Implementing a Business Continuity Management Program
1. Establish the BCM Ownership.
2. Align BCM Program to organizational Strategic Goals.
4. Determine the BCM Strategy.
5. Determine the BCM Implementation Approach.
6. Initiate the BCM Program
First, determine the BCM Program Injection Point
Not every organization is the same, and not every organization is starting at the same place. BCM is a lifecycle. If you are starting from scratch, the Business Impact Analysis (BIA) is a good starting point within the BCM lifecycle. Maybe your organization has performed a recent BIA/RA and it would be better suited to begin with Plan Development using the Maximum Acceptable Outage (MAO) values, dependencies and technology requirements from the recent BIA/RA results as the basis for the planning strategy.
Next, determine the scope of the Planning effort
Conduct a review of current Business Continuity Plans. The three main plan types can be described as:
Agency/Business Recovery – Plan development and documentation to resume/recover critical business activities
Crisis Management/Emergency Response – Contingency Planning for executive decision-making, communications and high-level pre-planning activities.
Disaster Recovery– IT Planning Contingency Planning for applications and related infrastructure components (systems, servers, network, databases, etc.)
Your organization may have some or all of these plan types in place already. You may choose to focus first on Crisis Management/Emergency Response first to ensure that effective crisis communications are in place as well as contingencies for safety of people and protection of critical assets during a disruption. Some organizations may choose to prioritize first the resiliency and recovery capabilities of the infrastructure and IT resources with Disaster Recovery planning. Others may need to prioritize the development of operational/business recovery plans for sustaining critical business functions identified during the BIA effort.
All business units, related activities, and associated IT applications and infrastructure must be identified for plan development.
The business units rated as most critical during the Impact Analysis should be the plans documented first by the Business Unit Recovery Teams.
The IT applications rated as most critical during the Impact Analysis should be the plans documented first by the IT Disaster Recovery Teams.
Designate team members that have responsibility for coordinating plan development and documentation.
For more detailed information about how to better prepare your organization with effective BC/DR Planning tools, or to schedule a tabletop exercise with our Certified Business Continuity Professionals, please contact us via:
The contact form using the link at the top of this page
Email at PSISales@ParadigmSI.com
For more information, call us at 800-558-9568 ext. 300
To speak with a Sales Representative about Business Continuity Planning Consulting or Business Continuity Software, please call:814-330-2560
Next up in Part 7: Business Impact Analysis