When Steve Burcham joined Digium Inc. in 2008, he was charged with getting the company ISO-certified and developing a business continuity plan. Although deciding which business continuity planning (BCP) standard to use can be a difficult decision, the benefits are worth the upfront homework, some organizations report.
Those plans were put into place in April when deadly tornadoes ripped through northern Alabama, including Digium's Huntsville headquarters, resulting in a five-day power outage. "At 4:00 or 5:00 p.m., the power went out, and the backup generator came on like it was supposed to," recalled Burcham, vice president of operations for the company that provides turnkey business phone systems, IP PBX phone systems, VoIP phone systems and Asterisk telephony software. "We run a 24/7 call center out of our headquarters building, and we had a normal handoff between the day and night shifts—despite the power being off."
Three days after the tornado, Digium lost its phone service, which was vital not only to operations but also its workers, who were calling into an employee hotline to receive daily updates on office status. Working with API Digital, the company's Internet provider, Digium was able to reroute calls through its Asterisk servers to Switchvox, both of which are Digium products. Phone service was restored within an hour.
Burcham credits the company's business continuity plan, developed using American Society of Industrial Security (ASIS) standards, with helping Digium to survive the crisis. "A 40- to 50-page document showed everything that was needed to develop a plan," Burcham said. "The senior management team was involved in several two- to two-and-a-half-hour workshops to conduct a business impact analysis and risk assessment to rank the possibility of threats, how to minimize them and how to respond should any of the scenarios come to fruition."
Choosing the right BCP standard requires coordination and communication
M5 Networks, a provider of hosted VoIP services, has formed a CIO Council of its top customers to help the New York company choose a standard for defining and communicating best practices for service management said Eric Raab, CTO. "We've done a lot of work with our technology. We're geographically diverse and redundant, but if we don't have a documented process for each person in the company in the event of a disaster, we haven't completed our planning," Raab said.
The company is leaning toward ITIL's service continuity module, which Raab said delves into operations and contains protocols and checklists to cover common BC scenarios. "I'm eager to get feedback from CIOs and see what they're leaning toward," Raab said. It is not sufficient to have a BC plan; you also need to be able to communicate that plan. Many of our customers are partners who resell our services, and they need a clear and concise answer to the question, ‘What is your business continuity plan?’ ITIL can help provide that answer.”
Atlanta-based marketing automation firm Pardot has made a conscious decision to rely on its service providers to provide BCP standards, said David Cummings, the firm's CEO. "We're big fans of having continuity in the cloud," said Cummings. The company uses Google for email and cloud-based PBX hosting from Aretta Communications, which was recently acquired by Cbeyond. Pardot has remote employees who have office extensions just like in-office employees do.
"We've made the decision to trust the experts," [for business continuity planning], Cummings said. "I'd rather spend more of my time on the strategic part of running my business."
Any BCP standard should be viewed as the minimum required to keep a business running in the event of a catastrophic event, said Jeff Stern, principal consultant at Eagle Business Solutions, based in metro New York.
"All of these standards, from NFPA 1600 here in the States to the new ISO standard, should be seen as the minimum standard to be achieved and a good outline to follow," Stern said. "They do not replace basic business/common sense as to what are the risks of a specific business or geographical area and the best ways to mitigate those risks."
A successful BC plan must be part of the company's overall business strategy and must take into account much more than data and phone service. The marketing and sales arms of any business are vital to the continued viability of the business, as are provisions to provide products or services during any outage. The basic roadmap should include people first, then processes and, finally, technology to support the first two, Stern said.
About this author: Matt Bolch (firstname.lastname@example.org) is an Atlanta-based freelance writer who regularly contributes to more than a dozen consumer and trade magazines on a wide range of topics, including technology and general business.