How an Effective Business Continuity Framework Protects Your Company
Running a business is a risky prospect, and it feels like the dangers expand each year. From increasingly common severe weather events to multimillion-dollar ransom demands to a global pandemic, there are threats on multiple fronts. While it’s impossible to predict the future or guarantee that none of these events will happen, a business continuity framework can offer crucial protection that stands between your business and the devastating effects of an impending disaster.
If your business doesn’t have a business continuity framework in place or has one that needs to be overhauled, now is the time. Once you understand the importance of creating a framework and what it takes to make one, you are one step closer to setting your business up for success if it should ever face a crisis.
What Is A Business Continuity Framework?
The goal of a business continuity framework is to keep your company’s operations running even in the event of a disaster. Your framework helps prepare in case there is, for example, a widespread power outage that takes out your IT network. During that time, what happens to your data? How long does it take to get running again? Your business continuity framework should answer these questions.
Business Continuity Defined
There are two key components of business continuity:
- Prevention: protecting against the risks of disaster
- Response: restoring operations after a disaster
An effective business continuity framework will address both of these points in equal measure. In other words, it will help reduce the odds that you will experience a disaster while also outlining the necessary steps to recover should one occur.
One of the best ways to conceptualize a business continuity framework is to compare it to a framework for a building. In order to create a strong building that can withstand natural forces, an effective framework is essential. For example, consider a building designed to resist earthquakes. It needs to have a flexible foundation, proper drainage in case of pooling water, structural reinforcement like braces and shear walls, and appropriate materials like structural steel.
How does this relate to a business continuity framework? Just like an earthquake-resistant building, your business needs to have:
- Flexibility to respond to changing circumstances
- The ability to reduce damage once a crisis has taken place
- Carefully selected tools that reinforce your systems
- Strong preventive measures
A business continuity framework incorporates all of these things. Keep in mind that, just as an earthquake-resistant building isn’t immune to damage, a framework will not ensure that your business will never be attacked or that it won’t suffer any damage if it is. It will, however, help you minimize the damage and get operations going again as quickly as possible.
Business Continuity in Practice
To better clarify what disaster prevention and response look like, let’s consider two examples of ransomware attacks and the very different reactions of the companies involved. This can help highlight the importance of strengthening every part of your business continuity framework.
The DarkSide ransomware attack against Colonial Pipeline in May 2021 was one of the most disruptive cybersecurity incidents in recent years. Colonial supplies gas to locations along the East Coast, so there were major consequences when DarkSide targeted the company’s billing system and internal business network.
Colonial failed to prevent a disaster by using severely inadequate cybersecurity measures, a fact that they have openly acknowledged before Congress. The company’s CEO explained that DarkSide was able to access the system with a single password, which was not reinforced with multifactor authentication. Had Colonial improved their preventive cybersecurity measures, the attack may never have occurred in the first place.
The company’s response to the event was also consequential. Colonial’s pipeline was shut down from May 7 to May 13, which resulted in gas hoarding, spiking prices, and fuel shortages. Ultimately, the company paid the $4.4 million bitcoin ransom demanded by DarkSide. The business’s leadership later stated that while they did not have a plan in place to prevent an attack, they did have an emergency response plan that helped them to bring systems back online more quickly, though the quality of this plan is open to debate.
Contrasting Colonial’s experience with that of Norsk Hydro, which suffered a ransomware attack in March 2019, highlights some interesting differences. While the circumstances of the events were similar, Norsk Hydro’s reaction to the attack was quite different.
In this case, the attackers locked everyone out of the company system and encrypted key areas of the IT network, essentially rendering the business unable to function. Nevertheless, Norsk Hydro refused to pay a ransom. They instead resolved to rebuild their system, rooting out the virus and helping to ensure that the network would function properly once it was back online.
While the system was down, the company relied on manual production, which presented its own set of challenges because modern manufacturing systems are so reliant on automation and computer calculations. Norsk Hydro explored possible options and ultimately decided to take creative steps, like bringing in retired employees who had experience operating with paper calculations and without computer guidance.While they might have lost business, they kept operations running at a minimum. Furthermore, because they were so transparent and open with what was happening, there was no effect on the company’s stock.
Why Is a Business Continuity Framework Necessary?
The experiences of both Colonial and Norsk Hydro make two things clear: every company is vulnerable to an attack, and the response can significantly affect a business’s reputation and future. If this isn’t enough evidence of the importance of a business continuity framework, consider these statistics:
- One in five organizations experienced a serious or severe outage in the past three years.
- A 2022 study found that 80% of data center managers and operators have experienced some type of outage in the past three years.
- According to FEMA, 25% of businesses do not reopen after disasters.
- According to Information Technology Intelligence Consulting, 91% of enterprises reported that one hour of downtime costs $300,000 or more.
Businesses that do not have a continuity framework in place are likely to experience more frequent downtime and more sluggish responses to get systems back up and running. This could ultimately mean the difference between future success and a business permanently closing its doors.
Having a strategy at hand before a disaster occurs can save time and money, protecting a business’s financial viability and also preventing customers from moving their business to a competitor. For this reason, no business, large or small, can afford to be unprepared.
What Should a Business Continuity Framework Include?
A business continuity framework is built on the nine pillars of prevention and response. Returning to the building analogy, a structure won’t remain standing for the long term unless it has strong support beams. The pillars of prevention and response serve the same purpose for your business continuity, protecting you as much as possible from disaster and offering solutions when you are unable to prevent an event from occurring.
Business Continuity Plan (BCP)
The BCP is the heart of your business continuity framework. It serves as a blueprint and includes comprehensive documentation of all of the elements that are necessary to avoid and reduce downtime. Although BCPs are tailored to specific business structures, most include:
- Initial data
- Purpose and scope
- Instructions for use
- Step-by-step procedures
- Glossary of terms
- Schedule for testing and updating the plan
Making this written document widely available is vital. It offers transparency to your team, allows everyone to prepare in advance, and enables all parties involved to act more quickly if an incident occurs.
Disaster Recovery Team
It’s important to have a dedicated team who is responsible for your BCP. This team will write, update, and test the BCP and manage the recovery process. In order for the team to be most effective, it’s best to include personnel from across the organization who are knowledgeable about the business, can react quickly, and have the ability to provide calm and steady leadership during a crisis.
Threat and Risk Assessment
Depending on business type, size, and location, you may be more vulnerable to specific kinds of threats. You can’t properly plan without taking into consideration the disasters that might realistically strike. Some of the threats you may need to prepare for include:
- Security breaches, including cyberattacks
- Natural disasters
- Power or utility outages
- Equipment failures
- Unexpected staff departures
- Contagious illness
- Supply chain interruptions or delays
Within your BCP, you may need to identify different plans based on the type of disaster that occurs. In other words, you will need to take different steps in response to a flood than to a ransomware attack.
The impact analysis aligns with your threat assessment. You will not only identify threats, but also estimate how they could potentially affect your business. Some of the most common impacts of disasters are:
- Downtime costs
- Inaccessible premises
- Loss of revenue
- Unavailable or idle personnel
- Recovery expenses
- Brand image
As you consider the possible impacts, you can prioritize processes and systems that need to be restored and work toward mitigating financial and production losses. Your impact analysis should include consideration not only of the impact on your own business but also on your customers, suppliers, and various stakeholders.
Continuity Technologies & Solutions
Identifying risks and impacts serves little purpose if you do not respond by implementing the technology that ensures continuity. Data backup is one essential component, and choosing the best system for your business is critical. For example, smaller businesses may need a solution with power and security but without excessive storage. Larger businesses, however, may need an option with significant storage for large amounts of sensitive data.
In addition to installing high-quality data backup technology, you may also find yourself in need of data recovery services if a disaster occurs and you are unable to retrieve important files. Researching and identifying a service in advance can save you precious time when you need to recover your data as quickly as possible.
Just as your business will need to back up its data, you also need to have a plan for a backup site where operations can continue at some capacity. Not all businesses can afford to keep a backup location on standby at all times, but you can nevertheless prepare so that you can find one without delay should the need arise. At the very least, consider finding a real estate professional that you can contact for potential locations if there is an emergency.
There are three possible options for backup sites:
- A cold site that does not have servers or other equipment installed
- A warm site that has some equipment
- A hot site that mirrors your data center with full infrastructure in place
The type of site that you create will depend largely on your budget and your needs. You can return to your impact analysis to determine which operations need to be brought online first and prioritize those in the design of your backup site.
Within your BCP, you should also break down the communication that needs to occur in the event of a disaster. Determine who is responsible for contacting:
- The media
- Regulatory agencies
- Law enforcement
You should also identify the means of communication. Will the team disseminate information using email, phone calls, or some other method? In addition, provide contact information for your disaster recovery team so that employees know who to contact if they need more information or have questions.
One of the core elements of a business continuity framework is a set of recovery strategies. While in an ideal world you could implement procedures that would eliminate any risk of ever experiencing a disaster, the reality is that there is no way to fully protect your business against all possible scenarios.
Your recovery strategies should outline in detail what will occur to restore full operations in the shortest time frame possible. You may want to identify procedures based on both short-term outages, such as five days or fewer, and long-term events that could go on for weeks or even months. Keep in mind that, although it may be tempting to leave out things that seem obvious, like calling 9-1-1 in the immediate response to a fire, it is in your best interest to document every step, no matter how minor.
RTO & RPO
As you develop your recovery strategies, you will need to determine two key parameters:
- Recovery time objective (RTO): the acceptable amount of time for recovery after a critical event
- Recovery point objective (RPO): the acceptable amount of data loss measured in time, such as a backup recovery point from four hours prior to the event
These numbers, in combination with your impact analysis, help you to create more effective and practical recovery strategies. With the RTO and RPO, you have a very specific objective that your recovery strategies should aim to achieve.
What Else Should I Know about a Business Continuity Framework?
With all of this information in mind, there may still be some lingering questions about how to proceed. As you move forward, consider:
- Where to start: Using a template to create a business continuity plan can save you time and ensure that you address all of the necessary information.
- Who is responsible: In general, IT departments generally take the lead on business continuity planning, but bringing in members of every department or business unit will make your plan more comprehensive and useful.
- When to seek help: In some situations, businesses with little to no experience in business continuity planning may benefit from bringing in a consultant to offer guidance and support.
- How to evaluate effectiveness: Testing is key to success, and it should take place on a regular basis, evaluating every aspect of the plan and whether there need to be any updates, particularly when it comes to technology.
In the end, creating an effective framework may be labor-intensive, but it is well worth the effort to protect your company and customers.
Where Can I Learn More?
Planning for a possible crisis can be unpleasant and daunting, but there is help available if you want to learn more about business continuity, disaster recovery, and data backup options. Reach out to the experts at Invenio IT to find the solutions that will work best for your business.