Article

Teamwork, diversity key to business continuance plan

Mark Lewis, Site Editor
NEW YORK -- Before September 11, talking about a Business Continuance Plan (BCP) was like talking about a tax audit -- it's not a procedure someone who eagerly volunteer to undergo. But here at the Data Storage Management and Business Continuance Conference here this week, that's all users are talking about.

Business Continuance 101

A business continuance plan takes a lot of hard work and preparation. Here are some of the major components delineated by Morgan Stanley's Executive Director of Global Business Continuance Planning (BCP), Gregory Ferris.

  • Business Impact Analysis (BIA): This step is for assessing risk and the need for a BCP. This may not be required if you have a good handle on your company's risk. Outsourcing this step is an option.
  • Business unit specific plans: Business unit specific plans should be owned by business units and developed in conjunction with a core crisis team. Can be developed internally or outsourced.
  • Awareness and training

    Requires Free Membership to View

    Login

  • : Attained though Web sites, brochures, etc.. Can be developed internally.
  • Crisis Management: This is the process of how a company manages incidents. Plans should be flexible, simple to follow with pre-determined roles.
  • Data/Application recovery: Strategy for recovering critical data and applications. Can be developed internally or outsourced.
  • Work area recovery: Company needs to find an alternative workspace for critical staff. If a company is big and diversified enough there is the potential for use of existing workspace by displacing less-critical employees. Can also be outsourced.
  • Testing: Failover strategies and crisis management should be tested once a year.

Gregory Ferris, Morgan Stanley's Executive Director of Global Business Continuance Planning, knows first-hand, however, the importance of having a BCP in place.

The investment bank lost 1.3 million square feet of physical space, lost the retail operation's distributed technology platform and still has seven employees unaccounted as a result of the World Trade Center terrorist attacks in September.

Although Morgan Stanley had a BCP before the attacks, Ferris has spent a good deal of time in the last five months taking a different approach to the September 11 disaster by extracting lessons from the events that have molded an industry.

Morgan Stanley's own BCP is a funneling process, said Ferris, which starts with one small unit called a "Core Crisis Management Team." This team has representatives from a number of different departments within Morgan Stanley including IT, corporate security, human resources and the legal department.

The crisis team is the first to talk about a given disaster, formulate a plan and then relays that information to a "senior business unit team." Based on business needs, the crisis team's plan is modified or approved by the senior business unit team and then is handed off to "business unit BCP coordinators." The business unit BCP coordinators are a group of middle-manager level employees who act on a plan that best suits their departments.

The first thoughts of any Morgan Stanley plan are to account for and secure personnel, said Ferris. This idea is so critical to Morgan Stanley that it is essentially changing the way their offices and data-centers are being structured.

"In this new environment you have to take a proactive stance and diversify your operation. For us this means pulling all of the technology out from where people live," said Ferris.

Morgan Stanley is in the process of completely collocating data centers and also diversifying office staff and office space locations.

Personnel is the first consideration of Morgan Stanley, but there are also a number of other company investments that need to be taken in to account.

Maggi Johnsen, of Georgia Power says before September 11 her company "was not too far along" with a firm BCP, but now they are working on a plan that would account for everything from "office supplies to system hardware."

But as Ferris pointed out "not too far along" is better than no plan at all.

"You need to accept the fact that some percentage of what you plan for will change. It's better to have a plan that is 80% complete than to have no plan at all," said Ferris.

The 80% rule as Ferris noted is good advice when you factor in numbers from Compaq's Rich Avis, Director of StorageWorks Advanced Application Solution Division.

"Half of the companies that lose their data never re-open. 90% of the companies that stay around close within the next two years," cited Avis.

Avis also mentioned that 80% of all U-S based companies and 91% of European based companies do not have a BCP.

FOR MORE INFORMATION:

Featured Topic: Disaster Recovery Policy

Featured Topic: Disaster Recovery and Backup Issues

Backup Tips


Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top