The CEO's knowledge of business continuity

Check out this great article from Continuity Central:

CEO? Here are three key business continuity questions you need to ask

So often, the CEO believes they have an understanding of business continuity that is greater than their true understanding. 

Business continuity professionals need to regularly communicate with the CEO to assure they understand the risk level the company was willing to take (as identified in the last Risk Analysis), what business functions were identified as critical to the survival of the company (and what business functions weren't deemed critical), and the resources required to either maintain critical functions without interruption, or recover critical functions in the in the Recovery Time Objective (RTO) as documented in the last Business Impact Analysis - including systems, data, sites, personnel, hardware including workstations

A CEO that understood these things 2 years ago when a Risk Analysis and Business Impact Analysis were completed may not recall everything, if they aren't involved in Business Continuity on a very regular basis (such as weekly, not yearly).

Can your CEO explain what is recoverable and in what time frame? Can they explain how many people would be working from home (if able) or waiting for facilities to secure a new site that can accommodate all employees and functions? 

Check out Continuity Central's article, and I'd love to know what you think.

And keep in mind that Business Continuity Awareness week is coming up in March and could be a great time to work on awareness with your CEO and upper management.

A common theme you may notice in my blogs is that I campaign hard against the idea that disaster recovery is dead (long live business resilience). Unless your RTOs for every function are zero downtime, and you have a perfect mirroring of all systems (which doesn't mean you're immune to disaster), you have work-space recovery for 100% of employees, disaster recovery is still relevant. Even if you have all of those things, you still have to deal with Crisis Communication, Emergency Response and Emergency Management, and Disaster Recovery. 

There is no getting around it. Business Continuity and Business Resilience plans enhance the Disaster Recovery plan, not replace. You can't disaster-proof your business. If you could, well, a lot of us would be out of a job!

Check out my Toolbox page for some resources you may want to incorporate for Business Continuity Awareness week.

Notification Wallet Card Template and Awareness Training

Business Continuity Contact Card (Wallet Card) Template

This PowerPoint presentation was shared on www.slideshare.net: Best Practices in Business Planning for Pandemic Influenza, by Jim Goble, CBCP, at National City Corporation. It's from 2006 but a lot of it is still relevant, including the Wallet Card template on slide 12. 

If you've never created a Wallet Card for your organization, they're very useful. Team members may have a lot of that information on their phones, but it could be outdated. By developing and distributing a Wallet Card, they can refer to it and updates contact information in their phones. This is Crisis Communication, something a team would access during the Notification Phase of an event as well as the Assessment Phase.

Make sure you date your Wallet Cards, so employees can easily tell if they're looking at the most recent version. I recommend updating the card quarterly, or more often if important information changes.

If your organization isn't used to the idea of a Wallet Card, this can be something you introduce during Business Continuity Awareness Week, March 16 - 20, 2015.

http://bcaw.groupsite.com/main/summary

BCAW also has a lot of information you may want to add to your toolbox. You can also sign up for the group so that you'll get reminders about Business Continuity Awareness Week. 

If you know that Business Continuity Awareness is an area your organization needs to work on, make this the year that you introduce Business Continuity Awareness Week!

Manage Risk and Deliver Security in a Digital World

Gartner Security & Risk Management Summit

8 – 11 June 2015 | National Harbor, MD (Washington, D.C. area)

http://www.gartner.com/technology/summits/na/security/

Risky Business

The Information Risk Management group is hosting the 2015 Risky Business conference in London November 12, 2015. Risky Business 2015 will be held in London, England.

http://www.irmplc.com/event/risky-business-conference/