Special Report on Software Tools
Our reader survey showed that 56 percent of respondents use business continuity planning software, down slightly from 59 percent in 2006. Seven percent of respondents to both the 2006 and 2009 surveys said they were currently considering or evaluating the purchase of a software product. An additional seven percent of respondents to this year's survey said they are considering changing software tools.
Pass SaaS Class?
While software usage remains fairly static, the way in which tools are deployed is changing. This year's survey showed that the majority (about 60 percent) of BC software is installed in customer environments. However, nearly 30 percent is vendor hosted, using either an ASP or SaaS (software-as-a-service) model. Three years ago, only 11 percent of tools were vendor-hosted. Some vendors are even offering SaaS-only tools.
"A lot of customers are wanting a hosted environment," according to Chris Alvord of COOP Systems. Alvord says the SaaS model results in "increased efficiencies" for the vendors and "very secure situations" for the customers, who are demanding "a lot of proof" that vendors can deliver what they promise.
That proof is key, says Frank Perlmutter of Strategic BCP. "A lot of people are saying they have a SaaS tool, and they really don't." How can consumers spot a true SaaS? According to Perlmutter, authentic SaaS tools are not only accessed via the Web, they were developed for it. "Webified" tools, those built to be client/server installations and later modified for Web implementation, can be "unstable and highly prone to errors," he says.
Other signs you are talking to a true SaaS vendor? Typically, SaaS tools will not require charges for maintenance and updates. SaaS tools are always vendor-hosted, pricing is subscription-based, and there are no software and hardware requirements for the customer. "The only thing you should need is a web browser that does not need be configured by an IT guy," Perlmutter says.
Do More, Cost Less
As deployment options are changing, so are customer needs. Not surprising given the economic climate, nearly 60 percent of respondents said cost was very important in their choice of a tool. This is up from 48 percent in 2006. But readers have more than cost on their minds. They are also asking for tools that do more.
There are still those who want-and are served well by-traditional business continuity planning tools. But there's also a segment of the market that is asking vendors to put the emphasis on business, rather than plan. These customers are looking for tools that document business processes, result in actionable plans, include risk management functionality, and have some inherent business logic, analysis, and thought process built in. Their goal is to use such tools and then show management how their business operates, how redundancies might be eliminated, and how to reduce costs.
Ramesh Warrier of eBRP Solutions sees it as "business continuity planning reaching a stage of maturity where you could go into your senior management, your customers, your regulators and say 'I am incident ready.' I am prepared for any event because I have done my risk assessment, I have done my impact analysis, I have developed plans," and "I have tested and optimized those plans." Your software tool "should support each of those steps, as well as dependency mapping, resource management, collaboration, communication, and plan management," he says.
It also should provide "a decision support system" for incident management "where you can see what has been impacted, how many customers and vendors are impacted, etc. Understanding that is critical to effective incident management."
Steve Burns of EverGreen Data Continuity says some companies are looking for a BCP software tool that can double as an "an asset management tool, that can give them a snapshot of what departments are using what applications, sitting on what servers and on what network legs. That way, if a server goes down, they know who is effected and can quickly understand the impact."
He says customers are wanting more tools with built-in analysis-including gap analysis-that don't just tell users what's missing but also suggest solutions. "When you get a certified business continuity professional, they are looking for in-depth analysis with real intellectual property. It's a certain level of sophistication. You are seeing more well-rounded business continuity people who have more of a business understanding, rather than the IT guy who was dragged out of the server room and made the disaster recovery expert."
"They want more analytical tools that are visual," says Alvord. "They want to see dependency maps showing up and downstream how processes are related and what financial impacts are. They want to be able to mine data, analyze it, and link it to external systems."
Speed is another important concern, says Global AlertLink's Kevin Hall. He suggests customers consider how actionable plans are and how quickly they can be activated before committing to a tool.
"If they are building plans for planning's sake, then it is unlikely that they are building actionable plans," Hall says. "If you look at the amount of time that is put in by a company to do risk analysis and assessment, in creating static checklists, the value that ultimately derives when an incident occurs is very minimal. He says continuity professionals faced with real crises have found that "they didn't have what they needed to manage the event. They need a tool that helps them see what's going on and collaborate. They need living, breathing plans."
For Hall, a plan's pulse is only as strong as the workflow connected to it. He suggests looking for tools that automate planning functions, such as information updates, and action plans. "If a system can actually automatically kick off workflows, you get a lot more out of what you put in." If you have to do everything manually every time, "you never get past second base because you are hitting doubles every time."
Russ Blackwell of Paradigm Solutions International also favors "removing as many of the manual processes as possible to increase the amount of automation and routing of data."
There isn't a software vendor out there who will tell you their tool is difficult to use, confusing to navigate, and a chore to customize. They all claim to have "easy to use" and "intuitive" products.
And ease of use is a hot topic among CI readers. While 83 percent of those surveyed said ease of use was very important, some 35 percent of respondents were only somewhat satisfied or not satisfied with the ease of use of their tool. And 37 percent of respondents said they were just somewhat satisfied or not at all satisfied with overall performance. About 10 percent of readers surveyed in both 2003 and 2006 continue to use Microsoft Office in place of a commercial planning tool.
There seem to be two main strategies when it comes to usability - design the tool to mimic or incorporate widely used business tools, like Microsoft Word, Excel, and SharePoint, or build an entirely new system that is as intuitive as possible.
Isabelle Primeau of Premier Continuum believes use of Word is key. "BCP is always over and above normal duties. If the BCP manager has it as his job, he is lucky. But all the other people involved, have other things to do. And many tools have a really big learning curve to understand the software and adapt plans they may already have to the software methodology and terminology." Primeau says the more work that can be done in Word and Excel, the better. "People are comfortable with it, and already know how to use it."
Blackwell says ease of use is essential and favors a dashboard-type approach that is being used used in various ways and to various degrees by several software vendors. In this model, he says "everything that is important to the user is displayed up front. It is easy to use, especially for casual users. And it is very intuitive. Users can log on and see their plans and make updates, and there is no complicated navigation."
The Methodology Debate
Another area up for debate is methodology. Some tools have built-in methodology. Others don't. Both sides have strong opinions.
"There are tools that are powerful and loaded with lots of capabilities, but they come with a mindset that the business continuity professional is the person who is going to do the planning," says Virtual Corporation's Scott Ream. "But when you have thousands of plans, there's no way for a core [business continuity] group to write those plans, and there is no way that you are going to get to get all of the thousands of department managers to a training that takes two to three days -all for a tool that they would work with for eight to 13 hours a year. There is a need for a tool for business people, operations managers, who are not themselves business continuity professionals but who own the responsibility of planning for their part for the organization." Ream says a tool should be "methodology agnostic" and "designed to facilitate planning."
Not so, says Perlmutter. "You need to have a fully built-in methodology, or else you will have to program the tools and tell it what to do. If you want to map business processes, you have to tell it how to do that. If you want a tool you can use right away, you need that methodology. Otherwise, it's more of a science project than a way to build plans, and it's limited to what your own people can design. It's like if you went to use TurboTax, and the first thing it asked you is how you wanted to do your taxes. If you knew that, you wouldn't need the software."
All in One
Tracey Forbes of SunGard Availability Services Information says software users should be looking for tools built on best practices, business continuity experience, and customer requests. She says the trend is for vendors to offer "one-stop shopping for business continuity," by providing a single interface and single sign-on to multiple tools that can "support the full life-cycle of the BC program."
"This is driven by standards and regulations, particularly BS 25999, as well as increased global awareness of the importance of BCP," she says. It used to be that BIA capabilities, some crisis management task tracking ability, and a link to a notification tool were enough. But today's customers are asking for "integrated tools for risk assessment, workforce management, and supply chain management."
Supply chain is an area of particular interest, she says, because "while there is a need to look at the dependencies within your organization, it doesn't stop there. You have to look outside of your organization and you need to do some analysis on the resiliency of those particular vendors." Some tools allow you to gather data from vendors to ensure that they have plans and that those plans are plans are being built and exercised according to your specifications."
The all-in-one approach relies heavily on a vendor's ability to integrate the tools. Customers should not be satisfied with a simple affirmative when asked if tools are integrated. Some integration requires data to be downloaded from programs and uploaded into the business continuity tools. "Seamless integration," which is also claimed by every vendor, is when the tool pulls information from sources and keeps data current real-time, without the need for manual intervention. CI
Winner of the 2007 Software of the Year Award, COOP Systems is the exciting developer of myCOOP™, the complete BCM software solution provided to a growing client list around the world. The full life cycle for all functions is managed in a tightly integrated, web-based, easy-to-use package. With a reputation for rapid no-risk deployments, low cost of ownership, and extreme ease-of-use for all users, myCOOP™ is the next generation of business continuity software.
eBRP Solutions, Inc.
eBRP Solutions has unveiled it latest innovation-Toolkit SaaS. Toolkit SaaS puts eBRP's award-winning Toolkit-chosen by Fortune 500 enterprises-within reach of organizations wishing to accelerate their BCM program without the constraints of capital expenditures or internal software management issues. Offered with no up-front fees, and only a flat monthly charge, Toolkit SaaS alleviates the burden of software maintenance, change management, and technical support. Hosted in a SAS-70 audited environment, Toolkit SaaS offers unlimited user access via Internet Explorer.
EverGreen Data Continuity, Inc.
EverGreen's Mitigator version 8 is business continuity management software. Mitigator is the only Business Continuity Management solution to enable enterprise customers to integrate business and operational risk analysis, mitigation strategies, recovery planning, test analysis, emergency notification, documentation management, and security protection.
Global AlertLink™ is the first and only truly integrated solution to provide all of the critical elements needed to keep businesses moving in crises situations. Only Global AlertLink offers planning tools, incident management, emergency notification and risk management all in one system. Now, there is no longer a need to maintain separate systems. Go beyond notification…experience Global AlertLink.
Paradigm Solutions International
Paradigm Solutions International is a trusted source of emergency planning software and certified consulting services. The OpsPlanner™ BCM tool delivers web-based, fully integrated BCP/COOP/DR planning, business impact analysis, incident management, and automated notification. Our easy-to-use, yet powerful tool provides a reliable and cost-effective response to any crisis situation. Our customers rely on PSI's OpsPlanner software and expert certified consulting to reduce their operational risks, protect their people and property and prepare for any unexpected disruptions.
Premier Continuum, Inc.
Designed by Premier Continuum, ParaSolution helps you easily develop, maintain and communicate your Business Continuity Plans by facilitating plan members' involvement (access control, reminders, intuitive web interface...). Using user-friendly MS-Word documents as input forms and outputs, our web-based software captures the changes made in one document and modifies all other documents, sharing the same information. With ParaSolution, be more confident in your plans...because we think the way you do.
ResilienceONE™ from Strategic BCP, a Gartner 2009 Cool Vendor in Risk Management, is the easiest, most cost-effective web-based BCP software. ResilienceONE™ is an all-in-one planning, incident management, and notification tool that goes beyond traditional plan generation software with its highly intuitive business process-based methodology. Proprietary risk algorithms and metrics automate cumbersome tasks and provide unmatched insight into risk. ResilienceONE™ is still the only true BCP SaaS with NO upfront hardware, hosting or software costs, separately-sold modules, or upfront configuration.
SunGard Availability Services LP
SunGard Availability Services provides disaster recovery services, managed IT services, information availability consulting services, and business continuity manage-ment software to more than 10,000 customers in North America and Europe. With four million square feet of datacenter and operations space, SunGard assists IT organizations across virtually all industry and government sectors to prepare for and recover from emergencies by helping them minimize their computer downtime and optimize their uptime. We help organizations ensure their people and customers have uninterrupted access to
their information systems.
Virtual Corporation provides business continuity consulting and software with extensive experience in Healthcare. Their HVAdvantage™ methodology and toolkit expands on the traditional HVA required by JCAHO to give a true analysis of risk by facility and in order to mobilize an effective response and links HVA data to operational impact. For BC and IT recovery planning, Virtual offers Sustainable Planner®, complete with pre-populated plans for over 90 departments. SP is available as a perpetual license with optional hosting, or SaaS on a biannual, annual, or quarterly basis.