Business Continuity Management

1. Business Continuity Management: Process

The business continuity management process consists of four stages:

• Stage 1: Initiation
• Stage 2: Requirements and strategy
• Stage 3: Implementation
• Stage 4: Operational management

The first three stages involve the establishment and implementation of business continuity management within an organisation. The final stage is ongoing operational management of the process.

Stage 1: Initiation

This stage covers the establishment of the business continuity management process, including sponsorship, budget approval and identification of appropriate resources.

Activities to be considered during the initiation process depend on the extent to which business continuity management disciplines have been applied within the organisation.

Some parts of the business may have established individual continuity plans based around manual solutions, whereas IT may have developed contingency plans for systems perceived to be critical.

As part of the project initiation it is essential to scope the initiatives. Careful consideration should also be given to the inclusion of critical third parties.

Stage 2: Requirements and Strategy

This stage provides the foundation for business continuity management and is critical to determine:

• How well an organisation will survive a business interruption or disaster
• Any costs that will be incurred as a result of a business interruption or disaster

Requirements are identified through business impact analysis and risk assessment activities.

In turn, these feed into a business continuity management strategy that proposes risk reduction measures and recovery options, in support of business continuity.

Stage 3: Implementation

Once the business continuity strategy has been agreed (typically by Senior Management or the Board), the business continuity management lifecycle moves into the implementation stage. This stage includes:

• Establishing a business continuity management plan. This should include clear roles and responsibilities for any personnel who will be involved in a recovery
• Developing implementation and supporting plans
• Providing resources to implement risk reduction measures that are detailed in the business continuity strategy
• Procuring recovery facilities
• Proving continuity capability through initial testing

Stage 4: Operational Management

The completion of the first three stages of the business continuity management process will mean that a business continuity management solution has been analysed, agreed and implemented within the organisation. You then need to ensure that the strategy and recovery facilities are maintained as part of day-to-day business activities.

The business continuity manager has responsibility for maintaining the business continuity management environment through a series of operational management activities. These activities include:

• Reviews
• Change management
• Education and awareness
• Training
• Testing
• Assurance