Few organizations have effective continuity plans

Information Management Journal, May/Jun 2003 by Swartz, Nikki

According to Meta Group research, only 20 percent of Global 2000 organizations have business continuity plans effective enough to ensure a strong likelihood that they will survive a disaster without long-lasting adverse effects.

Business continuity extends far beyond information technology (IT) disaster recovery, according to Meta's analysis. An organization's business continuity planning committee must include human resources and facilities management, as well as line-of-business executives and the chief information officer. For large organizations, executing the plan requires a team of experts from across the organization and an adequate budget.

Meta says disaster recovery should be managed as a subset of the overall business continuity program. Business continuity plans must be formulated to ensure the viability of every type of resource that the organization will need to survive a disaster, including adequate facilities, the safety and accessibility of staff members, and IT systems. Meta suggests that leaders itemize the importance of business processes and analyze: What processes must continue uninterrupted for the entire enterprise or a major business unit to survive? Which processes can stand an interruption and for how long? What alternatives or backup processes exist?

According to Meta, sound business continuity planning should begin with senior management confronting and demanding honest answers to a vital question: Is the organization prepared to withstand a major disruption? Each of the possible causes of disruption must be assessed, including the relative probability of each of these causes and the damage they could cause. To protect the company, management must allocate adequate funding to the creation, review, testing, and upgrading of continuity plans. Most important, business and IT leaders must recognize that a business continuity plan is an ongoing project, or an "insurance premium" that must be paid to protect the organization, and budget the money that is required to do just that.