business continuity management institute resilience (bangalore) chapter q3 2008

Business Continuity Management Institute (BCMI)

Business Resilience BCMI Bangalore Chapter Newsletter

Business must go on, come what may!

Aug 2008

BCMI Bangalore Chapter

Focused on CONTINUITY.

Committed to SUCCESS.

Key Contacts:

BCMI India

Dhiraj Lal - Country Manager

[email protected]

Nidhi - Chapter Coordinator

[email protected]

BCMI Bangalore Chapter

Pradeep Prasad - President

[email protected]

Krishna Reddy - Vice-President &

Treasurer

krishnareddy.bommireddy@honeywe

ll.com

Ram Kumar G - Secretary

[email protected]

Sanjay Mittal - Jt. Secretary

[email protected]

Sandeep Erat - Jt. Secretary

[email protected]

INSIDE…

Cover Story

• Business Continuity – A Safety Net for

Businesses

BCMI Courses

• New to BC or DR?

Upcoming Events @ BCMI Bangalore

• India Business Continuity Survey 2008

Release Event on Aug 27th

, Bangalore

BCMI Forum

• Online Platform for BCM

professionals

Business Continuity (or lack of) from

around the World

• Marriott takes Disaster Recovery

Underground

Welcome to the BCMI Bangalore Chapter Newsletter!

Welcome to the first edition of Business Resilience – BCMI Bangalore Chapter Newsletter.

The purpose of this newsletter is to update and inform BCM professionals on BCMI Bangalore Chapter initiatives and developments. Also and most importantly, to promote awareness and understanding of BCM domain across the BCM professionals.

This newsletter focuses on the criticality of having a well structured Business Continuity Program in place for ensuring organizational resilience. As such, business continuity management is a strategic imperative for corporate survival!

Every business faces minor downtimes and major unknowns; hence it is important to have plans in place which guarantee business continuity. Prior to 9/11, quite a few business executives said that they saw BCP as an inefficient use of resources, i.e. an expenditure which does not bring any return on investments. But statistics tell a different story, and events like 9/11 serve as drastic reminders that it is vital for every company to have plans in place to ensure business continuity, and the continuity of our suppliers and logistics - especially as globalization and our interdependence continues to grow.

Business Continuity Plans cost relatively little in comparison what the company could potentially lose in a major incident. Therefore it seems highly prudent that organizations of all sizes seriously research and develop a plausible and efficient BCP.

We hope you find this newsletter useful and informative.

Happy Reading!

1

BCMI Bangalore Chapter Internal ePublication © BCMI India 2008

Cover Story Business Continuity Planning – A safety net for businesses

The events of September 11, 2001 were a drastic reminder to all companies that Business Contingency Planning (BCP) should not be disregarded. According to the Info Security News Magazine (2000), an effective BCP and disaster recovery plan can reduce losses by 90% in the event of an incident. According to another study 81% of CEOs indicated their company plans would not be able to cope with a catastrophic event like the 9-11 attacks.

There are numerous examples of companies suffering due to poor Business Contingency Planning. In the 1993 World Trade Center bombing, 150 companies went out of business (out of 350 affected)-scarcely an encouraging statistic. But an incident does not need to be a dramatic terrorist attack to have a massive impact on an organisation. For instance, in the case of fires, 44% of businesses fail to reopen and

33% of these failed to survive beyond 3 years. The examples could be continued endlessly. The bottom line is businesses need to have plans in place to cope with incidents (whether they be major terrorist attacks or a minor hardware problem) and thereby avoid major business interruptions. Business Impact Analysis A business impact analysis will help to define critical business processes. This is useful since once a major incident happens all efforts must be invested to return the primary business functions to a predetermined level during the critical business resumption phase and to establish the time span to achieve these objectives. Both of these objectives must be determined by management beforehand for the process to proceed as smoothly as possible. One has to collect data in order to decide which are the primary business processes and which are the secondary. As a company has limited resources it is critical to understand where it needs to focus on in order to recover in case of an incident. Planning Once that has been done the team can design the Business Continuity Plan(s). It is important to make the plan simple enough so that it can be executed without any problems during a crisis and it needs to be based on steps previously described. Also one has to define the threshold for every incident so that appropriate measures can be taken depending on the incident. Once the BCP plans has been designed and approved it needs to be tested under realistic conditions as untested BCPs historically fail. David Spinks, Director of Information Assurance EDS, stresses that, "we see far too many Business Continuity Plans and or Disaster Recovery Plans that whilst they have been tested were done so in unrealistic ideal conditions and thus we do not truly recognise what really happens in a crisis." It is important to always tie aims during the Business Continuity Management Process to the business needs. For example, it is not the function of an Information Security to protect all information. They just need to protect the information which the business needs to protected. The same needs to be done with Business Continuity Planning. Once the plan has been tested and designed, it is important to revaluate the plan and retest it as business processes change periodically as the requirements of companies are changing from time to time. For example, a company buys new equipment on which it is heavily dependent. Thus a BCP should be revised after purchases, upgrades of equipment and so on. It is therefore important to realize that the Business Continuity Plan is a living document, which needs to be changed and adjusted if business requirements change. Finally it is equally important to educate everyone in the company of the BCP. Since it will be the employees who are there to react to (or in some cases prevent) an incident, a BCP's success or failure depends largely on the way it is implemented by the employees. If not properly trained regarding the BCP, its likelihood of success is seriously diminished. Media Management One aspect of BCP which deserves special attention is media management. Business Continuity not only deals with putting all the company's effort in recovering the critical business processes. It is of as much importance to have good media management during this process, whether you do it yourself in a small company, or have professional help in a larger company. This is because a company which recovered after an incident, but did not communicate with its customers, suppliers. stakeholders, shareholders, employees, or affected public will have lost the trust of these groups. This will have an adverse impact on the company's public perception, lead to a deterioration of faith in the company, and in the end it will translate itself into revenue losses. So BCP should also focus on what the military like to call "hearts and minds" operations where the company tries to maintain its public standing. Businesses should prepare public statements beforehand as it would be very bad to have no comments during a crisis as it will not prevent journalists from writing about the event and turn the event into a PR nightmare. Manufacturers are highly dependent on their suppliers; hence it is important to work together with the important ones (at least the ones that support the primary business functions) and make sure that they have good BCP plans in place as it is of little use to have effective BCP plans in place whilst the main suppliers have none. Conclusion In conclusion businesses should have BCP in place in order to resume functionality, and procedures in place in case of an incident which affects the company and which will enable them to recover far quicker and with less losses than a company who disregards such plans, thinking 'it would never happen to us.' Business Continuity needs to be seen as safety net for businesses. Even though there are costs involved, it is well worth having such plans as it will save the business during an incident and help it react in an ordered and timely matter. Good BCP plans, which are implemented successfully during a crisis, will give the company good return of investments and hence BCP can be seen as a business enabler.

Article source: http://www.iwar.org.uk/infocon/business-continuity-planning.htm

Business Continuity Management Institute (BCMI) Business Resilience – Aug 2008


Upcoming Events @ BCMI Bangalore Chapter

India BCM Survey Report 2008 Release Event – August 27th, Wednesday @ Bangalore

BCMI Bangalore Chapter is proud to organize an event on August 27th to release the India BCM Survey

Report 2008.

We invite all BCM professionals to this event to be held at , Bangalore between 6 pm and 8 pm.

Mr.Dhiraj Lal, Country Manager, BCMI India will be releasing the Report and giving a short presentation highlighting the key points. This Survey Report gives us insights into BCM practices, trends and pointers to BCM practices and maturity levels in organizations across India.

The event will feature video, simulation exercise, discussion and serve as an opportunity for peer networking among BCM professionals.

For further information, please contact: Pradeep Prasad – [email protected] or Ram Kumar G – [email protected]


3

BCMI Forum - Online Platform for BCM professionals

Join Free @ http://bcmi.collectivex.com/ This site is a meeting place that provides members of BCM Institute with a shared calendar, discussion forums, files and member profiles.

BCMI Courses

New to BC & DR?

BCM Institute offers both certification and non-certification courses. Our courses extend from introductory to specialised and expert level courses. Whether you are new to Business Continuity (BC) and Disaster Recovery (DR) planning or a professional practitioner, our range of courses are designed to cater to any level of expertise. The 'lack of skill' and 'just-in-time' experience based training offered in the public domain is what BCM Institute will be offering. Our courses will provide a gradual progression of certification in sync with the individuals' advancing experience.

For further information: www.bcm-institute.org


BCM/DR best practices(or lack of) from around the World

Marriott Takes Disaster Recovery Underground By Carol Sliwa

14/07/2008 11:09:36

Hurricane Katrina and the September 11 attack on the

World Trade Center caused scores of companies to

reconsider their disaster recovery and business continuity

plans, whether they were affected by those catastrophic

events or not.

Marriott International was no exception. Marriott's

outsourced disaster recovery program depended on a third

party company that might require up to 24 hours to restore

business critical systems. Plus, Marriott might need to

compete with others for space at the recovery facility.

That will change dramatically early next year, when Marriott

completes a new "in-sourced" Recovery and Development

Center (RDC) in 12,500 square feet of space leased on a

long-term basis from Iron Mountain. Marriott anticipates it

will slash recovery time for business systems to within four

hours, a standard that many other companies also have

been trying to achieve.

But, what sets Marriott's RDC apart from the typical disaster

recovery facility is its location -- 220 feet underground in a

highly-secure and naturally-cooled former limestone mine

located about an hour's drive north of Pittsburgh, in the US.

When the RDC goes live, Marriott will be the largest private

customer operating a data center in Iron Mountain's 145-

acre "underground city," which has its own fire company,

water treatment plant and 24-hour security and

maintenance force to serve the 2,700 people working there

from 18 companies and various government entities.

"The RDC demonstrates our dedication to developing

innovative technology solutions for our business and the

environment. The underground facility will enable cost-

effective operations and is environmentally friendly,

positioning us to lower our energy consumption," says Carl

Wilson, executive vice president and CIO at Marriott.

Marriott's decision to shift from an outsourced cold site,

which required a formal declaration process to activate, to

an in-sourced hot/warm site, with dedicated space and

infrastructure, falls in line with a trend that analysts have

been seeing with increasing regularity.

John Morency, a research director at Gartner, says the

need for quicker response and recovery times is driving

many companies to weigh the cost of their existing

contracts with external providers against the expense of

doing the work internally. Plus, many IT staffs want added

flexibility to manage and test their disaster recovery

processes, rather than being subjected to the rigid time

frames of many third-party agreements.

Business Resilience is a quarterly awareness newsletter of BCMI Bangalore Chapter written and published by BCMI India.

The information contained herein is the property of BCMI except where those articles for which the source has been acknowledged and may not be reproduced, copied or distributed either wholly or in part without the express written permission of BCMI.


News Articled Condensed and Sourced from:

http://www.computerworld.com.au/


4

BCMI, India

Level 15, Eros Corporate Towers Nehru Place New Delhi – 110019. India Tel : +91-11-4223 5338 Fax : +91-11-4223 5339

BCMI, Singapore (Head Office)

BCMI Pte Ltd 315 Outram Road #15 – 04, Tan Boon Liat Building, Singapore-169074. Tel: +65 6323 1500 Fax: +65 6323 0933

For more information: www.bcm-institute.org

Or email us: [email protected]

Business Continuity Quote

“You can't prepare for everything - but you can prepare for anything.” - Paul Young Johns (involved in Lockerbie recovery)

business continuity management institute resilience (bangalore) chapter q3 2008

Documents