Denphone's Simon Gibson spoke recently with Gary Binda about the work he has done in the field of Business Contingency Planning (BCP). Gary has also worked for many years in the telecom industry and joined Denphone to help kickstart Denphone's Nortel PBX support service.
With the recent outbreak of Swine Influenza, many businesses have been given cause to rethink their contingency plans, so we thought it would be helpful to give an in-depth overview of Business Contingency Planning with a focus on Japan and companies in Japan, and including a look at BCP for small and medium size enterprises. Many companies run their BCP operations out of Hong Kong or Singapore, however there are Japanese-specific factors which also need to be looked at.
Simon: First of all, could you tell us a little about your experience with BCP?
Gary: Well, I started out in BCP with Morgan Stanley in 2000 just prior to 9/11. This was the period when BCP started to raise its head in the banking industry, and Morgan Stanley was one of the first to seriously take on BCP in Japan as part of their overall risk management program. As far as I am aware, they implemented the first fully-blown disaster recovery site in Japan.
At that time BCP was quite haphazardly managed throughout Asia, and working in BCP meant taking up what was basically a completely new role within the organization.
Simon: Can you give us a short overview of what BCP means for an organization?
Gary: There are two main thought process or strategies when considering BCP - namely "Guardianship" and "Going Concern".
Firstly, let me define what these are. A Guardianship strategy allows any company during a disaster to close their position, manage their risk and meet any regulatory obligations they might have. This means that they would need to understand and agree before-hand how they would want to recover the business.
A going concern strategy generally focuses on recovery and maintaining certain level of services to clients and getting the organization back on track after an emergency.
For a company such as Morgan Stanley, the benefits of a soundly implemented BCP plan were easily recognizable. It allowed Morgan Stanley to reassure their employees that they would be safe and their clients that they would be able to recover from a disaster - when you are asking any company to manage your assets, you really want to be assured that your assets are safe. It is therefore very important for any organization, both big and small, to understand that it takes years to build a reputation but seconds to loose it.
Simon: Was there much resistance to the BCP system when you started getting involved?
There was some initial resistance to the implementation of the BCP program - this mostly came from people on the floor, and was mainly due to lack of interest, and I would guess lack of understanding of how vital this program was to the reputation of the organization. Senior management understood the risks to the organization all too well. Once business leaders started to communicate about the BCP program to their staff the resistance subsided. It highlighted one of the really important factors in the building of an effective BCP program - this is true for any organization - good communication between all stake holders within the organization is critical when it comes to planning, building and testing your BCP plans.
Simon: Things must have changed in regards to BCP as a result of 9/11?
Yes, that certainly was a huge wake up call for a lot of organizations. I think up till that point, a great many people were quite blasé about BCP - especially outside of the United Kingdom. The United Kingdom of course was very aware of the need for BCP programs as a result of the IRA's terrorist campaigns.
9/11 caused a lot of movement within the BCP industry - and a lot of chaos. One thing it did do from our perspective, was prove that the BCP program worked - we were back up and running within a few days because of the processes we had put in place during the planning and testing of the firms
BCP program. We were very busy coordinating the recovery process, this was a 24 hour job so we took it in turn regionally to coordinate to whole process.
There were a lot of lessons learnt from that experience, too much to cover in this interview, however, if you asked me to choose one, then that lesson would be Dependency Failure. What I mean by Dependency Failure is that while you may have great plans, if you do not know the recovery strategy for the people you depend on, be it vendors, clearing houses, telecom service provider etc, your plan will still fail since you have not factored in or planned for the failure of those entities. Service providers BCP programs' must be factored into any BCP planning program.
Simon: What were the major changes in BCP that you experienced during your time?
I think the biggest change is that BCP moved from being something that people wanted but didn't have budget for, to something that they had budget for and that was taken very seriously and incorporated into the corporate culture as a whole. It was clear to all that without a proper recovery strategy it was quite possible for businesses to fail. This was especially true with investment banks and clearing houses, but also many of the larger corporations based in Japan began to move in this direction.
Simon: Many people have an image of BCP being only for banks. How do you think BCP works for smaller businesses?
A lot of small companies think that it will be easy to recover because of their size, and to most small business owners it doesn't seem like something they need to think about in too much detail.
Here at Denphone we provide a service we like to call the circle. The "circle" is the process we use to help leaders in any organization think through the business processes, we then work with company appointed personal to assist in creating a Business Contingency Planning program. There are instances where disaster recovery is left to the information technology department, but it is essentially a business problem that requires a business process as its' solution. There needs to be a realization that DR applies to the organization as a whole. Awareness, training, participation and competence are required across the entire organization in order to survive and recover from any disaster. It is essential even in the smallest of companies that senior management sponsor disaster recovery planning from inception for it to succeed. It takes a few hours to sit down with a company to get an understanding of their systems and to better understand the type of recovery strategy that would work best for each company.
Simon: Are there any Japan specific considerations that need to be kept in mind when thinking about BCP?
Japan being very prone to earthquakes, is something that comes to mind. Companies do need to think this through carefully as different earthquakes damage different buildings in different ways. Depending on the building you are in, including what kind of material it is made of, how tall is it, when was it built and to what earthquake standards, dictates some of the thought process that one would need to consider before a plan can be made. However, since earthquakes are unpredictable and will more that likely affect everyone it would be a good idea to have have a good communication strategy in place as well as ensuring that all vendors and business counterparts BCP plans are known.
In general though, and this covers all the process that incorporate a BCP strategy, regardless if it is being implemented in Japan or elsewhere, a Sponsorship Strategy by which the DR plan can be implemented with full cooperation from senior management should be created. Initiate a Facility Risk Assessment to identify various risks to a company's business facilities. Direct input is required from external sources including building management, utility companies and public services.
The information gathered during this phase will be a sub-set of the more comprehensive Business Impact Analysis. Initiate a Business Impact Analysis or BIA. This is done with the co-operation of a DR representative from each internal department. It also includes all external vendors and counter-parties that are critical to a company's' business model.
Develop feasible and timely Business Continuity procedures, also known as Business Recovery Operating Strategies, to guarantee continuity of business when there is either an interruption at a site or when critical internal or external dependencies are disrupted. This section provides logistical support for recovery that would be difficult to assemble on-the-fly in the wake of a disaster. This process also helps to determine whether a separate facility is necessary for a variety of disaster scenarios.
Information gathered during the Facility Risk Assessment and BIA stages are used to create effective strategies.
Define how the business organization should react to safeguard life and property immediately following a disaster, also known as Emergency Response and Recovery Operations. Information that is gathered needs to be prepared in a variety of formats to meet the needs of regulators, employees, clients and shareholders. It is best to begin planning for the time required to create Documentation from the inception of the DR program. Execute a company-wide Disaster Awareness and Training Campaign, with assistance from your DR team, to increase awareness and encourage participation. Schedule a Disaster Recovery Test with employee participation to allow them to confront the possibility of disaster and to be better prepared to respond rationally to the chaos that often accompanies a crisis. The knowledge gained from this initial experience should lay the groundwork for subsequent tests that must be planned throughout the year. Complying with these eight standards will help to ensure successful recovery of critical business areas when a disaster or prolonged disruption of services occurs.
Simon: Obviously with your background you must have a good understanding of how phone systems fit into the BCP picture. Could you tell us a bit about that?
First of all identify as part of your Crisis Management process a call tree program, this is used to contact and communicate all across the organization.
Other things to think about include programs such as Denphone's own Voiceblast system, ensuring that your recovery site is on separate voice grid to your main office. Implement an effective communication program which should be tested regularly to contact employees, clients and counter-parties - a system like Voiceblast can automate this. Another recommended solution may include satellite phones which provide one to one communication. Satellite phones are expensive, but if they are only used once a year then the cost is not that great, and only select senior management require them.
Simon: How do you see the future of BCP developing?
It is quite interesting to look at the way most companies are moving to more of a campus computing environment and how this removes the need for dedicated backup data centers for BCP - as the data is replicated within the campus environment.
This also helps with reducing the costs involved with BCP and gives you greater peace of mind regarding the applications and assets that your BCP plan identifies. So the focus has switched more from equipment to identifying the people necessary to recover the systems. This is better than a per building piecemeal recovery solution, and can be run out of any site you choose.
From a small business perspective, cloud computing provides a great, inexpensive solution and from my point of view provides the future of BCP for small organizations and also for how they build data centers in general. Denphone can assist any organization large or small with their BCP requirements, from helping organization with specific studies, (BIA, BCP Plan building program, infrastructure analysis) to building programs from the ground up.
