RBS and BC
Currently working on a 12 month contact with RBS within UK&I Business Continuity.
This is one of the on going battles any Business Continuity Manager/Consultant etc has to face.
There are many different ideas of how to do this, buy in from above, buy in from below, accessibility etc etc etc.
The issue is the difference in high level and general level buy in. High level buy in will tend to be from managers who are set in their ways, where as the general level buy in will be from the younger more tech savvy. This present a problem. When you ask for money to develop a new style of BC strategy, using new technologies for example the top level managers may not see its relevance or applicability.
To allow for a greater understand of this a dynamic use of the current technologies in place is the solution. For example sharepoint or similar forums open to all cal provide a simple way to get the messages out there…especially with new intakes to the work force who will filter up in the company. There can also be simple ideas like deploying images as backgrounds for staffs computers, allowing you to transmit messages simply to them.
The above solutions and more can begin to entice the senior buy in to using more advanced and new technologies within your companies BC plans.
Yacht Racing and Resilience
Resilience roles bring together people from many different backgrounds; Army, Local Authority, Close Protection, IT professionals and the list goes on. My background is as a semi professional Yacht racer racing on yachts from 53ft carbon fibre grand prix racers to 150ft classic yachts.
When we put this role into a resilience role, there are great similarities.
Firstly, the drive behind yacht racing is to win, the better the team the more competitive alongside a mentality which understands that winning occurs due to on the water performance (actual ability to deal with a crisis) but also off the water performance (preparation and planning of team and scenarios).
The planning and preparation involved in yacht racing gives a fluid outlook on resilience as in yacht racing you can be racing inshore (3-6 hours) to offshore (1+days) which presents a different need for each occasion – what do you need, what can you do without, what could go wrong, what will you need if anything goes wrong – changing every time. With this goes the preperation and practice of scenarios and having a team which is experienced and dynamic to deal with all scenarios, with post practice reviewing and improvements.
Crises can be as simple as not crossing the stating line as the starting gun goes to loosing the mast 100+miles from any help, both have large impacts on winning a race, a crisis in the business word can have an effect on profits etc.
If nothing else it brings another outlook on resilience to the table which is definitely worth a listen.
How much do you use and trust google maps?
Read a really interesting article in GeoConnections (GIS Magazine) on the number of professionals from many different fields who use free GIS data – such a Google Maps and the issues this causes.
Free GIS data has great implications for the future, jus think what we can currently do now with it, but do you trust it if you need to do something specific? This is an issue on the rise, as people save money by using it. If you log onto Google Maps and overlay roads on to the original image they do not always align. An example of this causing a problem is on sites such as Ushahidi where if you tag a specific location with a specific need how do you know that the the respondent will provide a solution at your location and not the one you have tagged?
The example above shows just one of many issues that could arise as free GIS data is used in Crisis Management and Business Continuity. In Business Continuity terms any issues may arise from audits or exercises but in Crisis Management it may be too late to highlight and solve the problem.
Business Continuity App Development Idea
Just thinking about the idea of developing an iPhone/BB app which can be used for internal business and maybe to an Ushahidi type level for Local Authority use.
The idea stems from the fact that in a crisis one of the first, if not the first, thing that a person will grab is their mobile phone. The second is that people live with their mobiles, be this in business or pleasure, so it is the most accessible option to use as a Crisis Management device. The app would allow the communication and also a detailed location information to be updated alongside twitter type sit reps which inc. photos/video/sound and aide memoirs linking to contact details.
>Capabilities
– Comms – Phone/Email/Text communication to a prearranged set of contacts for a crisis
– Aide Memoires – The app would contain an aide memoire for a crisis process and could contain as many different scenarios as was needed and could communicate the processes that all other key members are within the process
– Sit Reps – Allows all app users to upload sit reps in a twitter type style. When this is collated on the main coordinating computer it can be organised for to read all/managers/board members etc. allowing details to be searched. The sit reps can also contain videos and photos allowing another element to the sit rep, the resulting sit reps allow the coordinating team to make better decisions. The ability for all people to upload sit reps allows for better post crisis discussion with information from every point of view
– Locations – Using a google maps/GPS/internet process locations of all users can be gained, this has advantages when tracking people moving to a secondary site for work or travelling into work in snow. The app could also feed travel information and the best route to the user to get to their final location. This is true of the user has never been to the secondary (as very few will have) site before.
– Resource sharing – a building/person/team could post their need for a certain resource in a crisis situation. This would be accessible to all other users so that resources could be shared to those who need it.
– Personal/Family – If a major crisis was to occur, the app could upload details of users status’ or even locations putting loved ones at ease.
> Drawbacks
– Mobile Signal – In a major crisis situation mobile comms become blocked due to the amount of usage of the system. I’m unsure if this also includes the internet. The second is the availability of adequate internet connections (3G) to allow the app to work, but this could be over come by WiFi use for the phones or the compatibility with laptops for internet connection.
– To much information? – The system could provide too much information and this could allow for slower decisions to me made. The ability to over come this by using a computer search function but also twitter type prefixes to message/include specific people.
>In to the future
– This app could become a standard from of communication or workplace twitter for all employees allowing managers and HR people to keep upto date with all employees. It also would allow for better workplace cooperation – with any one employee posting what he is doing and allow others to feedback information from which ever department they may be in.
The idea of this Business Continuity App is one that would allow fantastic responses for whatever scale of information with greater communication across all levels of a company….I just need to build it now!
Resilience from the beggining
One of the greatest problems with any form of business continuity is that it is not always listen too or taken up at management levels. This is mainly due to people not wanting to exchange their knowledge.
However, young people entering business – graduates etc or in business are happy to share information. Just look at Facebook, Twitter and any other form of social media. The thing to do is to bring up the idea of resilience and business continuity from the start of their working lives. This means they will be proactively perform business continuity measures but also be receptive when approached by the business continuity/risk team.
Ways to inform and educate graduates:
> Presentations – Old school presentations which highlight areas which should be near the forefront of graduates minds
> Exercises – The best option, in small groups perform exercises to highlight the need to BC in day-to-day roles.
> New and innovate ways – Using social media to highlight areas of risk, such as an internal twitter type service. Or a personal wiki page where you just add pieces of information that you have learn on to a central server so if you are not able to perform your role people can get a good idea of what you do in different situations.
The ideas of bringing in BC from the beginning of peoples careers not only benefits their first company but also spreads out into the business world as people move on. It helps build on a companys internal BC but also their BC appearance to companies their are doing business with.
British Standard 25999-2 for Business Continuity and International Standard ISO 27001 for Information Security Management should be seen as intertwined rather than separate within any commercial resilience.
BS25999-2 and Business Continuity describes themselves as the “strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level”. ISO 27001 describes itself as the “preservation of confidentiality, integrity and availability of information”. In first sight these two descriptions may look like vastly different descriptions.
However, if you look at these at a closer scale, the links between the both become apparent. One example is that if the integrity and availability of information contained within your business systems is becomes exposed for whatever reason then this can have large effects on your business continuity plans -specific customer, security, financial can all be impacted. Visa versa if your business operations are effected then this can have implications on integrity and availability of information. A basic example could be seen as the loss of a sever due to powercut/flooding/fire etc.
The two standards are also similar in the processes which they govern carrying out the risk assessment, in order to identify potential problems related to information; both standards require document management, conducting internal audits, management reviews, and corrective and preventive actions.
This similarity makes the argument to include both within any business environment, this does not have to be by following both to a commercial accreditation as this is not always financial viable for even large businesses but to increase your business resilience across the board.
Summary and Comment based on from http://blog.iso27001standard.com
Usahidi – Using it as a preemptive tool?
Ushahidi is obviously a fantastic tool for current and post disaster/crisis management/recovery but hot applicable would it be as a pre-emptive tool?
My dissertation looked at imputing data from a set area into a very simple excel database which could then calculate the risk percentage of a typhoon occuring. I gained the data through data trawling the web and using google maps to provide this data – what if people could do this themselves and comment on current conditions allowing organisations to pre-empt any hazards.
This obviously has an application for natural hazards and maybe a few human hazards…people could highlight unrest beginning.
Alex Friend 