I think there is a common mistake that we, as business continuity planners, make when working with our business partners to determine RTOs for processes and applications that support them.
I think we do a good job in using the findings from our Business Impact Analyses (BIA) to help identify the Most Critical, Critical and Essential business processes (or whatever labels you happen to use) to ensure that these processes are what we recover first, but, I think when we work with these areas to define Recovery Time Objectives (RTO) we do not properly establish the post-disaster performance objectives. I think that most of us allow our business partners to establish their RTOs based on the assumption that they will be operating at or close to business as usual.
Sure, we instruct them to try to establish the minimum requirements and consider work arounds and the such … but, to achieve what end? How many of us first ask senior management if there will be any changes to our management objectives following a serious business interruption event? Will revenue or income targets be adjusted? How much additional costs and expenses can we incur? Will response or service targets be adjusted? Margin targets adjusted? ROI? ROE? Or, any other management metrics adjusted because we are in crisis mode of operations?
Although this goes against my overall philosophy of trying to simplify things, I think it would be beneficial to establish three modes of operation when establishing RTOs with our business partners.
- Survival Mode
- Sustain Mode
- Business as Usual Mode
The goal of Survival Mode operations is simply to keep the company solvent. Forget trying to be profitable; forget growth targets; forget avoiding all penalties, fines and service interruptions – what, minimally, does the company need to do to not jeopardize the solvency of the firm?
The goal of Sustain Mode operations is to satisfy the commitments we have today with our current customer base. What do we need to do to keep our current customer base satisfied and meet the regulatory and contractual obligations we already have in place.
And the goal of Business as Usual is … well, just what the words say.
I think if we could get senior management to define the management objectives for each mode of operation and how long the company can operate in each mode, the RTOs we establish will be much more realistic.
I work in many environments testing their RTO capabilities where, when short time-frames are missed, they report this as a failed exercise but, the business areas ultimately say, we could have lived with the delays. I think our RTOs, in general, are much tighter than they need be if we think about Survival first, then Sustain and then BAU.
I know, I know, I know … for those of you cursing me out; yes, there are some real crucial business processes that legitimately have very short RTOs (or require immediate failover with no downtime), but I think that pool of requirements is much smaller than many of our programs suggest.
So, yes, I think we do a good job focusing on Most Critical job processes, but I don’t think we establish the right mindset in gathering the requirements to support them after a disaster.
I welcome all comments to the contrary or, heavens forbid, in support of this concept.