Common Trends in Low to Moderately Compliant BCM Programs
The BCMMETRICS self assessment tool and its real time reporting revealed a number of common trends affecting the successful implementation of “low” to “moderately” compliant BCM programs:
1. MANAGEMENT ROADMAP/REPORTING INCONSISTENT OR LACKING – In many cases, BCM Offices simply lack documentation of a BCM Program roadmap and management status reporting. Without knowing where you are going and/or where you stand, leaves the future up in the air.
2. LACK OF DOCUMENTED STANDARDS – Majority of BCM programs have a policy but lack the documented standards (Recovery Plan Development, Alternate Work Area, Recovery Strategies, Plan Maintenance, etc.) needed to guide the execution of the other key dimensions (Crisis Management, Business Recovery, Disaster Recovery) of the program. Without documented standards, organizations do not have a clear roadmap of BCM expectations.
3. IT AND BUSINESS ALIGNMENT ABSENT – There is a clear lack of alignment between Information Technology and the business. Business Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are not being regularly aligned with Information Technology and their current recovery capabilities. Often, actual recovery times (RTAs) and recovery points (RPAs) are not known or communicated.
4. INCONSISTENT APPLICATION OF RECOVERY STRATEGIES – Due to lack of strategy standards, BCM programs are often left to haphazardly identify recovery strategies/solutions across the business and Information Technology. Recommended recovery strategies/solutions need to be pre-defined and approved for each level of Recovery Time Objective (RTO) and Recovery Point Objective (RPO) to ensure consistency in application of strategies and solutions.
5. RECOVERY EXERCISE TYPES INCONSISTENT WITH LEVEL OF CRITICALITY – BCM Offices are not using increasingly complex recovery exercises (tabletop, functional, full relocation exercise, etc.) to validate the ability of businesses and Information Technology to recover the critical business processes and systems/applications of the organization.
6. TRAINING AND AWARENESS NOT IMPLEMENTED AT ALL LEVELS- BCM Offices have yet to implement training at all levels of the organization including senior management, recovery teams and general employees. It is critical that all levels of the organization are educated to ensure comprehensive knowledge and awareness.
Michael Herrera is the CEO and Founder of BCMMETRICSTM, a cloud based self-assessment tool designed to evaluate the level of BCM compliance in today’s continuity planning programs. Visit our website at (www.bcmmetrics.com) for more information or to schedule a demo.
Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
