What should business continuity expect in 2008
What should business continuity managers expect in 2008? Implementation of new standards; development of new terminology; greater coordination with the surrounding community; progress toward more formal performance benchmarks; and a financial squeeze in the U.S. owing to the subprime mortgage crisis
What are the major changes and challenges the business continuity profession can expect to see emerging though 2008? David Honour offers a useful summary.
* The impact of BS 25999 certification. 2007 started with business continuity managers around the world attempting to get to grips with BS 25999 part one, British Standards’s new business continuity management offering. 2008 will see the next step in the process, with BS 25999 part two being released in time for business continuity managers to decide whether it was a Christmas present or rather a Christmas turkey. If BS 25999 part two is widely accepted, 2008 should see many organizations working toward the formal certification of their business continuity arrangements, followed by the same organizations placing pressure on their suppliers to follow suit.
* Moving toward an ISO business continuity management standard. 2008 is expected to see further movement toward a recognized ISO standard for business continuity management. During 2007 ISO published “ISO/PAS 22399:2007 Societal Security — Guideline for Incident Preparedness and Operational Continuity Management. PAS documents are not full standards but are guidelines of good practice and the approval process is less onerous than for a formal ISO standard. Work is on-going to develop a formal standard, but it has a long way to go.
* Continued discussion over terminology. From the time the term “business continuity” was introduced, an interminable discussion has been taking place as to whether or not the term was suitable. The standards development process has brought this discussion to a head with BS 25999 part two introducing the new term — “business continuity management system (BCMS),” which is defined as “that part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity.” The debate has not been settled, though, and the BCMS has yet to receive widespread acceptance as a useful term. Note that other terminological candidates are in play: “operational continuity management” would provide a way of combining “business continuity management,” “‘operational risk management,” “continuity of operations planning,” and “continuity of government planning” into one easily understood term.
* Business continuity looks toward the community. No business exists in a vacuum: It has many dependencies on its local community (for example employees, services and customers may all come from the local area) and, however well an individual business is protected, if the external community is subject to the impact of a major disruption, then that business itself will also be subject to disruption. Good business continuity planning thus takes into account local community dependencies and works with and within the local community to help make it more resilient. 2008 should see community resilience discussed in more detail, with many more business continuity managers starting to follow the example of their trend-setting peers.
* Virtualization marches on. More and more companies now understand the benefits of virtualization technologies for IT business continuity and disaster recovery purposes. Indeed, virtualization has been THE emerging technology of 2007. The virtualization band wagon is likely to keep rolling through 2008, with the technology becoming an increasingly central element of all IT continuity strategies.
* The emergence of business continuity quality systems. The importance of managing the quality of business continuity plans and strategies has long been understood, with much of the focus in this area being on the use of tests and exercises to examine the practicality of business continuity plans during invocation and to identify and remedy any mistakes or out of date elements in the plans. The need for testing and exercising will not go away, but forward thinking business continuity managers are starting to look at other forms of quality control and quality improvement measures. These include formal benchmarking against industry best practices and against the business continuity management systems in place within other comparative companies and organizations. Measurement systems are also being implemented which allow return on investment to be proved and which allow continual improvements in business continuity arrangements to be documented. In 2008 we should expect to see progress toward formal quality control measures becoming an essential aspect of business continuity management.
* Pressure on business continuity budgets. The 2007 U.S. subprime mortgage financial crisis has created headaches for many financial sector firms, with these looking to use 2008 to recover as many of their losses as possible. The financial sector undoubtedly leads the field in terms of business continuity take-up and in terms of the budget made available for business continuity. As firms look to tighten their belts in 2008, business continuity spending may well be one of the areas which is squeezed. With the finance sector making up such a large proportion of the business continuity cake, 2008 may be a relatively lean year for the business continuity market and its suppliers.
