Business continuity planning for telecoms services.

The purpose of this checklist is to provide a brief guide to business continuity planning based upon the methodology successfully adopted by a number of companies, who regard telecommunications as a business-critical service.

Introduction

The successful maintenance of telecommunications is critical to almost all companies. The inherent resilience of telecommunications equipment, both within and external to the organisation, has led many companies into a false sense of security. As technology changes, some of this inherent resilience is sacrificed in the drive to reduce costs and increase functionality. This potential reduction in resilience, coupled with an increasing dependence on telecommunications, has increased the need for effective business continuity planning.

Business continuity planning for telecommunications must be viewed as only one part of an organisation's overall business continuity plan. Successful business continuity planning for telecommunications depends upon an ordered consideration of all areas relating to the telecoms provision to the organisation.

Areas Affected

The effective provision of telecommunications services within an organisation depends upon the successful combination of equipment, people and external services. Failure of just one part of the overall structure can result in major adverse consequences to the organisation. Potential failure areas to be considered include:

* telephone PBX systems

* operator terminals

* call centres

* key systems

* voicemail and unified messaging systems

* interactive voice response (IVR) systems

* computer/telephony integration (CTI) systems

* fax machines and modems

* incoming and outgoing network services

* building services for telecoms equipment

* building access for users.

Action Checklist

Many of the areas of telecommunications provision fall within the direct management of the organisation, but some critical services reside beyond the organisation's control.

1. Define scope and objectives

As with all projects, it is essential to define and agree the scope and objectives before commencing the project activities.

Because business continuity includes many inter-dependant elements, both within and external to telecommunications provision, limits of responsibility must be agreed.

The overall business objectives must be clear. The ability to provide emergency service for a key Crisis Team requires a different approach to that required to support the whole organisation for prolonged periods of failure. Expenditure on any plan must provide a relevant business benefit. Business continuity planning within any organisation will have an optimum level of business benefit against expended cost. Beyond this optimum point the law of diminishing returns applies, resulting in higher and higher expenditure for a smaller and smaller reduction in risk levels.

Objectives may be set based upon a number of pre-determined failure scenarios, such as equipment or network service failures, loss of essential services, or access denial to all or part of the organisation's premises, or any combination of failures.

2. Analyse processes

In order to accurately assess risks to the provision of telecommunications services within an organisation, an understanding of the processes involved in providing that service is required.

The development of process maps for each of the provided service elements will indicate the interrelationship of the people, equipment, external services and non-telecoms requirements (e.g. power and accommodation). In addition, the process maps will indicate areas where alternatives are available or not. It is not unusual to find complex expensive processes hinging upon a single low cost item. The use of process maps assists in identifying such potential failure points.

Process mapping is often represented graphically, allowing dependencies to be easily identified. The effects of overcoming single points of failure can be modelled on the process maps, to assist in the evaluation of potential contingencies.

In establishing process maps the importance of external elements such as calling or called parties cannot be over-emphasised. The business effects of telecommunications failure within an organisation are most critical in these areas, and consideration of the risks must not be neglected.

3. Assess risks

Having established the products and services to be included within the plan, and the process elements required to deliver those services, an assessment of the risks must be carried out. The risk assessment provides the basic information necessary to evaluate potential contingencies, and to prioritise their implementation.

Generally the risk analysis is based upon two criteria; likelihood of failure and business impact of failure. A third criterion may be considered; the period of failure. Many organisations can sustain service failures for short periods without a critical business impact. This period will be different for each service and user. It is essential to establish the business users' assessment of impact. Typically users would be asked for their assessment of business impact for each service for different failure periods, such as 4 hours, 8 hours, 24 hours, 3 days.

The risk assessment may be made on the provision of a whole service or only upon critical elements of service provision as identified within the process analysis.

Based upon the business user information and a knowledge of the products and external services used within the overall service provision, a risk assessment can be made.

Often the assessment is made using a weighted evaluation technique, resulting in a priority order from high risk/high impact services to low risk/low impact provision.

Some organisations may have previously established risk analysis information held by internal insurance departments. This information can provide a useful guide to the overall risk analysis process and give vital risk assessments of non-telecommunications areas that are necessary for the continuation of service.

4. Evaluate potential contingencies

Upon completion of the risk analysis, evaluation of potential contingencies may be made. Usually this is carried out in order of priority defined by the risk analysis. Each of the potential contingencies are considered in terms of cost and benefit, and the likely timescale for delivery. Positive and negative aspects of each option are considered and the best options to meet the defined objectives selected. The preferred contingencies should be measured against the agreed scope and objectives. The exercise is often carried out in several stages to reduce the potential contingencies to a realistic and achievable list.

5. Procure and implement

Having established the preferred contingencies, the necessary products and services must be procured and implemented. This may involve the capital purchase of equipment, establishment of contracts for emergency equipment or services such as replacement systems or off-site call answering, and duplication of some key areas of service provision such as network service routes and network service providers.

Sufficient time must be allowed for any necessary internal or external procurement regulations.

Within the procurement process it is essential that the personnel requirement of the business continuity plan be considered. The deployment of contingencies will not produce the desired effect without the support of a team equipped with all the necessary information and with knowledge and skill in the use of the agreed business continuity solutions. The establishment of a team to manage and control the implementation of the business continuity plan is essential to meeting the overall objectives.

6. Develop procedures

In order to obtain the maximum benefit from the investment in business continuity products and services, pre-defined procedures for their effective use must be established. The procedures should apply to the agreed failure scenarios, and should indicate details of necessary actions, individual and group responsibilities, locations of information, reporting and control methods, information dissemination to staff and public.

Many organisations set up a 'disaster box' containing key requirements such as contact information, contract numbers, latest configuration details of equipment, passwords, keys, cabling records, building plans, spare mobile phone batteries, torches, order book, camera etc. Generally the 'disaster box ' is held off-site in a secure accessible location, with its contents updated regularly.

Often the procedures are detailed in flowchart form with supporting information. Such procedures should take the form of controlled documents, ensuring the issue of only the latest version. Often the documentation requires the insertion of activator names and activation times for each step of the procedure.

Procedures should initially be established to obtain and regularly update information relating to the system and services in use, and to the contacts for personnel included in business continuity activity. Change management control processes are closely linked to the establishment of these procedures.

Contingency activation procedure documentation should be designed to provide clear, short instructions of how to carry out the necessary element of the plan, together with any system/service and contact information. It should be remembered that only essential information is required at times of crisis.

7. Test and review

The business continuity provisions, which have been put in place, together with their associated procedures, must be tested to ensure their effectiveness when required.

Usually this takes the form of a desktop exercise, where a failure scenario is chosen and the normal business continuity team participants, plus external observers, if appropriate, follow the pre-defined procedures. The exercise serves to familiarise the team with the procedures and to identify areas of ineffectiveness or omission in the chosen business continuity solutions, procedures or supporting information

Based upon the results of the exercises, reviews should be carried out and the provisions and procedures amended as necessary.

It is recommended that testing and review takes place regularly, using different failure scenarios.

Conclusion

The establishment of an effective business continuity plan for telecommunications cannot guarantee freedom from the effects of failure. What it can do is provide a considered and planned method of dealing with failure in the most effective way to meet the organisation's defined telecommunications priorities. Effective telecommunications planning allows incorporation within an overall business continuity plan which offers a demonstrable benefit to the business continuity of any organisation.

Dos and don'ts for bcp for telecommunications services

Do

* Plan meticulously.

* Ensure that the Crisis Team are fully trained and know exactly what to do in an emergency.

* Ensure that all other staff know what the broad plan entails.

* Test the systems out on a regular basis.

Don't

* Think that crises only happen to other companies.

Further Reading

Books

Tolleys handbook of disaster and emergency management: principles and practice, 2nd ed Raj Lakha and Tony Moore eds. Croydon: LexisNexis UK, 2004

Expecting the unexpected: business continuity in an uncertain world London: Business Continuity Institute, 2003

Disaster recovery planning for telecommunications, Leo A Wrobel Boston Mass.: Artech House, 1990

Journal articles

Business continuity management for telecommunications, David Birch Continuity, Spring vol 6 no , 2002, pp10-13

Useful Address

The Business Continuity Institute 10 Southview Park, Marsack Street, Caversham RG4 5AF Tel: [phone] www.thebci.org

Thought Starters

* BCP takes a lot of time, effort, planning and money. In the event of an emergency however, not having a plan could be many times more costly and disruptive.

* What if key staff are away when disaster strikes?