Key Takeaway – Use a template to enable decentralized planning since it provides structure and consistency, as well as an outline of key concepts to address. However, establish the template as the minimum and pair the template with training to explain how the plan would be used during a disruptive event, and to enable the development of quality, detailed content.
Business continuity-related templates are everywhere. Websites, your colleagues and commercial software are just three sources of templates that can assist your organization in starting or improving its business continuity planning effort. Unfortunately, some business continuity professionals believe these templates can be used with minimal effort. Just as dangerous, many feel that if they customize a business continuity plan template for their organization and send it out to the business, the program will automatically materialize into something that reflects its unique needs. Nothing could be farther from the truth! This mindset leads to “cookie cutter” plans that fail to manage the business risk associated with a disruptive event. The remainder of this perspective provides a number of key recommendations to consider when developing and communicating templates and then managing the output from the development effort.
Creating a Template
As you begin developing a plan template for use throughout your organization, consider the following five recommendations:
- Consult a standard – A growing number of business continuity programs are being organized around one or more specific standards (BS 25999 and NFPA 1600, as examples). Consider reviewing these standards and the recommendations contained within them specific to plan documentation content.
- Leverage lessons learned – Ask business continuity professionals, as well as those who have managed recovery efforts during a disruptive event, what they needed in their plans.
- Think about simplicity – Keep in mind that many business professionals charged with developing and maintaining business continuity plans don’t focus on this 100% of the time – it’s a part-time, assigned task. As a result, create a logical flow and offer ways to organize needed information using simple methods (e.g. checklists and tables). Also, avoid threat-specific plans and instead consider creating a threat-independent plan with unique information, strategies and processes added as separate sections (as warranted).
- It’s a guide – Be sure to create a template that acts like a guide, not a mandatory set of instructions. Further, make sure planners understand they are documenting information to assist in response and recovery using flexible processes, and that these plans should complement the management styles and culture of the organization.
- Avoid planning process information – Only offer information needed during the disruptive event, not business continuity planning process information (e.g. how to test the plans).
- Consider the audience – Some groups, like IT, may need very detailed recovery procedures to enable their successful recovery. Others, like executives, may need very concise procedures. Don’t be afraid to rework the “look and feel” of the plans to suit the needs of your audience.
Communicating the Template
Developing an effective template isn’t the only task necessary to increase planning effectiveness. Creating a deployment strategy is just as important. Consider the following five recommendations to improve your organization’s planning effort:
- Before you plan – Never ask someone to begin developing plan documentation without establishing a clear set of objectives and identifying the underlying strategy (writing a plan is not a method of determining a strategy – this approach creates frustration amongst planners, and ultimately an overall lack of detail).
- Instruct – When delivering the template, always offer documented instruction and other training materials (including some sample plans that demonstrate an appropriate level of detail). Consider establishing a “planning help desk” to answer ad hoc questions.
- Consult – Schedule periodic meetings with planners (especially those representing critical business areas and technologies) in order to develop good content and recovery instructions (don’t let them plan in a vacuum).
- Workshops – Offer periodic plan workshops to enable hands-on assistance and discussion between planners (sharing best practices).
- Create clear expectations – Be sure to tell planners that they are not expected to document best-in-class plans during the first planning cycle. Instead, let them know that plan reviews, walkthroughs and exercises will drive continuing plan maturity over time.
This perspective began by establishing a link between business continuity software and templates, mainly because software often fails when customization and appropriate levels of end-user awareness are overlooked. Business continuity software can add value, but it is not a silver bullet. Employ templates as a starting point and offer some sample content, but train business and technology planners to go beyond these examples and frameworks and make their plans actionable and usable in a crisis situation.