|
Jeremy Pendyk
|
10/01/2008 18:41 GMT
RE: Scenario Plans vs. Asset-based Plans
Which way to go depends on your needs. If you are looking pulling something together for your insurance company then you need to do a plan based on the worst case scenario.
If, however, you are focused on how you will recover, scenario based planning is not viable. The reason, there are too many scenarios and the plans are not necessarily interchangeable. For example, if you plan for a fire, but get a flood, your plan probably won't work because the damage and response would be different. While planning for the "worst case scenario" it can be a bit too big and also presents the problem of what to do when the smaller event occurs. For example, if your worst case was the destruction of a building, your plans may include contracting out new space and moving all your personnel. However, if a fire at a neighbouring facility occurred (I had a facility cleared for six hours due to a fire about two blocks away) , you would only need a small portion of the plan and it might be hard to break out the components you need when the incident occurs.
For my part, I have been doing a variation on the asset plan. My main focus is on loss. This has been effective for both DRPs and BCPs. By focusing on the loss of services provided by IT systems or the loss of services provided by a team (including the people portion of IT), I have flexibility in how to I respond. For example; I had an incident where the staff at a small call centre all came down with Strep throat. the rest of the company (only one location) was not affected. As a result, I just invoked the plans for that team.
Asset based planning, however, is not easy to maintain. You have to know who and what are operating from where. If you have a larger incident (such as loss of access, or a catastrophic loss of a building) you need to be sure that you have up to date records so that you know which plans to invoke.
All that said, there are still a couple of uses for scenario planning. The first use is when you have diversified operations. In such a situation, when planning, you will need to plan for two scenarios - the loss of one location and the loss of the services overall.
The other use for Scenarios is when testing the plan. In that case, you want to test using the worst case scenario, within reason. Why within reason, because if your scenario is too big (nationwide power failure) it will be overwhelming and virtually impossible to plan for.
|
