Sat, October 01, 2005 — CIO — Business-continuity planning has grown more sophisticated in the past few years, going beyond the technical recovery of IT systems and getting networks back online. Whether it’s a carryover from Y2K and 9/11, or the demands of Sarbanes-Oxley, CIOs find themselves in the position of not only making sure technical disaster-recovery plans are in place and working but also coordinating larger continuity efforts with all business functions.

Members of the CIO Executive Council recently identified business continuity as a topic for future Council activities and research. Twenty-seven members also participated in a June 2005 conference call on business-continuity planning. The following are some best practices from members who have made such planning an integral part of their organizations.

1] Attach a business owner as the main driver. Business continuity is not about IT; it’s about the business. Therefore, it only makes sense that someone from the business be the owner of this significant undertaking. By not identifying business continuity as an IT project, its importance to the company as a whole becomes clear and more widely accepted. The Board of Trustees at The George Washington University, for example, hired an assistant vice president in 2003 who sits outside of IT and is charged with coordinating business-continuity plans for the university, with significant day-to-day assistance from IT.

At Eastman Chemical, business-continuity planning is specifically linked to the company’s Sarbanes-Oxley efforts, which are sponsored by the CEO. At Intelsat Global Services, a Washington, D.C.-based satellite and telecommunications company, CIO and Senior VP Joe Kraus sits on the crisis management team, which is made up of 20 senior representatives from business units such as HR, facilities, security, corporate communications and the medical unit. This team, led by Intelsat Global Service’s president, is responsible for managing communications in the event of a disaster. The team meets quarterly, providing a forum for senior business leaders. Given the strong infrastructure emphasis of the business-continuity planning process, IT is responsible for the program’s day-to-day operations. A business rep is responsible for guaranteeing business-side participation.

2] Encourage business members to understand and document core business processes. It’s hard to write a business-continuity plan if you don’t understand all the details of your business. Dave Swartz, VP and CIO at The George Washington University, was surprised by the large number of managers who lacked a solid understanding of the university’s business, and therefore had not accurately documented how they ran their functions. "The first exercise that the business units underwent was to examine the business processes, including people involved, relationships with different units and their specific reliance on technology systems," says Swartz. "It was interesting to see the new points of risk that were identified that people hadn’t been aware of."