Recently I attended a meeting – as an FYI/observer – where discussions were taking place amongst management representatives for a service provider. There were many topics on the agenda but the one that struck a chord with me was about Disaster Recovery / Business Continuity plans (I think this was the reason for my invitation though not as a participant but on a FYI basis (??)).
In many instances, the attendees were constantly and consistently stating that after they implemented BCP plans (of any type) they’d get back to running in normal operations – this struck me as odd. I didn’t understand how you can change something – in some cases stop doing things altogether – and still have things operating ‘normally’.
Normal is defined as “conforming to the standard or the common type; usual; not abnormal; regular” (Dictionary.com) but if you’re operating in a “Disaster mode” are you in normal operations? You can’t possibly be.
Organizations develop, plan, implement, exercise and maintain BCM/DRP plans and components (hopefully…) to address situation that stop or hinder its ability to deliver key products and services, as well as the protection and the health & safety of its employees – as well as visitors – to its facility when emergency situations strike. When something does strike a corporation, it can’t possibly be thought that normal is still in existence or something to be obtained once more.
One of the reasons for having proper BCM programs and/or Disaster Recovery Plan (DRP) in place – among many applicable reasons – is to address circumstances that deny a corporation the ability to operate or deliver its products and services due to a disaster situation or some other critical emergency situation/incident. When something does occur and plans and response area initiated – from evacuation plans to communication plans to technology recovery plans – there is no longer any such thing as “business as usual.” How can any organization be running or in ‘normal operations’ in the middle of the disaster? Sure, I concede that that is a state a corporation wants to get to so that it can continue or begin once again to offer its services and support to clients but even then, it’s under non-normal circumstances. If you’ve deviated from what you do on a regular daily operational basis with no issues or incidents to contend with, it’s impossible to state you are in normal operations.
The assumptions being made were driving me crazy; this will happen and that will occur and this person will do that thing…yikes!! It reminded me of the lyrics of the song “No Such Thing” by Marillion: “There’s no such thing, as an easy ride / There’s no such thing, as a place to hide / There’s no such thing, as a perfect day…”. So true in a disaster situation.
During a crisis or disaster, many corporations will activate various contingency measures to concentrate on the situation at hand and suspend those activities that have no value to the situation; meaning activities that won’t harm or impact the continued delivery of services or products.
Normal – as defined by a corporation prior to a disaster or crisis situation – may never exist again. Normal goes out the window when a crisis strikes and the corporation needs to rethink what it does, how it does it, its responses and its measures to improve its DR/BCM plans and components. What will happen is that a new level or definition of normal will be established, as the new normal now incorporates the learning’s from the situation – both good and bad – into its daily operations. In other words, you can never really return to “normal operations” as they were before a disaster – I think it’s next to impossible. What you do is move forward and create a new normal.
One way or another there will be impact upon a corporation; in its culture and how it views plans and processes. There will be the thought – hopefully – to make stronger any program or plan in place so that when a crisis hits again (regardless of size and scale) it will be better prepared to respond appropriately. This includes the level of input from employees on what went well and what didn’t and how to better improve communications and information supplied to customers – the very people employees on the front line are dealing with when a crisis hits. This isn’t normal – it’s a proactive approach to get things in order when disaster strikes.
It’s not even normal levels of operations when a corporation has mirrored or duplicate sites. It may seem like that for many employees because they may not see the relevant contingencies (the IT processes) kick in – it may be seamless to them. When a connection is lost it automatically switches/redirects to a new server located at an alternate site. The user may see a quick ‘blip’ but that’s it. However, for IT teams it still isn’t ‘normal operations’ because they are dealing with an activated contingency location and having to investigate the corrupted or impacted home/production environment to see what has gone wrong. It may appear normal to users but to technology teams it’s far from it.
They may need to investigate the causes of a corrupted IT environment and what triggered the automatic activation of contingencies. They are maintaining two environments; the alternate production environment and the corrupted environment (well, for issue investigation and all…). If the investigation takes some time there will be issues with backups and schedules there too. Though users may still be able to do many – if not all – functions but how is this returning to normal operations? It’s not normal.
The attendees at this meeting were assuming that as soon as a band-aid was placed on a wound – the DR/BCM plan was activated – things would return to normal. However, if you have a bandage on your wrist or a band-aid covering a cut, are you back to ‘normal’? No, you’ve just protected yourself from further damage but you aren’t back to normal. For that to occur the bandage, needs to be removed and the cut/injury can’t be seen anymore. And even then, you’ve learned not to do what caused the cut/injury in the first place. For BCM/DR, that’s figuring out what caused the problem and incorporating that into plans or processes (even daily operations processes) so that you establish a new normal.
After a disaster or crisis, you can never go backwards to normal. You can only establish a new normal; a new level of expectation and response level. To pinpoint normal is impossible because it continually changes and let’s face it, after a disaster do you really want to go backwards to a time before a disaster or do you want to move beyond that and learn from it. That’s what makes a BCM/DRP program stronger and more suited to the organizational need by way of responding to disaster and crises.
The new book by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3, “Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a Social Responsibility.” Available at www.stone-road.com **