Introduction
The purpose of this step is to select appropriate tactical continuity options for each activity that supports the delivery of the organization’s products and services, and to identify what needs to be done to implement the selected options.
These tactics will be based on the BCM strategies selected for each product or service.
Appropriate tactics for each activity will need to be selected to cover the requirements in the relevant areas of:
• People (skills and knowledge)
• Premises (buildings and facilities)
• Resources
> Information technology (IT)
> Telecommunications
> Non electronic (paper) information
> Equipment
• Suppliers (products and services supplied by third parties)
• For manufacturing organizations, particular attention will also need to be given to:
> Production processes
> Materials, logistics and inventory
> Power and utilities
In order to undertake this stage, both RTO and RPO parameters must be available with an up to date CRA that identifies the recovery requirement. The agreed BCM strategies for each product and service must also be available.
Concepts
Determining recovery tactics and selecting appropriate
solutions from available options is the most detailed part of the BCM Lifecycle. This is because it is:
a) the part of the process which will probably incur the most expenditure
b) the fundamental part of the technical and operational infrastructure that is needed to make plans workable in practice
In order to do this effectively, certain concepts need to be considered in some depth.
Consideration should be given to the following:
• Extent of planning
• Urgent activities
• Recovery time objectives for activities
[] BCI Good Practice Guidelines 2010 | GLOBAL EDITION
BCI Good Practice Guidelines 2010 | GLOBAL EDITION []
• Options by time
• Reliability
• Re-appraising strategies
• Costs vs benefits
• Third party recovery sites
• The needs of diverse stakeholders
• The demands of civil emergency responders
Extent of Planning
The extent and detail to which the tactics for each activity need to be planned will depend on the urgency with which they are required and the complexity of the resumption.
Urgent Activities
Not all the activities associated with a product or service will necessarily need to become operational within the RTO set for the product or service, and in larger organizations, the sheer scale and difficulty of determining continuity options for every activity would be impractical. For these reasons, determining continuity options should concentrate on the most urgent activities. These will have been identified during the BIA, and will generally consist of those activities where the MTPD of the products and services that they support (and hence the RTO) is relatively short.
Recovery Time Objectives for Activities
Where an activity must be operational to support the delivery of a product or service, the RTO for that activity must be less than or equal to the RTO of the product or service it supports.
Options by Time
Continuity options for activities might change over time as the activity moves though the three levels of recovery:
1 Initial Continuity – to a minimum acceptable level 2 Recovery – to a sustainable level
3 Resumption – back to the normal level
Reliability
When the options considered involve third party provision of services, there is often a management decision to be made between the cost and the reliability of third party provider.
Promises may vary from verbal reciprocal agreements through
‘best endeavours’ to a contractually committed service level.
The shorter the RTO, the more important the reliability of the delivery becomes.
Re-appraising Strategies
It is not unusual to find that there is a need to re-appraise the BCM strategies for a product or service once the tactical
continuity options have been reviewed for the activities that support its delivery.
Costs vs. Benefits
It is difficult to use conventional cost-benefit analysis to justify the cost of protection or continuity measures because this requires assumptions to be made on the likelihood of incidents.
Manufacturing and service industries who supply other businesses may be able to demonstrate that increased sales or better margins can be achieved by demonstrating BCM capabilities (i.e. improved reliability) to their customers – and thus show a benefit compared to costs. This is more difficult to demonstrate when the service is non-commercial or is being provided as a public service.
Third Party Recovery Sites
Third party alternative site arrangements are widely available in many countries. The options vary widely and are discussed in more detail in Annexe 1.
The Needs of Diverse Stakeholders
There may be many individuals and groups affected by an incident. For example, in a major fire there may be contractors injured, local residents evacuated from their homes and local business having to close for safety reasons or suffering reduced trade. The organization’s level of responsibility (both legal and moral) for these groups should be understood.
The organization should ensure that the needs of various stakeholders are satisfied when selecting continuity options, otherwise they may impede the subsequent recovery effort. For example, the local residents could press the local authorities to refuse permission to rebuild on a damaged site.
The Demands of Civil Emergency Responders
The organization should be familiar with the procedures of the local emergency responders, and contact with these groups in advance may provide useful information to assist in selecting tactical options
Civil emergency responding organizations should implement their own BCM programme to ensure that disruption to their facilities does not hamper the response service that they provide to the community. In many countries, BCM planning is a statutory requirement for civil emergency responders.
Process
The process includes the following steps:
• Identify the activities to be included for each product or service
• Determine the RTO and RPO for each activity in line with that for the product or service that the activity supports
• Identify tactical options for each activity
Analyze the options for effectiveness and cost
• Provide Top Management with an evaluation of the options and recommendations
> Obtain agreement from Top Management on the tactics to be used, including the financial and resource provisions for implementation
> Identify implementation projects for each of the tactics selected
Scope
The scope of this part of the process is complex and demanding.
Often technical advice might need to be sought from experts in other fields, in particular for manufacturing businesses.
Typically specialists in purchasing and supply, inventory management and capacity planning might be needed to help determine tactics that would be appropriate.
In general terms, the BCM professional needs to ensure that the following areas are addressed properly in any tactical solution:
• People
• Premises
• Resources
• Suppliers
Due to the vast differences in types of businesses that will implement BCM, it is not possible in such a Guide as this to be prescriptive about what tactics will be suitable for which companies, sectors or geographies. However Annexe 1 provides considerable advice which should help with the selection and decision process.
Although the options selected need to work in isolation (e.g. in the event that the only loss is of a computer system or single production line), they also need to work together (e.g. when a building is lost in a disaster that destroys all the resources in the building, renders some of the staff unavailable for work, and also disrupts a local time critical supplier).
Outcomes and Review
The outcomes and deliverables from this stage are:
• An agreed set of tactical continuity options agreed by Top Management
• Funding and resource approval to implement the agreed tactical options
• A list of projects for implementing the agreed tactical options Another outcome may be to re-appraise the BCM strategies selected for a product or service if tactical options prove unavailable or costly.
A review to ensure that the appropriate continuity options have been selected for each important and urgent activity should be carried out at least every 12 months, and following any change to the BCM strategies for any of the products and services that the activity supports.
Any significant change in the following may also trigger a review:
• The skills required to undertake the activity
• The premises at which the activity is undertaken
• The resources used by the activity (particularly IT)
• The suppliers on which the activity is dependent
[] BCI Good Practice Guidelines 2010 | GLOBAL EDITION
iStockphotos.com/lorrainedarke