This is typical of many continuity plans and response plans. We spend so much time worrying about various ’scenarios’ and never pay attention to what the solid foundation of BCM are. A scenario by definition is an ‘imagined sequence of events,’ with sequence being the operative word. A tornado isn’t an imagined sequence of events, it’s a real situation; it happens; it’s real. The scenario and the sequence of events that occur because of the tornado is the scenario but the tornado itself isn’t. You imagine what happens to you company or organization if the tornado hits and what it causes to your employees, facilities and technology resources (including servers, printers, Telecomm, PC etc).
What practitioners and managers should concentrate on is what happens if they loose their employees, loose their facility (or facilities) and what if all the flashing green lights on the technology equipment suddenly go out, making IT unavailable. Don’t sit around and worry about ‘dream sequences or scenarios’ some executive is probably quizzing you about. If you understand what to do in the worst case situations based on people, places and things, you’ll be able to work backwards and be able to answer – or better yet get the executive – to answer the question. Realize, they’re asking because they don’t have a handle on the foundations or the basics of BCM. That could be our issue for not communicating or educating people properly. Yes, that’s our fault. Either way, they are asking because they’re afraid of what might happen. If they can ask you a question that is so far out there they can send you on a wild goose chase trying to figure it out it’s proof they don’t understand the key foundations you’ve set in your organization. Thus, you get people wanting critical files recovered before the actual system they reside on. So don’t waste time on imaginary things – deal in the basics and the solid foundations. Don’t let the fearful distracters and the “what if…” talkers derail you from what’s important.
Many managers in DR and BCM sit and mull over silly situations that all start with, “what if” questions and then try to build a plan that addresses that situation. You could end up with millions and millions of scenarios and related plans based on that kind of thinking and never capturing what’s actually critical to your organization. Can you imagine the documentation and maintenance processes required to keep that sort of documentation up to date? Yikes!
A continuity or response plan should address the worst-case situations and results. If the absolute worst-case situation can be addressed, then all the ‘what if’ situations will be addressed too…well, easier anyway. If not, you’re bound to encounter issues with executives who think the organizations plans are worth anything. That’s why many plans don’t work and people get angry at the practitioners (or others responsible for recovery and restoration plans) because they waste their time on the “what if’s” of BCM and not on the solid foundations on which its built – Employees, Facilities and Technology, which can include processes and process activities. Focus on these areas and you’ll be able to walk your way through most situations. Along the way you can test your plans by throwing some of those “what ifs…” at your test objectives it and see if your basic plans can still hold water. It’s kind of like testing the sealant on you basement to make sure it can still hold the water back during a major shower; the foundation is solid and stable.
If performed correctly, the BIA findings will tell you what infrastructure systems need to be available first and what critical files reside on those systems. Then when something occurs even during a test, you’ll be prepared.