Operational Resilience

Yes, it can be confusing, and we recommend reading the following publication: BCI / DRJ Glossary of terms. We always spell out acronyms in full the first instance they are used. Here is a run-down of the most common acronyms used and what they mean:

• BCMS: Business Continuity Management System – Part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity.
• BCP: Business Continuity Plan – Documented procedures that guide organisations to respond, recover, resume and restore to a pre-defined level of operation following disruption.
• BIA: Business Impact Analysis – The process of analysing activities and the effect that a business disruption might have on them. This is a detailed piece of work that helps an organisation understand what is critical to the business, what those critical things depend on and how long you can be without them before the impacts become unacceptable.
• MBCO: Minimum Business Continuity Objective – A minimum level of service and/or products that is acceptable to the organisation to achieve its business objectives during a disruption.
• MTPD: Maximum Tolerable Period of Downtime – The time it would take for adverse impacts which might arise as a result of not providing a product/service or performing an activity, to become unacceptable.
• RTO: Recovery Time Objective – Applications, or functions must be recovered after an outage within this timeframe to stop unacceptable impacts occurring.
• RPO: Recovery Point Objective – The point in time to which data is restored and/or systems are recovered after an outage. Think of this as a backup schedule for data in IT systems.

Business Continuity looks at the organisations ability to recover from an incident that ‘has’ impacted the organisation e.g., having a plan to follow to recover a service or product, testing that plan to ensure it works.

ISO 22301:2012 definition: “The capability of the organisation to continue delivery of products or services at acceptable predefined levels following a disruptive incident”.

Operational Resilience looks at the wider picture of what could prevent you from continuing operations such as risks, change management, suppliers, market conditions etc. Importantly, Operational Resilience is the organisations ability to ‘absorb’ the impacts caused by a disruptive event, and ‘continue’ operations to an acceptable.

BCI definition: “Ability of an organisation, staff, system, telecommunications network, activity or process to absorb the impact of a business interruption, disruption or loss and continue to provide an acceptable level of service”.

A business continuity plan sets out processes to respond, recover and resume operations to a predefined level following any disruption that impacts on the way the business operates, for any length of time. A disaster recovery plan is predominantly concerned with the recovery of the business’ critical technology and provides procedures for managing the recovery of IT and communication services and supporting the business following disruption of these services. A disaster recovery plan can be part of a business continuity plan – but not the other way around!

Put simply, a Business Continuity plan (BC Plan) looks at recovering business processes/services etc. A Disaster Recovery plan (DR Plan) looks at recovering technologies such as IT/Telephony/Data/Connectivity systems etc. BC Plans are business focussed; DR plans are IT focussed.

Firstly, do you understand ‘what’ is critical in your organisation? E.g., Services, Products, Processes, Activities, People, IT Systems, Data, Suppliers etc.? Understanding these means you will be able to create more effective plans to support the recovery of them during an incident.

Do you have plans in place for data protection, crisis management, IT disaster recovery or business continuity, to enable you to cope if your business has a cyber or other business threatening incident? Are these plans kept up to date and have they been tested? Do people understand their roles within them?

Having the correct plans in place, that are regularly tested will ensure that your business, systems and data are resilient if a disaster strikes and help your organisation to survive a disruptive event.

Our planning, consulting and data protection and recovery services address all the fundamentals that you need to cover in order to achieve operational resilience. Current state assessments, crisis management exercises, operational planning and consultancy services simplify the overhead, regulatory, legal, audit and insurance compliances required by modern businesses.

Read more

Yes, some organisations are able to cover all or a lot of what is required, with their own internal resources. However, it is a full-time job and often requires a whole team of people to manage the various elements involved. Read our article to learn more: https://daisyuk.tech/resource/business-continuity-management-bcm-are-you-going-out-or-staying-in/.

There are many providers who can help with different elements of operational resilience, but as the market has increasingly condensed over the years, Daisy is the only UK-wide, full-service business continuity services provider in operation. We are also one of the UK’s leading managed services providers with IT, cloud and communications expertise, which sets us apart from any other organisation in our ability to deliver end-to-end solutions.

Businesses who believed that a work from home strategy would solve their operational resilience challenges are starting to realise that this is not the case. Instead, they are finding that it merely changes the problems they have and presents new risks.

This does not mean that a remote or hybrid working strategy is doomed to fail. Remote and hybrid working is completely possible long-term. However, it is important that businesses ensure that their operational resilience strategy is adapted to include the working from home environment. This is especially true from a data, cyber security and risk perspective, particularly as staff may also need to transport confidential material and laptops more frequently in a hybrid arrangement.

You can read more on this topic here.