Business Continuity

A: A business continuity plan (BCP) are the steps involved in ensuring a company’s ability to continue its standard operations during times of catastrophe. Laid out comprehensively in a document, it will go into great detail through checklists for each internal department as well as the company’s human resources, business partnerships, assets and on-hand physical resources – literally any and all aspects of the business that can be affected by any of various types of disasters.

Major disasters can be man-made, such as cyber-attacks or natural, such as fires, floods and earthquakes. However, a BCP should entail natural functions of the company which can affect business continuity, albeit it on a smaller scale. Office moves and even the massive migrations involved in moving from a local, physical network to cloud-based operations must be planned so as to not interrupt operations.

As a longtime member of the IT Support Los Angeles Community, IT Support LA, which provides Managed IT services, works with our clients on their BCPs – specifically as concerns their network infrastructure. While we may not be able to put out an actual fire, the overview of our IT support and services includes providing a comprehensive Backup and Disaster Recovery (BDR) plan, which exists as a stand-alone document as well as being included in the overall BCP.

A: Simply put, it is the ability to continue doing business in the face of difficulties or a disaster which may cause a disruption. Depending on the nature of the disaster, different levels of disruption may occur.

If a local diner burns to the ground, there will most certainly be a lag before business can resume, but a fire in a business office may cause a momentary interruption as workers switch locations and the IT service sets up new computer hardware, retrieves data from a cloud backup (if the unconnected local backup is destroyed), reinstalls the data for the end user, and attends to the availability of  peripheral devices such as printers, scanners and VoIP phones.

For a Managed Services Provider, maintaining the business continuity in terms of network operations is fairly cut and dried provided the IT services had all elements firmly in place before the disruption. A small amount of onsite tech IT support may be necessary as concerns the hardware, but all internal network functions can be easily handled by the remote IT HelpDesk.

The bottom line is to keep the business running and producing revenue, or to get the business back into operation as soon as possible.

A: These are the key elements that MUST be realistically discussed and included in the BCP:

1)   Threat Analysis: Take into account all manner of potential threats, from flood or fire, which may render your physical location to every possible type of cyber-attack. Whether it is a fire or a Ransomware attack, your IT Services people need to be involved from the start.
2)   Responsibilities: Determining who will be responsible for what. There can be no confusion. When the ‘Battle Stations’ alarm is sounded on a Navy ship, everyone knows exactly where to go and who is in charge.
3)   Emergency Contact Information: This should be explicitly required as part of any basic Employee Handbook. Emergency Contact info should be kept on several devices and in several forms. If the only place you keep yours is on a Post-A-Note stuck to your monitor, it won’t do you any good if the place burns down.
4)   Off-site Backups: You must have your data backed up remotely, and test retrievals should be performed regularly. Your Managed Services Provider or even your IT Support ‘Guy’ should set this up for you immediately – if it is not in place already.
5)   Communications: Once landlines or internet-dependent VoIP phones and emails are down, make sure that you have a plan in place to communicate through smart phones and other devices.
6)   Dedicated Recovery Team: All integral departments; IT Support, HR, Communications and Security must be represented by a designated point person – the most expert in their field.
7)   Backup Power: This may not be possible in every office location, but for a free-standing building, a generator system should be in place. It is advisable to lease office space in buildings with a backup power generation system.
8)   Backup Site for Operations: If you cannot work in your building, you should have an alternate space in which to set up and conduct operations. More difficult for a manufacturer than a CPA, but have a ‘go-to’ spot for the administrative operations at a minimum.
9)   Equipment and Services: Make sure you will have access to everything – phones, emails, computers and any other essentials that will keep you in operation.
10) Recovery: Just as your BCP must include executable measures for the emergency itself, you must have a plan for the quick, orderly return to ‘business as usual’ once the disaster is fully resolved.

A: There is not just one, but in its most simplistic form, the goals are to maintain and resume business operations, then to fully recover from the emergency. The FDIC has a BCP Planning Booklet that is very detailed.

One excellent rule of thumb is that if you have an excellent BCP in place, with qualified and competent people running key areas, you should theoretically be able to continue operations, and ultimately recover from the disaster without discomfiting your  clients at all – in fact, with a flawless plan, your customers may never know you experienced the disaster at all.

This may be tricky for some types of businesses, and truthfully, in the Managed IT Services field, Some forms of momentary disruptions, or ‘blips’ in their IT service may occur, as a power outage may reboot servers or workstations before the auxiliary power can kick in - but these events will be short-lived if they do happen.