The economy. Everyone has felt the effects of the economic downturn, and the business continuity industry is no exception. To explore the related issues Continuity Insights spoke with Carolyn DeWitt of Dialogic Communications Corporation (DCC), Ramesh Warrier of eBRP Solutions, and Troy Winskowicz of Dell ProManage-Modular Services.

How have business continuity and resiliency changed due to the recession?

Carolyn DeWitt, Dialogic Communications Corporation (DCC): Clearly, the economy has impacted everyone from Wall Street to Main Street. Companies, like consumers, have tightened their belts and braced themselves for the long and bumpy ride to recovery. They're thinking more creatively about ways to do more with less, both in dollars and headcount, and they are seeking to improve efficiency on every level.

The "business" of business continuity is no exception. Planners are using this time to reassess their organizations' strategies, and they are addressing any and all vulnerabilities, particularly in the area of communication. Those without emergency notification technology are continuing to evaluate vendors, identify key capabilities, and compare pricing as they finalize their 2010 budgets.

Those with the technology are asking, "How do I further expand the use of this valuable tool so we can eliminate other manual communications processes and expedite decision-making?" To these organizations, we recommend integration with other software and/or databases via an API (application programming interface); use of an inbound bulletin board (if available) for general information-sharing, status updates, etc.; and surveying/polling of employees, customers and others on a regular basis.

While the economy finally may be showing subtle signs of improvement, business continuity professionals have been moving forward all along. For them, continuity is their business, and that means helping their respective organizations get through the toughest of times, whether in a pandemic or a recession.

Ramesh Warrier, eBRP Solutions: The most obvious change is slashed budgets, programs, and personnel. For many business continuity management (BCM) organizations and professionals, the new mantra is survival. How much "soul searching" is going on in these budget reduction discussions? It seems clear that when BCM and DR programs haven't been shown to add to the bottom line, reduce costs, or affect customer satisfaction, many organizations have willingly sacrificed BCM to save programs that do. We've seen organizations slash BCM budgets and manpower - in one case reducing a BCM program from 17 full-time employees to one. Look at 2009 BCM industry tradeshows; in some cases, attendance has been down more than 50 percent over prior years. Companies are looking to maximize returns on investment. Those BCM professionals who haven't demonstrated the value of their programs are suffering consequences - sometimes extreme ones. Some organizations have chosen to assume the risk of a disruption by completely dismantling their BCM programs.

Troy Winskowicz, Dell ProManage-Modular Services: As companies are forced to do more with less, we see them looking to service providers such as Dell to fill the gaps. software as a service (SaaS) is one way we see customers enhancing their resiliency without increasing headcount. For example, traditional backup and recovery solutions for Microsoft Exchange and Lotus Notes require a senior skill set and extensive hardware resources. Dell's email continuity and recovery services allow our customers to meet or exceed the RPO (recovery point objective) and recovery time objective (RTO) demands set by the business at a fraction of the cost and personnel requirements of traditional solutions.

Do you see any emerging areas in our field that will be critical in this new economic environment?

CD: The role of emergency notification technology is changing. It is no longer simply about pushing information out in contingencies, like severe weather or security threats. It is a 360° process that allows organizations to come full circle, helping them gather important feedback for business continuity, employee safety, client relationships and day-to-day operations.

The benefits of utilizing emergency notification technology outside of contingencies are two-fold. Communication is improved, and a faster ROI is realized (which is extremely important and beneficial in these tough economic times).

RW: If the days of big budgets are over, there are going to be corresponding changes in how organizations perceive BCM, and what they're willing to pay for. Organizations have begun to merge risk management and BCM - to look to at BCM as a supplement to their enterprise risk management strategies, not as a stand-alone function.

Organizations have also begun to question the value of the traditional 10-step BCM program development roadmap. They've begun to understand that in that traditional program, plans serve a very limited purpose - as ?insurance policies' to satisfy regulators and business customers - but aren't enough to assure their ability to respond to potential risks that cause a disruption.

Management is beginning to understand that it needs specialized information that will facilitate good decision making during a disruption; and a BCM program built around paper plans doesn't provide that decision-supporting information. The days of hiring consultants to write plans - and having them come back year after year to rewrite them - may be over.

TW: SaaS is the single biggest change to impact the BC/DR space in recent history. We are seeing more and more customers, of all sizes, moving critical DR functions to the cloud - from communications infrastructure to server replication and application failover. The SaaS model allows companies to achieve resiliency never before attainable, through geographic dispersion and zero internal resource dependencies.

What opportunities have emerged for savvy BC professionals as a result of the economic crisis?

CD: By having to be more resourceful in their thinking and more conservative in their spending, many business continuity professionals are looking for ways to help their respective organizations do more with less. They are suggesting "out of the box" uses for emergency notification technology (like HR-related communications), and they are justifying upgrades to these systems by demonstrating their numerous, enterprise-wide benefits.

Take H1N1 for example. The obvious use would be to alert employees of outbreaks and office closures as they happen. The not-so-obvious use would be to call employees weekly to see if they are experiencing any flu-like symptoms. With information gathered from these notifications, organizations could potentially identify "hot spots" ahead of time, taking the necessary precautions to avert an office closure and subsequent loss of revenue.

As another example, many business continuity professionals are now being approached by their organizations' security divisions to help them in improving protection of assets and personnel. It is a sad, but true, fact that the economic crisis has resulted in a direct correlation to workplace violence incidents. Notification solutions like DCC's NetNotify can quicken the response and protection of others in the workplace or minimize the affects of domestic violence in public areas, by disseminating upwards of 50,000 desktop alerts across an organization's IP network.

While the economic outlook remains somewhat bleak, the opportunity for companies to build on their business continuity/crisis communications strategies does not. It is just a matter of matching budget to need and information to results.

RW: One of the major topics that risk management organizations have begun to grapple with is supply chain risks. This may present an opportunity for BCM professionals: how to analyze them, how to develop mitigation strategies, and how to help organizations understand their supply chain dependencies and risks.

BCM professionals - those who have thus far survived - need to get out of their safe little shells and start participating in the mainstream operational areas of their organizations. They have to stop thinking of themselves as lords of little oversight fiefdoms and start becoming facilitators. A good BCM professional has a unique perspective; he or she often knows more about how the company functions (and certainly more about the risks to its continuing function) than anyone else in the organization. That knowledge can be leveraged to add value. Volunteer to participate in new product, new process, and new application brain-storming sessions, or get involved in development groups. Shoulder into reorganization and downsizing meetings. Use that unique knowledge of impacts and organizational dependencies to help decision makers make better decisions.

Bottom line: burn all the existing plans, forget about rigid BCM guidelines, and start focusing on adding value to the organization - not protecting turf. If the economy gets worse, there may not be any turf left. And when it gets better (and it will eventually), you won't just be a survivor, you'll be an insider.

TW: We have seen the more experienced and savvy BC professionals learning to combine services through one vendor. In tough economic times, leveraging multiple purchases through one support contract allows you to better negotiate price, service level agreements, and executive relationships. Dell prides itself on being that one vendor that can partner with our customers to maintain the highest levels of service, whether it is hardware, software, SaaS, or consulting services.

What advice do you have for organizations struggling to maintain-and improve-preparedness and resiliency while doing more with less?

CD: Take this opportunity to re-evaluate your crisis communications strategies and address all vulnerabilities, whether in processes or infrastructure. Look for ways to streamline operations and improve efficiency. Communicate more (your people will appreciate it).

If you have an emergency notification solution, use it for daily, weekly, or monthly communications. Remind people of company meetings, scheduled activities, continuing education requirements, CPR training, etc. These are simple ways to ensure that when an emergency actually does happen, your people will be able to activate with confidence, and that recipients will know exactly what to do when they receive notifications.

If possible, run full tests of your emergency notification scenarios. This will help you identify potential problems, such as incorrect data, ahead of time. If you have a small amount of dollars left in your budget, consider upgrades, like surveying/polling, or take part in refresher training programs.

Small measures such as these will ensure your communications readiness at all times, and open the door for major improvements, or new vendors, when the economic situation improves.

RW: Think "risk-centric." Forget about maintaining line of business recovery plans, and department continuity plans, and data center recovery plans. Focus on the most critical assets at risk - the vulnerabilities, the gaps, the single points of failure. Stop rewriting "scenario" plans ( for hurricanes, tornadoes, loss of IT, etc.) and start creating asset-based plans that can address any disruption (all hazards).

Make an effort to prove to whomever controls your BCM budget that an automated notification system is much less expensive than the man-hours spent updating (and executing) call trees!

Network, network, network. Join a BCM organization and attend meetings as often as you can. Establish and maintain relationships with other BCM professionals. Share best practices. You may learn things that will help improve your program, or help someone else improve theirs. And you just might need those network connections if the economy gets worse.

TW: We always recommend that our customers start with a good communications plan. If you can't communicate, you can't recover. Ensuring communications during a crisis requires practice and the right tools. Emergency notification services are a good start. Notifications allow you to send instructions to employees or key vendors and customers.

Equally important is the implementation of a collaboration tool. A collaboration tool will give your teams a place to share documents, task lists and notes while you manage through a crisis. An obvious, but sometimes overlooked, element of communication is e-mail. If e-mail is not available it becomes nearly impossible to continue business operations. So much of our daily activity flows through e-mail. Most companies are dead in the water without it.

Using a SaaS provider for these services will ensure the continuity of communication regardless of the state of your infrastructure. Good communications are not a replacement for a good plan, but in times of doing more with less, communications can help cover gaps. Perhaps most importantly, communications help your people manage to recovery. CI