key metrics for disaster recovery and business continuity
DESCRIPTION
A metrics-driven approach to Business Continuity can determine the success or failure of your BCM initiative. This presentation will arm you with the basics needed to determine the best ones for your business. How do you measure the performance of your Disaster Recovery and Business Continuity program? What are the key indicators that you can use to tell what needs to be improved? Are there any early signs of success or failure you should be aware? In this session you will learn: - How key performance indicators impact your DR plans - Best practices for identifying KPIs - The importance of Key Risk IndicatorsTRANSCRIPT
![Page 1: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/1.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Paul F Kirvan, CISA, FBCIIndependent BC/DR Consultant
Member of the Board and SecretaryThe Business Continuity Institute USA Chapter
Key Metrics for Disaster Recovery and Business Continuity
![Page 2: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/2.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Watch The Recorded Online Session
Watch the recorded online session in our BrightTalk channel!Go to www.brighttalk.com and search for Axcient.
![Page 3: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/3.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Agenda
1. Introduction
2. Key Performance Indicators
3. Key Risk Indicators
4. Roles of KPI and KRI in BC/DR
5. Mistakes and Pitfalls to Avoid
6. Next Steps
7. Summary
8. Q&A
![Page 4: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/4.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Introduction
•Business continuity and disaster recovery are all about metrics
•This session discusses two metricsKey Performance IndicatorsKey Risk Indicators
•… and their roles in DR and BC
![Page 5: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/5.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Quick PollDo you currently use any specific performance and/or risk metrics?
a. Yes, we use KPI and/or KRI at my company
b. Maybe, and we need to address them more closely
c. No, but would like to investigate their use further
d. No, and have no plans to use them
![Page 6: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/6.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
![Page 7: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/7.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
A key performance indicator (KPI) is a measure of performance, or how well specific outcomes are achieved based on pre-defined processes and procedures
A key performance indicator (KPI) is a measure of performance, or how well specific outcomes are achieved based on pre-defined processes and procedures
![Page 8: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/8.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
KPIs help an organization define and evaluate how successful it is, typically in terms of making progress towards long-term organizational and business goals
"What is really important to our stakeholders?"
![Page 9: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/9.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
PRESCRIBE
MEASURE
MONITOR
Key Performance Indicators
How KPIs can be used:
Measure the results
IDENTIFY
Monitor and analyze KPIs to assess the current state of the business and/or technology
Identify corrections that ought to be made
Prescribe a course of action
![Page 10: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/10.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
Frequently used to "value" difficult-to- measure activities:
Benefits of Leadership Development
Quality of Service (inside and outside)
Customer Satisfaction
![Page 11: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/11.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
Key environments for identifying KPIs are:
• Having pre-defined business processes
• Requirements for those business processes
• Quantitative/qualitative measurement of the results and comparison with established goals
• Identifying variances and adjusting processes and/or resources to achieve short-term goals
![Page 12: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/12.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Performance Indicators
BC and DR performance indicators:
Recovery Time Objective
Recovery Point Objective
Service Level Agreements
Operational Level Agreements
Frequency of BCM exercises
Others …?
![Page 13: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/13.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
![Page 14: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/14.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
Management measure that indicates how risky an activity is
Provide early warning to identify potential events that may disrupt the activity/project
Key components of operational risk analyses
![Page 15: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/15.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
Differ from key performance indicators (KPI) in that KPIs measure how well something is being done while KRIs are indicators of the possibility of future adverse impacts
Differ from key performance indicators (KPI) in that KPIs measure how well something is being done while KRIs are indicators of the possibility of future adverse impacts
![Page 16: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/16.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
Example of a Risk Indicator:
• As customer complaints increase, this could mean operational mistakes and errors of judgment are being made
• Changes in the value of this indicator could indicate changes in operational risk exposure or operational loss experience
Number of Customer Complaints
![Page 17: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/17.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
Example of a Risk Indicator:
• If the number and severity of storms, e.g., hurricanes, tornados, grows during typical storm seasons, this could increase the chances of damage to the building, employee injuries and/or loss of power
• Changes in the value of this indicator could indicate potential operational losses
Frequency and Severity of Storms
![Page 18: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/18.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Key Risk Indicators
Example of a Risk Indicator:
• If the company’s stock price drops and continues to drop that could indicate a loss of investor interest in the stock and the company
• Changes in the value of this indicator could indicate that the company needs to make major changes in its operations and/or business model
Stock Prices Dropping
![Page 19: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/19.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Roles of KPI and KRI in Disaster Recovery and Business Continuity
![Page 20: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/20.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Roles of KPI and KRI in BC/DR
Key performance indicators and key risk indicators can both be used in business continuity management and disaster recovery
Their value is that they establish specific metrics for analyzing how well BC and DR programs are performing
Their value is that they establish specific metrics for analyzing how well BC and DR programs are performing
![Page 21: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/21.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Complete two (2) plan exercises annuallyComplete two (2) plan exercises annually
Roles of KPI and KRI in BC/DRExamples of KPIs for BC/DR:
Update all BIAs annuallyUpdate all BIAs annually
Update all risk assessments annuallyUpdate all risk assessments annually
Review/reconfirm roles and responsibilities for BC/DR/emergency teams quarterly
Review/reconfirm roles and responsibilities for BC/DR/emergency teams quarterly
Confirm alignment of contact lists with HR databases on a bi-monthly basis
Confirm alignment of contact lists with HR databases on a bi-monthly basis
11
22
33
44
55
![Page 22: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/22.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Review/audit all BC and DR plans annuallyReview/audit all BC and DR plans annually
What KPIs are you using in your programs?
Roles of KPI and KRI in BC/DRExamples of KPIs for BC/DR (cont’d):
66
Conduct training for all BC and DR team members twice annuallyConduct training for all BC and DR team members twice annually77
Conduct a senior management briefing on BC and DR activities annually
Conduct a senior management briefing on BC and DR activities annually88
Conduct employee awareness briefings quarterlyConduct employee awareness briefings quarterly99
![Page 23: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/23.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Roles of KPI and KRI in BC/DRExamples of KRIs for BC/DR:
Delays in completing exercises based on exercise schedulesDelays in completing exercises based on exercise schedules11
Delays in completing RAs and BIAs on scheduleDelays in completing RAs and BIAs on schedule22
Inability to complete training for emergency team membersInability to complete training for emergency team members33Delays in completing updates to BC and DR plans and related
documentationDelays in completing updates to BC and DR plans and related
documentation44
Major highway construction that could result in damage to infrastructure services, e.g., commercial power, communications
Major highway construction that could result in damage to infrastructure services, e.g., commercial power, communications55
Reports by the Centers for Disease Control (CDC) about a flu outbreak that is spreading
Reports by the Centers for Disease Control (CDC) about a flu outbreak that is spreading66
What KRIs are you using in your programs?
![Page 24: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/24.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Roles of KPI and KRI in BC/DR
How can you use KPI/KRI?
Organize KPI/KRI measurement criteria into indexes that measure organizational risks:
•Business Continuity Index - Track vulnerability and criticality of processes, quality of BC and DR plans and the frequency and adequacy of practices and tests
•Information Technology Index - Track availability and performance of technology at critical time periods for critical business purposes
![Page 25: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/25.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
When defining KPIs, identify how well specific activities should occur and/or be executed, as well as other specific performance metrics
Use KPIs to identify opportunities for performance improvement
Roles of KPI and KRI in BC/DR
Focus KPIs on what specific BC and DR activities should be performed, when they should be completed, how well they are executed
![Page 26: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/26.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Identify where a material loss has actually occurred or could occur
Roles of KPI and KRI in BC/DRWhen defining KRIs, for example, identify areas of highest risk for specific business units or the entire organization
Focus KRI analyses on processes / functions within each business unit as well as the entire organization
Consider how they work and where risks exist that threaten their operation
![Page 27: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/27.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Roles of KPI and KRI in BC/DR
Consider setting ranges of indicator value that call for specific actions:
Low-risk range: no action required
Medium-risk range: some action required
High-risk range: escalate issue to management; launch other actions to mitigate damage
![Page 28: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/28.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Mistakes and Pitfalls to Avoid(the not-so-obvious things)
![Page 29: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/29.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Mistakes and Pitfalls to Avoid
No senior management or audit support
No budget (i.e., no activity)
Lack of upfront research (e.g., risk/performance metrics, experience by other organizations)
Lack of documentation (e.g., assume resources are available)
No step-by-step procedures for implementing a KPI/KRI initiative (assume you know what to do)
No follow-up after the initiative launched (e.g., was the anticipated value achieved?)
![Page 30: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/30.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Next Steps
![Page 31: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/31.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Next Steps
• Determine how KPIs and KRIs can add value to your existing business continuity and disaster recovery programs
• Identify situations where these metrics and others may be useful
• Review the use of these metrics with management (and the audit department) to ensure their use is acceptable
• Begin defining relevant metrics and create indexes and reports on BC and DR risks and performance
![Page 32: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/32.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Next Steps
• Develop a plan for implementing the metrics in your BC and DR program efforts
• Integrate KRIs with risk management activities
• Integrate KPIs with program management activities
• Use results from KPI/KRI initiatives to identify opportunities for program improvement and improved risk management
![Page 33: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/33.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Summary
![Page 34: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/34.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Summary
We hope you can now see how metrics such as KPIs and KRIs may add value to your BC and DR programs
From BC and DR views, KRIs and KPIs can be used to set thresholds and escalation triggers for responding to out-of-normal conditions; they can also be used to establish and measure program performance levels
![Page 35: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/35.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
Summary
KRI/KPI thresholds will vary across organizations, and will depend on management’s risk appetite and performance expectations
Use these and other metrics to reinforce the value of BC and DR to management
Thank you!
![Page 36: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/36.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
About AxcientLeader in Recovery-as-a-Service
One SaaS Platform
Backup DisasterRecovery
BusinessContinuity
WAN Optimization
Dedupe
vs.
Rapid RecoveryPhysical & Virtual Application
ContinuityCloud
VirtualizationTrue Cloud
Platform
![Page 37: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/37.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
About the BCI
The Leading Institute for Business Continuity Professionals
• Founded in 1994 – the 20th anniversary
• Currently over 8000+ members in 100+ countries
• Provides an international certification scheme – based on recognized standards of competence
• Provides a broad range of educational programs and thought leadership activities across all aspects of the profession
• Provides a continuous professional development process to encourage personal growth and development
• Respected, established Institute – MBCI is a leading global standard for professional accreditation
• USA Chapter launched in 2008; over 900 members
www.thebci.org
![Page 38: Key Metrics for Disaster Recovery and Business Continuity](https://reader034.vdocuments.site/reader034/viewer/2022052504/54b3d4ef4a795991608b45fd/html5/thumbnails/38.jpg)
Copyright © 2014 Axcient, Inc. All Rights Reserved.
For more information, visit axcient.com or call 800 715.2339
@Axcient linkedin.com/company/axcient
axcient.com/fac
ebook
Paul Kirvan, CISA, FBCI
Phone (908) 902-2586
Email [email protected]