Business Continuity Management Institute (BCMI)

Business Resilience Aug 2008

BCMI Bangalore Chapter Newsletter

Business must go on, come what may!

BCMI Bangalore Chapter

Focused on CONTINUITY.
Committed to SUCCESS.

Welcome to the BCMI Bangalore Chapter Newsletter!

INSIDE… Welcome to the first edition of Business Resilience – BCMI Bangalore Chapter
Newsletter.
Cover Story
• Business Continuity – A Safety Net for
The purpose of this newsletter is to update and inform BCM professionals on BCMI
Businesses
Bangalore Chapter initiatives and developments. Also and most importantly, to promote
BCMI Courses awareness and understanding of BCM domain across the BCM professionals.
• New to BC or DR?
This newsletter focuses on the criticality of having a well structured Business Continuity
Upcoming Events @ BCMI Bangalore Program in place for ensuring organizational resilience. As such, business continuity
• India Business Continuity Survey 2008 management is a strategic imperative for corporate survival!
Release Event on Aug 27th , Bangalore

BCMI Forum Every business faces minor downtimes and major unknowns; hence it is important to
• Online Platform for BCM have plans in place which guarantee business continuity. Prior to 9/11, quite a few
professionals business executives said that they saw BCP as an inefficient use of resources, i.e. an
expenditure which does not bring any return on investments. But statistics tell a different
Business Continuity (or lack of) from story, and events like 9/11 serve as drastic reminders that it is vital for every company
around the World to have plans in place to ensure business continuity, and the continuity of our suppliers
• Marriott takes Disaster Recovery and logistics - especially as globalization and our interdependence continues to grow.
Underground
1
Business Continuity Plans cost relatively little in comparison what the company could
Key Contacts: potentially lose in a major incident. Therefore it seems highly prudent that organizations
of all sizes seriously research and develop a plausible and efficient BCP.
BCMI India
We hope you find this newsletter useful and informative.
Dhiraj Lal - Country Manager
dhiraj@bcm-institute.org
Happy Reading!
Nidhi - Chapter Coordinator
nidhi@bcm-institue.org

BCMI Bangalore Chapter

Cover Story

Pradeep Prasad - President Business Continuity Planning – A safety net for businesses
pradeep.prasad@in.ibm.com

Krishna Reddy - Vice-President & The events of September 11, 2001 were a drastic reminder to all companies that
Treasurer Business Contingency Planning (BCP) should not be disregarded. According to the Info
krishnareddy.bommireddy@honeywe Security News Magazine (2000), an effective BCP and disaster recovery plan can
ll.com reduce losses by 90% in the event of an incident. According to another study 81% of
CEOs indicated their company plans would not be able to cope with a catastrophic
Ram Kumar G - Secretary
event like the 9-11 attacks.
g.ramkumar@rediffmail.com

Sanjay Mittal - Jt. Secretary There are numerous examples of companies suffering due to poor Business
sanjay.mittal@honeywell.com Contingency Planning. In the 1993 World Trade Center bombing, 150 companies went
out of business (out of 350 affected)-scarcely an encouraging statistic. But an incident
Sandeep Erat - Jt. Secretary does not need to be a dramatic terrorist attack to have a massive impact on an
sandeep@sumerusolutions.com
organisation. For instance, in the case of fires, 44% of businesses fail to reopen and

BCMI Bangalore Chapter Internal ePublication © BCMI India 2008

 Business Continuity Management Institute (BCMI) Business Resilience – Aug 2008

33% of these failed to survive beyond 3 years. The examples could be continued endlessly. The bottom line is businesses need
to have plans in place to cope with incidents (whether they be major terrorist attacks or a minor hardware problem) and thereby
avoid major business interruptions.

Business Impact Analysis

A business impact analysis will help to define critical business processes. This is useful since once a major incident happens all
efforts must be invested to return the primary business functions to a predetermined level during the critical business resumption
phase and to establish the time span to achieve these objectives. Both of these objectives must be determined by management
beforehand for the process to proceed as smoothly as possible. One has to collect data in order to decide which are the primary
business processes and which are the secondary. As a company has limited resources it is critical to understand where it needs
to focus on in order to recover in case of an incident.

Planning

Once that has been done the team can design the Business Continuity Plan(s). It is important to make the plan simple enough
so that it can be executed without any problems during a crisis and it needs to be based on steps previously described. Also
one has to define the threshold for every incident so that appropriate measures can be taken depending on the incident. Once
the BCP plans has been designed and approved it needs to be tested under realistic conditions as untested BCPs historically
fail. David Spinks, Director of Information Assurance EDS, stresses that, "we see far too many Business Continuity Plans and or
Disaster Recovery Plans that whilst they have been tested were done so in unrealistic ideal conditions and thus we do not truly
recognise what really happens in a crisis."

It is important to always tie aims during the Business Continuity Management Process to the business needs. For example, it is
not the function of an Information Security to protect all information. They just need to protect the information which the business
needs to protected. The same needs to be done with Business Continuity Planning.

Once the plan has been tested and designed, it is important to revaluate the plan and retest it as business processes change
periodically as the requirements of companies are changing from time to time. For example, a company buys new equipment on
which it is heavily dependent. Thus a BCP should be revised after purchases, upgrades of equipment and so on. It is therefore
important to realize that the Business Continuity Plan is a living document, which needs to be changed and adjusted if business
requirements change.

Finally it is equally important to educate everyone in the company of the BCP. Since it will be the employees who are there to
react to (or in some cases prevent) an incident, a BCP's success or failure depends largely on the way it is implemented by the
employees. If not properly trained regarding the BCP, its likelihood of success is seriously diminished.

Media Management

One aspect of BCP which deserves special attention is media management. Business Continuity not only deals with putting all
the company's effort in recovering the critical business processes. It is of as much importance to have good media management
during this process, whether you do it yourself in a small company, or have professional help in a larger company. This is
because a company which recovered after an incident, but did not communicate with its customers, suppliers. stakeholders,
shareholders, employees, or affected public will have lost the trust of these groups. This will have an adverse impact on the
company's public perception, lead to a deterioration of faith in the company, and in the end it will translate itself into revenue
losses. So BCP should also focus on what the military like to call "hearts and minds" operations where the company tries to
maintain its public standing. Businesses should prepare public statements beforehand as it would be very bad to have no
comments during a crisis as it will not prevent journalists from writing about the event and turn the event into a PR nightmare.

Manufacturers are highly dependent on their suppliers; hence it is important to work together with the important ones (at least
the ones that support the primary business functions) and make sure that they have good BCP plans in place as it is of little use
to have effective BCP plans in place whilst the main suppliers have none.

Conclusion

In conclusion businesses should have BCP in place in order to resume functionality, and procedures in place in case of an
incident which affects the company and which will enable them to recover far quicker and with less losses than a company who
disregards such plans, thinking 'it would never happen to us.' Business Continuity needs to be seen as safety net for
businesses. Even though there are costs involved, it is well worth having such plans as it will save the business during an
incident and help it react in an ordered and timely matter. Good BCP plans, which are implemented successfully during a crisis,
will give the company good return of investments and hence BCP can be seen as a business enabler.
Article source: http://www.iwar.org.uk/infocon/business-continuity-planning.htm

BCMI Bangalore Chapter Internal ePublication © BCMI India 2008

 Business Continuity Management Institute (BCMI) Business Resilience – Aug 2008

BCMI Courses
New to BC & DR?

BCM Institute offers both certification and non-certification courses. Our courses extend from introductory to specialised and
expert level courses. Whether you are new to Business Continuity (BC) and Disaster Recovery (DR) planning or a
professional practitioner, our range of courses are designed to cater to any level of expertise.

The 'lack of skill' and 'just-in-time' experience based training offered in the public domain is what BCM Institute will be
offering. Our courses will provide a gradual progression of certification in sync with the individuals' advancing experience.

For further information: www.bcm-institute.org

Upcoming Events @ BCMI Bangalore Chapter

India BCM Survey Report 2008 Release Event – August 27th, Wednesday @ Bangalore
th
BCMI Bangalore Chapter is proud to organize an event on August 27 to release the India BCM Survey
Report 2008.

We invite all BCM professionals to this event to be held at , Bangalore between 6 pm and 8
pm.

Mr.Dhiraj Lal, Country Manager, BCMI India will be releasing the Report and giving a short presentation
highlighting the key points. This Survey Report gives us insights into BCM practices, trends and pointers to BCM practices
and maturity levels in organizations across India.

The event will feature video, simulation exercise, discussion and serve as an opportunity for peer networking among BCM
professionals.

For further information, please contact:

Pradeep Prasad – pradeeep.prasad@in.ibm.com or Ram Kumar G – g.ramkumar@rediffmail.com

BCMI Forum - Online Platform for BCM professionals

Join Free @ http://bcmi.collectivex.com/

This site is a meeting place that provides members of BCM Institute with a shared calendar, discussion forums, files and
member profiles.

BCMI Bangalore Chapter Internal ePublication © BCMI India 2008

 Business Continuity Management Institute (BCMI) Business Resilience – Aug 2008

BCM/DR best practices(or lack of) from around the World

Marriott Takes Disaster Recovery Underground

By Carol Sliwa

14/07/2008 11:09:36

Hurricane Katrina and the September 11 attack on the
World Trade Center caused scores of companies to
reconsider their disaster recovery and business continuity
plans, whether they were affected by those catastrophic
events or not.
Marriott International was no exception. Marriott's
outsourced disaster recovery program depended on a third
party company that might require up to 24 hours to restore
business critical systems. Plus, Marriott might need to
compete with others for space at the recovery facility.
That will change dramatically early next year, when Marriott
completes a new "in-sourced" Recovery and Development
Center (RDC) in 12,500 square feet of space leased on a
long-term basis from Iron Mountain. Marriott anticipates it
will slash recovery time for business systems to within four
hours, a standard that many other companies also have
been trying to achieve.
But, what sets Marriott's RDC apart from the typical disaster
recovery facility is its location -- 220 feet underground in a
highly-secure and naturally-cooled former limestone mine
located about an hour's drive north of Pittsburgh, in the US.
When the RDC goes live, Marriott will be the largest private
customer operating a data center in Iron Mountain's 145-
acre "underground city," which has its own fire company,
water treatment plant and 24-hour security and
maintenance force to serve the 2,700 people working there
from 18 companies and various government entities.
"The RDC demonstrates our dedication to developing
innovative technology solutions for our business and the
environment. The underground facility will enable cost-
effective operations and is environmentally friendly,
positioning us to lower our energy consumption," says Carl
Wilson, executive vice president and CIO at Marriott.
Marriott's decision to shift from an outsourced cold site,
which required a formal declaration process to activate, to
an in-sourced hot/warm site, with dedicated space and
infrastructure, falls in line with a trend that analysts have
been seeing with increasing regularity.
John Morency, a research director at Gartner, says the
need for quicker response and recovery times is driving
many companies to weigh the cost of their existing 4
contracts with external providers against the expense of
doing the work internally. Plus, many IT staffs want added
flexibility to manage and test their disaster recovery
processes, rather than being subjected to the rigid time
frames of many third-party agreements.
News Articled Condensed and Sourced from:
http://www.computerworld.com.au/

Business Continuity Quote

“You can't prepare for everything - but you can prepare for anything.”
- Paul Young Johns (involved in Lockerbie recovery)

Business Resilience is a quarterly awareness newsletter of BCMI Bangalore Chapter written and published by BCMI India.

The information contained herein is the property of BCMI except where those articles for which the source has been acknowledged and may
not be reproduced, copied or distributed either wholly or in part without the express written permission of BCMI.

BCMI, India BCMI, Singapore (Head Office)

Level 15,
Eros Corporate Towers
Nehru Place
New Delhi – 110019. India
Tel : +91-11-4223 5338
Fax : +91-11-4223 5339
For more information:
BCMI Pte Ltd www.bcm-institute.org
315 Outram Road
#15 – 04, Tan Boon Liat Building,
Singapore-169074. Or email us:
info@bcm-institute.org
Tel: +65 6323 1500
Fax: +65 6323 0933

BCMI Bangalore Chapter Internal ePublication © BCMI India 2008