Growing Up: Like People, BC Programs Should Gain in Maturity Over Time
Becoming more mature is not only an important goal for people. Business continuity programs should also strive to become more capable and sophisticated over time.
Related on MHA Consulting: What’s Up, Doc? When and How to Perform a Current State Assessment
The Meaning of Maturity
Anyone who has raised a child (or been one) knows that the main work of childhood and young adulthood is growing up: becoming more mature physically, emotionally, and in every other dimension.
However, the goal of becoming mature is not just for people. It’s also a highly desirable state for business continuity programs, and one that every BC office should aspire to achieve.
By saying a BC program is mature, we’re not simply saying it’s “good” or “robust” or “sound.” Maturity in the context of a BC program means all that and more. It implies that the program has existed for some time, and that over that period it has been tested and seasoned.
A mature BC program is one that has reaped the benefits of extended care and investment. It’s also one that has proven its ability to help the organization shrug off disruptions—and gained the kind of insight and confidence that can only come through experience.
A mature BC program goes beyond merely having plans in place; it signifies that these plans have been tested, refined, and integrated into the organization’s culture and operations. Maturity implies a comprehensive understanding of risks, a proactive approach to mitigation and recovery, and continuous improvement based on lessons learned and evolving threats.
Essentially, a mature BC program is one that has evolved to effectively safeguard the organization’s ability to continue operating in the face of disruptions, demonstrating resilience, adaptability, and strategic alignment with business objectives.
Traits of Mature BC Programs
Everyone is familiar with the steps that chart the maturation of a person, such as eating solid food, learning to ride a bike, becoming more considerate of others, and getting a job.
You might be less familiar with what maturity for a BC program looks like.
Below, divided into 15 program areas, are the characteristics that indicate that a BC program has achieved the highly desirable (and resilient) state of being mature. Does your organization’s BC program exhibit these signs of maturity?
- Governance and oversight. The program has effective management oversight, direction, metrics, and staff.
- Policy. BC policy at the organization is documented, communicated, and enforced by management.
- Budgeting. Business continuity is part of the annual corporate budget.
- Program management methodology. The BC office has a roadmap that guides their activities over the next 12 to 18 months.
- Prioritization of critical processes and systems. The organization has identified and prioritized the most critical processes and systems they need to keep the business running in the first week of a disruption.
- Identification of relevant threats and risks. The BC team has identified the relevant threats and risks to the organization via a threat and risk assessment. They have a mitigation plan to either accept, transfer, or mitigate threats?
- Crisis management. The organization has identified a crisis management team and documented a plan for how it will strategically manage a crisis. .
- Crisis communications. The company has formed a crisis communications team and documented how the organization will communicate internally and externally in a crisis.
- Recovery strategy. The organization has identified recovery strategies that will recover their critical business processes and systems.
- Recovery plans. The organization has documented, comprehensive, and tested recovery plans for their mission critical business processes and systems.
- Data backups and offsite storage. They are meeting their Recovery Point Objectives (RPOs).
- Exercises. The BC office and business departments hold regular exercises to validate the capability of the recovery strategy, recovery plans, and people.
- Training. The company holds training on a regular basis to educate new and existing staff members on the BC program and its role in the culture of the organization.
- Maintenance. The company has a comprehensive maintenance schedule in place to maintain currency of the components of the BCP program.
- Continuous improvement. The organization has a process in place to look for ways to improve their BC program. They know what level of maturity is required to meet the needs of their business.
The Current State Assessment and Beyond
We have reviewed what maturity means in the context of a BC program, why it’s important, and what specific traits and achievements maturity requires. The nexts step for any organization interested in improving the maturity of its BC program are to conduct a current state assessment, gain an understanding of the health of the program, close any identified gaps, and commit to an ongoing process of review and improvement.
This is well worth doing for the simple reason that a mature BC program is your best defense against disruptions, ensuring your organization not only survives but thrives in the face of challenges.
The Ability to Thrive Amidst Disruptions
Just as individuals strive for maturity in various aspects of life, business continuity programs must also evolve and mature over time. A mature BC program is not merely a collection of plans, but a comprehensive system that has been tested, refined, and integrated into the fabric of the organization.
The best place to begin for organizations intent on increasing the maturity of their BC programs is a current state assessment followed by a systematic effort to eliminate identified gaps. By embodying traits like effective governance, tested recovery plans, and a commitment to ongoing improvement, a mature BC program becomes a vital asset in safeguarding an organization’s ability to thrive amidst disruptions.
Further Reading
- What’s Up, Doc? When and How to Perform a Current State Assessment
- Weighing the Danger: The Continuing Value of the Threat and Risk Assessment
- Navigating Resilience: How to Create a BCM Roadmap
- Testing, Testing: Our Best Blogs on BC Testing and Mock Disaster Exercises
- Taking Care of Business: How to Write a Business Recovery Plan
Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
