Most people I know in this industry started their careers as business continuity planners by accident. They found themselves in a position at a company where their boss said to them, "Oh, by the way, in addition to all the other things you have on your plate, I want to you do the business continuity for the organization." If they're lucky, the company then ships them off to an industry conference to "learn something about it." Sometimes that helps and sometimes, it just overwhelms them even more.

Business Recovery Is Hard

If you are one of those people new to this field - or those of you who are not so new, but looking for a new perspective - here is some real help from somebody who has been there. First, let me tell you something. It's not about the technology. It's about the business. Technology recovery is easy. It's very black and white. It either works or it doesn't. How well it works and how quickly you recover your technology is entirely dependent on two things. How much money you want to spend and how often you test your recovery.

Business recovery is hard because it involves people and people are not black and white. They have families and houses and lots of other issues that, in a disaster, are more important to them than recovering the business. It's your people who make your business succeed or fail. Technology is an enabler but without the people, nothing happens.

Selling the Need to Recover

Unfortunately, selling the need to recover the technology environment is much easier than selling the need for an enterprise-wide plan. So how do you sell it and who do you sell it to? You sell it to the business people. The business makes the money, and they are the ones who decide how the money is spent. The technology people generally already understand the need for a recovery plan but they don't know how to sell it either and, to be honest, they'd much rather spend the money on new toys for their production environment than on improving the recoverability of the business.

You have to ask the business people if they are serious about being recoverable or whether they just want to meet an audit requirement. If they are not really serious, then you are not going to get them give you what you will need to build a program.

What to Do Next

Once you have implemented your plans, you need to transition from a project into an on-going program of plan reviews, testing, updating, training new planners, and communicating the plans to all employees.

You can also start to expand your plans to include other event types, such as workforce impairment events like pandemics or employee labor strikes or transportation strikes. These are events during which your building and technology are fine, but your people are unwilling or unable to come to work.

And in the End

In the end, your program is a success when every single employee can answer this question: "Where do I go if I cannot get back in my building?" If you were evacuated from your space right now and standing outside the building with your fellow employees and you can tell, either because of the smoke billowing from the windows or the National Guard blocking the entrance, that you were not getting back into your office today, do you know what to do next? Does your staff? Does every single person who works for your company? If you can answer yes, that's a plan.