How to Involve the Business to Create a Solid Continuity Plan

Business-continuity planning has grown more sophisticated in the past few years, going beyond the technical recovery of IT systems and getting networks back online. Whether it’s a carryover from Y2K and 9/11, or the demands of Sarbanes-Oxley, CIOs find themselves in the position of not only making sure technical disaster-recovery plans are in place and working but also coordinating larger continuity efforts with all business functions.

Members of the CIO Executive Council recently identified business continuity as a topic for future Council activities and research. Twenty-seven members also participated in a June 2005 conference call on business-continuity planning. The following are some best practices from members who have made such planning an integral part of their organizations.

1] Attach a business owner as the main driver. Business continuity is not about IT; it’s about the business. Therefore, it only makes sense that someone from the business be the owner of this significant undertaking. By not identifying business continuity as an IT project, its importance to the company as a whole becomes clear and more widely accepted. The Board of Trustees at The George Washington University, for example, hired an assistant vice president in 2003 who sits outside of IT and is charged with coordinating business-continuity plans for the university, with significant day-to-day assistance from IT.

At Eastman Chemical, business-continuity planning is specifically linked to the company’s Sarbanes-Oxley efforts, which are sponsored by the CEO. At Intelsat Global Services, a Washington, D.C.-based satellite and telecommunications company, CIO and Senior VP Joe Kraus sits on the crisis management team, which is made up of 20 senior representatives from business units such as HR, facilities, security, corporate communications and the medical unit. This team, led by Intelsat Global Service’s president, is responsible for managing communications in the event of a disaster. The team meets quarterly, providing a forum for senior business leaders. Given the strong infrastructure emphasis of the business-continuity planning process, IT is responsible for the program’s day-to-day operations. A business rep is responsible for guaranteeing business-side participation.

2] Encourage business members to understand and document core business processes. It’s hard to write a business-continuity plan if you don’t understand all the details of your business. Dave Swartz, VP and CIO at The George Washington University, was surprised by the large number of managers who lacked a solid understanding of the university’s business, and therefore had not accurately documented how they ran their functions. “The first exercise that the business units underwent was to examine the business processes, including people involved, relationships with different units and their specific reliance on technology systems,” says Swartz. “It was interesting to see the new points of risk that were identified that people hadn’t been aware of.”

3] Improving the process should be part of the plan. In 2002, Texas Children’s Hospital suffered through a virus scare for several days where faulty antivirus software made it appear that thousands of the hospital’s computers were infected with a virus. The hospital’s IT staff quarantined the affected computers, limiting access to critical patient data. Given the life-and-death importance of IT to a hospital, clinical staff moved to manual processes to keep patients safe. They found that the established downtime procedures worked well for the first couple of days, but the longer the trouble dragged on, the more time-consuming it became to recover. The clinical staff learned some valuable lessons during this incident. “It prompted them to review business-continuity procedures and develop new, manual processes as a result,” says David Finn, VP and CIO, privacy officer and information security officer. Schedules are now printed on hard copy for the current day and the next couple of days to reduce reliance on IT systems.

4] Coordination should stay with IT. IT should provide templates, review the plans and coordinate overall processes to ensure that each unit has done its due diligence. Eastman Chemical CIO Jerry Hale, Kraus and Swartz provide templates for each function that describe what components to include and how specific to be in the documentation. At Texas Children’s Hospital, IT is developing templates that will standardize the process of business continuity, outline practices and establish a monitoring process to ensure plans are updated as needed. (For sample templates, visit the online version of this story at www.cio.com/100105.)

5] Test business-continuity plans just as you would test technical disaster recovery. “We get the group of business owners in a room, present a scenario, and then walk through the business-continuity process,” says Hale. Kraus uses scenario-based testing to make sure the plan covers all the necessary elements. He gets information on potential scenarios from colleagues, by participating in external disaster-related activities, and from federal and government agencies responsible for disaster preparedness and planning. This year Kraus plans to run a business-continuity drill that will involve relocating staff from different subsets of Intelsat to the backup facility, and then restarting the business.