C²: Enterprise Continuous Continuity…

Business Crisis and Continuity Management (BCCM) is a dynamic change management initiative that requires dedicated resources, funding and auditing.

Since effective BCCM analysis is a 24/7 operation, it takes a combination of factors across the organization to provide what one might call C², or “Continuous Continuity”.

A one-time threat or risk assessment or even an annual look at what has changed across the enterprise is opening the door for a Board of Directors worst nightmare. These nightmares are “Loss Events” that could have been prevented or mitigated all together.

According to the best practices from several sources, the Board of Directors is responsible for the BCCM of an organization. Let’s take a look at what the highly influential Basel Committee says about one principle as it pertains to business continuity:

Review and Testing of Business Continuity Plans – Basel Principle 13

“It is the responsibility of the organization's Internal Audit and Business Continuity functions to ensure that all of the organization's business continuity plans are tested and reviewed on a periodic basis to spot incorrect assumptions, oversights or changes to equipment, and employees and to identify any changes in business requirements not reflected in specific plans. Any undocumented requirements must immediately be documented. In addition, appropriate information owners and users must be informed of updates to plans.”

• The following testing techniques must be used to ensure the continuity plan can be executed in a real-life emergency:
• Table-top testing: Discussing how business recovery arrangements would react by using example interruptions such as ransomware.
• Simulations: Training individuals by simulating a crisis and rehearsing their post-incident/crisis management roles .
• Technical recovery testing: Testing to ensure information systems can be restored effectively.
• Testing recovery at an alternate site: Running business processes in parallel with recovery operations at an off-site location.
• Test of supplier facilities and services: Ensuring externally provided services and products will meet the contract requirements in the case of interruptions.
• Complete rehearsals: Testing to ensure the organization, employees, equipment, facilities and processes can cope with interruptions.

The best practices talk about a BCCM that will be periodically updated. Periodic is not continuous. Change is the key factor here.

What changes take place in your organization between these periodic updates?

How could any organization accurately account for all the changes to the organization in between BCCM updates? The fact is that they can’t.

This will change over time as organizations figure out that this is now as vital a business component as Accounts Receivable. The BCCM will become a core process of the organization if it is not already, dynamically evolving by the minute as new change-based factors take place in the enterprise.

As new or terminated employees, suppliers and partners come and go into the BCCM process, the threat profile is updated in real-time.

This takes the operational management that much closer to C², or “Continuous Continuity”.

The enterprise today that understands the myriad of potential threats to its people, processes, systems and structures, stands to be better equipped for sustained continuity of Operational Risk Management and business operations.