Whether you are planning for a hurricane, earthquake or cyber incident, the ability to maintain essential functions is critical to your organization’s success and long term viability. Working with organizations over the past two years, we have seen an increased interest level in writing continuity plans that are able realistic and are able to be updated without significant resources.
For many organizations, Continuity Planning is viewed as a significant project that is hard to attain and requires lots of resources. Here are five considerations to consider when starting or re-imagining your continuity program:
1. Assess Existing Resources or External Requirements
First, take a look at existing plans, policies or procedures that may outline the basics of a continuity plan. Many times elements of your organization have already developed downtime procedures or other steps to increase resiliency. Even if they aren’t written down, talking with key team members may uncover past discussions regarding potential continuity plans or expectations.
Additionally, during this discovery phase, external requirements need to be reviewed. Are you required by law, administrative code, contract, or other regulations to maintain a certain function or plan in a certain way? Does an accrediting body require a certain approach to continuity planning or does your insurance carrier require specifics? Determining any external requirements that may dictate specific steps, processes or outcomes should be the first step in the process.
2. Choose a Methodology that Works for your Organization
There are numerous models and tools out there to build a Continuity program and it may be overwhelming to determine which model to use. There are really two main models out there for organizations to choose from, the FEMA Model and the Business Continuity Planning (BCP) Model. While there are similarities between the two systems, the FEMA system seems to scale a little easier to governmental and non-profit agencies. Both can benefit from the Inverted Pyramid Planning Model (TM) (described below), and unless there is an external requirement, neither method has to be followed step by step. Many organizations use a blend of the two processes to meet their organizational needs
A Word of Caution – the methodologies discussed above are processes and not end products. There are many great continuity planning tools based in software which help to organize and facilitate future plan updates and data elements. It is important to remember that a software solution is only a tool to help organize the plans, and should not be looked upon as the solution itself.
3. Use the Inverted Pyramid Planning Model
The continuity planning process can be a complex undertaking requiring significant human capital and resources and many organizations are hesitant to begin the process due to the perceived complexity, cost and time commitment. Unless your organization is ready to invest significant organizational energy into continuity planning, we recommend using what we refer to as the Inverted Pyramid Planning Model. Breaking down the planning process into major phases or focus areas will allow an organization to move closer to a resilient organization through each step while building a culture of resiliency.
In summary, the inverted pyramid builds the foundation of a continuity plan through a strategic framework focusing on human capital, decision-making processes, and core business practices. Once the foundation is built, the plans become more tactical at each step focusing on sub-divisional function identification and prioritization. Finally, the tactical process of identifying required supporting mechanisms (staff, equipment, technology, logistics, etc) are documented. As organizational priorities emerge, the last step may be a tactical downtime procedure or recovery procedure for
The key to the inverted pyramid model is that each step can be done in succession or parallel and can be implemented over the course of months or years depending on organizational support, priorities, and resources. (Stay tuned for a more
4. Validate Plans at Each Step
Undertaking a major planning initiative has its benefits, but the larger the project, the more the end document becomes the goal. Using an iterative planning process or the inverted pyramid planning process gives the planning team multiple opportunities to validate their plans and build resiliency. Instead of building a couple hundred page plan and then doing a major continuity exercise once the plan is complete, we recommend completing some mini-table-top exercises throughout the planning process to make sure the plan is aligned with the organization. These exercises do not need to be a major production using HSEEP method, a contractor, and a meal; but more like agenda items in an existing meeting to discuss the draft documents. Breaking down the plan into multiple discussions during regularly scheduled meetings will help to facilitate that Culture of Continuity and provide multiple validation points to
5. Foster a Culture of Continuity
All too often, there is a small number of individuals in an organization who are charged with writing, testing, training, and implementing a continuity program. The challenge this presents is that most customers expect an organization to seamlesly continue operating as normal during an incident, and entrusting the entire continuity process to one or two individuals is much like putting all of the eggs in the same basket. The planning process (and update process) should include all levels of staff in the organization to ensure the plan addressed everyone’s needs.
Taking small steps to build a culture of continuity such as including small discussion-based exercises during normal meetings is a way to keep the concept in the forefront of an organization. Even talking through a downtime procedure in a shift briefing/huddle helps to enhance a level of familiarity to the process.
Instituting regular downtime operations is key for organizations to practice meeting mission essential functions when key systems are offline. Many organizations use this opportunity to do routine maintenance on IT system and the process can enhance a culture of resiliency as long as the events are moved around to give all shifts and levels of staff an opportunity to participate.
And finally, general Human Resources Succession planning concepts can be used to build upon a culture of resiliency. Leaders should make sure they are training their teams and identified successors in key systems, processes, cultures, and expectations to ensure a smooth leadership transition or disruption due to a continuity event,
A recent increase in continuity planning may be the result of an increase in wildfires, hurricanes, tornadoes, and cyber events; or it could be a generalized increase in the customer expectation that organizations will remain resilient during disasters. Regardless of the underlying reasoning, it is important to set your organization up for success during a business disruption through a coordinated approach to continuity planning.
We hope these five steps will help you begin to build a culture of resiliency or begin to reimagine a renewal of your existing continuity program.
Crisis Focus, LLC has focused expertise in continuity planning, organizational resilience, and emergency planning. Please visit the Crisis Focus’ contact us page for more information.