At this time of year, many of us are scrambling to get plans exercised to meet a calendar year commitment or deadline, so I’d like to explore the issue of continuity plans and how “actionable” they really are. This actually applies to all types of continuity plans – whether they are business continuity plans, IT disaster recovery plans, crisis management and incident response plans, or COOP plans in the public sector. The type of plan isn’t important, but the ability to use them is.
This may sound like a bit of an odd topic to discuss, but I’ll bet once you hear my perspective, many of you might just agree with this view. If you do, then this was well worth our collective time, since I think it will make an improvement in your ability to recover.
To set the stage for this, my perspective comes from more than 25 years of managing operations and supporting customer exercises in hot sites for Comdisco, HP, IBM, and participating in hundreds of actual recovery efforts following disasters. During all of those events, I noticed a fairly common thing that happened: clients often didn’t use their plans to conduct their exercises or to direct their actions during a recovery.
What? How could an organization spend the time and money to put together a continuity plan and then not use it to support their exercise or recovery? Simple, I respond, because I find that while most plans do a great job of being repositories for information, most lack a clear and comprehensive action plan that can be followed to direct who-does-what-when-where – providing the direction we need in order to recover.
Most plans start out with an introduction to the topic of recovery, possibly including the history of continuity at the organization. The table of contents is riddled with team definitions, maps of locations, call trees, inventories, vendor lists, sign off and maintenance procedures, and so on. But often that critical set of actions that would guide the actual recovery effort is either missing or scattered throughout the plan. What it isn’t is obvious: up front, easy to find, and ready to be executed when time is critical.
People plan their exercises, but few actually exercise their plans. I have written before about my concerns with the lack of realistic exercising that occurs in most organizations. (I’ll leave that for a future DRJ article.) Organizations spend weeks or months planning their exercises, developing exercise scripts, laying out objectives, but then when it comes to executing the exercise, they leave the recovery plan at home. Doesn’t seem logical, but all too often, that is the case. Time after time during my years in the alternate site business I experienced this phenomenon.
Then we come to the actual recovery effort from a disaster, and again, my experience is that while the plan provides critical information that the recovery team relies upon the detailed steps to act out are not there in a fashion that lend themselves to guidance of the recovery effort.
How do we fix this problem? I think it is by making sure the recovery planning document, whether in paper form (hopefully not) or developed in a software planning tool and downloaded to your smart phone or tablet is actionable and that it contains an obvious, up front set of specific actions the team or teams must follow to guide the recovery effort.
Pick up or look at your plan and see if you can quickly find the specific actions that would guide you or someone else. Better yet, find someone in your organization and hand them your plan. Ask them what they would do with the plan and what actions they would take based on it. If you or they cannot find those critical action steps, you have the problem I am describing.
Some other things to consider as you review your plans:
- Does team member, employee, and vendor/supplier information occur in one, easily updatable, and reference-able place in the plan to simplify maintenance and reduce errors?
- Can team members readily understand their responsibilities vs. the responsibilities of others so as to not be confused?
- Do the steps flow in a logical sequence and are dependencies considered so things don’t happen out of order?
- Can I access my plans remotely with the tools we all use today in a mobile world?
I would call on all of you reading this to pick up the charge and make sure you create consolidated action plans people can follow.
I’d also call on auditors and examiners to make this a key aspect of their assessments or examinations. Look at the plan with an eye toward action. Yes, make sure it contains all the sections and documents it needs but also say to yourself, “If I had to pick up this plan and execute it, where would I start, and what would I do?” If you can’t find that part of the plan, the plan has limited value. Make sure you address this issue during your audit review.
Finally, start using your plan as the basis for your exercising effort. Make the plan drive the exercise, and make sure every step you take is documented in the actionable steps. That way you will know your plan will work for you when you need it.
John A. Jackson FBCI Hon., CORE, is an executive advisor for Fusion Risk Management and on the board of directors for Business Continuity Institute (BCI). Jackson has more than 30 years of continuity industry leadership and is widely regarded as an early and current visionary in enterprise business continuity, crisis management, risk management, and disaster recovery. Jackson’s industry experience includes executive management of Comdisco, HP, and IBM’s business continuity organizations. Jackson co-founded Fusion Risk Management in 2005 and today actively contributes to the industry by serving on the Disaster Recovery Journal Executive Advisory Board and the Disaster Resource Guide Editorial Advisory Board. He also serves as a board member of the BCI USA Chapter, contributes in a number of roles with InfraGard, and was a founding board member of the Northern Illinois ACP Chapter. In 2012, Jackson received the prestigious “Lifetime Achievement Award” from the internationally-recognized Business Continuity Institute. In 2013, Jackson was awarded the honorary certification of Fellow of the Business Continuity Institute (hon FBCI) joining an elite global group of industry-leading business continuity practitioners. If you have comments on this or a perspective to share, please contact Jackson at JJ@FusionRM.com.
