What is a business continuity plan (BCP)?
Let’s get the technical jargon out of the way. So the next time someone asks: “Do you have a BCP?”, you won’t have to quietly Google it at home. Your BCP is your business continuity plan.
It’s a document that clarifies how your organisation will continue to operate in light of circumstances beyond your control. Things like fire, flood, cyber-attacks, natural disasters, and – yes – pandemics.
It includes your disaster recovery plan, a full risk assessment, and a recovery time objective. Don’t worry – we’ll get to these.
Each hypothetical scenario is thought through.
So, if a disaster happens, there’s no need to run around like a headless chicken. You will have a detailed roadmap telling you what to do to facilitate continuous operation on a day-to-day basis and you can ensure as little downtime as possible.
-
Step 1: Business Impact Analysis (BIA)
You conduct a business impact analysis (BIA), along with a risk assessment, in the first stage of developing a business continuity plan. Your business impact analysis establishes what would happen if a particular function of your business were to fail. Carrying out a business impact analysis forces an organisation to scrutinise its weaknesses and implement preventative measures. The business impact analysis process helps you to create a hierarchy, establishing which operations are the most critical in upholding business processes. Base your hierarchy on considerations like financial losses, operational difficulties, quality control, etc., depending on your priorities. Once you’ve done this, you can work on creating a plan to protect and uphold the most important functions.
-
Step 2: Forming your business continuity plan
Once you’ve established which core processes you need to protect, it’s time to outline how you plan to defend these functions in a crisis. For each hypothetical eventuality, your plan should contain:
Contact information
This pertains to people working within the business, in addition to external individuals that you may need to go to for help. For a flood plan, for instance, you may have the details of contractors, decorators, and flood restoration experts. You’ll have the relevant contact details for your insurers. You may have the contact information for other companies that you can outsource work to during the business recovery phase.
A guide for when to use the document
It’s fine having these measures in place, but not all of them will be necessary depending on your particular circumstances. You don’t need to handle a flood on the shop floor in the same way as an overflowing sink in the staff room. Your guidelines need to set out the criteria for these measures to be implemented. You may choose to include different degrees of response for variations of the same scenario.
Recovery time objectives
These objectives are influenced by the hierarchy we discussed. Your recovery time guidelines set out which elements of the business should be recovered first, not to mention establishing an acceptable amount of downtime for each function.
Resources
Your inventory of resources should provide information on the resources that your company has access to and can use in an emergency. It’s good to know where to locate the fire extinguishers and replacement tech but non-physical resources should be taken into account as well. Perhaps Sharon from accounts has had first aid training. Maybe Chris on reception has done a fire safety course. Personal assets need to be included too.
-
Step 3: Future-proofing your continuity plan
A business continuity plan should outline the frequency with which the plan itself should be reviewed and updated. Writing the plan itself is the hardest part. Once this is out of the way, making modifications is a breeze. We’d recommend reviewing your plan once a year. Employees come and go, machinery is upgraded, and procedures become obsolete. Your plan should move with the times and reflect these changes.
If a disaster has happened, you should expand upon the plan you had in place. What worked well and what didn’t? Would you do anything differently if this were to happen again? You should also be prepared to include new scenarios in your continuity planning. Many businesses neglected to include a worldwide pandemic in their plans. Now, following the events of 2020, they have incorporated new strategies in case of future disease outbreaks.
Get the team involved. Two heads are better than one and people across different departments may think of potential risks that you hadn’t even considered.
-
A guide for when to use the document
It’s fine having these measures in place, but not all of them will be necessary depending on your particular circumstances. You don’t need to handle a flood on the shop floor in the same way as an overflowing sink in the staff room. Your guidelines need to set out the criteria for these measures to be implemented. You may choose to include different degrees of response for variations of the same scenario.
-
Recovery time objectives
These objectives are influenced by the hierarchy we discussed. Your recovery time guidelines set out which elements of the business should be recovered first, not to mention establishing an acceptable amount of downtime for each function.
-
Resources
Your inventory of resources should provide information on the resources that your company has access to and can use in an emergency. It’s good to know where to locate the fire extinguishers and replacement tech but non-physical resources should be taken into account as well. Perhaps Sharon from accounts has had first aid training. Maybe Chris on reception has done a fire safety course. Personal assets need to be included too.
Business continuity and disaster recovery are sometimes used interchangeably. But it’s important to remember that your disaster recovery plan is not the same as your business continuity plan. It’s a subsection of it. To outline the differences between the two, we’ve put together some handy guides in the form of a blog post and an infographic.
Disaster recovery refers to IT infrastructure issues, cyber-attacks, viruses, data losses, and document recovery. Your disaster recovery plan tends to focus on repairing and recovering your business should anything catastrophic happen to your technology and data. New developments in cloud storage have frequently been incorporated into business continuity plans to back up important data. Your plan, in this instance, would outline how this data can be recovered from your cloud server.
Following the pandemic, working from home has become the norm for many people. As a result, tech companies have been able to add new technological solutions for a variety of potential disasters. Scratch out the part about renting office space if the building catches fire. You can now replace it with your shiny new working from home protocols.
-
A complete guide to business continuity
Business continuity refers to the ability of a company to persevere through challenging times and potential threats. It means keeping critical business functions operating in the face of adversity. It is important to note from the outset that this differs from inherent resilience, elasticity, and can-do attitudes. These are, of course, important although continuity is maintained through comprehensive business strategies, risk management procedures and recovery plans, all of which add to a company’s resilience. In this article, we’ve compiled all you should know about business continuity and how best to create a plan to protect your business.
-
Reality: Testing your continuity plan
Your plan may look lovely on paper. But there’s no better way to put your business continuity management skills to the test than running a simulation. We recommend putting your teams to the test at least once a year on a different potential problem. This ensures you’re ready to tackle any potential issues. You may also find inspiration for solutions that you can incorporate into the business continuity plan document. Fires are in the business continuity plan and you run fire drills. Why should this be any different?
You could use table-top exercises or scenario walk-throughs. A simple sit-down discussion can help to get your team thinking about what you might do in the event of a certain issue. This will help you to see if your employees are equipped to facilitate business continuity. If not, further training might be needed as a preemptive measure. It’s all about being proactive, not reactive.
-
Educate yourself and your employees
Business continuity is vital in ensuring the survival of a company through the ups and downs that life throws at us. Anyone can run a successful business when things are going well. But it’s not all plain sailing, and it takes more than good management skills to lead a team through a time of crisis.
The first step is always the hardest and starting a business continuity plan from scratch can seem rather daunting and time-consuming. But the pros outweigh the cons, and you’ll be thanking yourself further down the line. Fortunately, there are lots of resources available to help you to craft a tailored plan for your company. We’ve put together an article on our eight top tips for maintaining business continuity.
And the Business Continuity Institution (BCI) has lots of guides and resources on good practices for business continuity plans. Their Good Practice Guidelines draw on knowledge from practitioners all over the world. It provides an excellent starting point to work from when you’re first drafting up your plan.
-
Four key points to take away
To summarise, your objective for a BCP can be split into four separate goals:
1. Ensure your employees are safe during a disaster event and that you can communicate essential information during and after the worst has happened.
2. Respond to your customer’s needs during a disruption to ensure that both your relationships and reputation remain intact.
3. Get your IT up and running as quickly as possible, ensuring that your operations can continue while your full system is being restored. This is where disaster recovery as a service (DRaaS) can make a huge difference.
4. Provide access to essential applications and data that will help keep your business ticking over. If you can maintain some continuity of operations then it’s possible to mitigate the impact on your bottom line.
-
Final Considerations
While we’ve covered the most common factors to consider in business continuity, there are also many other aspects to keep in mind:
- Make sure you’re fully insured for the specific needs of your business. That also means keeping the information ready to access and process in the event of disaster.
- Educate your executives, managers and employees about their business continuity roles and responsibilities.
- Check your building facilities are fully operational and capable of handling the most common disaster scenarios
- Map out your supply chain dependencies. Have a plan to mitigate the impact if the disaster is suffered by a company you rely on.
To learn more about the intricacies of business continuity and cloud services, check out some of the information via the links below:
- Infographic: Business Continuity vs Disaster Recovery
- Infographic: Digital Transformation
- Brand Battle: Citrix vs Azure
- Brand Battle: VMware vs VirtualBox
Our team at Venom IT are on hand to answer any questions you may have about business continuity and disaster recovery. It’s best to be prepared and we’re equipped to help you whether the toughest of storms. Contact us with any queries.
Download The Ultimate Guide to Business Continuity here.
Get in Touch Today
Partnership & Accreditations
