Believe it or not there is a hopscotch game that management and executives like to play in the Business Continuity Management (BCM) world. None will ever admit they play it but I’ve been in enough situations to know that just about every manager or executive who isn’t familiar with BCM, the 10 Best/Good Professional Practices tends to play. They play it every day, especially when something dreadful happens to their operations and they didn’t have something – like a continuity plan – in place to respond to it. What’s that game; hopscotch. Yes, hopscotch.
Not don’t’ think for one moment this is a visual thing; watching executives throw rocks and hop up and down the outlines playing space but rather is mental game they’re playing. Why a mental game? Using my comment above about something dreadful occurring; when something does occur managers and executives usually want to know why it occurred (there could be many caused or triggers for an incident) and why we their organization didn’t have a plan to respond to that particular situation. Their first response is to “get a plan in place” in case that happens again.
So what does that do? It probably skipped the Business Impact Analysis (BIA) or didn’t bother to refer to the existing one – if there is one at all – and just went right to investigating, developing and implementing a contingency plan that only addresses that one particular situation. In effect their jumping along the chalked outline of the hopscotch board skipping over a key piece of the puzzle.
This happens more times that naught. One, or a combination of executives, skip over key steps that could have had a proper continuity / recovery / response and communication plan in place that can be used for any situation, not just one that addresses a particular situation. This is an error many executives make.
Imagine the effort that goes into the developing of the plans that are based on only a single particular situation and can only be of use when that single particular situation occurs again? Guess what? The next time something occurs, management jumps up and down (like in hopscotch) wondering why all that effort that just went into creating a few comprehensive continuity / response / communication and restoration plans didn’t work? Well, the situation was different and what they had didn’t address the bigger picture of the company and thus was useless. They skipped some keys components to identify what really was critical and what wasn’t.
It’s often humours to watch managers have a ‘fit’ when an IT component becomes unavailable. On one hand they said during their BIA process that the system wasn’t critical and they could go 3 days without it then when it isn’t available it suddenly becomes mission critical and must be up in 3 hours – or 3 minutes. As a side not, hopefully the BIA is reviewed on an annual basis because things do, can and will change.
As a result of their response in the BIA, technology teams that developed their recovery strategies don’t have a plan yet in place for systems that aren’t required for a determined time. They’ve concentrated on systems that are 4 hours, 12 hours, 24 hours and 48 hours, not ones that are 72 hours. The funny thing is though that when a response is needed to a non-critical system and management are having a fit because there is no recovery restoration plan for these non-critical systems, they immediately want everyone to turn their focus to that one system, which in the grand scheme of things isn’t even identified as being needed so quickly.
You do end up with situation where systems that aren’t required for 72 hours – or more – have a contingency plan in place (a recovery and/or restoration plan in place) but the key system it depends on don’t have plans. If they hadn’t jumped all over the place and let the BCM team (technical personnel and non-technical personnel) concentrate on key system they would be in a much better situation.
I’ve been in many places where managers want the most visible system to have a plan and in many cases the most visible system isn’t the mission critical system for the organization. They either had the biggest ‘hissy-fit’ or just made the most noise to get something in place. But when something drastic does occur, the systems that support it aren’t up and running, meaning allot of effort and resources were wasted.
Like any roadmap, BCM has a set path that can get an organization to where it needs to be and be in a position to respond to all sorts of situations. Jumping about doesn’t help the overall path. In fact, it’ll only get you lost and confused and at some point an organization will no longer know where it is or where it’s going. So don’t skip along playing hopscotch. Following a set path will get you there; The Tortoise and the Hare anyone?