Managing Business Continuity with ClearView

After reading the headline, many probably thought that this material was not for them. But take your time to close the page! Remember the famous power outage in Moscow that happened more than 10 years ago due to an accident at a substation in Chagino. It took one director of a large publishing house by surprise exactly when the magazine was published. Up to hour X there was only 3 days left, and then the energy collapse!

Business Continuity (NL) is the company's ability to plan and respond to incidents and emergency situations to maintain its business processes at the optimal level. In modern society, the NB is not only possible, but also need to be able to effectively manage. In this post I will talk about the ClearView platform, which was created to automate the management of the entire life cycle of the NB.

Instead of joining

Let's go back to the publishing house example - the banal lack of electricity then paralyzed the editorial office at the most inopportune moment (however, there couldn’t be any suitable one). Employees of the publishing house could see the general, nervously pacing back and forth along the corridor and mentally counting forfeits and losses from failure to meet the deadlines for printing the magazine. The solution, of course, was found, but the leadership burned a lot of nerve cells. The IT department experts removed two key servers, switching equipment, and all editorial computers, together with the editorial staff in the Moscow Region, and there they lay down and handed over the magazine for sleepless days.

But this case has become a very valuable educational material for the publisher’s management: they bought a powerful diesel generator and a weekly supply of fuel for it; included in the staff list of the “diesel engineer” and conducted emergency wiring from the generator to the power panels serving the server room, the editorial office and the prepress department; compiled relevant instructions for business and IT services to act in such situations.
This example shows very clearly how a case can disrupt business continuity, and it is clear that it is better to take care of overcoming such emergency situations in advance. So you save your nerves and money.

Now let's see how and how the ClearView platform helps us.

What tasks can be automated?

Let us dwell in more detail on those stages that are easy to automate.

Resource plans

By analyzing the impact of threats on a business, we can automatically enter this information into the appropriate section of the resource plan. It lists the processes that need a particular resource or site. For each resource, you can automatically calculate the RTO / RPO parameters - the minimum values ​​for all processes that depend on this resource.

Site plans

In them we define:

1. the number of employees using this site as a backup workplace in case of emergency (Work Area Recovery - WAR);
2. the number of employees who can use it as an alternative workplace in normal mode.

Having this information, we can plan the work of the company in normal and emergency modes.

For this we need:

• make a list of what is needed to restore resources or a site;
• designate responsibility for specific recovery actions;
• prepare a list of work that will be performed by the emergency team.

Help updating plans

The NB automation and control system allows you to plan according to a single, pre-created template. Employees working in different departments and participating in different processes will create uniform plans, which allows colleagues to better understand each other and effectively share planning experience.

The program helps users to plan all the necessary information. Each item can be provided with explanations: what is indicated in a particular field, why this information will be used. And, of course, the employee can add any useful, in his opinion, "Old."

Just as a plan clearly and accurately drawn up on paper helps to act more effectively in real life, a structured description of actions in the event of an emergency will help to take quick and accurate measures to restore the business. In addition, it is easier to make corrections to a clear and well-structured action plan, and working with a “beautiful” document is easier and more enjoyable.

And most importantly, automation helps you create best practices when creating or updating plans. When we plan something, many questions always arise: what information should be included in the plan, how to arrange it, how many plans should be, how much they should be, etc.

Over the years, the expert community has already worked out optimal answers to most of them. You just have to take advantage of their experience, which will help to make the plans as effective as possible. I note that all the solutions recommended by the program have been repeatedly tested by practice!

Integration with other systems

In order for your plans to help quickly and efficiently restore the work of the company, they should always contain up-to-date information about the employees involved, sites and necessary resources.

You can update this information manually - this method is convenient when the number of plans is small. Their maximum number depends on the complexity of the documents, qualifications of those responsible, the number of parties involved in the restoration and other factors.

If you do not have a system for automatically updating documents, you can do this in semi-automatic mode. To do this, place the appropriate files in the directory tree. And before that, they need to enter all the source information and bring it together using macros in Microsoft Office applications.

But, if several dozens of plans are typed, even this method will be very time-consuming. Fatigue, carelessness and carelessness will lead to mistakes that easily turn your plans into useless waste paper. Here ClearView will come to the rescue. They can be configured to receive relevant information from other information systems. For example, name, contact information, positions of employees mentioned in the plans can be taken from the information system of the personnel department; Information about IT equipment - from CMDB; valid email addresses - from the mail system, etc.

Consistency and Life Cycle Automation

All documents, like people, have a specific life cycle. They are created (“born”), edited and coordinated (“raised” and “grow”) and periodically tested (“undergo medical examination and medical examination”).

Documents are understood to mean elements created and existing inside ClearView that correspond to the plans of the National Bank, reports on the analysis of the impact on the business, resource plans, etc. Each such element can have a diverse structure, consist of many sections and contain different contents: text, lists, tables, pictures and even geographical maps. Everything is done here so that any user receives the most detailed and accurate information and uses it with the best efficiency.

But the main convenience of ClearView, in my opinion, is manifested in another way - the document approval process is built into the platform. The manager responsible for the document, when making changes to it by another person, receives a notification by e-mail that he needs to go into the system and coordinate the document.

The system takes into account multi-level dependencies: for example, the process of approving a document begins with approval by a higher responsible (“parent”), then notifications of changes come to lower responsible (“daughters”). And finally the document is approved by its owner. Reminders and deadlines are sent to all participants by e-mail. And, if someone has not reacted before the specified time, the system reports this to the higher leader.

In addition to a reminder of the need to approve the changes, ClearView tracks the approaching date of the revision, and every document created in the system should have such a deadline. About his approach, ClearView will warn the owner and show this information on the administrator’s summary screen, which can start the update process if for some reason it was not done.


Admin screen that displays the current status of documents

Formalization of BIA and RA Results

It is very important for any leader to know what damage this or that emergency will cause to the company. Therefore, for each of them it is necessary to conduct a separate analysis (BIA). For this, specialists who know well what business processes and resources are needed for the company to work, fill out special questionnaires. Since the questions in them can be very different, in ClearView you can create templates taking into account the specifics of different business processes.

Typically, when compiling a report on the analysis, various questions arise. For example, what information and in what form should be included in the report. ClearView implements a ready-made reporting methodology, and with its help it can be done without any questions.

The first part of the report, which analyzes business impact, describes what a particular business function does and what steps it consists of:

• list of business units considered by the current analysis;
• A list of key processes that a business unit performs
• time periods or calendar dates when the importance / criticality of the function in question increases (these may be the dates of preparation of reports, delivery of work to the customer, end of the quarter or receipt of goods at the warehouse);
• A list of resources that a business unit needs to solve problems. It is recommended that you list only critical resources, and not just facilitate the work.

The second part describes in more detail the elements of business processes and the order of their interaction:

• a list of business units that are involved in this business process;
• a list of times when maximum performance is required, and deadlines related to the process under study;
• a list of products and services that this business process supports;
• A list of resources used by the business process
• for each business process, it must be indicated whether it can be performed in an alternative way or in another unit;
• a list of all Internet services needed to complete the business process;
• a list of dependencies on other business units that are necessary to complete the business process;
• a list of external companies on which the work of the business unit depends;
• A list of important entries required for the business unit
• a list of continuity strategies that provide the required RTO parameters for business processes.

Finally, the third part describes and assesses the likely threats that affect the business continuity. It also determines where you can continue the work of the organization, and who will do it:

• a list of backup offices where you can continue to carry out business processes;
• a table of growth in the need for working employees over time when using different options for a continuity strategy;
• a table of growth in demand for additional resources over time for each backup office;
• a list of threats indicating estimated probabilities and extent of damage.

Risk assessment

To maintain business continuity, you need to constantly analyze the threats facing the company and have clear action plans in case they arise. Under “risk assessment” in ClearView, it is understood not only their identification and analysis, but also the development of a strategy to minimize them. Risks in the program are divided into natural, social and technological.

The program helps us assess threats first, and then select the appropriate response measures.

To conduct an assessment, you need to specify a set of probability and amount of damage from each threat for each specific step of the business process. The risk level of a particular threat is calculated as the product of the probability of damage. Next, we must choose the optimal risk reduction strategy from the list below.

But the built-in process for eliminating non-conformities allows not only to identify the found risks, but also to record the actions taken, to appoint those responsible for their elimination and to ensure that all found non-conformities are eliminated or their influence is minimized. In this way, ClearView helps you meet the requirements of the ISO 22301 standard in terms of monitoring, measurement, analysis and evaluation.

Testing Assistance

In preparation for testing, it is important to consider many details. The absence of each of them can disrupt the task, so ClearView provides for filling out a detailed questionnaire.

The description of the planned testing has the following sections:

• Background;
  
• Goals;
  
• What is included in the testing framework;
  
• What goes beyond testing;
  
• Scenario;
  
• Risks
  
• Participants;
  
• Preliminary actions;
  
• Agenda
  
• Observations and recommendations;
  
• Actions after testing;
  
• Goal achievement status;
  
• Reports, protocols;
  
• Summarizing.
  

The system is able to track who performs what steps and how much time it took and the current status of the implementation.

Benefits in NB Incident Management

At the heart of each plan for supporting the NB are various lists of necessary actions, by whom they should be carried out and for how long. These lists can be activated at any time so that members of the crisis response team can interact effectively with each other.

For clarity, the status of each step from the list is marked with the corresponding color. Three grades are provided: “completed”, “in progress” and “awaiting execution”. Users can switch between their own and the full list of actions. Depending on the scope of authority, they can observe the progress of restoration of one plan or all activated.

ClearView has a collaboration tool that allows all participants to share information about the progress of recovery, no matter where they are. For example, it may be a description of unplanned expenses or reports on the condition of the victims. This information appears in real time and is visible to all participants.

The ClearView incident notification module allows you to choose one of three options for sending notifications: SMS, voice message or email. Alerts can be sent to different user groups.

Who will benefit from the ClearView platform

To appreciate the usefulness of ClearView, you can refer to the widely used standard, Business Continuity Management Systems. It has the following sections:

• Organization terms
  
• Leadership;
  
• Planning;
  
• Support;
  
• Activity;
  
• Performance assessment;
  
• Continuous improvement.
  

Consider in which sections ClearView will be useful.

• From the point of view of understanding external and internal factors affecting the fulfillment of the set goals of NB management, the automation system helps to formalize risks and set their criteria.
  
• In the field of leadership, ClearView can be useful for periodic reminders to managers of ongoing work in the field of NB management and the need to participate in them. This will contribute to continuous updating and improvement of the process.
  
• When planning the NB, the usefulness of the system also raises no questions. Indeed, to achieve this goal, the standard requires the following:
  
  • appoint responsible;
    
  • determine the necessary actions;
    
  • identify the necessary resources.
    
  
  And all this and much more is conveniently taken into account in the automation system.
• The "Support" includes all issues related to the exchange of information and document management. They are very convenient to perform using ClearView. The program provides all the necessary tools for internal and external exchange of information. Plus, the system ensures the availability and security of information, which is also very important.
  
• One of the main advantages of the automation system is manifested in the section "Activities". Here, the leaders of the organization should establish, configure, implement and maintain a formal documented process of analyzing business impacts, risk assessment, management procedures and continuing their activities in emergency situations. It was to assist in these tasks that this system was originally created.
  
• In the section "Assessment of performance", the standard requires conducting it at planned intervals, with the obligatory recording of the results of monitoring and measurements. Automation helps to conduct timely inspections and accurately record their results.
  
• In the Continuous Improvement section, the standard requires, at a minimum, identification of nonconformities. The organization shall retain documentation:
  
  • On the nature of the nonconformities and all actions taken,
    
  • About the results of corrective actions.
    
  
  

I note that in ClearView, each document provides a mechanism for identifying a noticed discrepancy.

Do not forget that ClearView is not an automatic system and does nothing without human intervention! No information and no relationships in the documents will appear by themselves, no text will be created without the participation of a specialist, no conclusions will be made mechanically, without involving the mind.

Any, even the best automation system is just a tool that, when used properly, can facilitate the execution of laborious, monotonous and repetitive tasks. But the first time they should be performed by a person.

Konstantin Musatov, Business Continuity Consultant, Jet Infosystems