JBM CON SU LTIN G GROU P

What is Business Continuity Management?

Business Continuity
"Providing for the continuous operation
of business-critical functions under
predefined circumstances."

JBM Consulting Group’s Business

Continuity Glossary states that
business continuity is focused on
providing for the continuous operation of
business-critical functions under
predefined circumstances. What does
this mean?

"Continuous operation of critical

business functions" implies that some
parts of your business are more important than others. Most business functions are
valuable or you wouldn't do them, right? Would the company go out of business if your
accounts receivable department couldn't process incoming payments? Eventually, but
not necessarily right away. How long could you operate without A/R processing before
the impact to the operation was intolerable? Not sure? Do you think there are people
within your Finance Department who intuitively know the answer to that question?
Perhaps.

Moreover, who defines what's ‘intolerable’ and how do you arrive at a useful
answer to that question for each business-critical function?

Let's now look at the rest of the definition: ‘under predefined circumstances.’ Is it
possible to ensure a continuous operation if a killer asteroid hits the earth!? This is a
highly unlikely event to be sure. But it makes the point. It isn't practical for organizations
to plan for maintaining continuous operations under all circumstances. So, where do you
draw the line? Are you being sufficiently prudent if you limit your disaster planning to a
city-block fire? ...A city-wide earthquake? ...A regional weather event or network outage?
What are the likely incidents – statistically speaking – that could adversely affect your
business?

Okay, so you've decided to plan for the complete destruction of your headquarters
facility. Now what? Is that a practical scenario to plan for? Might the cost to provide
alternative means of operation be so prohibitive that you might be driven out of business
simply in the effort to provide that level of protection? What about those incident
scenarios that are considered less severe than your worst-case scenario? Do you need
plans for those scenarios? How many scenarios is enough?

In the end, it comes down to ‘how much business protection do you want or
need?’

Welcome to the discipline known as business continuity management, or BCM.

The JBM Consulting Group’s Glossary states, business continuity management is:
 JBM CON SU LTIN G GROU P

"A proactive process that identifies and prioritizes the business-critical

functions and the likely threats to those functions. From this information, plans and
procedures are developed through a regular program of personnel training, plan
exercising and/or testing, and maintenance. These management disciplines,
processes and techniques provide business continuity of the critical business
functions under the circumstances and within limits set by senior management.
These circumstances and limits include:
 Defining the best scenario used for business continuity planning; and
 Approving funding and staffing of the company's BCM Program."

BCM is a process. It can be represented graphically as a process flowchart. The

Flowchart included on the BCM Methodology page shows how this process is in fact
comprised of two primary elements: the BCM Initiation Project and the BCM Program.

 The BCM Initiation Project involves all the steps necessary to develop,
document, and test a business continuity plan (BCP) for the first time. This
three-phase, 7-step one-time project ensures that every critical function has
an initial BC plan (BCP) in place.
 BCM Program: Once the initial BCP has been developed, the BCM
Program is initiated. It involves all of the activities that sustain and over
time, enhance the state-of-preparedness of the business functions covered
by the BCP. In essence, the BCM Program institutionalizes business
continuity practices into a sustainable process.
 JBM CON SU LTIN G GROU P

Business Continuity
Vulnerability Assessment
Often, the first question when undertaking a
business continuity project is "where do I
begin?" First, begin by answering: What level of
preparedness already has been achieved?
What is the level of senior management
commitment to this project or initiative? How
does our Business Continuity Maturity
compare with other companies in our industry?
Do we have the internal resources to execute
this or would we be better served through
outsourcing business continuity plan
development and support? The JBM
Consulting Group Vulnerability Assessment
seeks to answer these and other important
initialization questions.
No two vulnerability assessments are ever
the same. JBM Consulting Group
emphasizes the importance of tailoring its
methodologies and resources to each
client's specific requirements.
Working with you, the JBM Consulting Group Engagement Manager will define an
initial work effort that includes, but is not limited to, the following elements:

Define Project Scope

 Exposure Categories in-scope and out-of-scope;

 Strategy Alternatives to be considered;
 Business functions and physical sites to be included; and
 The Business Continuity Management (BCM) Deliverables desired.

Assemble Project Organization

 Establish BCM Program Office;

 Identify sponsor and assemble executive steering committee;
 Assemble working team comprised of department managers, key knowledge holders, and business continuity
coordinators; and
 Determine workload distribution between client and consulting resources to best meet project time and cost
objectives.

Define unique client-specific characteristics of BCM Implementation Model

 BCM Business strategy;

 Infrastructure strategy;
 Rollout strategy;
 Test & maintenance strategy; and
 Support strategy.

Prepare project plan based on BCM Implementation Plan

 Step 1 – Model Development;

 Step 2 – Pilot Implementation(s);
 Step 3 – Rollout; and
 Step 4 – ‘Steady-State’ Maintenance.
 JBM CON SU LTIN G GROU P

Business Continuity
Outsourcing
JBM Consulting Group’s consultants have
the skill, background, and experience to work
with you to design, implement, exercise/test,
and maintain your BCM Program without the
challenges and expense of fulltime internal
staff. Our Business Continuity Institute (BCI)
and Disaster Recovery Institute (DRI) certified
business continuity planners are available on
a short-term basis to meet your immediate
needs or under long-term contract to
participate in projects such as annual
business continuity plan updates, ad hoc risk
analyses, and/or planning for new technology.

To get started, we recommend performing an

accelerated Vulnerability Assessment from
which your business continuity planning
strategy can be designed and executive
commitment obtained. Our Fast-track engagement team approach ensures timely and
cost effective results. Our large intellectual property library contains the knowledge tools
necessary to provide our clients cost-effective, standardized, and sustainable results.

Business Continuity
Fast-track Engagement Team
Through many years of practical experience and in recognition of the importance of
senior management commitment, JBM Consulting Group has developed a highly
efficient project organization model that can be applied to most small, medium, and large
project or process initiatives we undertake. This model is sensitive to workload
distribution between internal and consulting resources. JBM Consulting Group is
committed to minimizing client's consulting costs and maximizing the knowledge transfer
that occurs during our involvement. As such, JBM Consulting Group wants to involve
client resources wherever prudent and practical. Our Project Engagement Manager and
BCMS SME will work with you to identify the project resources and define a project
organization that best achieves these results.
 JBM CON SU LTIN G GROU P

Roles:
Make Decisions
Review Recommendations
Business Continuity Management Approve Funding
Project Management Office
(BCMPMO)

Reports Program Status

Executive BCM
Issue / Risk Escalation
Steering Committee
Change Management
Internal Consultancy

Key Knowledge Holders

Validate Analyses
Filter Suggestions
Prepare Recommnedations
Brainstorm
Provide Business Interface
Integrate Cross-Functions
Issue Resolution
BCM
Working Team

Facilitates Processes
Collects Data
Conducts Analyses
JBM CON SU LTIN G GROU P Reports Findings
Manages Engagement

Figure 1 Fast-track Engagement Team

 JBM CON SU LTIN G GROU P

Business Continuity
E-Continuity Services
Providing a high availability
environment is a cornerstone of
your e-commerce platform. Of
course, you designed redundancy
into your technical systems from
the start. But, have you had any
trouble convincing senior
management to invest in the
people, processes, and tools
needed for business continuity and
recovery? How severe would the
impact be (revenue loss, damage
to company image, or drop in
stock price) of an eight hour
outage?

This is a very critical time in the

developing e-commerce marketplace and many companies that participate only get one
opportunity to provide a positive customer experience. This requires reliability and high
availability before you can even begin to sell.

JBM Consulting Group can show you how a rigorous business continuity,
contingency planning, and crisis management discipline can protect your critical
investment in e-commerce.

Our Disaster Recovery Institute (DRI)

and Business Continuity Institute (BCI)
certified consultants can help in all
aspects including:

 Project Initiation and Management

 Risk Evaluation and Control
 Business Impact Analysis
 Developing Business Continuity
Strategies
 Emergency Response and
Operations
 Developing and Implementing
Business Continuity Plans
 Awareness and Training Programs
 Maintaining and Exercising Business Continuity Plans
 JBM CON SU LTIN G GROU P

Business Continuity
Deliverables
No two business continuity projects will be the same. JBM Consulting Group
emphasizes the importance of tailoring its methodologies and allocating its resources
to each unique client situation. Our Fast-track engagement organization ensures that
projects are completed timely and cost-effectively.

Before a project is undertaken, the client and JBM Consulting Group's Engagement
Manager and BCMS SME reach agreement on the critical project objectives, scope,
approach, deliverables, schedule, and pricing. These characteristics are documented in
our standard Statement of Work. Please note that JBM Consulting Group leverages
deliverables generated during previous engagements wherever possible to minimize
client's consulting expense.

Project deliverables are the tangible and measurable results of the work effort. The client is
always afforded the opportunity to review and edit any deliverable before it is finalized.

Sample BCM Deliverables

Business Continuity project deliverables include the following:

Assessments

 Identify critical processes, systems and resources

 Classify disruptions in terms of business impacts and estimated duration of
outage
 Prioritize business functions and processes by impact category
 Prioritize computer applications required to support critical functions
 Establish Maximum Tolerable Outage and Recovery Time Objectives for critical
business functions
 Document internal and external operational and site risks
 Document state of preparedness and mitigation opportunities
 Evaluate and document vulnerability to physical and/or data security
 Evaluate current contingency plans and document short-falls and opportunities
for enhancement

Recommendations

 Design and recommend BCM Implementation Model for enterprise-wide

business continuity program launch
 Evaluate and document technology backup considerations including alternative
sites, data storage and telecommunications requirements
 Recommend BCM policy guidelines for enterprise
 Design and recommend crisis management infrastructure
 Design and recommend organizational considerations
 Identify and recommend process improvement opportunities
 Identify and recommend new tools that can be employed
 Evaluate existing business continuity plans and recommend enhancements
 JBM CON SU LTIN G GROU P

Operations Outsourcing

 Conduct BCM awareness and executive training.

 Facilitate departmental / enterprise-wide business continuity program
development.
 Write departmental / enterprise-wide business contingency plans.
 Coordinate departmental / enterprise-wide exercises, drills, and tests.
 Coordinate departmental / enterprise-wide plan update and review.

Business Continuity
BCM Methodology

Methodology Steps

The JBM Consulting Group’s Business Continuity Implementation Methodology is

a 3-phase, 7-step model that divides the tasks of launching a Business Continuity
Management Program into three primary components:

BCM Launch Strategy

A 3-Phase, 7-Step Approach to Develop Your BC Plan
Phases I, II, & III, Steps 1 - 6: BCM Project

 1-time project
 Initial BCM at all sites
 Enhance Crisis Management
 Develop BC plans by Dept.
 Conduct initial BC plan test

Phase III, Step 7: BCM Program

 Ongoing Departmental Process

 Annually repeat steps 1 - 6
 Link to Change Control
 Evolve BCM competency
 Improve state-of-preparedness

The chart depicts this 3-phase, 7-step

approach and summarizes the key
requirements to reach each. A more thorough
description of each Phase and Step can be
found by clicking on each Phase and Step in
the chart.
 JBM CON SU LTIN G GROU P

PHASE-I, STEP 1: DEFINE THE SCOPE OF YOUR BUSINESS CONTINUITY PLAN

The purpose of phase-I, step 1 is to identify and define those operations to be addressed
in the business continuity planning process. This step is important since it will define the
scope of the planning process. This definition will have a direct bearing on the viable
recovery approaches, the resources required for a recovery effort and the
interdependencies among the operations covered by the continuity plan and those
operations outside the planning scope.

To help collect the material necessary to write a business continuity plan, a Toolkit is
included (as it is for each of the 3 phases and 7 steps) consisting of forms and other
tools to assist in properly organizing and launching this project. When followed, it will
help attain well thought out continuity goals and objectives. The business continuity plan
will provide the appropriate procedures for the following circumstances: the occurrence
of an unplanned downtime incident, the recovery period after the incident, and for the
return to normal operations.

Business continuity planning is really ‘a long range strategic business planning effort.’
Consider that the plan, for a period, will provide the ‘alternative business plan’ for
business operations under ‘chaotic’ and ‘highly stressed’ conditions. Consequently, step
1 will address the following strategic planning issues: justification for valid business
reasons, determination of scope and impact of potential disasters, a set of business
goals and objectives, and a project management plan that organizes management's
commitment of business resources. To successfully design, write, exercise/test, and
maintain the business continuity plan, attention to these requirements is compulsory.

PHASE-I, STEP 2: COLLECT BUSINESS CONTINUITY DATA AND INFORMATION

The purpose of this step is to build the business process inventory, determine the
business unit's state of disaster readiness and decide ‘how much planning’ is needed to
meet continuity goals and objectives.

The information collected in this step will be used to understand ‘the big picture.’ The
goal of step 2 is to identify the functions or processes for step 3 – Business Impact
Analysis and arrive at step 4, designing continuity strategy options, with confident
knowledge of exactly what business processes to recover to protect the business
effectively.

Having listed the business processes, the following question must be answered: ‘Is the
business unit prepared to recover in case of disaster today?’ To answer that question,
assess the current situation; collect information about the business unit's current level of
disaster preparedness. Review the state of disaster readiness of each business process
against those planning elements already in place.

As the detailed analysis of the status review grows, a heightened grasp of the continuity
issues will emerge. This will yield a new understanding of how far the project must go to
reach its continuity goals and objectives. This is a definitive step that should lead to the
refinement of the initial project plan assembled in step 1.
 JBM CON SU LTIN G GROU P

PHASE-I, STEP 3: COMPLETE THE BUSINESS IMPACT ANALYSIS

In Step 3, the business impact analysis determines which business processes on your
Step 2 list are mission critical and how long you can operate without them. Step 3 is
important because it ties the plan organization (Step 1) and data collection (Step 2) to
the strategy (Step 4), writing (Step 5) and implementation (Step 6) of the plan. As a
bridge, the impact analysis shows the value of committing resources to the business
continuity effort and where to spend those resources for maximum benefit to the
business.

The business continuity plan's effectiveness will depend on management's support. The
business impact analysis conducted in Step 3 is a key foundation for the Report to
Management created during Step 4 as a result of preparing continuity strategy
recommendations. As well, all of the critical resources on which critical processes
depend, such as IT, need to know how quickly they must be recovered (Recovery Time
Objectives) in the event of a catastrophic failure.

PHASE-I, STEP 4: DESIGN BUSINESS RECOVERY STRATEGIES

In Step 4, the strategies to recover key business processes are designed; strategies that
fulfill the objectives identified for business continuity in Step 1. The Business Impact
Analysis (Steps 2 and 3) will guide which characteristics of which process are critical and
essential.

In addition to developing the contingency strategies that would be invoked during a

disastrous event, it is here that mitigation strategies are brainstormed and evaluated.
These mitigation strategies focus on either reducing the likelihood that a disastrous
event will occur or seek to reduce the impact of disastrous events when they occur.

As more computer processing platforms interconnect through LAN/WANs, the

complexity of business processes also expands. This increases the complexity of
business continuity planning as there are many options for business backup and
recovery strategies. And each option requires a different level of time, money and effort
to implement.

Because the disaster will probably last for a short period and stand-by/redundant
resources are expensive, management will want creative and cost conscious continuity
strategies. The goal is not to solve for world hunger. The goal is for the business to
survive. These should be the guiding principles when designing continuity strategies.

PHASE-II, STEP 5: WRITE THE BUSINESS CONTINUITY PLAN

The strategic planning work has been done. In Step 5, these strategies are converted
into plans of action to be invoked when a disastrous event disrupts critical operations.
The process of documenting your Business Continuity Plan involves the following major
steps:

Design and Activate Recovery and Crisis Management Organization

 JBM CON SU LTIN G GROU P

Implement Risk Reduction Measures

Implement Stand-by Arrangements
Build And Publish Your Business Recovery Plan
Develop Recovery Procedures

A Business Recovery Software tool will be integrated here to help users with these
steps. All vendor supplied (3rd party) software tools come complete with implementation
methodology and training aids, (e.g. Software User Guides, Training Materials, etc).

PHASE-III, STEP 6: COMPLETE INITIAL TESTING OF BUSINESS CONTINUITY PLAN

Testing the business continuity plan certifies that the plan will work when activated. The
goals are to exercise procedures and educate staff. Revealing the plan’s weaknesses
provides the opportunity to make corrections, while building staff experience and
confidence. To achieve these results, the company’s business continuity teams will
perform scheduled and unscheduled tests. This section describes typical processes
associated with business continuity plan testing.

The purpose of the testing process is to determine the following:

What is the state of readiness of the Business Recovery Organization to cope

with a major disaster?
Verify that recovery resources stored offsite are adequate to support the recovery
of critical business functions as specified in the business continuity plan.
The ability to restore critical business functions within the appropriate recovery
time objective (RTO).
That the business continuity plan and procedures have been properly, updated,
maintained and distributed.

PHASE-III, STEP 7: MAINTAIN THE BUSINESS CONTINUITY PLAN

After the development and testing of the initial business continuity plan, Step 7
begins. This is one of the most important aspects of the planning process. It
ensures that the plan's content will remain aligned with any changes in
technology, personnel, physical locations, policies and procedures, standards
and other pertinent operational issues. The primary goal of Step 7 is to
implement a sustainable business process that ensures the on-going viability of
the hard work and effort initiated in Steps 1 through 6.
Beyond ensuring that the business continuity plan is updated and tested on a
regular basis, another key goal during this Step is to annually enhance the
business continuity competency of the organization. A business continuity
planning competency baseline is to be established during the enterprise launch.
Then, the central Governance Organization will direct an awareness and training
program to enhance business continuity planning sophistication consistent with a
competency maturity plan. (See JBM Consulting Group’s Business
Continuity Maturity Model page for more information).
 JBM CON SU LTIN G GROU P

Business Continuity
Protect Your E-Business
E-commerce is a strategic
advantage your company has worked
hard to initiate. The investment in
advanced technology and significant
internal process change are paying
off. However, you know how delicately
you hold on to the advantages that
make this approach successful. High
availability is essential for all critical
functions, especially those that deal
directly with your customers. JBM
Consulting Group’s E-Continuity
offering protects these valuable
assets.

To get started, we recommend

performing an accelerated
Vulnerability Assessment, which is used to develop appropriate business continuity
management strategies and obtain executive commitment. JBM Consulting Group’s
consultants work in coordinated fashion with internal teams to convert this strategy into
tangible results. JBM Consulting Group’s Fast-track project team approach ensures a
timely and cost effective completion of this valuable process improvement exercise.
 JBM CON SU LTIN G GROU P

Business Continuity
Implementing Sustainable Enterprise Business
Continuity
Your company has worked hard to initiate and leverage its competitive advantages.
Providing high availability of all business-critical functions is essential to success in
today's business environment.

Yet, how can your management team be

confident that business will continue following
an unplanned downtime incident, especially
when…

 No one has business continuity

responsibility, or

 One person or group is trying to write plans

for the whole enterprise without the specific
business knowledge of each function, or

 Plans become outdated so quickly due to technology & process change, or

 Local business managers lack the business continuity experience and resources to
do it on their own.

What if your entire management team was skilled in a proven business continuity
discipline following a simple standardized methodology? Over time planning
sophistication could be enhanced as they gain confidence through success. But to
implement this enterprise process, you need a winning strategy and commitment from
senior management and those who will support the program. Think of this in the same
way your management team knows how to prepare a budget and conduct employee
performance reviews. They have discipline and methods they must apply and a support
infrastructure that ensures consistency of results and sustainability of the program. As
with budgeting and performance reviews, business continuity skill must be instilled in
every manager who has responsibility for business-critical functions.

 How do you measure the effectiveness of current Business Continuity efforts?

Check out JBM Consulting Group's Business Continuity Maturity Model.

 How do you develop the strategy and support infrastructure to launch and sustain
this new enterprise-wide business process?

To get started, JBM Consulting Group can help you design the implementation
strategies you will need to frame your program and obtain executive commitment to
the plan. JBM Consulting Group’s Fast-track project team approach ensures timely and
cost effective implementation. Experienced and knowledgeable JBM Consulting Group’s
consultants will work with your internal teams in a coordinated fashion. They will develop
and follow a practical implementation plan to launch, validate and sustain the BCM
program that is right for your organization.