Having decided why they need to implement business continuity management (BCM) in order to become more resilient, most companies will then start to look for a specialist service provider to help them turn that decision into action. For all but the smallest companies, this is probably a wise move because business continuity is a highly technical discipline, and specialist assistance is likely to save time and money in the long run.
Here are some factors to consider when assessing which supplier to choose:
Does it offer an end-to-end service? Many companies believe that implementing business continuity management is a once-off action, whereas it’s actually a process that has its own life cycle—a provider that understands the cycle and how to progress from one stage to the next is preferable. This is true even if a company believes it just needs one thing—disaster recovery, for example—it’s just as well to have a partner that understands the full picture. “Make sure that the partner you choose can provide the full range of services, from advisory right through to implementation of both the ICT and physical infrastructures (including an alternative site to work from),” advises Michael Davies, CEO of ContinuitySA, Africa’s leading provider of BCM services.
Another reason for choosing an end-to-end BCM integrator is that such a company will have experience in all of the components of BCM to enable the client to scope the nature of the solution required better, as appropriate to the stage within the life cycle it has reached and its business strategy and risk appetite.
Does it have sufficient experience in BCM and the right level of specialist skills? BCM as a discipline has evolved significantly from its beginnings as a way to recover from IT collapse. Since then, it has expanded to cover the business’s ability to continue servicing customers—how to ensure its business processes can be protected or reinstated.
“Now we are starting to talk even more broadly about business resilience—moving beyond simply understanding risks and putting contingencies in place to fine-tuning the business in the light of its risks so that it is less likely to suffer a setback, or can recover from one much more quickly,” Davies observes. “A company like ContinuitySA has been involved with that change as a member of the relevant industry bodies, so we understand it fully.”
A related point, says Davies, is whether the supplier adheres to and is accredited by the various BCM standards authorities, such as the Business Continuity Institute (BCI) and, of course, the International Standards Organisation (ISO).
Is it technology- and vendor-agnostic? Technology plays a big role in providing contingencies against disaster—it’s vital the provider is independent and thus in a position to choose the right business continuity solution for the client’s needs, without any predisposition for a specific technology or vendor.
Are its solutions flexible, scalable and tested? By its nature, a disaster invocation takes place at a time of high stress, when failure is not an option. It’s worth enquiring how many times a potential provider has actually provided “last-resort” services.
“One of our proudest achievements is that a financial services client had to relocate its treasury and trading operations to our recovery site—and was able to record its best trading day ever while it was using our infrastructure,” says Davies. “Having credible intellectual property around BCM plus a genuine track record is really what one should be looking out for.”