Manage Business Continuity with ClearView

After reading the title, many probably thought that this material is not for them. But do not rush to close the page! Remember the famous power outage in Moscow, which happened more than 10 years ago due to an accident at a substation in Chagino. One director of a major publishing house took him by surprise while putting the magazine into print. Up to an hour X there were only 3 days left, and here an energy collapse!

Business Continuity (NB) is the company's ability to plan and respond to incidents and abnormal situations to maintain its business processes at an optimal level. In modern society, the NB is not only possible, but also needs to be able to manage effectively. In this post I will talk about the ClearView platform, which is designed to automate the management of the entire NB life cycle.

Instead of intro

Let us go back to the example of the publishing house - the banal absence of electricity then paralyzed the editors at the most inopportune moment (however, it cannot be appropriate here). Employees of the publishing house could see Gender nervously paced back and forth along the corridor and mentally calculating penalties and damages from the breakdown of the print deadlines of the magazine. The way out, of course, was found, but the leadership burned a lot of nerve cells. The IT department specialists took out two key servers, switching equipment and all editorial computers together with the editorial staff in the Moscow region, and there they made up and handed over the magazine during sleepless days.
')
But this case has become a very valuable educational material for the management of the publishing house: they bought a powerful diesel generator and a weekly supply of fuel for it; included in the staffing table "diesel operator" and conducted emergency electrical wiring from the generator to the power boards serving the server room, the editorial staff and the prepress department; drafted relevant instructions for business and IT services on how to act in such situations.
From this example, it is very clearly seen how a case can break business continuity, and it is clear that it is better to take care of overcoming such abnormal situations in advance. So you save yourself the nerves and money.

And now let's see how and what the ClearView platform will help us.

What tasks can be automated?

Let us dwell on those stages that are easily amenable to automation.

Resource plans

Analyzing the impact of threats to a business, we can automatically enter this information into the appropriate section of the resource plan. It lists the processes that need a particular resource or site. For each resource, you can automatically calculate the RTO / RPO parameters — the minimum values ​​for all processes that depend on this resource.

Site Plans

In them we define:

1. the number of employees using this site as a backup workplace in the event of an abnormal situation (Work Area Recovery - WAR);
2. the number of employees who can use it as an alternative workplace in a regular mode.

With this information, we can plan the work of the company in normal and emergency mode.

For this we need:

• make a list of what is needed to restore the resources or site;
• assign responsibility for specific recovery actions;
• prepare a list of works that will be performed by the emergency team.

Help in updating plans

The automation and control system of the National Bank allows you to plan on a single, pre-created template. Employees working in different departments and participating in different processes will create uniform plans, which allows colleagues to better understand each other and effectively exchange planning experience.

The program helps users to bring in the plan all the necessary information. Each item can be provided with explanations: what is indicated in a particular field, for which this information will be used. And, of course, an employee can add any, in his opinion, “info”.

As a clearly and accurately drawn-up plan helps to act more effectively in real life, a structured description of actions in the event of a state of emergency helps to take quick and accurate measures to restore the business. In addition, it is easier to make corrections to a clear and well-structured action plan, and working with a “beautiful” document is easier and more pleasant.

And most importantly, automation helps you to use the most advanced practices when creating or updating plans. When we plan something, there are always a lot of questions: what information should be included in the plan, how to arrange it, how many plans should there be, how much should they be, etc.

For many years, the expert community has already developed optimal answers to most of them. You will only have to take advantage of their experience, which will help make the plans as effective as possible. I note that all the solutions recommended by the program have been repeatedly tested by practice!

Integration with other systems

In order for your plans to help you quickly and efficiently restore the company's work, they should always contain up-to-date information about the employees involved, sites and the necessary resources.

You can manually update this information - this method is convenient when the number of plans is small. Their maximum number depends on the complexity of the documents, the qualifications of those responsible, the number of parties involved in the restoration and other factors.

If you do not have an automatic document update system, you can do it in semi-automatic mode. To do this, place the appropriate files in the directory tree. And before that, they need to bring all the original information and bring it together using macros in Microsoft Office applications.

But, if the plans are recruited several dozen, even this method will be very laborious. Fatigue, inattention and carelessness will lead to mistakes that easily turn your plans into useless waste paper. This is where ClearView comes to the rescue. They can be configured to obtain relevant information from other information systems. For example, the full name, contact information, positions of employees mentioned in the plans can be taken from the information system of the personnel department; information about IT equipment - from CMDB; Valid email addresses - from the postal system, etc.

Automation of coordination and life cycle

All documents, like people, have a certain life cycle. They are created (“born”), edited and coordinated (“brought up” and “grow”) and are periodically tested (“undergo a medical examination and medical examination”).

By documents are meant elements created and existing inside ClearView, which correspond to NB plans, business impact analysis reports, resource plans, etc. Each such element may have a different structure, consist of many sections and contain different content: text, lists, tables, pictures, and even geographical maps. Everything is done here so that any user will receive the most detailed and accurate information and use it with the best efficiency.

But the main convenience of ClearView, in my opinion, manifests itself in something else - the document approval process is built into the platform. The manager responsible for the document, when making changes to it by another person, receives an email notification that he needs to log in and agree on the document.

The system takes into account multi-level dependencies: for example, the process of approving a document begins with the approval of the higher responsible (“parent”), then notifications about changes are received by the lower responsible (“daughters”). And the final document is approved by its owner. Reminders and deadlines are sent to all participants via email. And, if someone has not reacted before the specified time, the system reports this supervisor.

In addition to reminding you to approve changes, ClearView tracks the revision deadline, and every document created in the system should have such a deadline. ClearView will warn the owner about its approach and show this information on the administrator’s summary screen, which can start the update process if this was not done for some reason.


Administrative summary screen, which displays the current status of documents

Formalization of BIA and RA results

It is very important for any manager to know how much damage a company will cause to a company. Therefore, for each of them it is necessary to conduct a separate analysis (BIA). For this purpose, specialists who know well what business processes and resources are needed for the operation of a company fill out special questionnaires. Since the questions in them can be very different, you can create templates in ClearView, taking into account the specifics of different business processes.

Usually in the preparation of a report on the analysis, various questions arise. For example, what information and in what form should be included in the report. In ClearView, a ready-made method of creating reports is implemented, and with its help this can be done without unnecessary questions.

The first part of the report, devoted to the analysis of the impact on business, describes what a particular business function does and what steps it consists of:

• a list of business units accounted for by current analysis;
• a list of key processes that the business unit performs;
• time periods or calendar dates when the importance / criticality of the function under consideration increases (these can be the dates of the preparation of reports, delivery of works to the customer, end of the quarter or receipt of goods to the warehouse);
• List of resources that the business unit needs to solve problems. Here it is recommended to list only critical resources, and not just to facilitate the work.

The second part describes in more detail the elements of business processes and the order of their interaction:

• a list of business units that are involved in this business process;
• a list of times when maximum performance is required and deadlines related to the process under study;
• a list of products and services that this business process supports;
• list of resources used by the business process;
• for each business process, it should be indicated whether it can be performed in an alternative way or by another department;
• a list of all Internet services needed to complete the business process;
• a list of dependencies on other business units that are necessary to complete the business process;
• a list of external companies on which the business unit depends;
• a list of important entries needed for the business unit;
• a list of continuity strategies that allow you to provide the required parameters of the RTO business processes.

Finally, the third part describes and assesses the likely threats that affect the continuity of the company. It also determines where you can continue the work of the organization, and who will do it:

• a list of backup offices where business processes can continue;
• a table of the growth in the need for working employees over time using different versions of the continuity strategy;
• a table of growth in the need for additional resources over time for each backup office;
• a list of threats with an indication of the estimated probabilities and extent of damage.

Risk assessment

To maintain business continuity, you need to constantly analyze the threats facing the company and have clear action plans in case of their occurrence. By “assessing” risks in ClearView is meant not only to identify and analyze them, but also to develop a strategy to minimize them. Risks in the program are divided into natural, social and technological.

The program helps us first assess the threats, and then select the appropriate response measures.

For the assessment, you need to specify a set of probability and amount of damage from each threat for each specific step of the business process. The risk level of a specific threat is calculated as the product of the probability for damage. Next, we have to choose the optimal risk reduction strategy from the list provided.

But the built-in process of elimination of inconsistencies allows not only to identify the found risks, but also to record the actions performed, to assign those responsible for their elimination and to ensure that all found inconsistencies are eliminated or their influence is minimized. Thus, ClearView helps to fulfill the requirements of the ISO 22301 standard in terms of monitoring, measurement, analysis and evaluation.

Assistance in testing

When preparing for testing, it is important to consider many details. The absence of each of them can disrupt the task, so ClearView provides for filling in a detailed questionnaire.

In the description of the planned testing there are the following sections:

• Prerequisites;
  
• Goals;
  
• What falls within the scope of testing;
  
• What goes beyond testing;
  
• Scenario;
  
• Risks;
  
• Members;
  
• Preliminary actions;
  
• Agenda;
  
• Observations and recommendations;
  
• Actions after testing;
  
• The status of the achievement of goals;
  
• Reports, Protocols;
  
• Summarizing.
  

The system is able to keep track of who performs what steps, how long it took, and the current status of execution.

Benefit in terms of incident management within NB

At the heart of each plan to ensure the NB are various lists of necessary actions, by whom they should be executed and for what time. These lists can be activated at any time so that members of a crisis response team can effectively interact with each other.

For clarity, the status of each step from the list is marked with the corresponding color. There are three grades: "executed", "in progress" and "waiting for execution". Users can switch between their own and full list of actions. Depending on the level of authority, they can observe the progress of restoring a single plan or all activated ones.

ClearView has a collaboration tool that allows all participants to share information about the recovery process, no matter where they are. For example, it may be a description of unplanned expenses or reports on the status of victims. This information appears in real time and is visible to all participants.

The module for mass notification of an incident in ClearView allows you to choose one of three options for sending notifications: SMS, voice message or email. Alert can be sent to different groups of users.

Who will benefit from the ClearView platform?

To assess the usefulness of ClearView, you can refer to the widely used standard “Business Continuity Management Systems”. It has the following sections:

• Terms of organization;
  
• Leadership;
  
• Planning;
  
• Support;
  
• Activity;
  
• Performance evaluation;
  
• Continuous improvement.
  

Consider the sections in which ClearView will be useful.

• From the point of view of understanding the external and internal factors affecting the fulfillment of the set goals of managing the NB, the automation system helps to formalize risks and set their criteria.
  
• In the field of leadership, ClearView may be useful for periodic reminders to managers about current work in the field of NB management and the need to participate in them. This will contribute to the constant updating and improvement of the process.
  
• When planning a NB, the utility of the system also raises no questions. After all, to achieve this goal, the standard requires you to do the following:
  
  • assign responsible;
    
  • determine the necessary actions;
    
  • identify the necessary resources.
    
  
  And all this and much more is convenient to take into account in the automation system.
• "Support" includes all issues related to the exchange of information and documentation management. They are very convenient to perform using ClearView. The program provides all the necessary tools for internal and external exchange of information. Plus, the system ensures the availability and security of information, which is also very important.
  
• One of the main advantages of the automation system is shown in the section "Activity". Here, the leaders of the organization should establish, configure, implement and maintain a formally documented process of analyzing business impacts, risk assessments, management procedures and continuing their activities in a state of emergency. It was to help in these tasks that this system was originally created.
  
• In the “Evaluation of Implementation” section, the standard requires it to be held at scheduled intervals, with the mandatory recording of monitoring and measurement results. Automation helps to conduct timely checks and accurately record their results.
  
• In the “Continuous Improvement” section, the standard requires, at a minimum, identifying nonconformities. The organization must keep records of:
  
  • About the nature of the inconsistencies and all actions taken,
    
  • On the results of corrective actions.
    
  
  

I note that in ClearView, each document provides a mechanism for identifying the observed inconsistencies.

Do not forget that ClearView is not an automatic system and does nothing without human intervention! No information and no relationships in the documents will appear by themselves, no text will be created without the participation of a specialist, no conclusions will be drawn mechanically, without the involvement of reason.

Any, even the best automation system is just a tool that, with qualified use, can facilitate the implementation of time-consuming, monotonous and repetitive tasks. But the first time they have to perform a man.

Konstantin Musatov, Business Continuity Consultant, Jet Infosystems