Align Strategies With
Risks and Business Criticality
An effective business continuity program addresses measures
focused on mitigating the most likely threats to your assets of
greatest criticality. The measures put in place are built around
detailed preventive and reactive strategies that are the key to
ensuring an effective organizational resiliency and survivability
solution.
The strategies should bring all of your capabilities to bear in
order to address an incident – people, processes, partners, and
technologies – and should span your enterprise business environment. Protecting one asset, in a linked value chain, protects
none of them effectively. Strategies that only address technologies or facilities concerns may be too narrowly-focused and not
sufficient to ensure the longevity of your organization in cases
where there are regional issues or a loss of facilities that house
business operations. Solutions that do not leverage the business’
resiliency (and people, partners, and processes that may be in
place) are missing opportunities to accelerate recovery, enhance
resiliency, or reduce solution costs. And capabilities that do not
take into account the need for technology recovery in most cases
limit themselves to short term scenarios, since it is rare to find
a critical business process without technology systems and data
dependency.
Finally, a strategy that doesn’t focus on people – on the awareness, communications, and training needed to develop the level
of organizational readiness necessary – is a strategy that is not
only incomplete but also missing leveraging one of the organiza-
28 DISASTER RECOVERY JOURNAL FALL 2009
tion’s best assets. This second measurement ensures alignment
of threats and solutions and makes sure you are considering and
measuring all dimensions of your solution.
Key considerations:
n Do your strategies align to those threats that have the greatest
likelihood of impacting your organization? A solution that focuses
on bringing in a mobile data center, when the chief threat is an
ice-storm, doesn’t take into account the full scope of the threat to
people, transportation, power, and fuel accessibility.
n Are your strategies comprehensive and do they take advantage
of all of your capabilities? Do they leverage your manual
processing capabilities? Leverage geographic diversity? Take
advantage of partners and suppliers? Build on existing technology
capabilities? Do they ensure the focus is on all of you assets
(people, processes, and technologies/data) and not just one to the
detriment of other?
Build Solutions That Will Last
Once a strategy is settled on and the solution is implemented –
are you finished? The truth is you’ve only just begun. A solution’s
effectiveness often peaks some time after the initial implementation due to validation exercises driving process and technology
improvements that make the solution not just feasible but also
consistently reliable and easily enacted. The first step after implementation then is to drive to that peak of effectiveness. This starts
by ensuring that your solutions include not just the implementation effort and costs but also the long term need to continually
validate the solution and drive improvements in your capabilities.
Once the targeted peak is reached then the situation you will often
find is that the height reached was really only the first in a series
of plateaus of capability and the next level is one step up.
The need to continually improve your skills and capabilities thus never diminishes. This becomes an even greater ongoing challenge due to the ever present undertow that threatens to
drag your capabilities down from their level of peak effectiveness. Technology, business and personnel changes and overall
“organizational fatigue,” all can subtly undercut the gains made
and leave your program a shell of what it was targeted to be –
