Certifying Business Continuity Expertise
More and more business owners are coming to appreciate the importance of contingency planning and why solid business continuity plans are absolutely vital to the survival of their companies. More and more front-line managers are also understanding and buying into business continuity planning in the event that disaster somehow strikes. IT professionals understand and appreciate better than most why an integrated company-wide approach to planning is essential.
Many IT professionals who have worked hard to become certified in various IT programs and disciplines have worked to make certain that either they or someone else in their organization put contingency systems into place that protect the life and integrity of the fruits of their labor—their data and programs.
Today’s IT professionals do not look at their services and operations as stand-alone; they see IT as an integral part of the overall mix of business operations. Therefore, when disaster strikes, every aspect of the business is vital and intertwined from a contingency planning and business continuity point of view.
The World Trade Center and Pentagon disasters, the Oklahoma City bombing and the Rhode Island nightclub fire are all vivid examples of just how suddenly disaster can strike. The tolls that disasters take can be both immediate and long-term and are devastating to big, medium and small businesses alike.
There are dozens of scenarios—terrorist attacks, earthquakes, fires, hostage situations, structural failures or any number of events beyond our control—that can severely interrupt business operations.
And the damage need not be direct. Hundreds of New York City businesses folded because of the unexpected collateral damage their fragile businesses incurred both on and after Sept. 11, 2001. Many of these might have survived if they were prepared and had a comprehensive plan that went beyond IT contingency planning.
DRI International (DRII) can direct organizations to critical resources with which to develop comprehensive business continuity plans—total business continuity plans that are designed to both augment and seamlessly integrate with traditional IT contingency planning. DRII has found that while most organizations have established a disaster recovery plan for core technology and infrastructure, very few have a full-fledged business continuity plan. And, with heightened awareness since 9/11, states, local municipalities, banks, insurers and creditors want to know what contingency plans companies have made.
How do business continuity planners get prepared? They get certified.
DRII offers three levels of certification in business continuity training. Nearly 3,000 individuals have earned certification since the organization was founded in 1988. These certified professionals are now implementing business continuity plans in their organizations according to established industry standards.
The nonprofit DRII offers a comprehensive set of training courses leading to three levels of professional certification in the critical field of disaster recovery and business continuity planning. They include the Associate Business Continuity Planner (ABCP), the Certified Business Continuity Professional (CBCP) and the Master Business Continuity Professional (MBCP), each with varying course, experience and continuing education requirements.
While DRII can refer businesses to a certified, experienced professional, more and more companies of all sizes are availing themselves of DRII courses to certify their own employees. Individuals ranging from mid-level IT specialists with contingency planning responsibilities to senior-level executives with business continuity responsibilities can benefit from this training. It easily dovetails with and expands upon IT contingency planning.
Professional certification carries strong value in many areas of business, but few seem to have the critical impact that a holder of the CBCP designation has when businesses suffer major disruption if disaster strikes. Proper business continuity planning is not a cost, but an investment in the future success of an enterprise. Most organizations have also found that just going through the process of conducting business continuity planning has strengthened their work teams, streamlined and improved operations and increased overall knowledge and confidence in overall company operations.
While most organizations have established a disaster recovery plan for core technology and infrastructure, very few have a full-fledged business continuity plan. DRII statistics also show that 80 percent of small businesses experiencing business interruptions go out of business within five years. Many more suffer losses in profitability. So there’s a lot at stake in doing proper planning.
DRII has developed and refined a core set of 10 professional practices in business continuity that have proven to be effective in helping businesses recover from unexpected problems. They include:
- Project Initiation and Management: Establish the need for a business continuity plan (BCP), including obtaining management support and organizing and managing the project to completion within agreed-upon time and budget limits.
- Risk Evaluation and Control: Determine the events and environmental surroundings that can adversely affect the organization and its facilities with disruption as well as disaster, the damage such events can cause and the controls needed to prevent or minimize the effects of potential loss. Provide cost-benefit analysis to justify investment in controls to mitigate risks.
- Business Impact Analysis: Identify the impacts resulting from disruptions and disaster scenarios that can affect the organization and techniques that can be used to quantify and qualify such impacts. Establish critical functions, their recovery priorities and interdependencies so that recovery time objectives can be set.
- Developing Business Continuity Strategies: Identify strategies for each business operation, conduct cost/benefit analysis of business continuity solutions and consolidate recovery strategies across the organization. Obtain business unit consensus on consolidated strategies and the commitment of top management.
- Emergency Response and Operations: Develop and implement procedures for responding to and stabilizing the situation following an incident or event, including establishing and managing an Emergency Operations Center to be used as a command center during the emergency.
- Developing and Implementing Business Continuity Plans: Conduct planning and make arrangements needed to ensure continuity of critical business functions. Proper preparation and implementation of procedures covering equipment and personnel are essential. Account for unique organizational characteristics and build teams.
- Awareness and Training Programs: Prepare a program to create corporate awareness and enhance the skills required to develop, implement, maintain and execute the business continuity plan.
- Maintaining and Exercising Business Continuity Plans: Pre-plan and coordinate plan exercises, and evaluate and document plan exercise results. Develop processes to maintain the currency of continuity capabilities and the plan document in accordance with the organization’s strategic direction. Verify that the plan will prove effective by comparison with a suitable standard and report results in a clear and concise manner.
- Public Relations and Crisis Coordination: Develop, coordinate, evaluate and exercise plans to handle media during crisis situations. Develop, coordinate, evaluate and exercise plans to communicate with and, as appropriate, provide trauma counseling for employees and their families, key customers, critical suppliers, owners/stockholders and corporate management during crisis. Ensure all stake