An Interdependencies Workshop
External interdependencies are important and can impact your ability
to recover. Find out what you need to know about this elusive foe by
conducting an interdependencies workshop.
External interdependencies, both private and public, have been of great interest to me for some time now. What are interdependencies? They are your relationships with outside entities – public agencies and private companies – that could affect your ability to recover from an outage and sustain business.
To better understand interdependencies, I have developed a workbook approach that will help you create an awareness of the interdependencies that affect your organization’s business continuity planning and its ability to recover in a timely manner … and, therefore, its ability to operate as a resilient organization. This approach can be used as an aid in conducting an interdependencies workshop within your organization. And by conducting the workshop, the resulting awareness and information will help you:
- Identify the potential impact of various external infrastructure and business disruptions on your organization.
- Identify the impact of the interdependencies on your organization’s recovery times and points.
- Improve the awareness of the ways in which you rely on various private and public organizations.
- Determine potential steps and actions to mitigate or lessen the impacts of outages among interdependent organizations.
- Lay the foundation for continual evaluation of external interdependencies.
The more you understand interdependencies, the more prepared you will be to respond to them. You will be able to develop relationships with public agencies that strengthen your recovery capabilities and reduce the potential for inefficient interaction and even friction that can occur when problems arise. You also will better understand the impact on your ability to operate or recover, based on the recovery capability of other companies or businesses with which you transact business, or upon which you rely.
The steps in conducting an interdependencies workshop are:
1. Create awareness of the interdependencies that exist within your organization.
2. Define a scenario and determine the geographic area that should be considered.
3. Identify public agency interdependencies and impacts.
4. Identify private-sector business interdependencies and impacts.
5. Prioritize public and private interdependencies for action.
6. Review the scenarios and the interdependencies that might occur.
7. Initiate corrective or preventative steps to lesson the impact of interdependencies.
An interdependencies workshop conducted at your location should take four to eight hours to complete. Key players to include are:
- IT management.
- Facilities management.
- Data center management.
- Business continuity management.
- Security.
- Representatives from key business units who understand important business-to-business relationships.
Let’s review the steps of the workshop in more detail.
Step 1: Raise Awareness and Prepare
The first step is to create awareness of interdependencies. Spend some time researching private and public partnerships and share that information with others in your organization. Great sources for that kind of information include: InfraGard (infragard.net), Michigan States’ Critical Incident Protocol (cip.msu.edu), ChicagoFirst (chicagofirst.org), The National Council for Public-Private Partnerships (ncppp.org), and Private and Public Businesses (ppbi.org).
In addition, you may choose to meet with external organizations to understand how they would react to an outage. This will help to validate or mitigate your concerns as well as help them understand your plans and requirements.
Step 2: Define a Scenario
This step will help participants understand the scope of potential interdependencies, based on the types of disasters that may strike. Remember, the scenario must be one that impacts more than just your organization. Hence, an equipment failure, building fire, or other localized problem probably would not result in an interdependencies concern. Try something like this instead:
- A natural disaster, of regional proportions, such as a flood, tornado, hurricane, ice or snow storm.
- A terrorist event.
- A man-made event, such as an accident, malfunction, or deliberate disruption, which might affect a single infrastructure, such as electric, telecommunications, or water.
When you think about the scenario, make sure it is one that would involve public agencies and other local businesses so that interdependencies can be evaluated.
Step 3: Identify Public Interdependencies
Public agency interdependencies are those that involve outside public-sector organizations. Typical issues that arise with public agency interdependencies include utility services that are unavailable, denial of access to your building, transportation restrictions, and lack of medical services. To understand public interdependencies, you should first identify and list all public external interdependencies by type, including:
- Emergency management agencies.
- Federal government agencies.
- State government agencies.
- Local government agencies.
- Utilities (electric, gas, water, telecommunications).
- Public services (police, fire, public safety, emergency management, transportation.
Your discussion should cover the following questions:
- Why is there an interdependency concern?
- How would that interdependency issue impact your organization?
- Who can you speak or meet with to discuss this?
- What action should you take?
Step 4: Identify Private Interdependencies
Private-sector interdependencies are those outside companies that can affect your ability to recover from a business disruption and conduct business. These might be companies that you exchange information with, count on to conduct business, buy from or sell to, or rely upon in some other way.
To address this, you should identify and list all external business interdependencies by type, including customers, suppliers, trade associations, business-critical equipment and facilities vendors, and IT and facilities service providers and contractors.
Following the identification of the interdependencies, you or others in your organization will probably want to meet with all or some of the businesses to learn more about potential impacts. Your discussion should cover the following questions:
- Why is there an interdependency concern?
- What is the organization’s overall recovery strategy, including what is covered, what is not, and why not?
- What is the recovery time objective (RTO) by shared application (time to recover and make operational)?
- What is the recovery point objective (RPO) by shared application (how current will the data be)?
- Who is their recovery vendor and primary site if using a shared vendor?
- What are the major business-to-business interface points, systems, and/or data feeds?
- Who is their contact point during a disaster, and how do you contact this person?
- What major concerns do they have about their recoverability?
Step 5: Prioritize Interdependencies
While you may find a number of interdependencies that can impact your organization, it is important to address the most critical ones first. Select a handful – both the public and private sector – that have the highest potential to disrupt your recovery process. Considerations for selecting a most critical interdependency include: potential frequency of disruption, degree of impact, and the likelihood of resolving the issue.
Step 6: Consider the Possibilities
Now that you have selected the top-priority interdependencies, conduct a round-table discussion with your workgroup to discuss each one and determine the actions you should take. Actions might include:
- Assigning responsibilities to the team to take ownership of individual interdependencies.
- Meeting with the external organization or agency to better understand what they will do when an outage occurs.
- Sharing your recovery strategy and plans with the critical interdependency organizations (confidentiality permitting). This is especially important with fire, police, and local emergency management personnel.
- Determining a course of action for each interdependency.
Step 7: Take Corrective or Preventative Action
As important as it is to identify and resolve interdependencies, it is also important to factor them into your recovery strategy and plans. Consider the following adjustments to your continuity program:
- Modify your business impact analysis (BIA) process to ensure that the identification of interdependencies is an ongoing process.
- Ask questions about new critical vendors, suppliers, and partners when establishing contractual agreements.
- Consider that if some interdependencies cannot be mitigated, your recovery time and point may become unachievable, requiring either communication with management or a change to your strategy.
- Consider how your spending on continuity and recovery might be impacted by interdependencies. For example, are you spending to achieve a level of recovery that interdependencies might not allow?
In the End …
Conducting an interdependencies workshop is an important and prudent step in creating and maintaining your overall continuity strategy. Your continuity program and your ability to recover will be significantly improved by addressing this important issue. CI
