What is the business continuity plan and why should it be the basis of your company?

Life is uncertain, from one moment to another a catastrophe can occur from a natural phenomenon such as earthquakes, floods or fires, even diseases (pandemics) or criminal acts that not only pause the lives of people, but also companies enter a critical phase and can even condemn them to closure. If we add to this digital threats such as cyber attacks, The risks that companies face are increasing.

Although no one can predict a catastrophe, it is important that every business, regardless of size and type, have preventive measures in the face of the most common events that can occur. For this, a continuity plan is required, which consists of knowing how to manage the recovery of the company after a unwanted interruption or disaster in your organization, in order to restore its critical functions within a predetermined time.

“Unfortunately some businesses must close when they are hit by a disaster for which they were not adequately prepared. Any company of any size can improve the chances of overcome an incident that threatens to interrupt your activity and be left in one piece (with the brand intact and without loss of income) if you follow certain proven and trusted strategies”, explains Camilo Gutiérrez Amaya, Head of the Research Laboratory of ESET Latin America.

It details that this work is part of the international standard for business continuityISO 22301which explains the “capacity [que debe tener una organización] to continue the provision of products or services at acceptable pre-defined levels after business interruption incidents”.

To carry it out, there are four steps that must be followed, which are:

Identify and order threats

Start by identifying the key products, services or functions for an organization and perform a risk profile through a self-assessment using the four element framework: people, processes, benefits and partnerships.

Then you should create a list of business interruption incidents that are the most likely threats to your business, not forgetting to use someone else’s list, because threats vary by location. For example, one area may be more prone to earthquakes than another and this is important to establish the order and priority of actions.

In addition, the following questions must be answered:

1. “What happens where the company is located?”
2. “And what about data leakage or IT infrastructure disruption, which can happen anywhere?”
3. “Are you located near a railway track? From a major highway? How much does the company depend on foreign suppliers?

“At this stage, a good technique is to bring people from all departments together in a brainstorming session. The goal of the meeting is to create a list of scenarios ordered by probability of occurrence and by potential to cause a negative impact,” he says. Gutierrez.

Conduct a business impact analysis

You will need to determine which parts of the business are most critical for it to survive. Following this line, it is important to be able to assess the potential impact of interruptions for the company and its workers. You can start by detailing the functions, processes, employees, locations, and systems that are critical to the organization’s operation.

These tasks are generally handled by the project leader and, for this, you must interview the employees of each department and then develop a table of results that lists the functions, the main people and the secondary ones.

In this way it will be possible to determine the amount ofdays of survival” of the company for each function, that is, if an accident occurs, how long will it be able to resist?

Create a response and recovery plan

“In this stage, key data must be cataloged on the assets involved in carrying out the critical functions, including IT systems, personnel, facilities, suppliers and customers. Serial numbers of the equipment, license agreements, rentals, guarantees, contact details, among others, must be included.

For this, it is necessary to appoint a person in charge in each area to know who to call in case of accidents and thus, create a phone number tree so that the correct calls are made in the correct order. Every person should be in charge of media interaction during an incident. Here you can consider staying with a strategy that only involves the CEO if it is a sensitive incident.

In order to have a better control of these processes, each agreement made and notifications made must be documented.

“The steps to recover core operations should be ordered in a sequence where functional interdependencies are made explicit. When the plan is ready, be sure to train managers on the details relevant to each department, as well as the importance of the overall plan for surviving a an incident.”

Test the plan and refine the analysis

The ideal is to test the implemented plan once a year, at least, through exercises, simulations, analysis and measurement of results. In this way, the areas of opportunity and strengths are declared. Do not forget to modify it depending on the circumstances that arise.

“These four steps mean a lot of work, but it’s a task that companies ignore at their peril. If the project seems too daunting to apply to the entire company, consider starting with a few departments or a single office, if there are multiple. Avoid at all costs thinking that bad things don’t happen, because they do. You just have to be prepared and don’t pretend that when something happens it won’t be so bad, because it could be”, concludes Gutierrez.