What you will learn in this tip: There are several options for developing business continuity (BC) plans. You can...
do it yourself using Microsoft Word or Excel, hire a consultant or use business continuity software to create your own BC plan. This tip will teach you about the pros and cons of using business continuity software and how to integrate it into your business continuity management operations.
The benefit of using third-party business continuity software to create a BC plan is that a plan can be created quickly and easily once you've learned how to use the software and gathered the right information.
After you've completed system training, the next steps are to gather, compile, format and upload the necessary information into the application before you can produce a plan. The information you’ll need to collect for a BC plan includes:
2. Data on recovery time objectives (RTOs) and recovery point objectives (RPOs)
3. Contact details on suppliers, stakeholders, first responders, utility companies and business continuity team members
4. Step-by-step procedures for launching specific activities such as relocating to an alternate workspace or re-establishing business operations in collaboration with your IT organization
5. Input for plan exercising and maintenance
You’ll need to manage vast quantities of data to develop a plan, which is best handled by systems that use database management systems (DBMS) as part of their infrastructure. You may need a unique plan for each department, and an automated tool should have a sufficient selection of plan templates. If you need to perform a business impact analysis and/or a risk assessment, many automated systems also include those capabilities. Plan exercising can also be facilitated with software tools.
The good news is that most automated tools available today can do most—if not all—of the work for you.
While there are numerous business continuity software packages on the market, a few well-established systems continue to take center stage. SunGard Availability Services and its Continuity Management Solution (CMS) offers a most diverse product set. At the high end in pricing is SunGard’s Living Disaster Recovery Planning System (LDRPS).
Prices can range up to more than $100,000 and the product is scalable for small to medium applications. Other noteworthy products include ResilienceONE from Strategic BCP; Sustainable Planner from Virtual Corporation; Disaster Recovery System from TAMP Systems; and myCoop from Coop Systems.
Most of these systems are server-based and use relational database management systems. In addition, Rothstein Associates Inc. offers a broad selection of affordable BC/DR software with prices as low as $100.
Tips for implementing business continuity software
You’re going to install a fairly complex system and you should follow the parameters of the Software Development Life Cycle (SDLC)—or a similar methodology for assessing needs and evaluating applications - to ensure you have addressed all the critical issues.
If your organization has a formal program to evaluate, select, install and maintain specialized software, carefully follow those procedures.
Let’s examine how we can use the SDLC to implement business continuity software:
1. Set up a project plan and feasibility study (possibly a matter of acknowledging that you need the software and not a feasibility study). \
2. Conduct a requirements analysis:
- Determine your business continuity management (BCM) requirements, e.g., all business continuity management functions, BIA only, plan only
- Analyze your technical and operating requirements, e.g., will you need a standalone server for the new system?
- Analyze user requirements
- Analyze changes to user desktop configurations, if any
- Analyze integration issues with existing systems and platforms
- Analyze database management system requirements
- Analyze security and access control requirements
3. Conduct a request for proposals based on requirements documentation.
4. Since systems design work will not apply in this case, review the system design and configuration to see if it maps into your requirements.
5. Determine what modifications (e.g., coding) will be needed to make the system work for your organization.
6. Evaluate and select a system.
Integrating the software into business continuity management operations
Key points to remember about integrating BCM software into your department are:
1. Know how you want to use the software. Don’t spend a lot of money for something that creates only a single plan.
2. Make sure you have approval from senior management to embark on a new software acquisition; prepare whatever justification statements you need to make your case.
3. Make sure your staff has input into the planning and implementation stages so they will look forward to the new system, rather than dread its launch.
4. Talk to other users of the system to learn any tips and tricks they learned to make the system work better.
5. Get as much training on the new system as possible and make sure you can get hard-copy versions of the training and operations manuals.
6. Expect the time needed from installation to normal daily operations to be several weeks or maybe months—not the next day.
7. Don’t expect the software will take the place of human staff: The software makes your job easier, helps manage data effectively, plus produces plans, reports and other documents quickly.
Depending on how many management functions are present (e.g., scheduling of BIAs, scheduling of exercises), you may be able to leverage the system’s administrative features to streamline overall BCM department management. Give this plenty of thought before you proceed, because if your BCM department has been doing things manually for a few years, the staff may be reluctant to use a new tool.
Unless the vendor has a utility that quickly converts virtually anything into their resident DBMS format (or whatever data management function is used), allocate time for data conversion. For example, if existing department data from BIAs, risk assessments, plans, lists and other BCM-related activities need to be reformatted to load into the new system, somebody will have to perform that reformatting.
Learning the new system will take time; especially for most current DBMS-based systems that have dozens of features; their own plan development process; their own collection of templates; their own BIA/RA process and even their own exercise process.
In addition to buying your own system, which could cost tens or hundreds of thousands of dollars, you may want to consider a managed BCM service offering. This option lets you access the system from a standard Web browser and you only pay for those parts of the system you actually use. Check the security arrangements of managed service offerings so that your BCM data will not be at risk.
This article has provided useful tips on planning and implementing business continuity software for use by a BCM department. Treat the project as another normal software implementation, remember the key points about these specialized systems and you’ll be well on your way to developing the best possible business continuity and disaster recovery plans.
About this author: Paul Kirvan, CISA, FBCVI, CBCP, has more than 20 years experience in business continuity management as a consultant, author and educator. He has been directly involved with dozens of IT/telecom consulting and audit engagements ranging from governance program development, program exercising, execution and maintenance, and RFP preparation and response. Kirvan currently works as an independent business continuity consultant/auditor and is the secretary of the Business Continuity Institute USA chapter. He can be reached at [email protected].