|
Jim Mitchell
|
20/12/2007 20:27 GMT
Scenario Plans vs. Asset-based Plans
For years, most (if not all) organizations created Business Continuity and Disaster Recovery Plans based on 'scenarios' (Earthquake Plans, Worst-case Plans, Loss-of-facility Plans, etc.).
More and more I encounter organizations that have chosen to focus their planning as Asset-based (what 'assets' do I need to have to continue, and what strategies/alternatives might I employ if I lose access to any of those assets). Assets may be defined in broad categories (People, Physical Infrastructure, Technology, Business Process, Supply Chain).
Questions: Are 'scenario' Plans still a valid avenue? Are you using them? Have you ever executed one? Did it work?
Have you created 'asset-based' Plans? Have you ever executed one? Did it work?
|
|
John Glenn
|
09/01/2008 12:36 GMT
RE: Scenario Plans vs. Asset-based Plans
Properly done, a plan based on the "worst case scenario" (everything is gone) INCLUDES all lesser scenarios which would include hiccups in operations or resources - there would be functional unit plans (I prefer "enterprise risk management" to "business continuity") which would roll up into a higher level plan (e.g. facility, campus, division, corporate) and which enjoy the advantages of scale by utilizing (as required) resources from other units - e.g. Purchasing, Shipping/Receiving, Accounting, Communications, HR).
Plans ARE based on resource availability (including human) but include WHY the resource (e.g. server) is down as well as how to recover the resource.
John Glenn, MBCI, SRP
|
|
James Murdock
|
09/01/2008 14:33 GMT
RE: Scenario Plans vs. Asset-based Plans
At our organization, we utilize more of the "asset" plan. These plans base needs on critical processes, applications, resources, etc. I have found when we have had to execute a plan for an interruption it worked extremely well.
|
|
Jeremy Pendyk
|
10/01/2008 18:41 GMT
RE: Scenario Plans vs. Asset-based Plans
Which way to go depends on your needs. If you are looking pulling something together for your insurance company then you need to do a plan based on the worst case scenario.
If, however, you are focused on how you will recover, scenario based planning is not viable. The reason, there are too many scenarios and the plans are not necessarily interchangeable. For example, if you plan for a fire, but get a flood, your plan probably won't work because the damage and response would be different. While planning for the "worst case scenario" it can be a bit too big and also presents the problem of what to do when the smaller event occurs. For example, if your worst case was the destruction of a building, your plans may include contracting out new space and moving all your personnel. However, if a fire at a neighbouring facility occurred (I had a facility cleared for six hours due to a fire about two blocks away) , you would only need a small portion of the plan and it might be hard to break out the components you need when the incident occurs.
For my part, I have been doing a variation on the asset plan. My main focus is on loss. This has been effective for both DRPs and BCPs. By focusing on the loss of services provided by IT systems or the loss of services provided by a team (including the people portion of IT), I have flexibility in how to I respond. For example; I had an incident where the staff at a small call centre all came down with Strep throat. the rest of the company (only one location) was not affected. As a result, I just invoked the plans for that team.
Asset based planning, however, is not easy to maintain. You have to know who and what are operating from where. If you have a larger incident (such as loss of access, or a catastrophic loss of a building) you need to be sure that you have up to date records so that you know which plans to invoke.
All that said, there are still a couple of uses for scenario planning. The first use is when you have diversified operations. In such a situation, when planning, you will need to plan for two scenarios - the loss of one location and the loss of the services overall.
The other use for Scenarios is when testing the plan. In that case, you want to test using the worst case scenario, within reason. Why within reason, because if your scenario is too big (nationwide power failure) it will be overwhelming and virtually impossible to plan for.
|
|
Anna Dupuy
|
18/02/2008 06:50 GMT
RE: Scenario Plans vs. Asset-based Plans
Although I agree with both responses and certainly to the extent that there are far too many scenarios to consider, the main objective is to ensure what ever the plan is, it covers off on the fundamentals.
Business Continuity is about being resilient so before you decide on your approach, be it asset or scenario based training, you need to be clear on your objectives and what it is you are trying to test or achieve.
I often ask the participant to think about their areas in terms of light switches and ask them to consider which lights need to stay on i.e. absolutely essential to continue even in a reduced capacity and which can be switched off.
The switches that remain on need to supported by the plan, while the one's that are switched off, although also requiring management to some extent, need to be catered for as part of the transition back to business as usual.
Further, depending on the event, it may not be possible to walk back in and turn all the lights back on, this may open the flood gates and cause havoc, there needs to be some consideration regarding the sequence of switching the lights back on and an understanding of how long this may take.
A lot of focus is on having plans and test scenarios and the proposed reaction/responses following an event i.e. having a recovery facility, identifying key staff, contacts and processes, however I believe being resilient and having a plan and scenario that caters for return to a business as usual environment is an area which although discussed in the BC world, is often overlooked when implementing or testing plans. Maybe this is something that will help when considering whether to conduct an asset or scenario based exercise.
|
