“The real problem is that the activities and processes involved in creating business continuity programs are too often seen as something different, foreign, and almost mutually exclusive of other practices businesses engage in to enhance their productivity and relevance.”
At the October 4th Wichita Cyber Security Forum, Anneal Initiative participated in a general session panel on cyber and business continuity issues and offered some impressions on what difficulties and concerns small business owners face regarding business continuity planning. Here are some of the issues we felt were most likely to keep businesses from starting or persisting in the process of building a business continuity program:
- The difficulty in finding the time to start and continue development of a continuity program
- Figuring out where and how to start in developing a continuity program
- Evaluating an organization’s continuity planning approach to understand if they are on the right path
- Executives’ uncertainty that the time and resources dedicated to continuity planning will generate the desired results in the wake of a disaster
We offered ideas to help overcome those individual difficulties. We talked about how to start small, explore available low-cost resources, seek multi-discipline internal and external input, and test and exercise plans to judge how effectively and easily they can be executed. Those specific solutions are valid, but they don’t really address a significant overarching problem that the list of common difficulties and concerns highlights. The real problem is that the activities and processes involved in creating business continuity programs are too often seen as something different, foreign, and almost mutually exclusive of other practices businesses engage in to enhance their productivity and relevance.
Some of this disconnect may be due to the unique nature of continuity plans in comparison to other plans. However, the continuity plan is only a framework for the continuity program. The continuity plan must be accompanied by an organizational culture that empowers its members to see that framework as a starting point from which to adapt to change and solve the problems at hand. This “business continuity culture” in conjunction with a continuity plan is what constitutes a true business continuity program.
The disconnect may also result from the focus of continuity planning on disasters. Business continuity planners know that there are more incidents and events that can push a business into a continuity scenario than fit into what people normally consider disasters. Cyber-attacks prove daily that it doesn’t take a tornado, flood, ice storm or fire to disrupt business operations in a potentially fatal (for the business) way. Unintentional outcomes of technology changes, regulatory changes, market changes, and many other variables can also have the similar effect of pushing a business into scenarios where practiced and routine methods of operation won’t keep a business running anymore. History is littered with examples of businesses, organizations, governments, cultures, and nations that failed, and sometimes disappeared, because they couldn’t learn how to deal with changes in the world around them. Sometimes those changes occurred over a long time and sometimes they occurred very quickly. In either case they were disasters for those who couldn’t adapt.
If we consider the disasters, disruptions, incidents, attacks, and contingencies that business continuity programs focus on in the context of all other types of change that businesses must navigate then it is possible to see that the efforts involved in building those programs aren’t dissimilar from other efforts to keep businesses ahead in a rapidly changing world. There is a notable exception in that disasters may happen much more rapidly, violently, and dangerously, but they still constitute change that must be dealt with to persist as a viable business. This is where business continuity planning and programs present a significant opportunity to grow and enhance a business instead of just preparing for what is sometimes a hypothetical catastrophe. When business continuity planning is integrated into and helps to enhance a business’s overall culture of learning it stands to not only help businesses prepare for hazards but also prepare to seize on opportunities presented by new trends in markets, technology, government, politics, and culture.
So, when the term business continuity culture is used, it should be considered a complimentary element in an overall learning culture. Just as a learning culture allows for innovation and creative problem solving across an organization to keep a business progressing forward, so does a business continuity culture utilize those traits among employees to deal with disasters. When the learning culture and the business continuity culture are viewed as mutually supporting, tightly linked efforts then it becomes much more apparent that business continuity efforts can help prepare people to deal with not only disasters but also deal with opportunities. Finding the time to start and how to start is much less of a mystery when you are already engaging in the right activities and can modify them to address a different type of change. When business continuity becomes part of the learning culture, then the evaluation of the progress and results can be supported by how well the organization and employees adapt to any change.