secret to successful business continuity plans

This is a fantastic Article that I came across ...............

Exercising: the secret to successful business continuity plans

Denis Goulet, MBCI & Paul Kirvan, FBCI provide some advice for those new to the subject.

After you have completed all the necessary activities associated with a developing business continuity plan, you may think you’re finished. In reality business continuity plans are useless until you exercise them. Fortunately, many types of exercises are possible, ranging from simple to very complex. The key is to incorporate exercising as part of the overall business continuity management process.

Exercise types

Three fundamental exercise types can be defined: the plan review, table-top exercise, and simulation exercise. Let’s examine each briefly.

Plan Review
In a plan review, the business continuity plan owner and business continuity team discuss the business continuity plan. They look for missing elements and inconsistencies within the plan or with the organization. This type of exercise is comparable to plan auditing, and is useful to train new members of a team, including the business function owner.

Table-Top
In a table-top exercise, participants gather in a room to execute documented plan activities in a stress-free environment. Table-top exercises can effectively demonstrate whether team members know their duties in an emergency and if they need training. Documentation errors, missing information and inconsistencies across business continuity plans can be identified in a table-top exercise.

Simulation
To determine if business continuity management procedures and resources work in a realistic situation, a simulation exercise is desirable. This exercise uses established business continuity resources, such as the recovery site, backup equipment, services from recovery vendors and transportation. It can require sending teams to alternate sites to restart technology as well as business functions. Errors, omissions, missing or insufficient resources, incomplete coverage, and limited vendor capabilities may surface in this exercise. Simulations may also uncover staff issues regarding the nature and the size of their tasks. The use of a scenario is highly recommended for simulations.

Exercise objectives

Why exercise in the first place? The primary objective is to ensure that the plan works when it’s needed. But it’s not enough to exercise parts of a plan. Ideally all elements of business continuity plans should be exercised at least once a year. Each exercise may have different objectives, beside the primary one.

Main exercise objectives include identifying weaknesses and shortcomings, verifying recovery objectives and procedures, validating global efficiency of plans, verifying the adequacy of emergency operations centers (EOCs) and alternate sites, and achieving specific recovery time objectives (RTOs) and recovery point objectives (RPO).

How much should you exercise?

As mentioned earlier, exercises can be simple or complex. A table-top exercise can establish a plan performance baseline. A specialized exercise, such as one which focuses on crisis management procedures at an EOC, provides valuable information about specific activities. At a higher level, an integrated exercise can address multiple business continuity plans or plan components. Finally, an entire plan, with all components, can be exercised. It is far better to err on the side of exercising too much, rather than not enough.

Managing human resources

Exercises present human resource issues. Should employees participate in business continuity exercises? Clearly exercises are important for validating team member expertise and identifying training opportunities. Conversely, people could refuse to work overnight, weekends or be away from home even a few days. Be sure to discuss and resolve these issues with human resources management.

During business continuity exercises, it is good practice to treat team members well, especially when they are away from home or working difficult hours. Be sure to budget for appropriate hotel accommodations and food, while managing costs.

Effective exercise strategies

The exercise options described in this article will help improve business continuity plans and train your staff. But no matter how often you exercise plans, when reality strikes, your response capability could be much different than in the exercises.

Key strategies for exercising include starting simple; raising the bar in terms of difficulty; involving vendors and stakeholders in exercises; making objectives increasingly difficult to achieve; and launching surprise exercises. When launching an exercise program, start with plan reviews and table-tops. This will help staff get comfortable with the exercise process. As they improve, increase the level of exercise complexity. Remember that if an exercise “fails”, it is not a failure; rather, it is a success. It is far better to identify systems and procedures that may fail, and rectify them, before a real incident occurs. Finally, a true test is to launch a surprise incident. This will truly test how well prepared the organisation is to address a real incident.

What is a successful exercise?

The primary reason to exercise is to identify limitations of business continuity plans. Recognizing that most organizations change frequently, even mature business continuity plans may be inappropriate in a given situation or at a given time. Exercises that appear to be ‘successful’ and uncover no problem should be suspect. Maybe the objectives were too easy or the situation was unrealistic. Exercises present opportunities to fix problems before a disaster happens.

Ideally, a successful exercise uncovers and documents problems. Once the problems have been fixed, consider running a follow-up exercise to ensure the repairs work. Measuring the success of business continuity exercises means having relevant objectives that will help uncover problems. Exercise is your chance to ‘push’ your business continuity plans increasingly closer to the reality of a disaster.

This article was first published in BCM Now, the online newsletter of the Business Continuity Institute. To read the rest of the newsletter and to sign-up to future editions go to http://bcmnow.com/Summerpg1.html

ITIL :10 Pitfalls to be noticed!!

The IT Infrastructure Library (ITIL) is implemented in companies worldwide to change and improve processes within an organization. With ITIL, everything is changing -- organizational change as much as process change.But change doesn't always come easy. Organizations often make mistakes within the first year of an ITIL implementation, and that's normal. In his presentation at Pink Elephant Inc.'s 12th Annual International IT Service Management Conference & Exhibition, Graham Price, IT management consultant at Pink Elephant, addressed the 10 biggest mistakes IT organizations make during the first year of an ITIL implementation.


Mistake No. 1: There is no vision. No one is sure of what is happening with ITIL and there are no clear answers.
What to do: Make sure the plan and focus for the ITIL project is clear, so you can get buy-in or support. A vision will also build momentum for the initiative.

Mistake No. 2: Top-down commitment isn't necessary. The project can be infiltrated via middle management.
What to do: You really need an executive sponsor for ITIL, especially when you need more time, money or
resources. It's hard to sell ITIL to an executive board, especially when executives have no idea what you're talking about. You need a boardroom champion or sponsor for any ITIL project.

Mistake No. 3: We don't need a business case. We know why ITIL is important and why we're doing it.
What to do: You need to articulate the business benefits of ITIL to the stakeholders. Create a project checklist that includes the following items:
• Understand and articulate cost. We know there's a cost for doing ITIL -- but what do we get in return?
• Confirm the scope. This must be very clear.
• Specify success criteria and define benefits. Define the success of your program and how to meet your
goals. Outlining benefits will help justify the resources you need.

Mistake No. 4: We don't need an initial baseline. Let's just get started.
What to do: Figure out what you're trying to improve on. Have specific targets identified and have examples of usable baseline methods such as maturity assessment and change readiness assessment.

Mistake No. 5: ITIL is not a strategic project, so we can use existing resources to implement it.
What to do: Create a formal project plan and identify the best resources for the project, not just people who have free time. Create a "Dream Team" of ITIL resources that includes the following: an executive sponsor, steering committee, stakeholders, process owner, process manager, project manager, process advisor and process team members.

Mistake No. 6: We don't need a communications strategy. A few emails and a kickoff meeting will suffice.
What to do: A clear communications strategy will help you tell management the what, when and why for the ITIL project. Use a variety of ways to communicate. Most people prefer face-to-face communications (Web meetings,videocasts, etc.) vs. just email. Be creative to bring attention to the project. Involve a marketing or communications person to help create a communications strategy. Tailor the messages for your various target audiences, i.e.,senior management, middle management, etc. Have a consistent message and use the same terminology throughout all communications. Two-way, interactive communication allows for more user feedback.

Mistake No. 7: We don't need an overall process strategy. Different process teams can do their own thing and we'll worry about process integration later. Let's just get it done.

What to do: Introduce document control and establish common templates for all processes. Be consistent. Design your processes with integration in mind.
Mistake No. 8: We'll start with a new tool and build processes around that later.

What to do: Allow ample time for implementation. When selecting a tool, remember that the vendor's version of ITIL isn't necessarily the same as yours. Listen to the vendor's views, but base your selection on your own plan and process design.

Mistake No. 9: Unmanaged scope creep. Manage growth as you go along.
What to do: Don't bite off more than you can chew. Continual service improvement is a large part of the new ITIL.You doesn’t need to get it perfect out of the gate. Work on making it better and keep improving. A steering committee should approve any scope changes.

Mistake No. 10: We don't expect much resistance to ITIL. We'll just tell them what to do.
What to do: People will resist change and need a reason to change. Let your staff know what's in it for them.You're not just changing processes with ITIL -- you're changing culture and people, too.

The IT Infrastructure Library (ITIL) is implemented in companies worldwide to change and improve processes within an organization. With ITIL, everything is changing -- organizational change as much as process change.But change doesn't always come easy. Organizations often make mistakes within the first year of an ITIL implementation, and that's normal. In his presentation at Pink Elephant Inc.'s 12th Annual International IT Service Management Conference & Exhibition, Graham Price, IT management consultant at Pink Elephant, addressed the 10 biggest mistakes IT organizations make during the first year of an ITIL implementation.


Mistake No. 1: There is no vision. No one is sure of what is happening with ITIL and there are no clear answers.
What to do: Make sure the plan and focus for the ITIL project is clear, so you can get buy-in or support. A vision will also build momentum for the initiative.

Mistake No. 2: Top-down commitment isn't necessary. The project can be infiltrated via middle management.
What to do: You really need an executive sponsor for ITIL, especially when you need more time, money or
resources. It's hard to sell ITIL to an executive board, especially when executives have no idea what you're talking about. You need a boardroom champion or sponsor for any ITIL project.

Mistake No. 3: We don't need a business case. We know why ITIL is important and why we're doing it.
What to do: You need to articulate the business benefits of ITIL to the stakeholders. Create a project checklist that includes the following items:
• Understand and articulate cost. We know there's a cost for doing ITIL -- but what do we get in return?
• Confirm the scope. This must be very clear.
• Specify success criteria and define benefits. Define the success of your program and how to meet your
goals. Outlining benefits will help justify the resources you need.

Mistake No. 4: We don't need an initial baseline. Let's just get started.
What to do: Figure out what you're trying to improve on. Have specific targets identified and have examples of usable baseline methods such as maturity assessment and change readiness assessment.

Mistake No. 5: ITIL is not a strategic project, so we can use existing resources to implement it.
What to do: Create a formal project plan and identify the best resources for the project, not just people who have free time. Create a "Dream Team" of ITIL resources that includes the following: an executive sponsor, steering committee, stakeholders, process owner, process manager, project manager, process advisor and process team members.

Mistake No. 6: We don't need a communications strategy. A few emails and a kickoff meeting will suffice.
What to do: A clear communications strategy will help you tell management the what, when and why for the ITIL project. Use a variety of ways to communicate. Most people prefer face-to-face communications (Web meetings,videocasts, etc.) vs. just email. Be creative to bring attention to the project. Involve a marketing or communications person to help create a communications strategy. Tailor the messages for your various target audiences, i.e.,senior management, middle management, etc. Have a consistent message and use the same terminology throughout all communications. Two-way, interactive communication allows for more user feedback.

Mistake No. 7: We don't need an overall process strategy. Different process teams can do their own thing and we'll worry about process integration later. Let's just get it done.

What to do: Introduce document control and establish common templates for all processes. Be consistent. Design your processes with integration in mind.
Mistake No. 8: We'll start with a new tool and build processes around that later.

What to do: Allow ample time for implementation. When selecting a tool, remember that the vendor's version of ITIL isn't necessarily the same as yours. Listen to the vendor's views, but base your selection on your own plan and process design.

Mistake No. 9: Unmanaged scope creep. Manage growth as you go along.
What to do: Don't bite off more than you can chew. Continual service improvement is a large part of the new ITIL.You doesn’t need to get it perfect out of the gate. Work on making it better and keep improving. A steering committee should approve any scope changes.

Mistake No. 10: We don't expect much resistance to ITIL. We'll just tell them what to do.
What to do: People will resist change and need a reason to change. Let your staff know what's in it for them.You're not just changing processes with ITIL -- you're changing culture and people, too.

What does not kill you, makes you stronger..................