DEVELOPING SEAMLESS BUSINESS CONTINUITY AND DISASTER RECOVERY PLANS by Dr. Jim Kennedy.

Introduction

The development of recovery times for both the business organization’s business continuity plan and the IT department’s disaster recovery plan need to be developed through the collaboration of both parties for either plan to provide the proper protection. However in my thirty-five years in the business continuity and resiliency field I have found in many situations they are not.
The reasons for this can be timing or a lack of knowledge of the overall business continuity and/or disaster recovery planning process coupled with a lack of understanding of each other’s real recovery timing needs.
The purpose of this article is to provide a framework in which the recovery time objectives (RTOs) for the business continuity and the disaster recovery plan can be developed together.


Reason for inconsistencies and failures

Generally the drivers for business continuity and disaster recovery planning are considered to be one and the same, but this is not always the case. Many times the very design process for IT infrastructure requires that the IT organization develop disaster recovery planning thoughts and plans early in the application and/or systems development process. So, early in the project’s timescale of the development of a new application or system, IT must have some understanding of what kind of recovery timing and recovery point timing will be needed to support the technology to be deployed. IT will try to obtain the RTO and RPO (recovery point objective) numbers, but the business is most often focused on insuring that the deployment of the new business process or function is rolled out on time and within budget. The business organization is not thinking about business continuity planning at this time. So, IT will take it on itself to develop a best guess of the required recovery times either based on conversations with the business organization or on its own, if the latter cannot or will not commit to a number.
In other cases that I have seen, there is a clear lack of knowledge about business continuity and disaster recovery planning. Each organization knows that they need either a business continuity or a disaster recovery plan but they are not trained in the overall steps in developing such plans. As such the business organization does not understand the risks, tradeoffs, and costs involved in developing a proper business continuity plan. The business organization also often does not understand that it needs to properly analyze the operation to better understand the recovery requirements during the process/systems/application development phase of the systems/process development life cycle or, as ITIL defines it, the application life cycle (ALC). The business organization needs to quantify the impacts of loss of that process or system; and may not be sure of the right questions to ask - not only in terms of loss of productivity, but in terms of costs to process manually in case of a system loss or failure. Can the organization develop and use manual processes at all if the system or IT infrastructure fails? Does the organization have the human resources to perform the necessary manual processes or will they need to bring in contingent workers and for how long and for what cost? Every business organization needs to clearly understand and to articulate their operation’s maximum tolerable period of disruption (MTPD).
MTPD is the maximum time an activity or resource can be unavailable before irreparable harm is caused to the organization. This applies to both customer-facing and internal activities. Note that the recovery time objective specifies the time by which an organization intends to recover an activity or resource: the maximum tolerable period of disruption is the upper bound on this time.

The business needs to utilize the MTPD to develop its processes and contingency processes, and the IT organization need to understand the MTPD to properly develop its technology and RTO which, in turn, will enable the business to achieve its RTO objectives.
At the same time, IT needs to utilize the recovery time numbers developed by the business organization as a basis for its system and infrastructure RTO values.
Standards and planning process
There are so many business continuity and disaster recovery standards to choose from, as well as other related standards of practice, that this might be the reason for all of the confusion. The fact that none of these standards really talk of integrating the business recovery and the IT technology recovery plans together in to the overall process or application development life cycle complicates the matter even further.

There is also the issue that business continuity and/or disaster recovery planning classes are usually only electives in business administration or computer technology/information systems curriculum. So we are not exactly preparing our next batch of business or technology leaders to properly understand the methods, or importance, of contingency planning.
All that being said, most of the standards that exist do have a pretty consistent set of predefined steps to be reasonably successful. So if we take all of the contingency planning steps and align them with the ITIL ALC phases the planning cycle will integrate system development with continuity planning together at the best possible time in the development process.
I will outline the steps below in developing business continuity and disaster recovery plans with their corresponding points within the ITIL application development life cycle:

STEPS IN BUSINESS CONTINUITY AND DISASTER RECOVERY PLANNING	ITIL APPLICATION LIFE CYCLE PHASES
1) Understand the Organization a. Risk Assessment b. Business Impact Assessment             i. Determine MTPD for operation            ii. Develop RTO for Critical Systems            iii. Develop RPO for Critical Systems	Requirements – requirements gathered based on business needs of the organization
2) Evaluate and Determine Strategy a. BC strategy to meet RTO/RPO b. DR strategy to meet RTO/RPO	Design – requirements translated into specifications
3) Develop Plans a. BCP – Business Organization b. DRP –IT Organization	Build – Application and the operational model are made ready for deployment
4) Exercise Plan	Operate -- IT operates the application as part of the business service
5) Audit and Maintain Plan	Optimize

Using the standards and good practices
During the requirements gathering phase of the ITIL ALC the business owner should have also conducted the risk assessment and business impact analysis or BIA. The results of these two activities allow the business owner to clearly see the impact on the business of a failure or discontinuation of operations in either, or both, of the business or IT operations. They can then translate that knowledge from the risk assessment and business impact analysis into quantifiable RTO and RPO numbers to be used in the next phase of business continuity and disaster recovery planning (Evaluate and Determine Strategy) and the Design phase of the ITIL ALC.

The RTO and RPO numbers are used to develop alternative strategies that meet the recovery time and point needs. A cost for each alternative design is developed. The cost is the total of the IT cost to design, implement, build and operate; and the business cost for any workarounds or special handling during the outage period; plus costs to load any transactions processed during that outage period into the system (processing resynchronization) after they are brought back on-line and are processing again as before the incident.

The alternative strategies are then looked at using a cost and benefit (time, reduced workaround complexity, and etc.) analysis of each alternative. The best option will accomplish return to operation in a reasonable time with an acceptable cost to the business and IT. However, the alternative selected will require input from both IT and the business to properly address the risk of outage. The business will need to insure that it can perform the workarounds and still meet all of the business, regulatory and audit needs of the operation for the time period that the alternative defines the IT organization to need for restoring the IT systems needed to restart the application and its associated services.
For the plans to be effective and ‘fit for purpose’ it is very important that the business and IT are on the ‘same sheet of music’ as to recovery times and points. It is no good if the business has planned its resources and workarounds expecting a system recovery time of 24 hours only to find that the system will be down for 48 hours. On the other side of the coin it is not fiscally responsible to pay the cost to expedite the recovery time of an IT system to less than four hours if the business can tolerate an outage period of 24 hours or more at much less cost for the final IT solution.
Once it has been concluded that both plans are consistent with each other, the actual plans can be developed. While the business prepares for implementation of the new application and/or service, IT will make ready the systems and infrastructure needed to also meet the business schedule for implementation.


Exercising the plans
There is one caveat, however. Even if both sides have planned together and developed their plans based on a single and consistent recovery time, the two planning activities still need to verify (via exercising the plans together) that the IT recovery timing (the disaster recovery plan which includes hardware restoration, software restoration, synchronization of databases, and etc.) actually comes in on time to meet the business’ needs as provided for in the business continuity plan.
Only in testing and timing the two recovery processes to ensure that they are coincident can an organization truly be confident that the overall plans will be successful.

Is your organisation better prepared?

 2010 saw major earthquakes strike Haiti, Chile, China and Indonesia. It saw devastating floods in Pakistan and Australia. 2011 have brought out the opposite of resilience in people and organisation, confronted by the most extreme challenges. With flood events in Lagos, Australia, Brazil, the earthquakes in turkey, New Zealand, the tsunami in Japan, civil unrests in London, Greece, Spain, Italy, and the Arab spring of 2011, which ousted regimes in Tunisia, Egypt and Libya and created fuelled growing opposition to regimes in Syria, Yemen, Bahrain and other middle eastern states. These are very real recovery challenges that face organisations and you.  According to the Lloyd’s of London’s risk index 2011, 2011 was the second most expensive year ever for the insurance industry because of these incidents. 

In addition, while many of types of risk may be industry or regional specific, cyber risk is universal. 2011 saw the hacking of state network from India to Brazil to Nigeria. For businesses, the incident and frequency of data breaches have been even more unrelenting; Nintendo, Honda, Toshiba, Playstation, Nokia, Google, IMF, Wiki-leak and the Hong Kong stock exchange are victims of some form of cyber crime or hacking. A global estimate of cyber crime is now costing business around $114bn annually. Technical solutions are needed to evolve rapidly, together with more efficient reporting of breaches to help quantify the risk more accurately. 

By reflecting on disaster in terms of the need for strong, visible and distributes leadership, differentiated response, recovery and effective communication, organisations can achieve better outcomes with BCM, and reliably meet their obligations to regulators, boards and stakeholders. Since the true measure of a BCM plan is the success of it after an incident, organisations should apply the good practice approach which provides a baseline and common language to help BCM professionals to perform a rigorous Business Impact Analysis Assessment (BIA). The BIA is the foundation on which the whole BCM is built. It can be used to understand the impact of the failure to deliver a service or a product. The BIA identifies business activities across the organisation, identifies management owners of processes, identifies suitable staff, quantifies time scale and collects data for the Continuity Requirements Analysis (CRA). The good practice dictates that a BIA should be reviewed as a minimum annually but frequently in the event of business change, change to internal and external business process and significant change to risk and threats. Furthermore organisations must focus on robust BCM frame works strategies, resource allocation supporting continuity plans which objectively ‘fit for purpose’, practical and periodically tested and rehearsed.

After the unfolding events of the last two years, businesses need to give much greater priority to BCM planning carefully for those risks they cannot prevent, as well as being realistic about those they can. Organisations must determine its BCM strategy by using information gathered from the BIA, CRA and risk and threat assessment. Whatever strategy an organisation selects it has to ensure that it meets the target time for resuming the delivery of its products and services following its disruption. One strategy could be ‘balancing cost and speed of recovery’. In this strategy, there is always a trade off between cost and speed of recovery which needs to be balanced when selecting a strategy. So shorter recovery time objectives = higher cost and vice versa. Another strategy worth considering and is quite popular is ‘separation distance and the concept of “off site” it’s basically replicating operations in a different location. It reduces the likelihood of two sites being affected by the same incident except in cases like pandemics and cyber attacks.  Artco Solutions will also recommend a centralised access to data, emergency communications, emergency plans and key documents so senior management and employee have what they need when they need it.

As we have read, more than ever, businesses need effective BCM plans in place to protect their plants, infrastructure, property, staff, and supply chains from the fall of natural, political, social and economic threats.  

For further assistance please contact enquiry@artcosolutions.com

South Africa: top 10 business continuity issues for 2012

What are the risks that South African companies and their boards should be factoring into their planning for 2012? ContinuitySA has identified what it believes are the top issues facing business in 2012 that are likely to impact on business continuity strategies:

1. Socio-economic challenges ratchet up a notch
Last year, it seemed as though we might be coming out the recession, but now the talk is all about the dreaded double dip. Economic hardship is exacerbating social and political tensions, especially as retrenchments swell the hordes of unemployed. Too many people without work or the prospect of it places a huge burden on the state, provides the climate for crime and is likely to fuel tension between the haves and the have-nots.

2. Government performance and service delivery still lag behind expectation
Ongoing service delivery and corruption issues have continued to fuel widespread social unrest. Some commentators are even talking about popular uprisings comparable to those that occurred earlier in the year in North Africa. Instability in the ruling party continues to unsettle political and social life, and this will only get worse as the ANC’s leadership conference approaches. Meanwhile — no doubt fuelled in part by the economic problems mentioned above — strikes and social protests seem to be getting more prevalent.
For business, one direct consequence is frequent work stoppages, with staff actually finding it hard to get to their places of work.
“It seems that South Africa is coming to a crossroads again, faced with the choice between the high and low roads,” says Michael Davies, ContinuitySA’s managing director. “We have to have confidence that our leadership will make the right choices but, meanwhile, prudence demands a renewed focus on safety measures, including proper business continuity plans.”

3. National infrastructure remains weak—and the middle class is feeling the pinch
While Eskom contrived to come through a very cold winter with relatively few blackouts, concern remains high as summer is the time for planned maintenance. Another concern is the availability of skills to maintain the aging infrastructure at Koeberg, and to operate planned new nuclear power facilities. On the positive side, recent moves to introduce independent power generation and green power into the South African energy market are welcome.
That said, there are worrying reports that lack of additional energy capacity at present is affecting the ability of some data centres to expand.
Other infrastructural challenges include the new toll roads around Gauteng and the new national health insurance system. While both are desirable, they are placing additional financial burdens on the middle class—i.e. the small tax base on which everything rests. Is the middle class coming close to feeling as squeezed as the poor and unemployed and, if so, how will it make its distress known?

4. Water remains a concern
Water security remains a problem in this country, exacerbated by the pollution of our existing water stocks.
Although the government finally woke up to the problem of acid mine drainage and made R400 million available, media reports indicate that little action has actually occurred. If substantial progress is not made in finding a solution, the acid water is expected to begin decanting into the Johannesburg basin in March 2012—it is already decanting on the West Rand. Companies with IT equipment in basements need to remain on high alert.

5. Worsening business climate
The risks mentioned elsewhere will continue to weigh on risk-averse foreign investors, while the volatility of the rand will encourage destabilising capital movements. The socio-political challenges we have mentioned are also taking their toll on the outlook of local business. With the business confidence index declining, investment in equipment and people will be curtailed at a time when they are more necessary than ever. Militant unions and demands for increases that are significantly above inflation are further worsening the business outlook.
With revenues under pressure, many companies will be tempted to skimp on business continuity but this approach is short-sighted.

6. Regulatory burdens and responsibilities increase
Promulgated during 2011, the new Companies Act has made the directors of companies personally liable for the outcome of their decisions. The legislation is new and untested, making compliance even more risky than it might otherwise have been.
In combination with the recommendations of the King Commission, the new act has made risk management a much more important item on the board agenda—and this includes IT risk.
Boards are increasingly accountable to all stakeholders rather than just shareholders. In this regard, environmental issues are becoming more prominent, which may add impetus to the move towards cloud computing, which has the effect of greening the IT department.

7. The sting in the supply chain tail
Recent natural disasters like the volcanic eruption in Iceland and the earthquake and tsunami in Japan have emphasised the flipside of global interconnectedness. In order to ensure business continuity, companies must increasingly consider their entire supply chains. Adequate consulting around the business continuity threats originating outside of the organization is imperative.

8. Cloud computing blurs vision
As predicted, 2011 saw considerable movement in cloud computing. While it’s clear that cloud computing has real benefits, non-specialist public cloud offerings should not be confused with specialist business continuity, which is also making use of cloud-based approaches.
“The need to have absolute quality assurance and security in terms of your business continuity remains, especially in light of boards’ enhanced accountability,” Davies notes. “On the other hand, the greater availability of bandwidth and improvements in technology are changing the model.”

9. Mobility is creating huge new data risks
The growing range of smart mobile devices, and the explosion in useful applications, has made mobility a fact of life. At the same time, there is growing awareness of the value of a company’s data, hence the emergence of ‘data as a platform’. Securing and backing up the corporate data on mobile devices usually owned by employees rather than companies is raising CIOs’ temperatures worldwide.

10. Business continuity is still not integrated into corporate strategy
Given the scale and magnitude of the challenges business faces, the danger remains that business continuity is marginalised and siloed. In many instances, financial pressures are causing companies to cut back on business continuity. For example, banks which have retrenched large numbers of people now have excess office space which they tend to use to provide their own workplace recovery—and this may lead to a business continuity solution that is less than optimal.
A related issue is that the long-term viability of smaller business continuity providers is looking less certain in this climate. We think this will prompt a ‘flight to quality’ in many cases.
As indicated above, the emergence of new opportunities to remodel business continuity using a private cloud approach is a game-changer, offering cost savings, a much more effective product and the opportunity to get a return on your business continuity investment.
www.continuitysa.com

Does BCM exist in Afica?

Business Continuity management (BCM) has become a very important aspect of good corporate governance and has become a part of best practice recommendations in various countries. However, in Africa, BCM is still in its infancy, and is nonexistent in a few African countries.

It is crucial to separate Africa from the rest of the world because the continent has its unique set of challenges that could disrupt business at any time. Think of draught, poor supply chain infrastructure, political instability, bureaucracy and industrial actions. Furthermore, power disruption and pandemics such as HIV/AIDS also have impacts on workers, is a real concern in Africa.

Many organisation leave BCM until a crisis. BCM is simply the ability to maintain operations and services during a disruptive event. It provides a framework for building organisational resilience with the capacity for an effective response that safeguards the interest of key stakeholders, reputation, brand and value creating activities.

Remember the Blackberry outage in October 2011? That is a good example of poor Business Continuity Management. It appears that the most recent service outage will no doubt have a long term impact on Research in Motion (RIM). The poor crisis response contributed to the drop of its Smartphone market share from 19% year earlier to 12% in 2011.

The lack of BCM is not a story about Africa unwilling to follow the rest of the world, but the story of how Africa lacks awareness, leadership and standardisation. Some central banks on the continent are beginning to take matters in their own hands by creating their own BCM guidelines for the banking community in their country. Countries like Kenya, Nigeria, Tanzania and Ghana have all developed a set of standards that can be applied in the African Context.

The next few points will discuss some of the challenges Africa needs to overcome before BCM can become a norm in the private and public sector.

1.     Lack of Skills

There are not enough skilled people to meet the continent’s need. The continent needs to promote and invest more on developing graduates and encourage more professionals to learn about the business discipline.

2.     Awareness

Another challenge Africa is to overcome is the lack of awareness. There is a need for standardisation in the continent that is globally recognised and acceptable. The region as a whole is to be aware of these standards and how important it is to implement effectively.

The successful establishment of BCM has to be embedded in national and organisational cultures by training and education.

3.     Understanding

With awareness comes understanding of what BCM really is. There are some misconceptions of what BCM is. Many managers think BCM is all about backing up data. No, it not just about backing up data in a remote location. It is a holistic process that identifies potential threats to an organisation and the impact to business operations that those threats, if realised, might cause. BCM is critical to ‘Business As Usual’ it is a benchmark for a resilient organisation.

4.     Long term management and maintenance

Even when awareness and understanding is improved through the educational effort of professional BCM companies, the lack of skills limits the effective implementations and maintenance of plans. Consultants often engaged by organisations develop and roll out BCM plans, design an efficient system for them. However the problems occur once the consultants have left. BCM is a continual process that needs to be tested and updated regularly, so training people in BCM skills is crucial for an effective strategy.

5.     Cost

Every company is concerned about costs and Business Continuity can be an expensive affair, especially if solutions are created in-house. In many instances, Business Continuity is put on the backburner simply because of the costs involved in setting up a programme. This is the wrong approach to take. If executives consider the expenses involved in creating their Business Continuity plan and then compare it to the amount of money it would take to recover from a serious disaster without such a plan, they would realise that the initial costs are quite reasonable. The Information Warfare Site states that fires permanently close 44 per cent of businesses affected, while after the 1993 World Trade Centre bombing, 150 businesses out of 350 affected (that did not prepare BCM plans) failed to survive the event.

Finally, business continuity process is a necessary sustainability tool for maintaining successful business operations and securing more Foreign Direct Investment (FDI) in Africa.  We have to cultivate the sprit of getting things done, planning for, anticipating and minimising disruptive event. Let us protect our stakeholder.

Considering a BCM plan? Talk to Artcosolutions on enquiry@artcosolutions.com

The principles of Business Continuity Management

 

The constant evolution of today’s corporate environment has prompted many questions on how we plan for business resilience. Changing business dynamics coupled with the current economic climate pose new challenges for business continuity management; while events such as natural and manmade disasters we have witnessed this year push BCM to the fore as organisations seek to protect their continual survival.

Most articles on BCM have highlighted how an effectively structured and implemented continuity plan can serve to protect high-value activities and stakeholder interest. We ignore how BCM has contributed to overall business success and competitive advantage.

Artco solutions aim to offer an insight into what in our opinion are the nine principles of BCM

1.       Strategic orientation

BCM is a strategic initiative. It should be integrated into the corporate strategy planning level. Top management recognition and adoption of this strategic initiate is paramount to achieving organisational excellence. The business continuity manager has a pivotal role in establishing the competitiveness of the business through aligning BCM processes strategies and plans to corporate policy and structure.

2.       Leadership

Proactive business continuity leadership ensures that reputation and business performance are sustained from the moment disruptive event begins. It is important that business continuity is introduced at board level since it enhances the organisation’s long term competitiveness.

3.       Governance

BCM is an important element of an organisation’s overall approach to governance. It provides the impetus for delivering and governing the resilience programme in the organisation and its supply chain. It helps to establish the oversight capabilities required by senior executives to carry out their responsibilities for ensuring that effective management systems, including monitoring and control mechanisms have been out in place to protect assets, earnings capacity and reputation of the organisation.

4.       Good Business Management

The management function is about understanding the business philosophy, strategic objectives, corporate structure and critical operations of an organisation. It challenges corporate assumptions about threats and uncertainties, and facilitates greater certainty in the planning and achievement of long term goals.

5.       Multi disciplinary functions

It involves the skills and knowledge of a diverse group of people in the design, implementation and management of the programme. Management concepts in the field of strategy development, risk and insurance, human resources, quality planning and control, and finance, are all now essential parts of managing the BCM programme. The collective management progress preserves the long term well being of an organisation and its stakeholders, thereby facilitating business excellence. Core competence skills, notably, organisational management, analyse, communication, leadership, coordination, and innovation are the six fundamental managerial competencies of business continuity professionals.

6.       Anticipation

BCM is an active process which helps organisations anticipate threats and perceive the potentially significance implementations they could have for the organisations. This proactive sensing mechanism helps to remove the potential risk systems failures and safeguard mission critical operations.

7.       Communication

BCM promotes transparent communication within the organisation and amongst its stakeholders. A communication structure based on BCM underpins the corporate governance and improves the information flow to parties who require it for decision making, planning and implementation. During a crisis, it demonstrates the organisation’s transparency in dealing with the situation and reassures stakeholders. Such an approach reinforces stakeholder relationships and enhances shareholder value.

8.       Value preservation

Through BCM organisations are better able to withstand the impact of crises or recover more quickly thereby reducing the impact of loss and as a result preserving their overall value.

9.       Evolution

BCM is constantly changing and breaking new boundaries. One of the most common pit falls is that many regard it as simply a ‘crisis and invocation’ process stemming from IT DR origins. However, BCM has evolved significantly since then and is continually changing to meet new business challenges. It now offers a means of competitive advantage and gaining market share.

As business evolve BCM Mangers must take up the challenge of aligning BCMN with organisational performance, and promoting to senior executives the benefit it can provide in the context of strategic planning and the delivery of corporate goals.

Artco solutions believe that by training, exercising and rehearsing any organisation can make its plans, people and processes more resilient to a crisis. ‘We call this managing with certainty’. Our proficiencies reflect our strategic vision and ability to provide for the needs of new and existing clients to continue operations in the event of a disruption.

Is the London 2012 Olympics going to affect your business?

Let us engage in a conversation ...

London will be hosting the world’s largest sporting events in 2012. The games are already benefiting businesses. With billions of pounds of contracts to supply for the London 2012 games. The games promise to deliver a London changing experience. However, there will also be some challenges for business and individuals.

With 10.8 million tickets sold around 2 million Olympic visitors are expected to share the same resources as you and I struggle with daily. This will means millions of extra people will be using the transport system during the summer, a time that is already busy in the capital. Each individual or business will be affected by the games in different ways and to different extent and you will know best what is likely to work most effectively for you and your business.

The Game is likely to have an impact on the following areas of your business:

·         Travel to and from work for you and your employees

·         Travel for your customers or other visitors or family

·         Deliveries/ collections and other supplies

·         Business travel / personal travel

·         Internet security/ cyber attacks

Having established that you or your business will be affect, how are you preparing to manage these impacts?

·         Have you thought about  home working

·         Alternative routes to work

·         Have you thought about your supply chain management

·         How will your business deal with high absenteeism

·         How about flexi working times for employees

·         Using alternatives to meeting methods like teleconferencing, web conferencing

·         Have you thought about stock piling of non perishable goods

·         Have you asked your suppliers their plans for business during the games

Please share your thought below on how you/ your business is planning to reduce the challenges the LONDON 2012 games bring.

Buisness Continuity: Withstanding Power Outages

According to the 2011 Business Continuity Management survey, loss of electricity was highlighted the sixth most damaging threat to an organisation. A report from SunGard availability services ‘causes of invocations 2010’ highlights that 27 percent of invocations was caused by power outage in 2010. A wide power loss is a threat that the government takes very seriously after the 28 August 2003 wide spread power cut covering an area of central London. Although the power was restored in 30 minutes, the resulting chaos lasted well into the night. Energy experts still believe that there is still a risk of major power outages because national grids are struggling to cope with the increasing demand for electricity.

With organisations operating ‘Just in time systems’ there is no time for a black out. As we  know one weak link in the supply chain can have a far reaching impact on the business operation. To ensure that power outage does not escalate into a disaster that result in business disruptions, loss or revenue or even damage to your reputation you need to be prepared. Organisations should be able to cope with this level of disruption quite easily.

Why plan?

Organisations without a power cut disruption or major incident plan can suffer fatal damage. Research shows that about 80 per cent of them close within 18 months, according to the London Prepared, a government organisation that provides information about business continuity.

Going forward the article we will recommend strategies on how your organisation can develop a response to power outage. But first of all you have to determine what you have by identifying and understanding the electrical distribution system layout and design in the facility to be protected. Most organisations have a very complex electrical power distribution system and to properly understand them, wiring documentation will need to be reviewed and brought up to dated.

Furthermore, it is also necessary to determine what your organisation’s mission critical requirements are for power. Critical electrical power requirements are usually driven as part of a business impact analysis and risk assessment. After all critical systems have been identified their source of power within the facilities need to be identified on electrical drawings to make sure it is understood that they are critical to the operation. If the electrical distribution system has been properly designed, all business equipment should be connected to common circuits and separated from non- critical equipment. We recommend this because it makes it much easier to isolate mission critical circuits and to connect them to emergency power source during an emergency. Don’t forget to keep documentations up to date for the equipment contained on these circuits. This will help identify the electrical load so as alternative back up power source can be deployed.

It is always good to have an uninterruptible power supply (UPS) in case of power failure. They can sustain power for up to an hour if they are properly sized and maintained. If it is absolutely critical to maintain power for an entire operation thought a power cut, regardless the duration of the incident, you might consider installing permanent emergency generators.  In addition, these types of installations are quite expensive and complex to install, operate and maintain and depending on your county it may not be viable due to building codes or environmental constraints.

As it is difficult to predict a power outage, a contractual agreement with an availability service such as SunGard that delivers secure workplace recovery centres and remote access solutions will be effective in minimising business impact as returning you to business as usual quickly.

Think Artco Solutions

Artco Solutions has a team of specialist partners that design crisis management and incident management plans, training events, projects, and conduct crisis rehearsals day-in, day-out. It is our core business to manage your uncertainty.

The Artco solution is a carefully designed mix of consultancy, professional services, products and solutions, that can help put your organisation on the front with business continuity planning, delivery and management.

An introduction to Business Continuity Management (BCM)

Business continuity can be defined as 'the processes, procedures, decisions and activities to ensure that an organisation can continue to function through an operational interruption'.
In other words it is about making proactive and reactive plans to help your organisation avoid crises and disasters and to be able to quickly return to 'business as usual' should they occur.

Why is BCM important?..

In an increasingly uncertain world, business continuity management is more relevant than ever. BCM identifies potential threats to an organisation and the impacts to business operations that those threats, if realised, might cause. Natural disasters, network intrusions, human error, security and terrorist concerns - the list of threats to organisations keep getting longer.  In today’s integrated digital networked economy, even a few hours of service disruption can have a devastating impact.

Who is It applicable to?..

All organisations might be subject to disruption; this may include technology failure, flooding, utility disruption, pandemic influenza, fire or terrorist attack. The standard is available to any organisation regardless of the size, scope or complexity, that wishes to manage their overall business risks and develop the capability to plan for, and respond to, incidents and business disruption.

The consequence of unexpected business disruptions may be far- reaching and might involve loss of life, loss of asset or income, or the inability to deliver products and services on which the organisation’s survival might depend. By proactive identification of the impact of disruption, BCM identifies those products and services that are crucial for the organisation’s existence, and help to establish what responses will be needed if a disruption occurs.

What are the benefits?..

·         Improving an organisation’s resilience against vulnerability

·         Maintaining an ability to manage uninsurable risks

·         Developing a capability to manage business disruption

·         Minimising consequences of unexpected disruption

·         Providing a method of restoring an organisation’s ability to supply its key products and services

·         Protecting and enhancing the organisation’s reputation and brand

·         Gaining a competitive advantage by demonstrating the ability to maintain delivery of its products and services

Why use Artco Solutions?..

 The first few hours of a crisis are critical. The failure to take control in the early stages of a crisis can lead to, at best, a loss of confidence. You could be facing a real financial loss or severe criticisms from stakeholders that may last many months.

Artco solutions believe that by training, exercising and rehearsing any organisation can make its plans, people and processes more resilient to a crisis. We call this managing with certainty. Our solutions enable companies to continue operations in the event of a disruption. Artco solutions help protect your staff, your reputation and your organisation’s business.