By Kevin Komiega
Disaster-recovery (DR) planners and storage managers play a key role in getting an organization’s technology assets up and running after an outage, but IT is often out of the loop when it comes to people, facilities, and other non-electronic resources. According to a recent report from Forrester Research, most enterprises are pouring dollars into DR technology upgrades while overall business continuity (BC) planning is falling by the wayside. But there is another way IT can have a hand in the BC plan.
Balaouras says enterprises are starting to tackle the problem by turning to a small, but maturing, field of vendors that offer Web-based BC planning software to formalize, organize, and streamline their BC programs.
“Right now, the BC planning software market is pretty small. We talk to a lot of customers who don’t know this software is out there,” says Balaouras.
Forrester pegs the BC planning software market at about $70 million in annual revenues, with a CAGR of at least 20%. However, Balaouras believes the market will pick up steam as more-cohesive BC management and governance plans become commonplace, especially in large enterprises.
“What is strange about BC is that, right now, most enterprises are pretty immature in terms of their governance. At best, they have one individual with the responsibilities of BC planner, with one or two coordinators who report to that person,” says Balaouras. “The BC planner would set standards for BC and DR and hold the organization accountable for meeting those standards.”
Balaouras says as the BC plans within these companies take shape the planners will be more willing to invest in BC planning software. But, she cautions, “this software isn’t for everybody; it’s mostly for larger enterprises.”
Governmental pressure might, as it often does, help the process along. The US government has already taken a stab at outlining the rules of BC planning for financial institutions. In 2004, the Securities and Exchange Commission pushed through rules requiring NASD and NYSE members and member organizations to “create, maintain, review, and update a written BCP that identifies procedures relating to an emergency or significant business disruption.”
The rules cover everything from data backup-and-recovery capabilities to communication with regulators, and even how the organization plans to ensure customers can access funds if the business goes under.
But the British are taking it a step further with proposed standard BS 25999-2, slated for ratification this month. BS 25999-2 goes beyond a simple formalized BC plan for financial institutions to include the establishment of a business continuity management system (BCMS) for all organizations. According to the draft proposal, a BCMS includes planning, testing, training, and constant evaluation of the people, processes, facilities, technologies, and all things related to a BC plan.
Balaouras says the effects of BS25999-2 might be felt in the US as large enterprises consider adopting the standard internally as part of their “best practices,” thus spurring the adoption of BC planning software. “The British standard lays out all of the key elements of a BC governance program, and BC planning software will be key to [setting up such a program],” she says.
According to Balaouras, BC planning software packages come in all shapes and sizes and can serve as a solid foundation for any BC plan. The software, which is offered by a number of vendors, including Binomial International, Business Protection Systems International, COOP Systems, CPACS, eBRP Solutions, Office-Shadow, Strohl Systems, and SunGard (see table), typically outlines the links between business processes and people, IT assets, and other resources. Some of the products are limited in scope, but the features and functions are growing along with the market.
“The software vendors are starting to integrate more features. There are platforms out there that are all-inclusive and start at about $100,000, but there are products out there that focus on core planning that run about $20,000,” says Balaouras.
If the combination of regulations and internal motivation to adopt industry- accepted best practices isn’t enough to get organizations motivated, the bottom line might be.
“Building a business case for an investment like this is tough, but enterprises need to start thinking about it as a competitive advantage,” says Balaouras. “If you can hiccup through a disaster there’s the potential to steal market share from the competition.”