Business continuity planning software can add significant value if it complements a strong program that has management support, competent personnel, and the information necessary to establish requirements, identify strategies, and document plans. While software will not “do business continuity planning for an organization”, it can provide an already-built and structured approach that automates what could otherwise be a manual internal process, freeing practitioners to focus on program maturation. That said, not all software is right for every organization, so it is important to ensure any selected software is a right fit BEFORE trying to implement it. Many organizations approach software selection anticipating that the software vendor will show them what they need or tell them what features best fit their program; however, without first understanding the program’s current state, needs, and capabilities, odds increase that organizations will select software that does not align to the current state program and could thus require significant additional customization or result in ineffective use.
This article discusses common business continuity software myths and selection issues and provides recommendations on factors to consider before deciding to pursue, select, and implement a business continuity planning software solution, so that you can get the most value from whatever option you select.
Software Will Not Fix a Broken Program
Several persistent myths exist regarding the value gained from implementing business continuity software, so it is important that you first dispel expectations about these potentially harmful myths. Many business continuity software buyers assume that software will:
- “Think for me”
- “Tell me what to definitively do”
- “Work out of the box and support my as-is program”
However, software is only a resource, it’s not a magic wand. While software may have predefined questions to guide data collection, it is still dependent on the answers provided by end users in order to identify and prioritize risks. Even then, organizational leadership must assess the outcomes from various analytic efforts to decide what risk is tolerable and what gaps must be closed.
If you are looking at software to guide your organization on how to structure a program or what types of information you should collect and how to plan, consider researching business continuity standards instead. Standards such as ISO 22301 and NFPA 1600 are significantly less expensive and can provide substantial insight into designing a business continuity program that aligns to best practices.
Is Software of ANY Kind Right for Your Organization?
Before jumping into the business continuity software selection process, you should first assess if your organization would benefit from implementing software. Consider the several value propositions documented below when deciding if software would be an effective solution for your organization. Specifically, based on the software you select, it could potentially:
- Automatically remind responsible parties to complete recurring tasks (via automated workflow)
- Manage resource data across all planning processes (if proper data sources exist)
- Enable crisis communications (if software includes incident management and mass notification)
- Report on outcomes, either as documents or metrics
- Assist with process or document maintenance (through central management and automation)
- Link elements of the planning lifecycle (e.g., BIA/risk assessment to plans, plans to live incident management, exercises to corrective actions)
- Manage corrective actions (through a centralized list and automation)
- Enable standards compliance (if software aligns to specific standards expectations)
- Manage or maintain documents securely with appropriate versioning
- Produce performance measurement metrics and reporting (although significant customization may be necessary to produce the desired insight)
Will Your Organization Support/Enable System Rollout and Use?
To achieve many of the benefits listed above, software requires a supportive environment to enable effective execution and use. Before beginning the software selection process, you should ask the following questions to determine if software will prove valuable:
- Are your business continuity department leads receptive to learning and using new software? If not, you may end up having to publish the BIAs and plans in MS Word to even get them to make updates, which defeats the purpose of using structured planning.
- Do you have personnel who can dedicate the time necessary to maintaining the environment? The more complex the system, the more administration that is necessary to set up and maintain the system. System administration should be assigned to one (or more) individual(s) within your organization to help ensure data remains up-to-date.
- Does your organization have the time to dedicate to launching a new software? Again, depending on how much content your program currently has, as well as the complexity of the software, manipulating either the software or your current data to fit the software can be a time-consuming process. It’s common for software launches to take weeks to months (depending on which software you choose), so if you have hard deadlines (e.g. an audit) or limited resources, trying to implement a new software may result in failure.
(How) Does Your Organization Maintain “Systems of Record”?
While software can significantly streamline planning once implemented, the initial set-up can be complex, depending on how the system stores and tracks information. Most business continuity software products use relational databases to enable planners to select pre-defined resources (e.g. computers, personnel, applications, etc.) from set lists. However, even if you have the data already collected in official, maintained sources (which many organizations don’t), it’s unlikely your organization has existing sources that already align to the format a BC system would require to enable import.
Either developing the data from scratch or customizing existing data to fit the software’s requirements typically requires significant manual work. If your organization has official systems of record that would need periodically imported into the system, keep in mind the data modification process may need to be performed before each update. While many business continuity software products can interface with systems of record to remove the manual data update/maintenance process, again, systems can only import data that aligns to their existing fields, data types, and structure, or requires software customization to support import of your current-structure data.
Prior to beginning a software search, assess if your organization has any of the following data or systems of record, and, if so, build an initial list or pull out a sample of each to better understand the data structure. Some data, such as a departments and location lists, can be manually built easily, while others, such as activities and critical records, can be added by planners as part of the initial planning and analysis effort.
Other types of data are more complex, however, and would benefit from a system of record, if it exists. These include:
- Employee database (with names, job titles, departments, locations, contact information, and emergency contacts)
- Suppliers database (with supplier names, services provided, contact information, and business continuity capabilities, if known)
- Applications list (with recognizable names that planners can select – this includes server-based and third-party/web-based systems)
- Software list (this includes software that is installed on local computers)
- Production and disaster recovery infrastructure (some business continuity software systems enable the mapping of applications to servers, as well as production instances to disaster recovery instances)
- Equipment database (including equipment names, types, unique identifiers, locations, offsite locations)
For the data you are able to gather, once you begin the software search, you can provide this to prospective vendors and ask them to analyze what can be imported as is and where customization would be necessary.
How to Approach the Software Selection Process
If your organization reaches a point where implementing business continuity software makes sense, it’s important to approach the selection process with a defined understanding of your organization’s business continuity needs, minimum requirements, and desired outcomes.
It’s also important to understand the tool implementation process, because this will certainly affect the selection process, as well as the value proposition. Ask pointed questions, such as:
- Does the implementation process include customization and data import? If so, what are the limitations of this support? If not, how much time can we realistically expect to invest?
- What are the biggest issues organizations face when implementing your software? What factors typically contribute to project failure?
- What end user training and support exists to ensure my planners are able to successfully and painlessly utilize your software?
In addition, look for a demonstration of how the tool addresses key requirements, and do what you can to model your planning process in the tool before selection. All vendors should have demo sites that have the content necessary to demonstrate capabilities, so if a requirement is a must-have or deal breaker, be sure to “try before you buy”.
While this article raised concerns to consider prior to implementing software, that’s not to say that software is a burden or bad idea. In fact, many organizations of all sizes find software to be incredibly beneficial to implementing and continually improving business continuity planning outcomes. Business continuity software can help standardize, automate, analyze, and improve the business continuity lifecycle, it’s just important to do your homework first and ensure you get a system that makes the process more efficient and more successful than maintaining your program manually.
If you have further questions, don’t hesitate to reach out to us at Avalution. For more information on available software products, feel free to visit the following links:
- Catalyst Business Continuity Software, Avalution
- Assurance (formerly LDRPS), SunGard
- The Fusion Framework System, Fusion Risk Management
- RecoveryPlanner, RecoveryPlanner
- ResilienceONE, Strategic BCP
- eBRP, eBRP Solutions
- RSA Archer, EMC
- ClearView, Bis-Web
Avalution Consulting: Business Continuity Consulting