best-in-class crisis preparation - business continuity€¦ · if business continuity management...

Emergency Notification • Incident Management

Best-in-Class Crisis Preparation:Maximize Readiness with the 4 T’s Approach

© Copyright 2015, MissionMode Solutions, Inc. www.missionmode.com [email protected]

Best-in-Class Crisis Preparation: Maximize Readiness with the 4 T’s

2

What it Takes to Be Best-In-ClassIf business continuity management (BCM) was easy, any company with aspirations for a strong BCM program could achieve its goals for maximizing readiness. Unfortunately, year after year, benchmarking studies show that most organizations are not meeting their business continuity program maturity goals.

The fact is successful crisis preparation requires a consistent long-term commitment, a disciplined approach to planning, ongoing team training and refinement, and the resources to make all of this possible. Many organizations start down the BCM path with great intentions after facing an emergency situation unprepared, but then lose steam somewhere along the road to best-in-class preparation.

This paper explores the current state of BCM maturity and the key success factors that every organization needs to master if they wish to increase crisis readiness and create a business continuity program that is sustainable over time. It can serve as a litmus test for executive leadership when evaluating their organization’s current program effectiveness or as a blueprint for BCM teams trying to start a program or move theirs to the next level.

MissionMode has created the “Four T’s Approach” to help simplify business continuity program planning and evaluation. It provides an easy yet comprehensive framework for evaluating BCM program maturity on each of the primary success drivers:

Use the 4 T’s Approach to evaluate business continuity program maturity

What it Takes to Be Best-In-Class

Are We There Yet? BCM Maturity Trends

MissionMode Readiness Survey Findings

Why the 4 T’s Approach?

Team – BCM Success Starts Here

Templates – The Plans That Drive BCM Readiness

Test Exercises – Practice Makes Perfect

BCM Tools – Incident Management in the Digital Age

Metrics and Measurement —The “Fifth” T

Don’t Be a Statistic

Table of Contents

jvargo

Line

http://www.missionmode.com/solutions/role/business-continuity/



3

Are We There Yet? BCM Maturity TrendsMany studies report on BCM program maturity, and while some suggest improvement in recent years, most agree that the overall baseline is not great. At the beginning of 2014, Gartner reported scores of just below 2.5 on a 1 to 5 scale for BCM/IT DRM Maturity (based on Gartner client maturity self-assessment tool ratings). Gartner believes focus and ownership are the largest barriers to BCM program maturity. Their clients have indicated that the further a company gets from the last disaster, the less pressing the BCM topic appears to be on management agendas.

An even more pessimistic view was shared in the Disaster Recovery Preparedness 2014 Benchmark Survey which reported that 73% of companies worldwide are getting failing grades in terms of disaster readiness. Specific shortfalls included:

� 60% do not have fully documented DR plans � 40% report having plans that have not proven

effective in actual emergency situations � 65% of companies that do test exercises, report

not passing � 36% had lost one or more critical applications for

hours/18% lost applications for days or weeks over the past year

� 25% had seen data center outages with no backup in place that lasted multiple hours

A joint benchmark survey prepared by Continuity Insights and KPMG showed an 8 percentage point improvement in self-reported program maturity between 2012 and 2014.

Similar to Gartner, the CI/KPMG study showed a strong correlation between executive team support and BCM program maturity.

Gartner rated BCM/IT maturity at just below 2.5 on a 5-point scale

73% of companies get a failing grade on disaster readiness



4

MissionMode Readiness Survey FindingsThe MissionMode Readiness Survey was launched in September 2014 to help companies assess their programs on a number of business continuity key success factors and determine their organization’s overall Readiness Number. The Readiness Survey is just one component of MissionMode’s Customer Readiness Commitment aimed at helping companies improve the maturity of their business continuity programs. Preliminary results are now in with hundreds of organizations having completed the survey, and they are consistent with the maturity benchmarks above. The survey calculates a weighted Readiness Number on a 0–100 scale and the average score to date is just 58/100.

The survey covers a wide variety of BCM program success factors, including:

� Team composition and executive support � Planning effectiveness � Training and testing of plans � Risk assessment processes � Response effectiveness � Availability of support tools � Program Measurement/KPIs

As indicated in the chart below, 32% of respondents scored between 0–50 indicating that they are very or somewhat unprepared; 47.4% received scores between 51–75 suggesting that they are moderately ready; and only 21% scored over 76 to put them into the “well prepared” quadrant.

58/100 average Readiness Number of MissionMode Readiness Survey respondents



5

One of the biggest gaps identified is in the areas of planning and training where 60% of respondents report underdevel-oped readiness:

� 7% of respondents report having no business continuity plans in place

� 22% report having preliminary plans drafted but not trained

� 32% have some, but not all of their plans developed and trained

Similarly, under 20% of respondents reported having both the templates and tools in place for effective incident management and collaboration.

Interested to see how your organization stacks up? Take the Readiness Survey.

Why the 4 T’s Approach?It’s clear from the numbers outlined above, that the majority of businesses struggle with the complexities of business continuity management. We developed the 4 T’s Approach to address the most common pitfalls that we encounter when working with clients year after year:

� Assembling the right teams � Creating effective templates � Ongoing test exercises � Arming the team with the right collaboration tools

The chart below outlines the most common issues encountered within the 4 T’s:

Team• Executive Support • Frequent communications/visibility • BCM Team composition and training • Team building/Trust

Templates• Planning for right activities • Don’t try to handle too much too fast • Include everyday operational events vs. just crisis • Pre-populate messaging and task lists

Testing• Team training • Creating realistic test drills • Ongoing testing plans • Testing oversight/program adjustments

Tools• Enable anytime/anywhere access • Employ intelligent mass notification • Use an incident management system to standardize response • Use tools for both routine and crisis event management

60% report feeling underprepared with planning and testing

Address the most common pitfalls leading to BCM program maturity shortfalls

http://www.missionmode.com/be-ready/



6

A strong metrics-driven approach to business continuity management is imperative. As a result, you could consider adding a fifth “T” to our strategy—tracking.

Team – BCM Success Starts HereThe most commonly cited impediment to BC/DR program success is a lack of management support, and this is for good reason. New and non-established BCM programs have to overcome serious inertia in order to succeed.

Business continuity is not a core competency of most organi-zations and few employ a full-time team of BCM professionals. According to the CI/KPMG benchmarking survey, the majority of respondents have between 0 and 2 full-time employees (FTEs) dedicated to the primary BC/DR functions:

Even when launched in the aftermath of a major disaster like the World Trade Center attacks or Hurricane Sandy, the longer the interval after the disaster, the less of a priority crisis prepa-ration becomes. Strong executive sponsorship and the right BCM team are needed to create a lasting business continuity culture within an organization.

The Importance of Strong Executive Sponsorship

Executive management and executive steering committees ful-fill a myriad of critical roles in supporting the success of an or-ganization’s BCM program. There are few examples of success-ful broad-scale business continuity programs that don’t have consistent support and involvement from senior leadership. Key functions of the senior management sponsor include:

� Selecting/hiring/managing BCM team leadership � Securing necessary funding to support BC/DR

initiatives � Leading the BCM steering committee � Facilitating executive team input on critical decisions � Request/review key program metrics � Drive ongoing communication/visibility of business

continuity team activities across the organization

Executive sponsorship critical to BCM program success



7

Studies have proven a very high correlation between BCM program performance metrics and the existence of an executive level steering committee. The chart below from the CI/KPMG benchmarking study shows that companies with a steering committee in place outperform those without executive committees on every metric except the metric of “Do Not Measure BCM Program Performance”.

Companies with steering committees in place perform significantly more test exercises, are more likely to have a BCM performance dashboard in place and to consistently review program capabilities vs. industry benchmarks.

Strong executive support coupled with an active and involved steering committee may be the single most important success factor for BCM program maturity.

Case Study – Creating a Continuity Culture, Gap, Inc.

Challenge: Building relevancy for a new global business continuity program in an organization that previously only had limited, geographically disconnected BC/DR initiatives

Approach: The Gap, Inc. executive team was highly committed to the initiative. They hired a long-time, experienced BCM program leader, Michael Lazcano, to lead the effort. Gap management communicated heavily about the importance of the initiative and the definition of success. Resources were made available to the BCM team for training and relationship building. Processes were built leveraging state-of-the-art collaboration technologies and management reviewed key performance metrics on a quarterly basis and after each test exercise/incident. The team celebrated wins routinely and communicated all milestones widely. Today Gap, Inc.’s BCM program is considered one of the strongest in the industry.

Programs with executive steering committees significantly outperform those without

What is a Continuity Culture and how do you create one?



8

Assembling the Right Core Team

While there is no discounting the importance of executive support, day-to-day success is driven at the BCM core team level. A strong team has three macro roles:

1. BCM Director/Program Lead: This individual or group is responsible for organization and management of the company-wide business continuity effort. They determine what events to prepare for, make sure the right teams are in place for each event type, draft and document plans, manage ongoing testing, collection of metrics and ongoing optimization of the program.

2. Functional Leads: A cross-functional approach is required to successfully respond to any disruptive event. Team leads need to be identified to manage communications, ensure security at facilities, support customer service, manage operational impacts and more. For each event type, a different functional team may be required.

3. External Stakeholders: For some organizations and event types, external stakeholders may need to be informed and included in the resolution process. These may include public safety officials, suppliers, media and even consumers who need to be kept in the loop and potentially take action in the event of an emergency.

Templates – The Plans That Drive BCM ReadinessA business continuity program cannot “pass Go” without a process to create and document plans by event type. Prioritizing which events to prepare for is an important function of the BCM Lead Team and Steering Committee.

Deciding What to Plan For

A common pitfall is to try to prepare for every potential disaster and, as a result, not develop any of the individual event plans to a useful level of readiness. Another frequent issue is to focus narrowly on IT-related events without addressing the broader list of potential company impacts. Because IT issues appear high on the list of common threats, BCM executive sponsorship often comes from within the IT organization. While this might be a logical fit from both a functional and skills perspective, CIOs that act as executive sponsors for a company’s BC/DR program must take a bigger picture view of business continuity needs.

Every event type may require a different core team

For best results, prioritize the events that matter most to your business



9

While the list of priority events to prepare for differs by industry and geography, it makes sense to pay close attention to the most commonly experienced events that require BCM program support.

According to the CI/KPMG benchmark study, 59% of respon-dents activated one or more of their business continuity plans in 2013 for weather-related incidents, 52% for power-related outages and 37% for IT security breaches.

Top 10 Threats Impacting Business Continuity

1. Severe weather

2. IT issues (outages, breach, virus…)

3. Power outages

4. Natural disasters (flood, earthquake)

5. Physical violence

6. Fire

7. Epidemic

8. Product delivery/quality

9. Scandal/reputation

10. Theft

Drafting Effective Plans and Templates

There are many sample templates readily available to organizations in the early days of BCM program development. In fact, some incident management systems are structured to reflect the most common tasks within a business continuity plan and can be extremely useful to guide plan development and documentation. The framework below illustrates the six main stages of any BCM plan; team identification, risk assessment, impact assessment, response planning, recovery and post-event metrics review.

Weather, IT and power outages are the top events requiring the business continuity team’s attention



10

Business Continuity Plan Stages

1. Team Identification: Functional team leads and alternates plus external stakeholders need to be identified in this initial stage. Contact information for multiple devices must be collected and stored for emergency notification purposes.

2. Risk Assessment: For every event type, one or more team members need to be responsible for monitoring risks as they develop to the extent possible. Specific triggers should be agreed upon in advance that would merit BCM plan activation.

3. Impact Assessment: Plans should cover what information will be gathered to facilitate decision making, who and how the information will be collected, and how the data will be shared across the full team. In addition, this stage will document the level of executive involvement required to make go/no-go decisions on incident response.

4. Response Planning: Each functional team needs to create planning templates to serve as a roadmap for event response. These templates will include checklists of the likely required tasks and should be easily accessed by the full team in the event of an emergency.

5. Recovery: This stage is about executing the response plans and maintaining clear and consistent communications. Because of team interdependencies, full visibility of the incident dashboard facilitates better recovery coordination and reduces the possibility for miscommunication.

6. Post-Event Review: As part of the template creation process the team should determine which metrics will be measured to evaluate success and how these metrics will be collected and shared.

Follow this six-stage approach for comprehensive template development



11

Solid, well-documented plans are critical to BCM program success. They reduce decision time, increase recovery speed and facilitate appropriate communications that can help organizations manage their reputation in times of crisis.

Case Study – Standardizing Incident Management, Xcel Energy

Challenge: Xcel Energy was experiencing poor response times to outages and significant fines from regulatory commissions due to a siloed emergency response system.

Approach: Management determined that they needed a standardized, company-wide program and appointed a champion to lead the effort. The BCM team evaluated the best practices across the company and used these when developing the enterprise-wide approach. They implemented MissionMode’s Situation Center™ incident management system to help drive standardization and facilitate management of both routine and emergency events. The system was pre-populated with templates for everything from power outages, severe weather risks, IT issues and more. Templates included team members/alternates, contact preferences and data, task checklists, pre-approved alert messaging and operational log proce-dures. Because the system is used for both routine and emergency events, adoption was much quicker than for organizations that only deploy their incident management solutions in crisis situations. Xcel has dramatically reduced response times and associated regulatory fines.

Test Exercises – Practice Makes PerfectSeventy-four percent of BCM programs with executive steering committees routinely perform test exercises to train and refine their event plans. Why? Because testing is absolutely critical for program success. The Disaster Recovery Preparedness 2014 Benchmark Survey reported that 65% of companies perform-ing test exercises reported some level of failure. This is actually not such a bad statistic. It’s far better to fail during a test drill than during a true emergency. The purpose of drills is to uncover planning gaps and fix them before the crisis occurs.

Greater standardization drives faster business continuity plan adoption

65% of companies performing test exercises fail and need to adapt their plans



12

The Role of Test Exercises

Running BCM exercises is a key role for any business continuity program leader. Drafting BCM plans and making sure they work effectively in a crisis are two wholly different things. Plan testing is critical from a number of standpoints:

1. Team Building: Unlike many teams, business continuity teams frequently consist of cross-functional representation including a variety of individuals who do not typically collaborate outside their BCM roles. Most of these team members do not have formal training in business continuity, and they are not accustomed to working with each other. Exercises help team members get to know each other better to build relationships and trust. The more you know and work with colleagues, the more likely you are to take your role on the team seriously.

2. Team Training: As stated above, most BCM functional team members have little or no formal training. They are communications specialists, customer service managers, operations directors, IT program managers and more. These team members are selected for their functional expertise and need to be trained on the requirements of the business continuity role. Team training should cover the end-to-end incident management process, including; risk assessment, impact assessment, response planning, recovery and post-event evaluation.

3. Plan Validation: Exercises fulfill an important role in validating the effectiveness of the plan. Are the templates and task lists clear? Have all the critical steps been identified? Are the pre-populated messages valid? Have all the right team members been identified? What about their alternates, have they been identified and trained? BCM exercises frequently identify gaps that, once filled, make event resolution run more smoothly.

4. Support Tool Configuration: Every BCM program uses some form of support tools. Whether these include fully integrated emergency notification and incident management systems or simply shared drives and conference bridges, the tools need to be trained and exercised so that when a real crisis occurs, technology will help speed resolution vs. hinder team effectiveness.

Test exercises help solidify your business continuity teams and train staff



13

How to Run Successful BCM Exercises

Successful BCM programs have an ongoing exercise calendar. Each risk or threat that an organization prepares for is likely to have different team members, task lists and objectives. Every crisis team should do a minimum of one exercise per year and potentially more based on the complexity of the issue and outcome.

BCM team leadership typically orchestrates the overall exercise calendar and creates the objectives for each individual exercise based on approved planning documents. The simplified diagram below outlines the process for executing a successful exercise:

Key Stages of BCM Plan Testing

Create the Plan: Before a test exercise can be conducted, a plan needs to be created, drafted, approved and trained. While this seems obvious, some organizations try to use the testing phase to finalize draft plans vs. to test approved plans. We highly recommend drafting the plan and documentation before considering any test exercises.

Design and Development: The BCM team needs to take exercises seriously; an exercise planning team will ensure exercises occur and the results are documented. When designing an exercise, the exercise planning team should be realistic and as detailed as possible to best simulate an actual crisis situation. Identified objectives and a clear understanding of the expected responses will guide the design and development.

Exercise Conduct: The Exercise Director will begin disclosing scenario facts so that the team can begin to execute the appropriate response plan. The exercise planning team can help with evaluation of the exercise and monitor for the expected response actions to take place.

Planning test exercises requires a disciplined approach

Plans should be optimized after each test exercise



14

Post-Action Report: A critical part of each exercise is the post evaluation where team members review each step of the exercise to determine:

� How effective were you at executing the plan? � Did the team get to an impact assessment; go/no-go

decision in an appropriate timeframe? � Did each team member provide clear and appropriate

response plans with identified task lists? � Were the pre-populated templates and plans well aligned

for the required response? � Did we deliver the right communications to the right

audiences at the right times? � Were our recovery steps implemented quickly? � Overall, what could we have done differently to address

this incident more effectively?

Plan Updating: Based on the answers to the questions above, plan documents need to be updated to address the corrective actions highlighted in the after-action report.

BCM Tools – Incident Management in the Digital AgeThe right tools can help structure a business continuity team effort and make sure that key steps don’t get missed. They help standardize response and reduce the learning curve to achieve BCM program maturity.

In this age of connectivity and mobility there are huge advantages to equipping a business continuity team with collaboration tools that allow them to operate in a completely virtual manner from any type of device.

The 2014 Gartner’s Hype Cycle Report for Business Continuity Management and IT Disaster Recovery suggested that the virtual incident management system had officially “come of age.” The main drivers of adoption from their point of view included:

� Manage relationships with all internal and external stakeholders of an organization

� More efficiently manage response, recovery and restoration actions

� Communicate critical information internally and externally

� Review and report on the incident so that an organization’s business continuity team can utilize the data for future training and improvements



15

That same report estimated current penetration of incident management systems at 25–30% with mainstream adoption of the tools by 2019 as a way for organizations to improve BCM effectiveness by imposing a standardized best-practice or leading-practice model, extending uniform managerial controls across the organization, cutting staff training time and ensuring better integration with the broader internal and external community involved in recovering from a disaster.

Key Benefits of an Incident Management System

A cloud-based incident management system acts as a virtual command center that connects your people, plans and resources to resolve unplanned events more effectively. Key features include:

� Real-time incident log � Team and individual task checklists � Integrated emergency notification � Version-controlled resource library � Electronic forms management � Dashboard with color-coded visual indicators � Ability to attach any type of file to log entries � Command sub-rooms for different groups � Customizable templates � Automatic time-stamped audit log � Advanced mobile application capabilities � Integration toolkit

Many companies rely on everyday tools like email, voicemail and Excel spreadsheets to communicate and project manage disruptive events. Unfortunately, these systems weren’t built for critical incident management and often make navigating the rough waters of an unplanned event more difficult than it has to be. Incident management systems speed BCM team access to information facilitating faster decision-making, communications, response and recovery.

Intelligent Emergency Notification

Approximately 55% of business continuity teams are armed with some sort of emergency notification solution to deliver crisis communications to BCM team members, employees and other constituents. While there are many mass notification systems on the market today, there are wide differences in feature sets, pricing and customer support.

Gartner predicts mainstream adoption of incident management systems by 2019

Arm your BCM team with the tools they need for success



16

For both emergency notification and incident management systems simplicity is critical. While these systems must be robust, they must be equally easy to use because they are deployed during crisis situations.

In addition, typically these tools are accessed by many individ-uals within a company and therefore cannot require extensive training to operate.

Look for a system that includes features such as recorded voice alerts, intelligent automation such as the ability to send different messages to different devices in the same alert and flexible recipient response tracking. Intelligent automation adapts to changing situations and fits your current work processes. Advantages include:

� Straightforward and simple to use � Enables anytime, anywhere communications � Smart automation for personalized message delivery � Escalates alerts across devices � GIS mapping for location-specific alerts � Recorded voice alerts or text-to-speech � Multiple ways for recipients to respond � Real-time status of receipt confirmation and feedback � One-touch connection to a conference call � API integration toolkit

Make sure your system has the mobile capabilities you need such as rich two-way messaging via forms, expanded text functionality, photos and document delivery across any smart device to ensure timely field communications in the event of a crisis.



17

Case Study: BCM Efficiency with Better Tools, Birmingham Airport

Challenge: Birmingham Airport needed to consolidate and downsize emergency response teams across the opera-tion and wanted to transition from a paper-based logging system to improve efficiency and visibility to operational reports.

Approach: Many different employees across three shifts per day need to use the system to both log information and review project status. They needed a solution that was easy to use and required minimal staff training or process changes. They selected MissionMode’s Situation Center™ and were able to deploy the solution system wide in just two weeks. Time- and date-stamped operational log entries are particularly useful for regulatory compliance and the fact that all important information is accessible on the system dashboard reduces required briefing time during shift changes and allows management to stay informed anytime/anywhere.

Metrics and Measurement—The “Fifth” T In the world of Six Sigma they say, “What you measure is what you get”. The same is true for the world of business continuity. BCM programs that systematically track and report on key performance indicators reach maturity faster.

Not every metric tracked has to be quantitative. In fact, the five most commonly tracked BCM metrics include a combination of qualitative and quantitative measures:

� Completion of test exercises � Incident response performance � Completion of written objectives � Awareness generation; creating a business continuity

culture � Operational performance (SLAs)

What you measure is what you get



18

Despite the importance of tracking program success and the relationship between BCM reporting program maturity, according to a 2013 survey completed by Continuity Central, nearly half of all BCM programs are not actively tracking any KPIs.

If you are one of those companies with no BCM dashboard in place, it doesn’t take that much to make a difference. Focus on a small number of meaningful metrics and share them widely to either gain recognition for your program’s successes or create urgency for more focus and resources.

Don’t Be a StatisticYes, there are a lot of impediments to best-in-class crisis preparation, but the path to improving your organization’s business continuity program maturity is clear if you use the 4 T’s Approach to maximizing readiness. The cost of not being prepared is just too great:

� 25% of small businesses close each year due to an inability to recover from a disaster

� 180 of 350 businesses that were forced to shut down in the World Trade Center disaster never reopened their doors

By adopting the 4 T’s approach to crisis preparation, you can be sure your organization will climb the BCM maturity curve in a consistent, disciplined fashion to achieve your readiness goals faster.

Nearly 50% of companies have no BCM program metrics in place

25% of small businesses never recover from a disaster



19

About MissionModeSince 2003 MissionMode has been changing the game when it comes to crisis communications and incident management. Our emergency notification and incident management applications are easy to use when the pressure is on, yet advanced enough to be trusted during the toughest disasters. That’s why industry-leading organizations around the world depend on our web-based (SaaS) solutions to reduce response costs, boost operational efficiency, increase safety, reduce legal risks and protect lives. They also rely on us for exceptional service with a personal touch.

While a lot of companies claim to support incident manage-ment, only MissionMode provides true operational control through an end-to-end solution. MissionMode’s incident management approach goes well beyond emergency notifica-tion because in a crisis, you don’t just need to communicate the issue, you need to resolve it. MissionMode provides the tools business continuity teams need for effective crisis resolution, making managing disruptive events faster, easier and more effective. Tools that take business continuity plans off the shelf and put them at your team’s fingertips for superior operational readiness.

Contact us today to learn more or schedule a demonstration.

[email protected]

www.missionmode.com

+1 877.833.7763

+1 312.445.8811

best-in-class crisis preparation - business continuity€¦ · if business continuity management...

Documents