crucial to gather feedback from audits and peer reviews. Regular comparison not only highlights gaps but also drives continuous improvement, keeping the plan relevant and effective in evolving scenarios.

a. ISO 22301:2019 is good: 1. Self assessment is valid - can be done manually or through available tools 2. Third party assessment provides more assurance 3. Best assurance can be achieved through certification b. BCI GPG 7.0 can be used c. DRII guidelines can be used d. Some other countries have their own BCM standard and those can be used (e.g. NC3MA 7000:2021 in the UAE)

I've often quipped that "All the smart kids are using metrics" and it's absolutely true with Business Continuity Program Management. Metrics help you establish baselines and gauge your current state, they help define goals for program improvement, and they can help you measure progress towards those goals. It's very difficult to run an effective program without using metrics, because it's impossible to know how effective your program actually is without them.