Good Practice Guidelines 7.0: Enabling business continuity solutions
This month, we are releasing a series of articles highlighting some of the updates to the upcoming BCI Good Practice Guidelines (GPG) Edition 7.0, ahead of its launch on 1st November.
The GPG Edition 7.0 marks the start of a new journey where the document will be reviewed every year. This means that the GPG can better reflect the changing practices of the business continuity (BC) and resilience industry as they happen.
The new GPG consists of six professional practices (PP), split into two management practices and four technical practices. These provide a structure to be used in the development of a Business Continuity Management System (BCMS). In this article, we will be focusing on the revisions to Professional Practice 5 — Enabling Solutions.
PP5: Enabling Solutions
Enabling solutions is the PP that outlines the methodology for implementing the agreed solutions from PP4 Solutions Design, as well as for developing the response structure and business continuity plans to ensure that the solutions can be used when needed.
When considering the revisions to PP5, the group leader noted that one of the most significant is the change in perspective within the section. “Just like we've made a change from embedding to embracing in PP2, here we've changed from implementation to enabling the solution,” says the leader. This has been introduced to enhance the clarity of the PP in terms of what is required from practitioners, but also to highlight the throughline from an organization’s business impact analysis (BIA) in PP3, to the solutions in PP4, to implementing what you have agreed on in PP5, before validating them in PP6 – essentially improving the links between input and output in the overall business continuity management system (BCMS). However, the leader explains that enabling solutions also refers to making sure that the solutions are implemented and supported by a response organization and response plans so that these work as they have been designed.
When developing the revised version of PP5, the group considered feedback from practitioners and also worked to align the PP with industry standards.
The group leader added that the revised version is also enriched with additional content. It now considers the characteristics of implementing the BC solutions as defined in PP4. For this, the group prepared a specific section on the implementation process which highlights the essential elements that practitioners should consider when implementing BC solutions. This may include plans for extra data centres, back-up suppliers, alternative locations, training back-up staff, etc. The rest of the PP deals with the response organization and the response plans (collectively known as the Business Continuity Plan).
For the design and implementation of the response organization, attention was paid to how BC practitioners need to work together with other teams and how they can bring them together to provide a unified response.
The group leader also explained that the PP explores what happens when the organization is in its response phase, when it is utilising its business continuity management measures, and the return to business as usual (BAU). “I think that is something that's just not in any other document at this point. It makes you think further ahead.”
A matrix of plans
As in the GPG 2018 Edition, PP5 explores strategic, tactical, and operational plans. However, in this revised version, the group have worked to show how the different plans within an organization might be known by different names and be owned by different teams. This is highlighted by a table which showcases an overview of different plan types within a typical organization. The group leader notes that while a specific plan may not necessarily be in the BC manager’s domain, BC management may still depend on it, so it is important to make sure that the plan is present and functioning.
“We've recognized that there are many plans that come together in your overall response, like your emergency response plan, for example, and in the style of building resilience within the organization, we want each department to be able to cooperate. Therefore, we've taken into account that there are many different plans that need to come together and that they might have different names.”
PP5 now also includes an approach for scenario-specific planning, such as for infectious diseases or cyber incidents. The group leader explains that the plans have been designed to introduce a structure for the practitioner to consider, build on, and apply to their own organization.
After activation
As noted above, the revised PP5 also now includes a section which explores the process for returning to business as usual (BAU) after activating an organization’s recovery measures. The group leader noted that this may not be a simple process if the organization’s premises has been significantly affected by a fire or flood, for example. “You can't always have plans for going back to the original situation because the original situation may not exist anymore,” says the group leader. Therefore, the methodology includes a process for returning to BAU with the original resources but also for new resources as well.
Next article
The next article will explore changes to PP6.
Download the Good Practice Guidelines Edition 7.0
More on
About the author
Kieran Matthews
Content Creator, The BCI
