AN INTRODUCTION TO BUSINESS CONTINUITY PLANNING AND SOLUTIONS FOR IT AND TELECOM DECISION MAKERS Executive Summary Today s businesses rely heavily on voice communication systems and data networks to such an extent that any disruption to these vital technologies will disrupt operations impacting employees, customers and your bottom line. In the globally interconnected marketplace, where business transactions are expected to occur in real time, few companies can afford even short outages. Planning ahead ensures that your company will continue operations in the face of disaster. Think about it if your competitors haven t addressed business continuity, and a disruption occurs, they ll be scrambling to resume operations while your business hasn t skipped a beat. In fact, you gain customer loyalty and attract new customers. That s competitive advantage! What is Business Continuity Planning? In a nutshell, business continuity planning entails the development of a framework for ensuring the continuation of an enterprise through whatever challenges it may face in the future, including unforeseen disaster events such as commercial power outages, harsh weather conditions, fires, floods, system-disabling viruses, and threats to homeland security. Such planning is not just meant to ensure survival in the face of a major event, it is equally important for ensuring smooth day to day operations in the face of computer and telecommunications failures. This kind of planning is especially important in this age of convergence, which has companies putting all their eggs -- voice, data and video -- in one basket. In converged environments the downtime risks and resulting revenue losses can be quite substantial. Effectively dealing with
business-disrupting events requires that disaster recovery be a major element of the business continuity plan. The first step in the business continuity planning process is to assess the risks faced by your company and determine how exposed it is to these risks, particularly those that threaten mission critical processes. With high dependence on computers, data networks and telecommunications systems and services, these will be among the first assets to come under thorough risk assessment. The next step is to decide what measures need to be put in place to minimize damage if a disaster does occur. Before the plan can be considered complete, you must test it to reveal any weaknesses. If weaknesses are revealed, the plan must be fine-tuned until it passes the test. Plans should be reviewed periodically and changed as often as necessary to accommodate new developments. Planning Framework Planning ahead ensures that your company will continue operations in the face of disaster. Think about it if your competitors haven t addressed business continuity, when a disruption occurs, they ll be scrambling to resume operations, while your business hasn t skipped a beat. Dan Testa, President & CEO TCI The following discussion defines the role of the IT professional in developing a business continuity plan to protect the mission-critical computer and telecommunications systems of the enterprise. Project Initiation and Management To establish the need for a continuity plan, including the disaster recovery component, your role is to: Coordinate and organize the project Take the lead in defining objectives, policies, and critical success factors Present the project proposal to senior management and staff Develop project plan and budget Define and recommend project structure and management Manage the planning process Risk Evaluation and Control You must identify the events that can adversely affect the business processes of the organization, the damage such events can potentially cause, and the tools and systems needed to prevent or minimize the impact of potential loss. This cost-benefit analysis can justify investments such as redundant systems, the use of diverse carriers, and backup services to mitigate risks. Your role at this stage is to: Identify potential risks to the organization, including any vulnerabilities, threats or exposures Interface with other corporate managers to determine acceptable risk levels Identify risk reduction remedies and alternatives Identify credible information sources within the organization Identify any outside expertise that may be required 2011 TCI, a Telcept Holdings LLC. Company Page 2
Document findings for peer review and consensus within your company Business Impact Analysis You must be able to describe the possible impacts that can result from disruptions to business operations, starting with the most likely disaster scenarios that can affect the organization. If your headquarters or branch offices are located in regions with a high incidence of hurricanes, for example, you must take into account the possibility of a prolonged commercial power outage and devise a strategy to deal with it. Once critical business processes have been identified, recovery priorities can be established to minimize the interruption to business systems. Specifically, your role here is to: Can you describe the impacts to your business if your building becomes inaccessible? Identify key personnel by area of expertise and compile emergency contact information Identify any technological interdependencies; for example, are voice systems dependent on the proper operation of the data network? Define recovery priorities and the procedures for implementing them Prepare and present this information as the business impact analysis Emergency Response and Operations Attention must be given to developing and implementing procedures for responding to and stabilizing the situation following an incident or event, including establishing and staffing an emergency facility to be used as a command center during the emergency. Depending on the organization, this facility might be the help desk or the network operations center. Smaller companies can avail themselves of an off-site Business Continuity Center hosted by a firm that is experienced in supporting the disaster recovery needs of businesses. This fully equipped workspace offers telephone line redirect service so you can receive your company s incoming calls. It also includes a conference room and teleconferencing services as well as telephones, fax, copier, printers and Windows XP workstations equipped with high-speed Internet access. From the Business Continuity Center, or alternative site for temporary relocation, you can respond to the disaster situation by implementing various aspects of the business continuity plan. This might entail: Notifying key company personnel that an emergency is in effect and that they should start implementing their piece of the business continuity plan immediately. If appropriate, notifying public authorities and first responders that your company is in an emergency situation. This would be necessary if the emergency affects public safety, such as a toxic leak or spill. Monitoring implementation of the continuity plan, noting any discrepancies in the execution versus the planned response procedures. Noting the need for development of emergency procedures where none exist. 2011 TCI, a Telcept Holdings LLC. Company Page 3
Determining whether the actual response was adequate to ensure full restoration of all business systems within the timeframes specified in the plan. Of course, a Business Continuity Center can also be used by key staff to operate critical business functions during the emergency situation. As part of the arrangement, your company would have all its critical data already backed up at this offsite location, for example, and ready for use in case your building is closed or inaccessible during the emergency. These resources could also be accessed remotely over a secure virtual private network (VPN). Maintaining and Testing Business Continuity Plans Since business-affecting disasters might be few and far between, it pays to take the time to schedule periodic tests of the continuity plan, plus evaluate and document the results. Your role is to: Plan and coordinate testing of the plan; for example, conduct a backup of critical data and then test the restore mechanism to be sure it actually works. On your network, test a router set up with dual links take down one to see if the traffic transfers to the other connection automatically. During the course of the year go through each component of the plan until the entire plan is thoroughly tested. Components of the plan that fail their tests should be tested again until they pass. Document and evaluate the results of pass-fail tests. Report the results to corporate management. Attend periodic strategic planning meetings. Coordinate plan maintenance. Update the plan as necessary. Business Continuity Center Many businesses are not adequately equipped to continue operations during a disaster situation, especially if physical access to their building becomes impossible. To guard against this, an off-site company location can be set up to sustain operations. For most companies, however, this is not an option because it is too expensive to equip and staff a mirror location for infrequent emergency use. An economical alternative would be to subscribe to a business continuity service from a provider that is experienced in meeting the disaster recovery needs of businesses. For a monthly fee, you have access to a complete alternate work environment for your company s key personnel, allowing them to carry on essential business functions for the duration of the emergency or until your company can once again function on its own. When choosing an off-site Business Continuity Center, the firm who will host your company during the disruption must be able to demonstrate that it can effectively apply its technologies and skill sets to address your company s requirements. 2011 TCI, a Telcept Holdings LLC. Company Page 4
A Business Continuity Center should be engineered from the ground up to support any production environment and should be evaluated according to the following checklist: Is there a high-end emergency datacenter and can it be configured to support your applications and remote access requirements? Are secure data services available from this location and can they be tied into your existing VPN? In what increments is Internet bandwidth made available from this location and how fast can it be activated? Can you choose your own Tier-1 Internet provider? Is there a fully staffed Network Operations & Security Center with Certified Engineers who are ready to address any request or outage? Do you have 24x7x365 on-site access to the provider s technical support team and engineers? Is there enough well-furnished office space and cubicles equipped with up to date PCs, operating systems and application suites? Does my company s staff have access to a secure LAN? Are administrative resources available fax, copier, office supplies? Can call center operations be established from this location? Are there provisions for audio and video conferencing? Is there remote voice and data access to support my teleworkers? Is there a live receptionist and automated attendant service available? Does the Business Continuity Center accommodate extended hours for my staff? What level of customization is possible to meet the unique needs of my business? Companies that set up a plan that offers the recourse of moving to an off-site location will stay a step ahead of the business implications that arise when an adverse event is prolonged. Maintain your productivity Protect your image Business continuity planning is very much like buying life insurance the expected rate of return is negative. This is often the reason companies put off the decision to invest in the systems, tools and skill sets to develop and implement disaster recovery plans. Without this kind of insurance, however, the consequences can be quite severe. According to a study by the University of Texas, of companies that suffered a catastrophic data loss, 43% never reopened and 51% closed within two years. Only 6% survived. These figures point to the urgent need for business continuity planning and for off-site resources to sustain critical business functions during a disaster situation. Large companies can afford to distribute their voice and data systems as a hedge against disaster, but smaller firms that 2011 TCI, a Telcept Holdings LLC. Company Page 5
cannot afford to do so can outsource this critical requirement to an experienced business partner with a well equipped and staffed Business Continuity Center. TCI helps defend your business against unforeseen events and disruptions. Our unique solutions can restore your business functions. Our customized solutions provide the peace of mind that comes from knowing you can continue to serve your customers under the worst of circumstances. We can offer you a custom solution to ensure that your infrastructure is secure and your business will continue to run without interruptions. Find out how TCI s Business Continuity Services can protect your business in times of disaster. Call 1 800 TCI 1001 or email Don Routhier at routhierd@tcicomm.com. About TCI TCI is one of the largest full-service integrated solutions providers in the Washington D.C. and Baltimore metropolitan areas. We deliver voice, network and data support to organizations of all types and sizes. TCI offers a complete line of client services and business solutions in partnership with leading manufacturers. Learn more by visiting our website, www.tcicomm.com 2011 TCI, a Telcept Holdings LLC. Company Page 6