After a major incident, everyone wants to restart first. Sales want order taking back, the workshop wants production, finance wants invoicing. But the people, premises, IT resources and suppliers available do not allow everything to restart at once. Without priorities agreed in advance, the decision is made under pressure, often in favour of whoever speaks loudest.
This article sets out a five-step method for setting these priorities in your business continuity plan (BCP). The concepts and recommendations attributed to SGDSN, the French General Secretariat for Defence and National Security, come from its reference guide, cited at the end of the article. The SME example is fictional and its timeframes apply to it alone.
Key concepts
SGDSN defines the BCP as the strategy and the set of arrangements designed to ensure that an organisation can recover and continue its activities after a disaster or an event that seriously disrupts its normal operations.
Its guide uses several concepts that help set priorities. The French acronyms are given in brackets:
- Maximum tolerable period of disruption (DMIA): beyond this period, stopping an activity has consequences the organisation considers unacceptable.
- Maximum tolerable data loss (PDMA): the amount of data, expressed in time, that the organisation accepts to lose since the last backup.
- Technical recovery time: the time needed to bring technical and IT resources back into service, in backup or normal mode.
- Degraded mode: reduced but acceptable operation, for example using manual procedures, for a limited period.
IT recovery and business recovery: two different things
IT recovery means bringing servers, applications and data back into service. Business recovery means serving customers and meeting obligations again.
The two do not coincide. An application can restart while the activity remains blocked: staff absent, stock inaccessible, data to re-enter, a supplier unable to deliver. Conversely, an activity can resume before IT does, thanks to a prepared workaround such as working on paper.
SGDSN also advises against giving the lead on the BCP to an IT manager or a facilities manager, as they lack the business view, and against building an IT continuity plan that is not integrated into an overall BCP.
Fictional example: a custom packaging SME
Fictional scenario, for teaching purposes. A 60-employee SME designs and delivers custom packaging. A water leak makes the ground floor of the workshop unusable, along with the small server room located on the same level.
Five activities call for a rapid restart: deliveries to contract customers, order taking, production, invoicing and payroll. All of them depend on the business management software, the logistics manager and the IT service provider, who can only work on one task at a time.
Management wants contract deliveries to resume within 24 hours. The IT provider estimates that restoring the business management software will take three days. This gap, specific to this example, can only be bridged by preparing a workaround: a paper list of open orders taken from the last backup, and manual order picking from the stock that was spared.
The five-step method
1. Rank activities by the consequences of stopping them
List your activities and assess what their interruption causes over time: human, financial, contractual, legal and reputational consequences, among others. SGDSN recommends using the same measurement scale for all activities, agreed by business managers.
Also identify critical periods: an activity may only be essential at certain times, such as payroll at month-end or deliveries during peak season.
2. Map dependencies
For each priority activity, identify the resources it cannot operate without. SGDSN distinguishes five categories of critical resources: human resources, infrastructure, information systems, intellectual resources and external suppliers.
In practice, ask four questions. Who knows how to do it, and who can stand in for them? Where can it be done if the premises are unavailable? With which applications and which data? Which suppliers and service providers does it depend on?
3. Compare desired timeframes with actual capabilities
For each activity, record the maximum tolerable period of disruption set by the business. Alongside it, record what is actually achievable: the technical recovery time announced by IT, the data loss allowed by the backups, and the response times set out in supplier contracts.
Each gap calls for a decision: invest to shorten recovery time, prepare a degraded mode or accept the risk. SGDSN points out that the cost of continuity measures rises as target timeframes get shorter, and that this trade-off must be approved by senior management.
4. Decide in advance how shared resources are allocated
When several activities depend on the same person, the same service provider or the same fallback space, set the order of priority before the crisis. Write the rule down, have it approved by senior management and name who may override it.
A simple rule is better than a complex grid. For example, in our fictional case: contract deliveries first, then order taking, with invoicing and payroll handled in degraded mode.
5. Test the priorities in an exercise
SGDSN recommends checking, through exercises, that continuity arrangements and procedures are known, understood and workable within the planned timeframes. To test your priorities, build a scenario in which several activities claim the same resource at the same time, then observe whether the crisis team applies the agreed rule or improvises.
Checklist
- Activities are ranked by the consequences of stopping them, using a common scale.
- Critical periods in the year or month are identified.
- The dependencies of each priority activity are listed: staff, premises, IT, suppliers.
- Every single critical resource has a deputy or a fallback solution.
- Desired maximum periods of disruption are compared with achievable recovery times.
- Tolerable data loss is consistent with backup frequency.
- Each gap has led to a decision: investment, degraded mode or accepted risk.
- Degraded modes specify how quickly they are set up, their maximum duration and how they operate.
- The priority rule for shared resources is written down and approved by senior management.
- These priorities have been put to the test in an exercise.
Where to start
A useful action: bring together senior management and two business managers for one hour. List your five most important activities and, for each one, the resource whose absence would block it. The resources that appear more than once are your first decision points.
If you run an SME and would like support, the Exerce-Ease resilience assessment analyses your risks and critical dependencies, and delivers a prioritised action plan.
Discover our SME offer: https://www.exerce-ease.com/en/pme.php