How to Involve the Business to Create a Solid Continuity Plan

Business-Continuity planning has grown more sophisticated in the past few years, going beyond the technical recovery of IT systems and getting networks back online. CIOs are increasingly finding themselves in the position of not only making sure technical disaster-recovery plans are in place and working but also coordinating larger continuity efforts with all business functions.

Members of the CIO Executive Council recently identified business continuity as a topic for future Council activities and research. Twenty-seven members also participated in a June conference call on business-continuity planning. The following are some best practices from members who have made such planning an integral part of their organizations.

1. Attach a business owner as the main driver. Business continuity is not about IT; it's about the business. Therefore, it only makes sense that someone from the business be the owner of this significant undertaking. By not identifying business continuity as an IT project, its importance to the company as a whole becomes clear and more widely accepted. The Board of Trustees at The George Washington University, for example, hired an assistant vice president in 2003 who sits outside of IT and is charged with coordinating business-continuity plans for the university, with significant day-to-day assistance from IT.

At Eastman Chemical, business-continuity planning is specifically linked to the company's Sarbanes-Oxley efforts, which are sponsored by the CEO. At satellite and telecommunications company Intelsat Global Services, CIO and Senior VP Joe Kraus sits on the crisis management team, which is made up of 20 senior representatives from business units such as HR, facilities, security, corporate communications and the medical unit. This team, led by Intelsat Global Service's president, is responsible for managing communications in the event of a disaster. The team meets quarterly, providing a forum for senior business leaders. Given the strong infrastructure emphasis of the business-continuity planning process, IT is responsible for the program's day-to-day operations. A business rep is responsible for guaranteeing business-side participation.

2.Encourage business members to understand and document core business processes. It's hard to write a business-continuity plan if you don't understand all the details of your business. Dave Swartz, VP and CIO at The George Washington University, was surprised by the large number of managers who lacked a solid understanding of the university's business, and therefore had not accurately documented how they ran their functions. "The first exercise that the business units underwent was to examine the business processes, including people involved, relationships with different units and their specific reliance on technology systems," says Swartz. "It was interesting to see the new points of risk that were identified that people hadn't been aware of."

3.Improving the process should be part of the plan. In 2002, Texas Children's Hospital suffered through a virus scare for several days where faulty antivirus software made it appear that thousands of the hospital's computers were infected with a virus. The hospital's IT staff quarantined the affected computers, limiting access to critical patient data. Given the life-and-death importance of IT to a hospital, clinical staff moved to manual processes to keep patients safe. They found that the established downtime procedures worked well for the first couple of days, but the longer the trouble dragged on, the more time-consuming it became to recover. The clinical staff learned some valuable lessons during this incident. "It prompted them to review business-continuity procedures and develop new, manual processes as a result," says David Finn, VP and CIO, privacy officer and information security officer. Schedules are now printed on hard copy for the current day and the next couple of days to reduce reliance on IT systems.

4.Coordination should stay with IT. IT should provide templates, review the plans and coordinate overall processes to ensure that each unit has done its due diligence. Eastman Chemical CIO Jerry Hale, Kraus and Swartz provide templates for each function that describe what components to include and how specific to be in the documentation. At Texas Children's Hospital, IT is developing templates that will standardize the process of business continuity, outline practices and establish a monitoring process to ensure plans are updated as needed. For sample templates (Business Continuation Plan Simple Form and Continuity of Operations Planning Checklist), go to cio.com/100105.

5.Test business-continuity plans just as you would test technical disaster recovery. "We get the group of business owners in a room, present a scenario, and then walk through the business-continuity process," says Hale. Kraus uses scenario-based testing to make sure the plan covers all the necessary elements. He gets information on potential scenarios from colleagues, by participating in external disaster-related activities, and from federal and government agencies responsible for disaster preparedness and planning.

This year Kraus plans to run a business-continuity drill that will involve relocating staff from different subsets of Intelsat to the backup facility, and then restarting the business.

Tools We Use

Priority Setting

Intelsat's CIO shares his organization's method for determining mission-critical functions

When drawing up a business-continuity plan for an entire organization, it is helpful to prioritize functions as to their relative importance and determine how quickly they must be restarted in order to keep the organization on track. Joe Kraus, CIO and senior VP at Intelsat Global Services, and his team use a classification system that they call "air, water and food" to classify different business functions and make the business-continuity process easier to think about.

It works like this: You can't survive without air. You can survive for a little while without water, and you can survive even longer without food. Using these three categories, the company classifies business functions and organizational units according to how critical they are to Intelsat's survival.

AIR

Business functions that must be performed and restarted as quickly as possible, within the first 72 hours of a disaster. Example: Customer communications

WATER

Business functions that must be performed and restarted within four to 30 days after a disaster. Example: Billing, payroll

FOOD

Business functions that are not classified as either air or water. Example: Marketing, anything strategic