Middle East Business Continuity Survey

Transcription

1 Middle East Business Continuity Survey

2

3 contents 1. Business Continuity Survey Executive Summary Profile of Respondents Perception of Threats Actual Disruptions State of BCM Maturity Crisis Management Communication & Co-ordination with External Agency/Vendor About Business Continuity Management Acknowledgements This report has been jointly developed by ehosting DataFort, the Business Continuity Management Institute.

4 1. BUSINESS CONTINUITY SURVEY Research Objectives This research aims at studying Business Continuity Management (BCM) and Disaster Recovery trends in the Middle East Region, to assess corporate preparedness as well as the maturity levels of BCM. The following areas were investigated : Experience of organizations with business disruptions Presence and robustness of a formal business continuity plan Concerns and preparedness for the future Research Methodology A structured questionnaire was used to gather information. The questionnaire was hosted on a web site and the survey was conducted over the Internet. Middle-level and senior level managers involved in BCM of reputed organizations were requested to visit the site to provide information. 2. EXECUTIVE SUMMARY PROFILE OF RESPONDENTS 32% of the respondents were either decision makers or part of senior management. 25% of the respondents were part of the corporate level BCM team. 25% of the respondents were department representatives/members of BCM implementation team/staff who have a role to play in BCM/incident management response plans. The average work experience of respondents was 18 years, which indicates the senior nature of the sample. Of this, average work experience in BCM was 6 years, of which 3 years was the average BCM experience in the current organization. The respondents came from various industries - Banking and Finance (36%). Services (25% - retail, media/entertainment, utilities, oil and gas, transportation). IT (22%). Others (17% - Manufacturing, Telecom, and Real Estate). The wide spread of industries is heartening, and is indicative of good corporate governance, going beyond implementing BCM just to comply with regulations (as in BFSI), or just because customers are demanding it (as often is the case in services and IT industries). Respondent sample exhibits a good distribution across the entire Middle East Region. Composition by country was UAE 48% (Dubai 39%, Abu Dhabi 9%) Saudi Arabia 16% (Riyadh 14%, Jeddah 2%) Kuwait 12% Qatar 8% Jordan 5% Egypt 2% Others 9% This being the first survey, we cannot conclude at this stage that these percentages are a reflection of degree of BCM awareness or implementation. 2

5 FINDINGS BCM Program Management About 60% of respondents had a full-time or part-time head for the BCM function, while in the remaining cases BCM was simply a role being played by one of the staff, without any formal designation. Compared to this figure of 60%, 68% respondents had at least 1 BCM certified professional on their staff which seems to indicate that organizations who are serious about BCM saw BCM certification as one of the ways to enhance their credibility and knowledge, and empower the BCM team to do a competent job. This is a sign of progressive thinking and maturity. Almost 82% of respondents seemed to have a designated role in the BCM initiative. This is significant because good role definition is commonly believed to be a key success factor to the effective execution and embedding of the BCM initiative. The identified roles played by respondents were either as members of the organization s Crisis Management Team/Senior Management (32%), part of the corporate level team centrally driving the BCM initiative (25%), Department Representatives/Members of the BCM implementation team (15%), and users who have a role to play only in BCM/Incident Management response process (18%). 72% of the organizations had a business continuity policy. For a region where BCM is a relatively new concept, this is a commendable figure. Industries that these organizations come from are quite diverse, like Banks (51%), IT (15%), Services (15%), Retail (7%), Telecom (5%) and others (7%). While quite a few organizations seem to have implemented the initial Program Management elements like identifying and training resources, formulation of BCM Policy etc..., only 19% of the respondents have had robust BCM program for a few years now. 17% of respondents have now started to maintain and exercise their plans, while 10% have recently developed their BC plan. 19% of the respondents are currently developing/writing their BC Plan, while 12% of the respondents are at the decision making stage or intend to initiate a BCM program. Overall 76% of organizations were at different stages of the BCM lifecycle, while the balance 24% were still to take a decision/had no concrete plans to initiate a BCM program in the near future. Understanding the organization 61% of the respondents claimed to have created or reviewed the BIA for their critical business functions in the last 12 months. In response to the question regarding the top 3 threats posing the greatest risk of disruption to the organization, the top threats that emerged were identified to be failure of computer hardware/software and data loss (74%), Communication and network failures (59%), Power breakdowns (47%), Fire (44%), Floods, earthquakes, sandstorms and other natural disasters (21%), Computer hacking and denial of service attacks (21%), Internal Data security breaches (18%), and Terrorist attacks (12%). Surprisingly, only 3% of the respondents claimed pandemic flu as one of the top 3 threats posing the greatest risk of disruption to their organization. One explanation for this is that WHO declared the Global pandemic for the flu scenario only after this data has been collected. Even though the bird flu has been on the horizon for at least the last 2-3 years, it must be stated that of the time of this report getting published, the pandemic flu seems to have not really affected many nations in the Middle East. 3

6 Developing and implementing a BCM response Of the organizations who had BCM plans, in 24% of the cases plans were not signed off which technically makes the plan null and void, since it does not yet have the sanction, approval and validation of the management. While no data was collected on the level of complexity and comprehensiveness of the BC plans, this being highly judgmental, about 53% of respondents tend to benchmark the robustness of their plan through exercise results, 10% through audit findings, 17% through management reviews, and 20% through benchmarking to industry norms. Other techniques for benchmarking plan effectiveness involve independent audit by BCM professionals, third party assessment and external certifications such as the BS25999 certification from the British Standards Institute (BSI). An indication that the plans may not be very comprehensive is provided by the fact that around 42% of the respondents had not identified any alternate work site for employees should the office premises sometime be inaccessible. Should such an eventuality occur, these organizations may struggle to identify, negotiate for and comprehensively equip at short notice an alternate site from which to commence operations, leading to delays in resumption of critical services, and also confusion and chaos, and the risk of being branded as unprofessional organization. It is strongly advised that organizations intending to have high quality BCM programs should identify alternate recovery locations at the earliest (which could be their own or partner premises at another location, third party work area recovery services, work at home etc...). 59% of the organizations have a documented Crisis Management Plan of which only in half of the cases is the plan signed off by senior management. Thus, only about 29.5% of organizations have a signed off Crisis Management Plan, while the others either have plans in place not yet ratified by management, or have no Crisis Management plans in place at all. 97% of the respondents felt that there was lots of room for improvement in their BCM plans. Even knowing what you do not know is a sign of intellectual maturity though perhaps not of plan effectiveness maturity! Among the respondents, the average number of significant disruptions faced by them was 3.77 per year. Exercising, maintaining and reviewing BCM arrangements Exercising and testing comes out as a very weak area in general, with both frequency and range of exercises being low, as well as organization-wide participation. Merely 7% conduct an evacuation exercise at a monthly or quarterly frequency. 28% of the respondents conduct an evacuation exercise every 1-2 years which for an exercise that is designed to protect lives, is woefully inadequate especially considering that fire is one of the most common threats that occur to organizations. The low incidence of testing and exercising is even more a cause for concern since 53% of the respondents stated that they measure BCM program effectiveness through exercise results. So it appears that while many of the organizations may have comprehensive plans in place, in most cases those plans may fail as and when a real disaster occurs. The Exercising of Emergency Response/Crisis Management Plans follows an even worse pattern with merely 7% conducting the exercises at least once in 3 months, and the balance 93% conducting it more infrequently, or even never. 4

7 In terms of notification, the call tree test is used by 41% of responsents, while 89% have an automated call tree option, 37% do it via SMS, and 32% via a call in number (some organizations use multiple communications protocols, all working together). Overall, senior management participation in exercises was healthy. 65% of the respondents had their senior management participate as a team, in simulations or other exercises designed to improve their effectiveness in managing crisis situations. However, this indicates that in 35% of cases, the company senior management may be totally unprepared on how to take effective decisions and work together as a team to bring the situation under control in any disaster situation such as a fire, explosion, terrorist attack, etc... This is not a reflection on the competence of the company s senior management, who in all probability would be very competent in their day-to-day responsibilities. It is just that a typical disaster situation such as an explosion or fire can often be extremely intimidating and stressful and senior managers who have not been trained to respond to such situations may find themselves breaking down or making wrong decisions which could lead to the loss of human life, damage to the organization s physical assets and reputation, etc... It would be wise for the senior management team of such organizations to receive training in simulation/tabletop exercises on how to effectively manage threat situations such as explosions, fire, medical emergencies and pandemics, etc... About 50% of the respondents had 25% or less of their total workforce participate in BCM exercise and testing activities in the last year which is quite a low figure. Of the balance 50%, 21% of the respondents had up to 75% of their total workforce participate, and 29% had about up to 50% of their workforce participate. None of the respondents had over 75% of their total workforce participate in the same during the last one year. External Arrangements 53% of the respondents have established relationships with appropriate external agencies (police, fire, hospitals, etc...) for coordination of response activities. This is a healthy figure, and reflects a high level of partnership and operational maturity. The balance 47% may struggle to put in place the required external arrangements at short notice, if at any stage faced with a disaster. The external agencies that organizations are maintaining readiness with are the fire department, medical and emergency services and the police. 67% of the respondents have plans in place to communicate with customers, partners, employees, regulatory authorities and the public about any incidents and business continuity situations. 8% of the respondents have shared their BC plan with vendors and about 18% have specified their BC needs to the vendor. Also, 9% of the respondents have involved vendors in testing-exercising and 15% have audited/reviewed vendor BC plans. Overall, the sample seemed to display a high level of maturity, both in terms of the characteristics of the BCM program, as well as the documentation. This may not necessarily be true of the implementation. One area that was clearly weak is testing and exercising. 5

8 3. Profile of respondents 3.1 By Industry Sector 36% Banking/Finance/Insurance 25% Services 22% Information Technology 17% Others 3.2 By Designation 8% CEO/CIO/CTO 15% VP/AVP/Director 21% Head 10% Consultant/Sr. Consultant 40% Manager/AGM/GM 4% Coordinator 2% Analyst/Engineer/Specialist 3.3 By Total Experience 38% More than 20 years 16% years 21% years 20% 6-10 years 5% Up to 5 years 6

9 3.4 By BCM Experience 46% More than 5 years 6% 5 years 4% 4 years 11% 3 years 11% 2 years 22% Up to 1 years 3.5 Have Formal BCM Training or Certification 68% Yes 32% No 3.6 Respondents Role in Organization s BCM Initiative 32% Decision Maker/Senior Management 25% Corporate Level BCM Team 18% BCM Implementation Team 7% BCM/Incident Management Response 18% No direct role 7

10 4. PERCEPTION OF THREATS 4.1 Perceived Risk of Business Disruption : Top Threats 74% Failure of computer hardware/software and data loss 59% Communication and network failure 47% Power breakdown 44% Fire 21% Computer hacking and denial of service attacks 21% Floods, earthquakes and other natural disasters 18% Internal data security breaches 12% Terrorist attacks 3% Pandemic flu 3% Strikes and riots Failure of Computer hardware/software/data loss was perceived as the largest threat by 74% of respondents Communication and network failure, power breakdown, fire, computer hacking and denial of service attacks were among the top 5 threats 8

11 5. ACTUAL DISRUPTIONS 5.1 Number of Significant Business Disruptions in the Last Year Reasons of Significant Business Disruption in the last 1 year 45% IT, data, communication and network failures 20% Power failures 11% Man made disruptions (theft, hacking attempts, sabotage, bad judgment/decision making) 8% Natural disasters (like sand storm/rain/flood) 6% Denial of access to physical infrastructure 3% Economic downturn 3% Fire 3% Denial of services attack 3% Logistics 45% of the respondents stated that IT, data, communication and network failure as a reason for significant business disruptions last year Each of the respondents had at least one significant business disruption in the last 1 year 9

12 6. State of BCM maturity 6.1 Presence of BCM Head/Coordinator 36% 40% No specific individual designated as Head/ Coordinator for BCM Head/Coordinator for the BCM function (full-time) 24% Head/Coordinator for the BCM function (part-time) 6.2 Rating of the current BCP Arrangements 3% Excellent 54% Effective, but could be better 43% Lots of room for improvement A substantial portion (97%) stated that their current BCP arrangement could be better 6.3 Organizations with a Formal Business Continuity Policy 72% 7% Yes No Don t know 21% 10

13 6.4 Organizations with a BC Plan signed-off by Senior Management 16% 24% 60% Yes No Don t know 6.5 Maintaining/Reviewing Business Impact Analysis (BIA) for Critical Business Functions in the Last 12 months 14% 25% 61% Yes No Don t know As high as 25% of organizations have not conducted their BIA in the last 12 months 6.6 Organizations Approach to Business Continuity Planning 19% Have a robust BC program for a few years now 19% Currently developing/writing a BC Plan 17% Maintaining/exercising a BC Plan 12% Decision making stage/intend to initiate a BC program 10% Recently developed a BC Plan 10% No concrete plans to initiate a BC program in near future 14% Don t know 11

14 6.7 Provision of an Alternate Work Site in the Event of Office Premises Being Unavailable 23% 19% 58% Yes No Don t know 6.8 Participants of BC Test 65% Senior Management/CEO (other than BCM sponsor) 46% BCM sponsor 46% Corporate level BCM team 65% Department reps and end users observers 19% Observers 23% Police department 35% Fire department 19% Medical and emergency services 6.9 Percentage of Employees Participating in BCM Testing and Exercising Activities 50% 0-25% 29% 25-50% 21% 50-75% 0% % 12

15 6.10 Measuring Effectiveness of BCM program 53% Exercise results 20% Benchmarking to industry norms 17% Management reviews 10% Audit findings 13

16 7. CRISIS MANAGEMENT 7.1 Presence of a Crisis Management Plan Organizations with a Documented Crisis Management Plan 10% 31% 59% Yes No Don t know 31% of respondents stated that their organization had not documented their Crisis Management Plan 7.2 Signing off the Crisis Management Plan by Senior Management 50% Yes 26% No 12% Don t know 12% Not Applicable 7.3 Methods to Communicate with Crisis Management Team 59% 41% Do you use call tree? 89% 11% If yes, is it automated 63% 37% SMS Yes 68% 32% Call in numbers No 14

17 7.4 Testing Frequency of Crisis Management Plan Minimum frequency of conducting tests 7% 2% Monthly 2% 33% 7% 5% Quarterly 5% 16% 14% Half Yearly Risk Analysis Business Impact Analysis Testing of Emergency Response/Crisis Management Plan 21% 30% Yearly 21% 12% 11% Once in Two Years 7% 37% 39% None of the Given Options 35% 15

18 8. Communication & Co-ordination with External Agency/Vendor 8.1 Involvement of Vendors 15% Audited/reviewed vendor BCM plans 9% Involved vendors in testing and exercising 18% Specified BCM needs to the vendors 8% Shared organizational BCM plans with vendors 8.2 Established Relationships With External Agencies (Police, Fire, Hospitals, etc...) for Coordination of Response Activities 6% 41% 53% Yes No Don t know 8.3 Communication with Customers, Partners, Employees, Regulatory Authorities About Any Incidents and BCM Situations 12% 21% 67% Yes No Don t know 16

19 9. ABOUT BUSINESS CONTINUITY MANAGEMENT Business Continuity Management (BCM) is a holistic management and governance process designed to reduce the organization s risk from an unexpected disruption of its critical functions, and ensure minimum acceptable levels of service. At an organizational level, BCM is typically driven by senior management and at a department process level by individuals. It involves : Identification of financial and non-financial impact of potential disruptions Formulation and implementation of viable recovery strategies and plans Exercising and testing these plans and maintenance and updating from time to time, to be assured of the desired continuity of products and services at any point in time The term Disaster Recovery (DR) refers to the effort involved in the recovery of Information Technology systems after a disaster. Disaster Recovery is a vital component of the BCM program. But Business Continuity consists of more than just Disaster Recovery. Business Continuity also requires the presence of people who perform critical functions, and the availability of critical processes and the requisite resources to ensure minimum levels of service. Crisis Management, which is another aspect of BCM, covers the immediate response to an incident. A Crisis Management Plan works to save resources in the event of a disaster. It is well known that most businesses are not prepared to survive a major disaster. Almost 40% of businesses that experience a major disaster never re-open at all. Of those that do open, almost 30% close again within two years. As an example, of the 930 companies that had offices in the WTC towers on 11 September, over 550 had failed 18 months later. Minor incidents that are not managed appropriately can also snowball into major disasters, leading to revenue losses, inability to meet commitments, penalties, embarrassment, and opening of inroads for competitors, negative publicity, customer and employee attrition and the loss of current and future business. This could lead to eventual closure of the business. BCM works towards ensuring that core, highpriority operations continue after a disaster or resume within an acceptable time. Customers in today s liberalized and competitive economy are becoming increasingly intolerant of lapses in service. As more business gets outsourced to third-world countries, organizations that can continue to deliver services at the agreed levels (continuity) and without fail (repeatability) will continue to thrive. At the same time, domestic providers of these services cannot afford to be complacent either. After all, it is all about Survival of the fittest! 17

20 Business Continuity Management Institute (BCMI) The Business Continuity Management Institute (BCMI) is a specialized Business Continuity (BC) and Disaster Recovery (DR) professional educational institution. Its mission is to promote and empower BC/DR practitioners with the appropriate skills and knowledge to help organizations strengthen their management systems and enhance operational resiliency in the business processes; thereby, helping to minimize the impact and losses due to disruptions and disasters. BCMI is committed to helping BCM and DR practitioners raise the professional standards and competency levels. This is done by : Conducting training workshops, including those that lead to professional certification. Organizing conference and seminars, such as the World Continuity Congress ( Asia s largest Conference for BC and DR Professionals. Publishing technical and research papers. 18

21 ehosting DataFort ehosting DataFort is a leading provider of Managed IT and Advisory Services, and a fully owned subsidiary of TECOM Investments member of Dubai Holding. Currently ehosting DataFort has a wide range of customers in various vertical segments including Emirates Airlines, SPICA, Dubai Financial Market, Arab Bank, His Highness Rulers Court, Government of Sudan, Qatar Foundation, Kuwait National Petroleum Company, DUBAL, Al Futtaim, du, Dubai E-government, Khaleej Times, Gulf Business Machines, Dulsco, Dubai Mercantile Exchange, Dubai TV, Panasonic and the World s largest Steel Company Arcelor Mittal. With world class data centres, estate of the-art infrastructure and 24/7 managed operations, ehosting DataFort has a wide network of technologies and channel partners based in GCC, MENA, Europe, North America and Asia Pacific region. It delivers its operation through highly reliable and scalable infrastructure based on international standards and best practices including ITIL and ISO Key Differentiators Leading provider of comprehensive managed IT and Advisory Services Customers include Government, Financial/Banking, IT, Electronics, Telecom, Aviation, Media, Entertainment, Retail, Real estate/construction etc Regional presence in GCC with partners in Saudi Arabia, Bahrain, Oman, Qatar, Kuwait & International presence in North America, Europe, and Far East Owns and operates its own state of the Art Data centres (24/7 operations and management) Adherence to International Standards & Service Level Management: ITIL, ISO 9000, ISO 9001, ISO 27001, ISO 20000, BS25999 etc Awarded Enterprise Service Provider of the Year ACN Arab Technology Awards 2008, Enterprise Service Provider/consultant of the Year ACN Arab Technology Awards 2009 & Most Innovative use of Technology NME Awards

22 Acknowledgments BCM Institute would like to thank everybody who spared time to participate in this survey. Some Participating Organizations : Abdulaziz Saud Al-Babatin Group Abu Dhabi Islamic Bank BoxSentry Pte Ltd Centennial Fund CNS Dahait Abdullah Al-Salim Co-Op Doha Bank DNV Dubai Customs Eclipse Staging Services Gulf DTH FZ LLC Kling Consult GmbH MoI Border Guards National Bank of Abu Dhabi National Clearing Company Optimiza Solutions Qatar Petroleum Sify Technologies Limited STC Tech Access United National Media Co. Zain GSM

23

24