You want to hope for the best, but disasters are always a real possibility for interrupting business as usual. Every time a hurricane hits or a forest fire spreads into town, businesses are affected. The office could lose power for several days, it could flood, or worse, it could sustain permanent damage. The question then becomes, does the business need to shut down until everything is back to normal, or is it able to function because there was a business continuity plan.
Why You Need a Business Continuity Plan
Having a business continuity plan helps organizations prepare for disruptive events. It needs to encompass how employees will respond to operational disruptions, communicate and keep working. The details can vary greatly, depending on the size and scope of a company and how it does business.
A disaster recovery plan should also be in place and is part of the business continuity plan. A business continuity plan addresses the organization as a whole, whereas a disaster recovery plan works to get the infrastructure back up and running and making data accessible following a disaster.
If you think this is common knowledge, here are some staggering statistics:
- 48% of small businesses do not have a business continuity plan in place (Source: CSO from IDG, "A Guide to Business Continuity Planning in the Face of Natural Disasters”)
- 40% of businesses do not reopen after a disaster (Source: U.S. Federal Emergency Management Agency (FEMA))
- 25% of businesses fail within one year of a disaster (Source: FEMA)
Approaching Business Continuity Planning with Project Management
At the time of a disaster or disruption, it will be too late to react if a plan is not in place. Therefore, organizations of all sizes must develop a disaster response and recovery plan through a business continuity plan. Once approved by stakeholders, you can apply the best project management methodology for the organization to complete your business continuity plan.
As part of that project planning, creating a business impact analysis report will demonstrate the impact of losing critical business functions. Reports typically include time-critical processes for the business, assessment of risks that threaten the critical processes and disaster recovery priorities. With its heavy focus on risk analysis and communication, CompTIA Project+ can help guide your project planning and implementation.
Four Key Elements of a Business Continuity Plan
When creating a business continuity plan, focus on four key elements.
- Time-critical Processes
To obtain an exhaustive list of time-critical processes and avoid departmental bias, the report cannot be created in a silo. Remember to interview all department leads, asking open-ended questions on input and output processes, loss and net impact, recovery time, recovery site needs and means to reduce disaster recovery time.
CompTIA Project+ Domain 1.0, Project Basics, covers planning the project – in this case, business continuity planning – and getting the necessary approvals to continue. You will learn how to classify staff roles and responsibilities and document the scope of the project. During interviews with all department leads, define the time-critical processes, impacts in case of a disaster and the expected recovery time.
- Assessment of Risks
Your organization may face various hazards, threats and vulnerabilities that will impact business operations and processes, which fall into the categories of natural, human-caused or accidents. Attempt to define these threats and consider the likelihood of them happening to you and your organization’s vulnerability to understand the full impact. Don’t forget to also strategize on the response through acceptance, transference or mitigation.
CompTIA Project+ Domain 2.0, Project Constraints, helps you understand how to predict risks and evaluate their impact and explain the importance of risk strategies and activities.
For example, if your office loses power or employees lose power at their homes, is there a central meeting location from which they can work? Hotels usually have generators and internet/wireless access, so with budget permitting, you could book a meeting room where employees can work.
- Recovery Priorities
The key to recovery is ensuring that time-critical processes become operational as quickly as possible. Develop a category system, such as critical or necessary, and define the recovery time objectives (RTO) and recovery point objectives (RPO) for each business process. In other words, determine how long it will take to recover systems and the allowable amount of time that data can be lost within a last backed-up time frame.
CompTIA Project+ domains 1.0, 2.0 and 3.0 all help you prioritize the processes and risks. You will learn how to execute and develop project schedules, define how long each of the disaster recovery actions will take and what the scheduling of activities will look like.
And having a communication plan is crucial. In the case of a disaster, it is imperative to define how will you communicate with the stakeholders and what kinds of communication is required to complete all the tasks.
As an example, decide how internal alerts will be sent —via email, voice messages, text messages or building paging systems – with instructions to evacuate the building and relocate at assembly points. Then, once you are in the disaster recovery phase, you need to know how the communication is going to change and how you’ll ensure you are getting the feedback you need.
- Testing and Maintenance
Without a proper training, testing and maintenance plan in place, the business continuity plan will not be as effective. Tests can be as simple as a paper walk-through or as advanced as a full mock interruption to test response and employee reaction.
Per CompTIA Project+, the execution phase will help you with testing. Although you might not need to execute the complete business continuity plan, you should test the most critical business processes to ensure the plan works. As you train employees and test the plan, you need to ensure all documentations are up to date and that you are using the right project tools, as defined in Domain 4 of CompTIA Project+.
CompTIA Project+ Can Guide Your Business Continuity Planning
Most organizations rely on the availability of their business processes at full capacity. A lack of disaster preparedness can result in significant cost implications during an outage, but most organizations are not adequately prepared. A solid project management approach can help you create an evergreen plan that combats identified risks and ensures that your team is up to the challenge each vulnerability holds. CompTIA Project+ can help with creating, testing and executing the business continuity plan. CompTIA Project+ validates the skills you need to manage projects, like business continuity planning for small to medium-sized companies.
Download your business continuity checklist today.
Tazneen Kasem has more than 20 years of experience in training and certifications. She manages CompTIA Network+, CompTIA Certified Technical Trainer (CTT+) and CompTIA Project+ and launched the CompTIA Instructor Network. Tazneen holds CTT+, Project+ and PRINCE2 Practitioner.
Jen Blackwell also contributed to this article. She is a senior products marketing manager at CompTIA and oversees CompTIA Project+.
