Fujitsu s Business Continuity Plan Development Methodology

Transcription

1 Fujitsu s Continuity Plan Development Methodology V Takeshi Ito V Hideaki Orikasa V Tetsuya Yoshida (Manuscript received November 7, 2006) In today s high-risk business environments, more and more companies are focusing on the Continuity Plan (BCP) as a management methodology for improving their ability to respond to any contingency. However, BCP development methodologies suitable for the business environment of Japanese companies have not progressed much beyond the theoretical stage, and the persons in charge of BCP development in companies have been struggling with this issue. Fujitsu has developed a practical methodology and software tool called BCEXPERT to streamline development of its own BCPs for business formations within the Fujitsu Group. This paper describes Fujitsu s BCP development methodology that has been standardized as the Fujitsu Continuity Management Model. This methodology mainly consists of three steps: 1) structuring business processes and resources required for the processes, 2) extracting essential resources for business ; and 3) analyzing the business impact of assumed resource damages in various risk scenarios. This methodology can be applied not only to BCP development but also to business resource optimization. 1. Introduction methodology can be made more practical and The persons in charge of risk management efficient based on the business conditions of in Japanese companies have been talking more about the concepts of the Continuity Plan (BCP) and Continuity Management (BCM) since the September 11 terrorist attacks in However, while the risk environments surrounding companies have become increasing- ly severe over the past five years, BCP remains a key concept that managers often hear about but The purpose of a BCP is to allow critical busido not fully understand. Moreover, various re- quests for responses to the internal control required by the soon-to-be-enforced Japanese SOX act, information security, the environment, privacy, and other management issues have yet to be addressed, and many persons in charge of risk management regard the need for BCP develop- ment as yet another burden to shoulder. This paper describes how BCP development Japanese companies by making use of Fujitsu s experience of BCP development. The methodolo gy will help reduce the burdens of the persons in charge of risk management in these companies. 2. What is a BCP? Fujitsu defines a BCP as follows: ness activities to continue when an unexpected situation such as a large-scale disaster occurs. A BCP is an action for achieving the goals of business (recovery time objectives for critical business activities) determined based on the analysis of the management environment, business structure, and risk environment. In BCP development, only analyses such as the analysis of the business impact tend to draw 168 FUJITSU Sci. Tech. J., 43,2,p (April 2007)

2 attention. However, the final purpose is basically to develop an effective action that specifies the items to be handled, the people who will handle them, and the deadlines to be met in an emergency. Fujitsu s BCP consists of an emergency action and the analysis of business requirements based on the analysis data that supports the action development. 3. Change in business environment The risk environment surrounding companies is becoming increasingly severe. The risks companies face include an earthquake in the northern part of Tokyo Bay or an inland earthquake in the capital; large-scale earthquakes in the eastern sea, southeastern sea, southern sea, and other areas; flooding (which is becoming an increasingly severe problem); terrorism; and a bird flu pandemic. These risks are constantly present and largely unpredictable. Because these risks are universally recognized, international standardization activities have been started to realize an adequate level of business management by The Japanese government publicized a series of guidelines for developing a BCP in 2005 that demonstrated a very proactive administrative approach for business enhancement. The guidelines are the Continuity Guidelines 1 st ed. 1) by the Cabinet Office and the BCP Development Operational Guidelines for Small and Medium Enterprises 2) by the Small and Medium Enterprise Agency. Also, the Continuity Advancement Organization (BCAO) 3) was established in June 2006 and has been actively promoting business since July. This is the first registered non-profit corporation in Japan aimed at promoting BCP standardization and fostering BCP specialists. A serious problem that needs to be addressed by companies is that BCP development is becoming mandatory. The growing international recognition of the need for business enhancement has emerged as a request to improve the business capabilities of business partners in the business-to-business transactions that secure the global supply chain. More and more companies check for the presence or absence of BCP development by suppliers before starting a transaction. Particularly, most European and American companies strongly recognize the risk of business in Japanese companies due to the threat of large earthquakes. BCP development is needed not only for ensuring business during a disaster but also during everyday operation. Despite the rapid changes in our environment, only 7.9% (23% including the companies who have just started to introduce BCP) of domestic companies have developed a BCP (Figure 1). 4) This figure is much lower than the 33% 44% 15% 7.9% We have no disaster prevention. We have a disaster prevention focusing on emergency, e.g., evacuation, confirmation of safety. We have developed a disaster prevention including emergency and launched BCP. We have developed a disaster prevention including BCP. Source: Development Bank of Japan: Special Survey Concerning Companies Approaches to Disaster Prevention (Chart 2-1 Development situation of disaster prevention and business [BCP]) 4) Figure 1 BCP development situation in domestic industries (November 2005). FUJITSU Sci. Tech. J., 43,2,(April 2007) 169

3 47% figure determined by the Continuity Institute 5) for major overseas companies. The Central Disaster Prevention Council wants all of Japan s major companies and more than 50% of the country s small and medium companies to develop a BCP within 10 years. 6) To attain this goal, further supportive activities based on public-private partnerships will be necessary as well as improved management awareness. 4. Fujitsu s Continuity Management Fujitsu is an information system vendor that plays a major role in the social infrastructure and also a manufacturer participating in the global supply chain. In keeping with these roles, since its establishment, Fujitsu has developed disaster prevention and emergency response s and conducted various training to prepare for emergency situations. Moreover, in 2004, a company-wide BCP development project was set up, and in 2005, a specialized organization was established to develop BCPs and enhance business throughout the Fujitsu Group. Fujitsu has a variety of business operations with different business environments, structures, bases, and management resources. To develop a BCP for each operation, company-wide business management has been implemented in three layers: management, a specialized organization for business, and the business unit (Figure 2). The specialized organization for BCP development plays a key role in this system. This expert group consists of Fujitsu staff having special skills in, for example, disaster prevention, procurement, information system operation, consulting, system development, and outsourcing. The organization for BCP development has also developed various tools and software products to make BCP development and maintenance efficient. Management architecture Function Document Management (management conference) Developing eloping and controlling basic policy for business Determines basic principles. Determines promotion system and control method. Approves group BCP. Approves amount invested for. Overall control basic policy Organization in charge of business unit Specialized organization unit Developing and supporting operation of BCP Developing, operating, and improving BCP unit unit Develops development and operation processes and methodology. BCP template Development support (consulting and tool provision) Adjusts company-wide optimization (inter-group and company-wide) Educational development and implementation support Develops, operates, and improves prior. Develops, operates, and improves action in an emergency. Develops, operates, and improves business recovery. Develops, operates, and improves information system recovery. Develops, operates, and improves human resource training. BCP development guidelines BCP (for each unit) Figure 2 management in Fujitsu. 170 FUJITSU Sci. Tech. J., 43,2,(April 2007)

4 5. Fujitsu s BCP development methodology Fujitsu s BCP development methodology has been standardized as the Fujitsu Continuity Management Model (Figure 3). This model covers the phases from ning to operation. BCP development and operation management performed in accordance with this model enable visualization and standardization of an entire business process regardless of differences in the business environment and structure. This model consists of the following six phases: 5.1 BCP system development (Phase I) This phase develops collaborative projects between the specialized organization for BCP development and the target business operation. 5.2 Analysis of business requirements (Phase II) This phase structures the current business processes and resources and sets a goal for business. Figure 4 shows the flow of business requirement analysis. 1) Collect and analyze information required for BCP development (research of the business environment and structure) (q). 2) Based on the information collected by interviews and questionnaires, analyze the impact of business interruption ( Impact Analysis) (w). 3) Based on the analysis results, determine the Recovery Time Objective (RTO) (e). 4) Analyze the business processes, resources that support the processes (people, facilities, information systems, etc.), and physical resource assignment to create a structured influence diagram (Figure 5) (r). The influence diagram clarifies the conditions for implementing business using the structured business processes and resources. 5) Analyze the risk environment surrounding the business to make assumptions about the risk factors and risk occurrence status. Although the possibility of an earthquake is often considered in risk analysis, it is important to study a wide range of situations that Phase I Phase II Phase III Phase IV Phase V Phase VI BCM system development Analysis of business requirements Development of business strategies Development of business Implementation of business Evaluation and improvement Setting up BCM enhancement Approving executives Developing promotion system BCM enhancement Collecting basic information Impact Analysis Analyzing resources of critical business process Risk analysis Extracting critical resources of critical process Extracting options Considering return on investment Developing Determining business strategies strategies BCP Awareness and training Developing BCM Testing items and approval Manual checklist Preventive Redundancy Spare Alternative Test and reflection in BCP Education Training Evaluating training results Extracting improved items Reviewing business environment Reflection in and Evaluation improvement report Project implementation (WBS) requirements Measures management Awareness and training Manual checklist (revision) Related documents (revision) Figure 3 Fujitsu s Continuity Management Model. FUJITSU Sci. Tech. J., 43,2,(April 2007) 171

5 q environment research w Impact Analysis at suspension edetermining Recovery Time Objective (RTO) trisk analysis yassuming resource damage at risk igap analysis Measures examination q structure research rmodelling process resource relationship (influence diagram) u damage at risk (time for recovery to current status) Figure 4 Flow of business requirement analysis. B6 Board production B2 供 給 能 力 の 確 保 凡 例 :ボックス 種 別 の 説 明 最 終 目 標 中 間 目 標 リソース 間 接 評 価 リソース 依 存 関 係 の 方 向 要 員 ( 別 モデル 化 ) ページ 間 のリンク *ボックス 内 記 法 ID ボックス 内 容 の 記 述 ID: 識 別 子 B*: 目 標 指 標 M*: 機 能 指 標 R*:リソース B3 生 産 工 場 での 生 産 台 数 の 確 保 B5 製 品 生 産 と 品 質 M6-1 Activation of board production environment B8 YY unit production Exatory note: Exation of box types Final goal Intermediate goal B12 生 産 オペレーション ( 生 産 工 場 ) 要 員 参 集 モデル R31 要 員 ( 生 産 オペ ( 生 産 工 場 )) Resource Indirect evaluation resource R32 生 産 管 理 データ (XXセンター) Personnel (separate modeling) R25 納 品 出 荷 伝 票 Linkage between pages Direction of dependence R06 電 力 B5 ー 2 生 産 管 理 システム B6 基 板 製 造 * Notation in box Description of ID box ID: Identifier B*: Objective indicator M*: Functional indicator R*: Resource B21 物 流 管 理 ( 本 社 ) 物 流 管 理 部 門 ) 製 造 等 (YYユニット 製 造 ) B13 部 材 購 買 ( 本 社 ) 調 達 部 門 ) 要 員 参 集 モデル R64 指 導 員 (YY ユニット 製 造 ) R21 ライン 要 員 (YY ユニット 製 造 ) R63 クリーンルーム (YY ユニット 製 造 ) B9 部 材 調 達 ( 生 産 工 場 ) M9 1 部 材 供 給 ルート B9 1 サプライヤ 部 材 直 接 納 品 Personnel collection model R10 Instructor (board production) R08 Line personnel (board production) R06 Electricity R61 Air conditioning B6-2 Drawing control system B6-4 Information system B R12 (Special equipment) Production line R13 (Special equipment) Tuning device R22 Stock amount (YY unit production relation) R06 Electricity R07 Pure water R61 Air conditioning B8-1 Information system E R17 (Special equipment) YY unit production control R68 Nitrogen R19 YY unit production line. Cleaning equipment, etc. (YY unit production) 要 員 参 集 モデル B18 生 産 オペレーション ( 本 社 ) 生 産 管 理 部 門 ) R53 要 員 ( 生 産 オペ ( 生 産 管 理 部 門 )) B5 2 生 産 管 理 システム R3 社 内 ネット(WAN) R57 生 産 管 理 データ (XXセンター) 要 員 参 集 モデル R40 要 員 ( 物 流 管 理 ( 物 流 管 理 部 門 ) R41 生 産 製 品 引 当 管 理 システム (XXセンター) R36 ( 情 報 システム) 物 流 オーダー 管 理 システム (XXセンター) B5 2 生 産 管 理 システム R3 社 内 ネット(WAN) 要 員 参 集 モデル R28 要 員 ( 部 材 購 買 ( 調 達 部 門 ) R29( 情 報 システム) 購 買 管 理 システム (XXセンター) R30( 情 報 システム) 部 材 管 理 システム (YYセンター) R35( 情 報 システム) 在 庫 管 理 システム (XXセンター R3 社 内 ネットワーク (WAN) B9 4 調 達 部 門 経 由 部 材 R39 サプライヤ 部 材 ( 関 連 会 社 ) R27 サプライヤ 部 材 (その 他 供 給 会 社 ) Figure 5 Influence diagram. 172 FUJITSU Sci. Tech. J., 43,2,(April 2007)

6 can occur. For example, a bird flu pandemic would leave buildings and equipment undamaged but would incapacitate an estimated 40% of the population. This situation clearly differs from that of an earthquake and consequently requires different counter. While it is a waste of time to think of unrealistic situations, it is important to look beyond the obvious risks to business (t). 6) Based on the above risk analysis, apply the situation (resource damage) to the influence diagram (y). 7) Based on the resource damage, determine how much damage the current business will suffer (time for recovery to current status). Also, identify the critical resource that will have the largest impact on the stop time (u). 8) Achieve the goal of BCP, which is to bridge the gap between the present recovery time and the RTO that has already been specified (i). 5.3 Development of business strategies (Phase III) This phase determines and strategies for attaining the above-mentioned goal of BCP. There is an inverse relationship between the amount invested in the for business and the effects they produce. If it were assumed an earthquake would make a critical production base unusable, it would be better to build a t having the same production capability elsewhere in advance. An information system can be made continuously available simply by building a second or even a third information center. However, for many companies, these are prohibitively expensive. This phase determines the optimum balance between the improved responsiveness to an unexpected situation and the investment amount and also determines the and business method to be employed in an emergency. To achieve these goals, the return on investment in the business enhancement investment must be visualized to support management decision-making. Figure 6 shows a matrix chart of the return on investment. Based on this matrix, priority will be given to with lower investment and higher effect. A measure with a higher investment and effect (construction of a second t, dual information system centers, etc.) will be addressed as a medium-term to long-term management challenge at the management s discretion. 5.4 Development of business (Phase IV) This phase creates a practical action based on the business strategies. The action consists of an implementation of various, an education and training, and an emergency action. The most significant of these is the action emergency, which must be optimized so that the persons in charge will rapidly and steadily perform their roles. This should be in the form of a concise manual or checklist that clarifies the individual roles and contains only the required information. 5.5 Implementation of business (Phase V) This phase implements the specified in the action. The include employee education and the fostering of specialists as well as for physical resources (i.e., preventive, redundancy, spare, and alternative ). 5.6 Evaluation and improvement (Phase VI) This phase performs yearly training in accordance with the developed BCP and updates the BCP every year after a review of the business requirements based on the changes in the business environment. This phase is the most important phase for keeping the BCP effective at all times. To reduce the load on the continuous FUJITSU Sci. Tech. J., 43,2,(April 2007) 173

7 Determining the direction of measure options based on return on investment matrix Measure effect Minor Medium Major Construction of second t Installation of private electric generator Outside of examination Addition of alternative production line Anti-seismic reinforcement Inventory building Decentralization of suppliers Mid- and long-term Remote backup of vital records Contract of alternative office Development of personnel participation at disaster Installation of safety confirmation system Development of SLA with outsourcing supplier Short-term Major Medium Minor Range of costs invested for Figure 6 Concept of examination (example for manufacturing industry). improvement activities, in addition to keeping the BCP up-to-date, it is also important to pursue BCP document composition with easy maintenance and efficient updating. 6. Tool for promoting BCP development efficiency Fujitsu uses the BCEXPERT software tool to promote standardization and efficiency of BCP development and updating operations (Figure 7). BCEXPERT provides standard processes from BCP development ning to BCP update operation. It consists of BC-Navi, which supports project management; tools that support simulations in each process; and document template groups. The goal of BCP development is to create an effective action for continuing business in an emergency. This action is based on the results of researchers who have analyzed the business environment, business structure, risk environment, and other factors. The environment surrounding business is constantly changing, and to quickly and accurately reflect these changes in the action, a proactive approach to BCEXPERT and other software tools is essential. 7. Future issues To continuously promote business enhancement activities based on BCP development, the following issues must be addressed: 1) Visualization of activity results It is easy to understand the costs of BCP development and these activities but difficult to understand their achievements. Therefore, the continuous improvement activities are liable to lose momentum. One effective way to promote these activities is to set activity results benchmarks. These benchmarks establish standards (maturity models) for the measurement of a company s business capability and link the standards with the activities status. To create a maturity model, benchmarks regarding the approaches of advanced companies and other companies in the same industry are necessary. However, there is no accumulation of effective data in Japan. We expect that the BCAO and industry 174 FUJITSU Sci. Tech. J., 43,2,(April 2007)

8 5000_1 リスク 評 価 ワークシート 5000 リスク 分 析 5000_2 リスク 分 析 結 果 報 告 書 3000_1 プロジェクト 計 画 書 3100_1 アンケート インタビュー 設 計 参 考 資 料 6000_1 施 設 人 員 分 布 状 況 データ 7100_1 対 策 投 資 対 効 果 分 析 ワークシート START 3000 パイロット 事 業 概 況 調 査 3100 アンケート インタビュー 設 計 3200 アンケート インタビュー 実 施 4000 収 集 情 報 の 分 析 重 要 業 務 の 特 定 4100 重 要 業 務 の プロセスと リソース モデル 化 6000 ビジネス 影 響 度 分 析 7000 対 策 オプション の 抽 出 7100 事 業 維 持 戦 略 の 決 定 8000 実 施 計 画 の 策 定 と レビュー 8100 ドキュメント 作 成 (BOP-BOM 計 画 書 ) END 3000_2 事 業 内 容 調 査 結 果 3100_2 アンケート インタビュー シート 3200_1 アンケート インタビュー 集 計 表 4000_1 現 状 調 査 分 析 結 果 報 告 書 4100_1 プロセス リソース モデル 6000_2 ダメージ シナリオ 設 定 表 6000_3 ビジネス 影 響 度 分 析 結 果 報 告 書 7100_2 対 策 投 資 対 効 果 分 析 結 果 報 告 書 8100_1 パイロット 事 業 向 BOM 推 進 計 画 書 8100_2 BOP 策 定 ガイドライン 8100_3 対 策 計 画 書 8100_4 災 害 時 行 動 計 画 書 8100_5 教 育 訓 練 計 画 書 Figure 7 BCM operation support tool (BCEXPERT). groups will promptly develop these benchmarks. 2) Linkage with internal control It is important for each company to implement to ensure the level of internal control that will be required by the soon-to-be-enforced Japanese SOX act. Internal control and business have one thing in common in their implementation processes in which process-oriented examinations are made and risks are clarified and controlled. However, they differ fundamentally in their purpose and scope because internal control is intended to guarantee reliability of financial reports, while business is intended to continue critical business activities in an emergency. Essentially, it would be ideal if BCP development and continuous improvement activities were both controlled by internal control activities. However, at the moment they must be developed as separate efforts. In the future, integration between internal control and business activities will be promoted in line with the expansion of the scope of internal control. 3) enhancement in the supply chain Because Fujitsu has been developing various businesses in the global supply chain, a companyspecific BCP is unlikely to enhance business. Fujitsu will continuously review the service level agreements (SLAs) with its clients and evaluate how its business partners have developed their BCPs. 8. Conclusion Sometimes, BCP development work is described as a tunnel that has no exit because, despite the extensive research analyses and large volumes of documentation associated with BCP development, the effectiveness of a BCP cannot be demonstrated until an emergency occurs. However, from a completely different standpoint, BCP development work provides a big opportunity for management restructuring. As mentioned above, the work includes creating a relationship model between the business processes of critical business activities and required resources to analyze the impact that resource damage will have on a business. In fact, this model can be used as a simulation model to cope with changes in the management environment and optimally and FUJITSU Sci. Tech. J., 43,2,(April 2007) 175

9 promptly allocate resources. Basically, BCP development work is nothing less than an activity for getting to the core of how to continue important business activities with minimal resources even in an emergency. This activity reveals the essential framework of a business with all redundancies eliminated and allows us to review the business origins of a company. Looking at BCP development work from the viewpoint of not only the against disasters but also for management restructuring can enhance business in an emergency. It also leads to sophistication and streamlining of management activities themselves. management in Japan is still in its infancy compared to that in European countries and the US; however, this can be converted to an advantage by regarding business as a management improvement activity from the beginning. Fujitsu aims to develop a new management model to achieve sustainable management that focuses on more than just efficiency. References 1) Central Disaster Management Council, Special Board of Inquiry on enhancing disaster management by utilizing the private sector and markets, Corporate Evaluation/ Continuity Working Group, and Cabinet Office, Government of Japan: Continuity Guidelines 1 st ed. Reducing the Impact of Disasters and Improving Responses to Disasters by Japanese Companies. August 1, guideline01e.pdf 2) Small and Medium Enterprise Agency: BCP Development Operational Guidelines for the Small and Medium Enterprises. (in Japanese). 3) A Specified Non-Profit Japanese Corporation Continuity Advancement Organization (BCAO). (in Japanese). 4) Development Bank of Japan: Special Survey Concerning Companies Approaches to Disaster Prevention. (in Japanese), January, html 5) InterRisk Research Institute & Consulting, Inc.: Report of Field Survey of Japanese Companies Concerning Continuity Management (BCM). (in Japanese), October ) Central Disaster Prevention Council: Countermeasure Strategies against Disaster by Inland Earthquake in the Capital City (). (in Japanese), April 21, shiryou3-1.pdf 176 FUJITSU Sci. Tech. J., 43,2,(April 2007)

10 Takeshi Ito, Fujitsu Research Institute. Mr. Ito received the B.A. degree in Law from Ritsumeikan University, Kyoto, Japan in He joined Fujitsu Ltd., Tokyo, Japan in 1982, where he was engaged in the sales and marketing of systems integration solutions and solution services for financial institutions. In addition, he was engaged in the sales and marketing of an Application Service Provider (ASP) service business. He is currently engaged in Continuity Plan (BCP) development and consultation on Continuity Management (BCM). In 2007, he moved to Fujitsu Research Institute. He is an executive board member of the Continuity Advancement Organization (BCAO) of Japan. Tetsuya Yoshida, Fujitsu Research Institute. Mr. Yoshida received the B.A. degree in Economics from Kwansei Gakuin University, Hyogo, Japan in He joined Fujitsu Ltd., Tokyo, Japan in 1992, where he was engaged in purchasing software licenses from software vendors for more than 10 years. He is currently engaged in in-company Continuity Plan (BCP) development. In 2007, he moved to Fujitsu Research Institute. Hideaki Orikasa, Fujitsu Research Institute. Mr. Orikasa received the B.S. degree in Mechanical Engineering from the University of Tokyo, Tokyo, Japan in He joined Fujitsu Ltd., Tokyo, Japan in 1976, where he was engaged in the development of operating systems, work on systems integration, and development of IT service management methods. He is currently engaged in Continuity Plan (BCP) development and consultation on Continuity Management (BCM). In 2007, he moved to Fujitsu Research Institute. He is a member of the Information Processing Society of Japan. orikasa.hideaki@jp.fujitsu.com FUJITSU Sci. Tech. J., 43,2,(April 2007) 177