Most organizations see Business Continuity as a process that is executed over time, rather than a static set of documentation.  While there are many different approaches to business continuity methodology, nearly all of them share the core elements identified below.

Define the Process
The first step in starting a business continuity program typically involves the establishment of internal governance structures and custom elements of the organization’s unique business continuity lifecycle. We have found that a management-approved policy statement and set of standard operating procedures clarify how the program will operate long-term and provide a method of measuring performance and holding key managers accountable.

Analysis
The identification of business and technology recovery objectives is a foundational element of the business continuity planning process. The Business Impact Analysis clarifies the scope of the planning effort and enables management to focus scarce resources on critical elements of the business. It is important to note that a BIA does not have to be a huge undertaking. There are many ways to identify recovery objectives, but often the process is heavily influenced by the organization’s culture.

In addition to a Business Impact Analysis, many organizations also perform a business continuity risk assessment. This often mirrors enterprise-wide risk management concepts by not only estimating the likelihood of risk occurrence, but also identifying opportunities to control the likelihood and severity. A risk assessment will identify likely sources of availability risk, current-state controls to mitigate risk, and options to further mitigate the likelihood of the event – to a level acceptable by management.

Business Continuity Strategy Development
Different organizations have different risk tolerances. Building on the results of the risk assessment and Business Impact Analysis, strategy definition addresses the cost-benefit analysis and selection of appropriate risk reduction strategies. Risk reduction addresses both likelihood reduction and impact limitation. While the latter is a common outcome of the business continuity strategy definition process, likelihood reduction is also import. A focus on preventing an event is of significant value to an organization and its stakeholders. The strategy definition phase of a business continuity planning effort results in the establishment of a crisis management process, internal and external crisis communications processes, and methods to recover the following:

• Facilities
• Roles, including key personnel
• Technologies, including systems applications, data, networks and telephony
• Vendor and business partner relationships, with a focus on critical single and sole source providers

Strategy Implementation
While business continuity planning involves more than just developing plans, this process is still a critical component of the business continuity program. This is because the least experienced person may be the one called upon to execute the plans. What are the most common components of the business continuity plan?

• Crisis Management Plan – The set of procedures designed to assist the management team tasked with responding to an event, with the objective of stabilizing the situation and preparing for recovery.
• Crisis Communications Plan – The plan outlining the organization’s internal and external communications strategy.
• Business Recovery Plans – The series of business function-oriented plans focused on the recovery of critical business processes to a minimal level.
• IT Incident Management Plan – The set of procedures preparing IT for a recovered state – regardless of cause (i.e. a crisis management plan for the IT department).
• IT Disaster Recovery Plans – The series of technology-specific procedural documents designed to enable a recovered state.

Awareness and Maintenance
Executive managers can obtain assurance that their business continuity strategies will work in one of two ways – a test (a.k.a. an exercise) or a real-world event. Without either, no one will be comfortable that a business continuity strategy will work as designed.  Often, this phase includes:

• Identifying the appropriate testing approach.
• Documenting the test plan, including assistance with developing test objectives and associated success criteria.
• Developing test facilitation materials, including scenario information and test scripts.
• Facilitating the testing event, including introducing scenario information.
• Leading a “post-mortem” discussion in order to capture lessons learned.