Chapter 3: Business Assessment - Business Continuity and HIPAA Business Continuity Management in the Health Care Environment [Electronic resources] نسخه متنی

Chapter 3: Business Assessment

THE BUSINESS CONTINUITY PLANNING CUBE

Having worked with quite a few business continuity planners, I came to realize that business continuity planners have unique ways of looking at BCP. What I learned is that there is no absolute right way to do planning (contrary to what some vendors might say). An organization's ability to be recovered after a disaster is really the important issue. With that in mind, what is offered here is A (not ‘THE') way of looking at Business Continuity Planning. Throughout this book, what is presented here is the underlying philosophy of how a business continuity plan is constructed.

In Business Continuity Planning, we have two main focuses. First, we try to protect our organization's ability to produce through strategies and designs that will withstand and circumvent destructive events. Second, we orchestrate the creation of procedures (and supporting documentation) that will allow our organizations to recover from a disastrous event in time to prevent financial collapse.

In trying to accomplish these, we need to have a model of the organization in the same way a military commander requires maps and various icons to plan battles tactics and strategies. This model should not only depict the services that we are trying to protect and recover, but also the departments and resources that produce those services.

Organizations all have the same basic structure. There is a focus or reason for the existence of the organization: the production of a service or product. Some organizations align their department structure around the service (product), most do not. By including all departments within an organization, all the components of the services (products) of the organization are captured by default.

Why do we want to make this distinction and work-around for capturing services? The reason is that information along department lines is generally more available. Department heads and personnel know more about how their department's work and what resources are required to make them functional than they do about all the components that go into producing a product or service offering.

Therefore, using a model of the organization as represented by the Business Continuity Planning Cube, we can protect and recover the organization's service offerings by focusing on the recovery/protection of the organization's departments.

Each department that we examine will have one or several core processes. The department receives an input from somewhere, does something to transform that input, and delivers a product/service to a customer. The entire process is the supply chain. In Business Continuity Planning we are responsible for of protection and recovery of the entire chain.

If you examine the "PROCESS" component of the supply chain, you will note that it can be broken down into the resources categories that are required to transform the input into the final product or service that is supplied to the customer. Those resources can be further broken down into resource items. The "Process Supply Chain" diagram below depicts the way a department is defined by the resource items that it takes to make it productive:

When we look at all the categories (and they can be broken down much finer than represented here), all of the vendor messages and topics that inundate the media that, to the first-time planner, looks like chaos, start to fit together because they are addressing unique components of the entire chain.

What is the advantage of viewing organizations in the manner described above (with respect to business continuity planning)? First, we eliminate the need to have recovery plans based on events. Using this concept, a tornado, or fire, or human sabotage has the effect of eliminating one or more vital components of production. In building a plan with a focus on recovering components of production, we are less concerned about the cause of disruption and more about the effects of the event as it pertains to our production capabilities.

Second, with a focus on production components, we are able to direct our recovery efforts toward replacing or repairing affected resource items. What I have seen too often are plans that concentrate on work-around procedures and communications with employees. While these two components have a place in the overall recovery effort, they should not be the main focus which is to get the production process fixed by making sure that all the component of production are operable.

Third, by using the listing of resource items found on the process supply chain diagram, the planner can systematically inspect each of the organization's resource categories and develop a strategy to insure that as many single points of failure as possible are eliminated.