The latest business continuity news from around the world

‘Social’ BCM: channeling business continuity professional networks for greater organizational resilience

Shivakumar Jayashankar, CBCP CISSP, Hewlett-Packard Enterprise, looks at the many benefits that can be gained by business continuity professionals tapping into external groups and networks.

Introduction

It is now common knowledge that the BCM function does not operate independently, but in concert with multiple teams across the organization – be it corporate security, facilities, or IT. However, it is time for business continuity professionals and teams to start looking beyond just their organization and work with business continuity professionals and teams in other organizations in the community, city, or region.

Business continuity teams are typically small, in many cases just a single person organization. A ‘social’ approach leveraging inter-organizational networks of continuity professionals will further strengthen an organization’s crisis preparedness as well as response in a host of ways. Before we look at the benefits, it is important to define what these ‘networks’ are. These could range from a simple group on a social networking platform (LinkedIn being most common) to formal local forums and chapters of organizations such as the Business Continuity Institute, ISACA or NASSCOM in India. The key feature of these groups is that they connect business continuity professionals in a particular geography or sector and provide a platform for information sharing, communication, and most importantly - collaboration.

The business continuity team at Hewlett Packard Enterprise India has organized and participated in multiple such discussion forums over the years, and have seen many benefits in doing so. Many of these benefits are highlighted below, and where possible supported by first-hand examples.

Benefits

Sharing threat intelligence

Any seasoned business continuity professional knows and understands the importance of timely and accurate information on imminent threats to the organization: be it weather forecasts, breaking news reports, or situation reports from on the ground as and when an incident that could impact the organization unfolds.

Different organizations are at different levels of maturity when it comes to having access to reliable threat information sources, ranging from public services like the police or fire department, subscription services such as Global Disaster Alert and Coordination System (GDACS), or even informal sources. In a fairly unstructured environment such as India and other countries in the developing world often there is no single source of reliable information accessible to all.

Business continuity professional networks have proven to be very useful in obtaining information, vetting information, and also in discussing the best course of action based on available information. It provides the organization’s crisis management team and senior management valuable input on the course of action chosen by other organizations in response to an event.

Improving recovery strategies through knowledge sharing

The exchange of ideas around how different organizations in the same geographic location or industry/sector are tackling common challenges around implementation of recovery strategies can be very helpful in improving organizational resilience.

  • Local issues, local solutions: some issues are very specific to a city or region, and would require local knowledge to resolve. Some examples of such issues that were discussed in local forums and resulted in exchange of valuable solutions are:
    • Low home-broadband Internet penetration amongst employees of Shared Service Centers in Chennai and Bangalore, which would have an adverse impact on the effectiveness of the remote-connectivity recovery strategy. This was solved by some companies by providing critical employees mobile broadband to support working from home during a crisis.
    • A discussion around how to best handle evacuation of pregnant women and employees with special needs during emergencies led to sharing knowledge of locally available chair-lifts which were cost effective and efficient.
  • Post-incident reviews: conducting post-incident reviews across organizations and sharing of lessons learned can be more effective for incidents that affect multiple organizations. There will be multiple perspectives on issues and solutions, and a possibility for collaboratively solving problems.

Coordination of crisis response and recovery

Many organizations are co-located in the same building / campus / area. As many crises impact the building/area and consequently all organizations present, pooling of emergency support and rescue faculties could mean more effective response. Benefits include

  • Coordinated periodic connect meetings with Fire, Police, Health department, and other public service organizations with representatives from different organizations would streamline response and recovery support.
  • At the time of a crisis impacting multiple organizations, coordination across organizations and speaking with one voice to public services such as Police, Fire Department or Disaster Management authorities would be more effective than individual channels for each organization.
  • Sharing of transportation and other infrastructure services during a crisis to optimize use of available resources.

Coordination of emergency evacuations and exercises

Often, fire evacuations and other exercises are tested in siloes, with one organization participating at a time. Realistically a fire or similar event affecting the whole building would result in an evacuation of the entire building or campus, which brings with it a host of complications and coordination requirements. This needs to be factored into the test and hence would require coordination between business continuity and crisis management teams across organizations.

Improvement of facilities from an emergency preparedness perspective

Intercompany coordination between business continuity teams could improve efforts in improving facilities in the building or campus with regard to crisis preparedness. An example of this is coordination between companies co-located in the Olympia Tech Park building in Chennai which is in a low lying area, resulting in working with the building management to make a host of improvements such as provision of water pumps to use in the event of flooding, construction of a bigger underwater tank for diverting flood waters if needed etc.

Reciprocal agreements for seat sharing

Organizations in different sites in the same city / region can hugely benefit from having reciprocal agreements for seat sharing in the event that a crisis impacts their primary site. Reciprocal agreements are very cost effective, and can be an important part of an organization’s relocation strategy. Using your local network of business continuity professionals would help find potential partner organizations to explore feasibility and establish reciprocal agreements with.

Coordination of training and awareness efforts

Annual events like Business Continuity Awareness Week (BCAW) can also be used as opportunities for information exchange across organizations, where common content can be delivered to employees such as awareness of emergency procedures, best practices, information security awareness etc. Pooling of resources such as venues for awareness events could prove cost effective to participating organizations.

Conclusion

The benefits highlighted above are just a few of the many that you and your organization can derive from having a good relationship and dialogue with local/regional business continuity professionals through these professional networking channels. The possibilities are endless, so engage, network, and collaborate!

The author

Shiva Jayashankar, MS CBCP CISSP, is manager, IT Risk Advisory Services at Hewlett-Packard Enterprise and is based in Chennai, India. He has nine years of experience and works with public and private sector clients internationally on business continuity, IT service continuity, and IT risk management consulting engagements. Contact shivakumar.jayashankar@hpe.com


Want news and features emailed to you?

Signup to our free newsletters and never miss a story.

A website you can trust

The entire Continuity Central website is scanned daily by Sucuri to ensure that no malware exists within the site. This means that you can browse with complete confidence.

Business continuity?

Business continuity can be defined as 'the processes, procedures, decisions and activities to ensure that an organization can continue to function through an operational interruption'. Read more about the basics of business continuity here.

Get the latest news and information sent to you by email

Continuity Central provides a number of free newsletters which are distributed by email. To subscribe click here.