If you do not think that business continuity – disaster recovery – and continuity of operations planning matters – just refer to the latest news that Delta Airlines will likely lose $120 million due to a recent power outage at one of their core centers for enterprise services. For the military, similar failures can result in far graver consequences. Beyond blizzards and hurricanes, in an age of increasing threats to information technology infrastructure due to cyber threats, planners must contend with more than just natural disasters and human error. When asked to develop plans to withstand these challenges many leaders will struggle to know where to begin. The following list may help you and your organization get started.
Determine what is critical first – Before you can begin to prioritize resources, reserves, and reporting requirements, you first have to determine what matters most. Priorities should drive decisions. You will have to rank priorities both for your customers’ needs as well as for your organization’s. Let your customers decide what is critical, while at the same time, ensure you communicate the full level of effort that would be required to provide full redundancy of services. Many of your customers will desire to have zero disruption, but when they see the price tag, they will realize that they have to make some tough decisions. Internally, you will have to make the same challenging choices. Your workforce will likely be impacted, and you will have to consider how to not just provide redundancy in equipment, but also in people. Consider what technical skills, and access, members of your team bring. Then think through how their absence in a time of crisis may impact your organization.
Set realistic objectives – As much as you would like to ensure zero disruption in services in the event of a disaster your organization may not have the money or manpower to deliver such results. By first determining your priorities, you can then scale how much you can deliver based on your means.
Do not over promise and under deliver – The last thing you want to do is promise 100% assured continuity in communications when you have known gaps in redundancy in your power, means of transmission, services infrastructure, or skilled personnel. You owe it to your customers, and your team, to identify precisely what you can guarantee both for continuity and recovery of services.
Focus to increase your resilience along multiple lines of effort – After you identify precisely what you can provide for continuity and recovery, you should then generate a vision, and plan to move forward to improve the resilience of your services. I recommend focusing within each of the following categories to document your vision and generate a sense of urgency in your leadership team.
- Business Continuity – Business continuity ensures that an organization can continue to deliver its services and support to customers in the event of a disaster. In order to get this right, organizations must plan with their customers, and not despite them. Resilience to withstand disruptions, the recovery of critical services, and contingency plans underpin business continuity must be viewed from a customer-first lens.
- Disaster Recovery – Disaster recovery focuses on how to return services after a catastrophic event occurs. Once the priority of services is determined, the next step is to determine how best they can be restored. Planning for disaster recovery is a subset of business continuity.
- Continuity of Operations Planning – for the military, continuity of operations plans (COOP) have been around since the Cold War. Much like a business continuity plan, COOPs focus on ensuring that critical services are mandated in the event of a disaster. The federal government mandates by law that certain capabilities be maintained at all times and FEMA has established a set of guidelines for all federal organizations.
Start mitigating vital threats immediately – As your team identifies critical gaps in the resilience of your services, you must begin to act to fill them. Failure to act makes you complicit. Any hesitation may later be seen as gross negligence on your part. If you do not have the means or expertise to fix these known issues it is your responsibility to fight for the resources to do so.
Use flow-charts and templates – When it comes to preparing your specific business continuity, disaster recovery, and continuity of operations planning take the time to generate some easy to understand, and simple to follow flow-charts and templates for those executing these responsibilities. Your plan may never be instituted under your watch. Leaders leave organizations and personnel rotate in and out of various positions. Investing the time and energy to get these right ahead of time will pay dividends when they are turned to in a time of crisis
Communicate your plans early and often – As you develop your plans, you will have to systematically engage a number of audiences to communicate your vision and ensure buy-in. First, your leadership team must be convinced of the value and effectiveness of your vision. Next, your customers must be absolutely onboard with your team’s plan. As most organizations exist to serve their customers, you would be foolish to ignore their wants and needs. At the same time, there are likely many outside partners you will have to coordinate with and through. Power companies, commercial internet providers, and enterprise services providers, for example, all will likely play a role in any plans you make. Finally, do not forget to full communicate your vision within your team. They will be the ones asked to execute it, so you must make sure they agree with it, and understand its intent.
Practice, practice, practice – Last, but not least, after you have completed all of the previous steps, you will need to rehearse your plans. I recommend a crawl, walk, run approach to this. Begin by educating the plan. Then conduct table-top exercises to test competence and decision making of your leadership team. Finally, test your team’s ability to execute a no-notice exercise of a catastrophic event. During each of these phases of training, capture and disseminate lessons learned widely. Your insights may make a critical difference for another organization and prevent unnecessary loss and suffering.
Developing business continuity – disaster recovery – and continuity of operations plans must be a primary objective for all communication leaders. Regardless of whatever echelon of services your organization provides – others are depending on it. When challenges arise, whether due to nature, or malicious actors, it is the responsible of leaders to have not only developed, but also rehearsed, how to respond to these challenges. Leaders must prioritize within their plans and practice them early and often.
As always – the views in this piece are mine alone and do not represent the U.S. government, Department of Defense, United States Army, or any other organization with which I have had any association.