Business continuity (BC) is variously described as encompassing a loosely defined set of planning, preparatory and related activities intended to ensure an organisation's critical business functions will either continue to operate in the face of disaster, or will be recovered to an operational state within a reasonably short period.
And, back in the day, establishing such a plan was a major headache, requiring dedicated leased lines to remote facilities that were either shared with other organisations or owned outright. It was also expensive. But that was before cloud. Today, such services are easily accessible and comparatively reasonably priced because Internet connectivity is ubiquitous in business.
At this roundtable, we try to establish the key features of an effective BC strategy. Anton He"ydenr"ych, analyst at Africa Analysis, begins proceedings with a question for the panel: "How do you see the current status of BC? Are companies implementing BC because they want to and they see the need for it, or are they forced to implement it in some way?"
The first respondent is Brian Henry, MD of Caridon: "We've been watching this closely and there seems to be more of an adoption of BCM (business continuity management), not because people want to, but because they're afraid they have to.
"You find that banks and the financial services industry, because of regulations, tend to take this more seriously, but there's still a lack of the understanding that business continuity is a management system that needs to be implemented; it's not something that's necessarily anything to do with IT," he adds.
Christelle Hicklin, customer experience director at Mimecast, agrees. "Everyone thinks of buying a generator in case the lights go out, but they don't think of ensuring people can continue to work."
Not an IT problem
Increasingly, she elaborates, the awareness is getting through to customers that having a BC strategy is not just an IT problem but a business problem. "They can't just give it to some guy in IT to run. They actually have to put a budget behind it, they have to plan it and they have to build a business case for it: what is it going to cost if the systems are down versus what it's going to cost if there is a BC plan (in place)," adds Hicklin.
Greg Comline, GM of Global Continuity SA, reports that he's seeing renewed interest in businesses owning a BC strategy and business testing, and evaluating the way it's implemented. Nevertheless, he wonders if such BC plans go far enough.
"It's fine to have a business interruption event just a couple of days' long; most companies will probably survive that. It's when you get into week two to six, or even longer, where they start to see that it's not only just the systems they use, it's communication within the business, and they lose out on that when a business interruption event occurs," says Comline.
Everyone thinks of buying a generator in case the lights go out, but they don't think of ensuring people can continue to work.
Christelle Hicklin, customer experience director, Mimecast.
Furthermore, he suggests it's a fallacy that SA doesn't experience such events. "Look at the recent strike affecting the metals and engineering sector. In SA, we're seeing anomalies you don't see internationally: cable theft, strikes, telephony systems failing, electricity outages," he continues.
Mariana Kruger, head of the integrated technology services division at IBM South Africa, notes these sorts of events happen more often than people realise. "If I just look at the types of recovery we've had over the last 18 months, there's been lightning, fire, flooding and strikes," she adds.
Unnatural disasters
"In SA, we don't have the natural disasters they have in Australia and in the US. We have different types of disaster," says Kruger. At the same time, she contends that some customers are better equipped to handle such events than others.
Pradeep Roy, senior infrastructure architect for Accenture SA, believes the effects of disaster are more pronounced than they once were because of increased reliance on ICT. "Your business process, your supply chain, is not measured now in days, it's measured in hours, and potentially minutes," he says.
Glen Khan, IT executive, risk and management at UCS Solutions, contends that over the last 18 months, the local market has seen a lot of focus on business continuity.
Ewan Shannon, technology lead for DHL South Africa, echoes that sentiment, noting as a supply chain business, DHL has to deliver stuff at the right time. If we don't, our customers could lose their brand in the country, he says.
Shannon also makes the point that customers in emerging markets purchasing goods on the Internet expect to receive their orders as quickly as their peers in developed countries would. "So we're having to build resilience in our supply chain. Not just the IT component, the entire business is adopting this model. And it's essential for survival if you operate in emerging markets, that you have this BCM before you attack those markets," he insists.
Ayanda Dlamini, business development manager for LGR Telecommunications, makes the point that BC strategies are no longer a choice but rapidly becoming mandatory as regulation increases. However, he says few customers see cloud as a silver bullet for BC.
Security has been an issue, as has loss of control. But dealing with strategic business people, the benefits of the cloud are more accepted, he adds.
Testing is king
Bradley Janse van Rensburg, CTO at ContinuitySA, warns against simply assuming all service providers are as resilient as they would have you believe. He advises investigating thoroughly their ability to deliver the services required of them.
This, he adds, is best accomplished with regular and extensive testing of fail-over systems and applications. "You need to know how often they test, how much, how recoverable they are, and how resilient they are."
Depending on the maturity of your infrastructure and your applications, you might need different solutions for different areas.
Mariana Kruger, head of integrated technology services division, IBM SA
Khan suggests resilience and continuity should be included in the business principles of any company. "If you have resilience as a philosophy in the company, all your procurements will ensure that you have resilience in the equipment you buy, in the processes you run, whatever you do in your company," he says.
Brendan Haskins, CTO and co-founder of Cloud on Demand, insists BCM isn't just about technology and that there's a lot of mystery around how it's implemented. "There are a lot of big words and people are scared of that. People are also scared of the financial element, because it is very expensive - or perceived as very expensive," he says.
He suggests the need for BC creates an opportunity for technology resellers to step away from their typical business and move into a consultative role, tying the technologies of various vendors together and presenting them as a bundle to a business. "The problem with BC is how it is executed," he opines.
Brendan Widlake, business development executive at Stratus Technologies, returns to an earlier point about emerging markets, noting that customers on the continent seem better prepared for dealing with continuity situations because they're accustomed to dealing with infrastructure challenges.
"And when you talk to them about moving forward onto the next step, they're ready in some instances to leapfrog technology because they don't have legacy technology to consider.
More insight
Accenture's Roy makes the point that an effective cloud-based BCM plan requires the correct technology stack, which is to say one that can enable fast and efficient recovery from the cloud.
Then Shannon notes that DHL's BC strategy is actually its business strategy. "We've had a global strategy for the last five years, that says that by 2015, we have to be completely resilient in everything we do," he says.
Kruger insists that, like many other areas of ICT, his is one in which one size definitely does not fit all. "Depending on the maturity of your infrastructure and your applications, you might need different solutions for different areas," she elaborates.
"Many of our customers locally have this false sense of security, thinking that if they mirror everything, they're fine. That's not the case, because you need to look at the full end-to-end picture to really understand whether you've got a full recovery model or not," she adds.
Hicklin contends that continuity has to be owned by someone in the business and somebody has to drive it, build the business case and show the financial value behind that. She also notes that companies need to be careful about putting all their eggs in one continuity basket. "You're not going to buy (electricity) redundancy from Eskom," she jokes.
Dlamini suggests that business doesn't always fully appreciate and understand the impact of downtime, data loss or losing operational capacity. "Not only in monetary terms, but also in terms of image," he adds.
Shannon insists that effective BCM need not cost the earth. "You have to understand which areas are critical, where you make or lose money... and those hot spots must be switched on and protected," he says.
Henry agrees and advocates doing a business impact and risk assessment in order to fully understand these dynamics.
The close
In one last spin around the table, the participants offer their final thoughts on BCM, and their recommendations to organisations evaluating their strategies. IBM's Kruger suggests companies make use of the latest technologies and offerings available, such as cloud, which she insists will mitigate the cost.
Shannon says choice of correct partners is critical. "You are a single point of failure yourself, within your own organisation, so make sure you choose the right partners. They need to have a similar mindset to you, and use ICT companies that have solutions and resilience around their own networks and have proven track records," he adds.
Widlake says it's crucial for IT and business to work in concert and communicate regularly. "Try to use always-on technology, resilient technology, instead of recovering from a failure. Try to avoid the failure in the first place," he suggests.
Dlamini advises identifying the key pain points and then incorporating BCM. He adds that it's also necessary to revisit those plans across the board every time a new implementation is delivered.
Khan echoes previous comments by recommending a business impact analysis and a risk assessment to know the full effect of outage to the business. "The main thing is to understand your business, know what's important and how long you can afford it to be down," he says.
Hicklin agrees and cautions against knee-jerk reactions based on fear. She suggests an audit to identify critical systems and processes that cannot fail, with a strong focus on those elements that face the customer. She also advises using trusted vendors and constant testing to ensure the plan doesn't need revision, because when disaster strikes, it's too late.
Not an expense
Haskins believes it's important that businesses understand that BCM isn't some product on a shelf; it's a business process that has to be implemented, and it's not only about technology.
"It also shouldn't be considered an expense," he adds, "but rather an improvement in the ability of the business. The technologies that help with BC aren't something only for that purpose; they very often add value to the business. It also doesn't have to be scary and it doesn't have to be pricey," he insists.
Roy brings the discussion back to cloud by stating that cloud reduces the cost as a barrier to entry to do proper BCM. It's up to 80% cheaper in certain cases, he confirms, but the critical point is not cost but how quickly the business can recover from disaster.
Comline insists that testing is crucial, as is having a well-structured BCM programme, but he notes also that all of the above must maintain a level of simplicity. "You have to understand that this needs to run business operations and you need anyone to be able to co-ordinate it as effectively as possible," he says.
Janse van Rensburg believes BCM needs to be entrenched in the culture of the organisation. "You have to acknowledge it's not just a once-off event. It's part of how we do business and it's not acceptable to run a risky business, just as it's not acceptable to drive without a seatbelt," he illustrates.
Henry agrees and concludes the session by noting the underlying requirements to effective BCM are to understand the business, the risks to the business, how to mitigate those risks and how to exploit the positive risks that emerge. "If you get that right, you're running a business that is going to grow."
Share