Get Instant Access
to This Blueprint

Infrastructure Operations icon

Develop a Business Continuity Plan

Streamline the traditional approach to make BCP development manageable and repeatable.

  • Recent crises have increased executive awareness and internal pressure to create a business continuity plan (BCP).
  • Industry and government-driven regulations require evidence of sound business continuity practices.
  • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.
  • IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

Our Advice

Critical Insight

  • BCP requires input from multiple departments with different and sometimes conflicting objectives. There are typically few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.
  • As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but ultimately business leaders need to own the BCP – they know their processes, and therefore, their requirements to resume business operations better than anyone else.
  • The traditional approach to BCP is a massive project that most organizations can’t execute without hiring a consultant. To execute BCP in-house, carve up the task into manageable pieces as outlined in this blueprint.

Impact and Result

  • Implement a structured and repeatable process that you apply to one business unit at a time to keep BCP planning efforts manageable.
  • Use the results of the pilot to identify gaps in your recovery plans and reduce overall continuity risk while continuing to assess specific risks as you repeat the process with additional business units.
  • Enable business leaders to own the BCP going forward. Develop a template that the rest of the organization can use.
  • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

Develop a Business Continuity Plan Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should develop a business continuity plan, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

1. Identify BCP maturity and document process dependencies

Assess current maturity, establish a team, and choose a pilot business unit. Identify business processes, dependencies, and alternatives.

2. Conduct a BIA to determine acceptable RTOs and RPOs

Define an objective impact scoring scale, estimate the impact of downtime, and set recovery targets.

3. Document the recovery workflow and projects to close gaps

Build a workflow of the current steps for business recovery. Identify gaps and risks to recovery. Brainstorm and prioritize solutions to address gaps and mitigate risks.

4. Extend the results of the pilot BCP and implement governance

Present pilot project results and next steps. Create BCMS teams. Update and maintain BCMS documentation.


Member Testimonials

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this blueprint and what our clients have to say.

9.2/10


Overall Impact

$35,136


Average $ Saved

27


Average Days Saved

Client

Experience

Impact

$ Saved

Days Saved

Cross Country Mortgage, Inc.

Guided Implementation

10/10

$3,899

2

Valley Strong Credit Union

Workshop

10/10

$64,999

32

Dave was amazing. This workshop did not seem like a class because Dave made it fun and very interesting. We learned a lot. He took the time to exp... Read More

AgWest Farm Credit, FLCA

Guided Implementation

9/10

$12,999

5

Independent Health

Guided Implementation

10/10

$9,099

20

Frank's ability to facilitate the exercise effectively helped our team gain valuable knowledge about contingency strategies that should be implemen... Read More

MyPath, Inc.

Workshop

10/10

$45,499

14

The Saskatchewan Liquor and Gaming Authority

Workshop

9/10

N/A

50

The entire workshop led by Dave was fantastic. There were no parts of the experience that were worse per se, with the exception of the length of ti... Read More

Cross Country Mortgage, Inc.

Guided Implementation

8/10

$12,999

5

Mutual Benefit Group

Guided Implementation

10/10

N/A

50

Benedict did a great job explaining your research and tools as well as options for us to move forward. I don't feel there was a 'worst' part of our... Read More

Incharge Debt Solutions

Guided Implementation

9/10

$64,999

47

Burke and Herbert Bank and Trust Company

Workshop

10/10

$12,999

35

There were no bad parts. Frank worked well with us on prep for the workshop and all expectations were met

Independent Health

Guided Implementation

8/10

$26,649

20

The overall experience.

Community Health Choice, Inc.

Guided Implementation

10/10

$24,699

10

The best part was the expertise Frank provided on the subject and how the InfoTech tools can be seamless integrated into the work already done. No ... Read More

Community Health Choice, Inc.

Guided Implementation

9/10

$30,549

20

The knowledge of Frank (InfoTech) was outstanding. I have nothing negative to say about the experience.

Coachella Valley Water District

Workshop

10/10

$61,749

50

Sumit is very knowledgeable on the BCP subject. His workshop delivery skills are outstanding. He was able to explain the concepts extremely well. T... Read More

Colonial Savings, F.A.

Guided Implementation

9/10

$2,599

20

I was a pleasure working with Darin. He definitely helped point us in the right direction. I would highly recommend him to others and would look fo... Read More

Auckland Transport

Guided Implementation

10/10

$32,499

10

For the purposes of question 3, we didn't have a budget, so I cannot estimate the savings in $. There were no 'worst' parts of my experience. The... Read More

Avalon Health Care Management Inc.

Workshop

10/10

$31,499

50

I found the workshop beneficial is jump starting our business continuity. Best part was seeing the documents 'in action' and how they are valuabl... Read More

Great Clips Inc.

Guided Implementation

9/10

$51,999

14

Best: The resources are incredibly helpful to jumpstart the process for us, and Andrew Sharp does a great job of leading us through the process and... Read More

WVU Foundation

Workshop

9/10

$129K

10

We’ve done several of these workshops over the years, they’re always very good. As one of our folks said “without the workshop we would never talk ... Read More

OnPoint Group, LLC

Workshop

9/10

$12,999

10

Sumit has been a PHENOMINAL facilitator for all 5 of our workshops (this was our 5th with him). He is prepared, picks up on the business context, a... Read More

OnPoint Group, LLC

Workshop

8/10

$32,499

20

eGov Jamaica Ltd.

Guided Implementation

9/10

$31,499

80

OnPoint Group, LLC

Workshop

9/10

$129K

20

Municipality of Chatham-Kent

Guided Implementation

8/10

N/A

5

The engagement was cut short due to resourcing issues on our end. Andrew was great and provided valuable insight. I hope to take this back up in ... Read More

Alabama Department Of Human Resources

Guided Implementation

10/10

$69,299

20

Andrew Sharp is very knowledgeable and he has provided great guidance in improving our Business Continuity Plan.

Eswatini Railway

Guided Implementation

9/10

$9,847

50

We are very impressed with the expert guidance and proficiency of the Infotech SME who was able to work with us on the DRP and BCP for the organiza... Read More

OnPoint Group, LLC

Workshop

8/10

N/A

10

Dedicating the time to conduct this exercise in a concentrated manner was difficult, but Sumit provided strong focus and an appropriate amount of f... Read More

National Arts Centre Canada

Guided Implementation

9/10

N/A

35

It was great to have a very knowledgeable person to talk to about BCPs.

Corix Infrastructure Inc.

Guided Implementation

9/10

$50,000

20

Catholic Health System

Guided Implementation

9/10

N/A

10


Business Continuity

Streamline the traditional approach to make BCP development manageable and repeatable.
This course makes up part of the Security & Risk Certificate.

Now Playing:
Academy: Business Continuity | Executive Brief

An active membership is required to access Info-Tech Academy
  • Course Modules: 5
  • Estimated Completion Time: 2-2.5 hours
  • Featured Analysts:
  • Frank Trovato, Research Director, Infrastructure Practice
  • Eric Wright, SVP of Research and Advisory

Workshop: Develop a Business Continuity Plan

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

Module 1: Define BCP Scope, Objectives, and Stakeholders

The Purpose

Define BCP scope, objectives, and stakeholders.

Key Benefits Achieved

Prioritize BCP efforts and level-set scope with key stakeholders.

Activities

Outputs

1.1

Assess current BCP maturity.

  • BCP Maturity Scorecard: measure progress and identify gaps.
1.2

Identify key business processes to include in scope.

1.3

Flowchart key business processes to identify business processes, dependencies, and alternatives.

  • Business process flowcharts: review, optimize, and allow for knowledge transfer of processes.
  • Identify workarounds for common disruptions to day-to-day continuity.

Module 2: Define RTOs and RPOs Based on Your BIA

The Purpose

Define RTOs and RPOs based on your BIA.

Key Benefits Achieved

Set recovery targets based business impact, and illustrate the importance of BCP efforts via the impact of downtime.

Activities

Outputs

2.1

Define an objective scoring scale to indicate different levels of impact.

  • BCP Business Impact Analysis: objective scoring scale to assess cost, goodwill, compliance, and safety impacts.
2.2

Estimate the impact of downtime.

  • Apply the scoring scale to estimate the impact of downtime on business processes.
2.3

Determine acceptable RTO/RPO targets for business processes based on business impact.

  • Acceptable RTOs/RPOs to dictate recovery strategy.

Module 3: Create a Recovery Workflow

The Purpose

Create a recovery workflow.

Key Benefits Achieved

Build an actionable, high-level, recovery workflow that can be adapted to a variety of different scenarios.

Activities

Outputs

3.1

Conduct a tabletop exercise to determine current recovery procedures.

  • Recovery flow diagram – current and future state
  • Identify gaps and recovery risks.
3.2

Identify and prioritize projects to close gaps and mitigate recovery risks.

  • Create a project roadmap to close gaps.
3.3

Evaluate options for command centers and alternate business locations (i.e. BC site).

  • Evaluate requirements for alternate business sites.

Module 4: Extend the Results of the Pilot BCP and Implement Governance

The Purpose

Extend the results of the pilot BCP and implement governance.

Key Benefits Achieved

Outline the actions required for the rest of your BCMS, and the required effort to complete those actions, based on the results of the pilot.

Activities

Outputs

4.1

Summarize the accomplishments and required next steps to create an overall BCP.

  • Pilot BCP Executive Presentation
4.2

Identify required BCM roles.

  • Business Continuity Team Roles & Responsibilities
4.3

Create a plan to update and maintain your overall BCP.

  • 3. Maintenance plan and BCP templates to complete the relevant documentation (BC Policy, BCP Action Items, Recovery Workflow, etc.)

Develop a Business Continuity Plan

Streamline the traditional approach to make BCP development manageable and repeatable.

Analyst Perspective

A BCP touches every aspect of your organization, making it potentially the most complex project you’ll take on. Streamline this effort or you won’t get far.

None of us needs to look very far to find a reason to have an effective business continuity plan.

From pandemics to natural disasters to supply chain disruptions to IT outages, there’s no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?

Don’t try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:

  • Focus on one business unit at a time. Keep the effort manageable, establish a repeatable process, and produce deliverables that provide a starting point for the rest of the organization.
  • Don’t start with an extensive risk analysis. It takes too long and at the end you’ll still need a plan to resume business operations following a disruption. Rather than trying to predict what could cause a disruption, focus on how to recover.
  • Keep your BCP documentation concise. Use flowcharts, checklists, and diagrams instead of traditional manuals.

No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.

Frank Trovato

Research Director,
IT Infrastructure & Operations Practice
Info-Tech Research Group

Andrew Sharp

Senior Research Analyst,
IT Infrastructure & Operations Practice
Info-Tech Research Group

Executive Summary

Your Challenge

  • Recent crises have increased executive awareness and internal pressure to create a BCP.
  • Industry- and government-driven regulations require evidence of sound business continuity practices.
  • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.

IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

Common Obstacles

  • IT managers asked to lead BCP efforts are dealing with processes and requirements beyond IT and outside of their control.
  • BCP requires input from multiple departments with different and sometimes conflicting objectives.
  • Typically there are few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.

Info-Tech’s Approach

  • Focus on implementing a structured and repeatable process that can be applied to one business unit at a time to avoid BCP from becoming an overwhelming project.
  • Enable business leaders to own the BCP going forward by establishing a template that the rest of the organization can follow.
  • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

Info-Tech Insight

As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but you must enable business leaders to own their department’s BCP practices and outputs. They know their processes and, therefore, their requirements to resume business operations better than anyone else.

Use this research to create business unit BCPs and structure your overall BCP

A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to:

  • Develop a BCP for a selected business unit (as a pilot project), and thereby establish a methodology that can be repeated for remaining business units.
  • Through the BCP process, clarify requirements for an IT disaster recovery plan (DRP). Refer to Info-Tech’s Disaster Recovery Planning workshop for instructions on how to create an IT DRP.
  • Implement ongoing business continuity management to govern BCP, DRP, and crisis management.

Overall Business Continuity Plan

IT Disaster Recovery Plan

A plan to restore IT application and infrastructure services following a disruption.

Info-Tech’s disaster recovery planning blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP.

BCP for Each Business Unit

A set of plans to resume business processes for each business unit. This includes:

  • Identifying business processes and dependencies.
  • Defining an acceptable recovery timeline based on a business impact analysis.
  • Creating a step-by-step recovery workflow.

Crisis Management Plan

A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.

Info-Tech’s Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage.

IT leaders asked to develop a BCP should start with an IT Disaster Recovery Plan

It’s a business continuity plan. Why should you start continuity planning with IT?

  1. IT services are a critical dependency for most business processes. Creating an IT DRP helps you mitigate a key risk to continuity quicker than it takes to complete your overall BCP, and you can then focus on other dependencies such as people, facilities, and suppliers.
  2. A BCP requires workarounds for IT failures. But it’s difficult to plan workarounds without a clear understanding of the potential IT downtime and data loss. Your DRP will answer those questions, and without a DRP, BCP discussions can get bogged down in IT discussions. Think of payroll as an example: if downtime might be 24 hours, the business might simply wait for recovery; if downtime might be a week, waiting it out is not an option.
  3. As an IT manager, you can develop an IT DRP primarily with resources within your control. That makes it an easier starting point and puts IT in a better position to shift responsibility for BCP to business leaders (where it should reside) since essentially the IT portion is done.

Create a Right-Sized Disaster Recovery Plan today.

Modernize the BCP

If your BCP relies heavily on paper-based processes as workarounds, it’s time to update your plan.

Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is increasingly difficult to resume business processes without IT.

Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It’s likely a completely offline process and won’t be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.

The bottom line:

Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.

Info-Tech’s approach

The traditional approach to BCP takes too long and produces a plan that is difficult to use and maintain.

The Problem: You need to create a BCP, but don’t know where to start.

  • BCP is being demanded more and more to comply with regulations, mitigate business risk, meet customer demands, and obtain insurance.
  • IT leaders are often asked to lead BCP.

The Complication: A traditional BCP process takes longer to show value.

  • Traditional consultants don’t usually have an incentive to accelerate the process.
  • At the same time, self-directed projects with no defined process go months without producing useful deliverables.
  • The result is a dense manual that checks boxes but isn’t maintainable or usable in a crisis.

A pie chart is separated into three segments, Internal Mandates 43%, Customer Demands 23%, and Regulatory Requirements 34%. The bottom of the image reads Source: Info-Tech Research Group.

The Info-Tech difference:

Use Info-Tech’s methodology to right-size and streamline the process.

  • Reduce required effort. Keep the work manageable and maintain momentum by focusing on one business unit at a time; allow that unit to own their BCP.
  • Prioritize your effort. Evaluate the current state of your BCP to identify the steps that are most in need of attention.
  • Get valuable results faster. Functional deliverables and insights from the first business unit’s BCP can be leveraged by the entire organization (e.g. communication, assessment, and BC site strategies).

Expedite BCP development

Info-Tech’s Approach to BCP:

  • Start with one critical business unit to manage scope, establish a repeatable process, and generate deliverables that become a template for remaining business units.
  • Resolve critical gaps as you identify them, generating early value and risk mitigation.
  • Create concise, practical documentation to support recovery.

Embed training and awareness throughout the planning process.

BCP for Business Unit A:

Scope → Pilot BIA → Response Plan → Gap Analysis

→ Lessons Learned:

  • Leverage early results to establish a BCM framework.
  • Take action to resolve critical gaps as they are identified.
  • BCP for Business Units B through N.
  • Scope→BIA→Response Plan→Gap Analysis

= Ongoing governance, testing, maintenance, improvement, awareness, and training.

By comparison, a traditional BCP approach takes much longer to mitigate risk:

  • An extensive, upfront commitment of time and resources before defining incident response plans and mitigating risk.
  • A “big bang” approach that makes it difficult to predict the required resourcing and timelines for the project.

Organizational Risk Assessment and Business Impact Analysis → Solution Design to Achieve Recovery Objectives → Create and Validate Response Plans

Case Study

Continuity Planning Supports COVID-19 Response

Industry: Non-Profit
Source: Info-Tech Advisory Services

A charitable foundation for a major state university engaged Info-Tech to support the creation of their business continuity plan.

With support from Info-Tech analysts and the tools in this blueprint, they worked with their business unit stakeholders to identify recovery objectives, confirm recovery capabilities and business process workarounds, and address gaps in their continuity plans.

Results

The outcome wasn’t a pandemic plan – it was a continuity plan that was applicable to pandemics. And it worked. Business processes were prioritized, gaps in work-from-home and business process workarounds had been identified and addressed, business leaders owned their plan and understood their role in it, and IT had clear requirements that they were able and ready to support.

“The work you did here with us was beyond valuable! I wish I could actually explain how ready we really were for this…while not necessarily for a pandemic, we were ready to spring into action, set things up, the priorities were established, and most importantly some of the changes we’ve made over the past few years helped beyond words! The fact that the groups had talked about this previously almost made what we had to do easy.“ -- VP IT Infrastructure

Download the BCP Case Study

Project Overview: BCP

Phases Phase 1: Identify BCP Maturity and Document Process Dependencies Phase 2: Conduct a BIA to Determine Acceptable RTOs and RPOs Phase 3: Document the Recovery Workflow and Projects to Close Gaps Phase 4: Extend the Results of the Pilot BCP and Implement Governance
Steps 1.1 Assess current BCP maturity 2.1 Define an objective impact scoring scale 3.1 Determine current recovery procedures 4.1 Consolidate BCP pilot insights to support an overall BCP project plan
1.2 Establish the pilot BCP team 2.2 Estimate the impact of downtime 3.2 Identify and prioritize projects to close gaps 4.2 Outline a business continuity management (BCM) program
1.3 Identify business processes, dependencies, and alternatives 2.3 Determine acceptable RTO/RPO targets 3.3 Evaluate BC site and command center options 4.3 Test and maintain your BCP
Tools and Templates

BCP Business Impact Analysis Tool

Results Presentation

BCP Maturity Scorecard

Tabletop Planning Template

BCP Summary

Pilot Project Charter

Recovery Workflow Examples

Business Continuity Teams and Roles

Business Process Workflows Examples

BCP Project Roadmap

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

BCP Business Impact Analysis Tool: Conduct and document a business impact analysis using this document.

BCP Recovery Workflows Example: Model your own recovery workflows on this example.

BCP Project Roadmap: Use this tool to prioritize projects that can improve BCP capabilities and mitigate gaps and risks.

BCP Relocation Checklists: Plan for and manage a site relocation – whether to an alternate site or work from home.

Key deliverable:

BCP Summary Document

Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.

This document consolidates data from the supporting documentation and tools to the right.

Download Info-Tech’s BCP Summary Document

Insight summary

Focus less on risk, and more on recovery

Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.

Small teams = good pilots

Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.

Calculate downtime impact

Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.

It’s not no, but rather not now…

You can’t address all the organization’s continuity challenges at once. Prioritize high value, low effort initiatives and create a long-term roadmap for the rest.

Show Value Now

Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other departments right away.

Lightweight Testing Exercises

Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs and risks.

Blueprint benefits

Demonstrate compliance with demands from regulators and customers

  • Develop a plan that satisfies auditors, customers, and insurance providers who demand proof of a continuity plan.
  • Demonstrate commitment to resilience by identifying gaps in current capabilities and projects to overcome those gaps.
  • Empower business users to develop their plans and perform regular maintenance to ensure plans don’t go stale.
  • Establish a culture of business readiness and resilience.

Leverage your BCP to drive value (Business Benefits)

  • Enable flexible, mobile, and adaptable business operations that can overcome disruptions large and small. This includes making it easier to work remotely in response to pandemics or facility disruptions.
  • Clarify the risk of the status quo to business leaders so they can make informed decisions on where to invest in business continuity.
  • Demonstrate to customers your ability to overcome disruptions and continue to deliver your services.

Info-Tech Advisory Services lead to Measurable Value

Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP (source: client response data from Info-Tech's Measured Value Survey).

Why do members report value from analyst engagement?

  1. Expert advice on your specific situation to overcome obstacles and speed bumps.
  2. Structure the project and stay on track.
  3. Review project deliverables and ensure the process is applied properly.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostic and consistent frameworks are used throughout all four options.

Guided Implementation

Your Trusted Advisor is a call away.

A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between eight to twelve calls over the course of four to six months.

Scoping

Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.

Business Processes and Dependencies

Calls 2 - 4: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.

Conduct a BIA

Calls 5 – 7: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.

Recovery Workflow

Calls 8 – 9: Create a recovery workflow based on tabletop planning.

Documentation & BCP Framework

Call 10: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com | 1-888-670-8889

Day 1 Day 2 Day 3 Day 4 Day 5
Identify BCP Maturity, Key Processes, and Dependencies Conduct a BIA to Determine Acceptable RTOs and RPOs Document the Current Recovery Workflow and Projects to Close Gaps Identify Remaining BCP Documentation and Next Steps Next Steps and Wrap-Up (offsite)
Activities

1.1 Assess current BCP maturity.

1.2 Identify key business processes to include in scope.

1.3 Create a flowchart for key business processes to identify business processes, dependencies, and alternatives.

2.1 Define an objective scoring scale to indicate different levels of impact.

2.2 Estimate the impact of a business disruption on cost, goodwill, compliance, and health & safety.

2.3 Determine acceptable RTOs/RPOs for selected business processes based on business impact.

3.1 Review tabletop planning – what is it, how is it done?

3.2 Walk through a business disruption scenario to determine your current recovery timeline, RTO/RPO gaps, and risks to your ability to resume business operations.

3.3 Identify and prioritize projects to close RTO/RPO gaps and mitigate recovery risks.

4.1 Assign business continuity management (BCM) roles to govern BCP development and maintenance, as well as roles required to execute recovery.

4.2 Identify remaining documentation required for the pilot business unit and how to leverage the results to repeat the methodology for remaining business units.

4.3 Workshop review and wrap-up.

5.1 Finalize deliverables for the workshop.

5.2 Set up review time for workshop outputs and to discuss next steps.

Deliverables
  1. Baseline BCP maturity status
  2. Business process flowcharts
  3. Business process dependencies and alternatives recorded in the BIA tool
  1. Potential impact of a business disruption quantified for selected business processes.
  2. Business processes criticality and recovery priority defined
  3. Acceptable RTOs/RPOs defined based on business impact
  1. Current-state recovery workflow and timeline.
  2. RTO/RPO gaps identified.
  3. BCP project roadmap to close gaps
  1. BCM roles and responsibilities defined
  2. Workshop results deck; use this to communicate pilot results and next steps
  1. Finalized deliverables

Phase 1

Identify BCP Maturity and Document Process Dependencies

Phase 1

1.1 Assess Current BCP Maturity

1.2 Establish the pilot BCP team

1.3 Identify business processes, dependencies, and alternatives

Insights & Outcomes

Define the scope for the BCP project: assess the current state of the plan, create a pilot project team and pilot project charter, and map the business processes that will be the focus of the pilot.

Participants

  • BCP Coordinator
  • BCP Executive Sponsor
  • Pilot Business Unit Manager & Process SMEs

Step 1.1

Assess current BCP Maturity

This step will walk you through the following activities:

  • Complete Info-Tech’s BCP Maturity Scorecard

This step involves the following participants:

  • Executive Sponsor
  • BCP Coordinator

You'll use the following tools & templates:

Outcomes & Insights

Establish current BCP maturity using Info-Tech’s ISO 22301-aligned BCP Maturity Scorecard.

Evaluate the current state of your continuity plan

Use Info-Tech’s Maturity Scorecard to structure and accelerate a BCP maturity assessment.

Conduct a maturity assessment to:

  • Create a baseline metric so you can measure progress over time. This metric can also drive buy-in from senior management to invest time and effort into your BCP.
  • Understand the scope of work to create a complete business continuity plan.
  • Measure your progress and remaining gaps by updating your assessment once you’ve completed the activities in this blueprint.

This blueprint primarily addresses the first four sections in the scorecard, which align with the creation of the core components of your business continuity plan.

Info-Tech’s BCP Maturity Scorecard

Info-Tech’s maturity scorecard is aligned with ISO 22301, the international standard that describes the key elements of a functioning business continuity management system or program – the overarching set of documents, practices, and controls that support the ongoing creation and maintenance of your BCP. A fully functional BCMS goes beyond business continuity planning to include crisis management, BCP testing, and documentation management.

Audit tools tend to treat every bullet point in ISO 22301 as a separate requirement – which means there’s almost 400 lines to assess. Info-Tech’s BCP Maturity Scorecard has synthesized key requirements, minimizing repetition to create a high-level self-assessment aligned with the standard.

A high score is a good indicator of likely success with an audit.

Download Info-Tech's BCP Maturity Scorecard

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

MEMBER RATING

9.2/10
Overall Impact

$35,136
Average $ Saved

27
Average Days Saved

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.

Read what our members are saying

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Need Extra Help?
Speak With An Analyst

Get the help you need in this 5-phase advisory process. You'll receive 5 touchpoints with our researchers, all included in your membership.

Guided Implementation 1: Scoping
  • Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.

Guided Implementation 2: Business Processes and Dependencies
  • Call 1: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.

Guided Implementation 3: Conduct a BIA
  • Call 1: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.

Guided Implementation 4: Recovery Workflow
  • Call 1: Create a recovery workflow based on tabletop planning.

Guided Implementation 5: Documentation & BCP Framework
  • Call 1: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.

Authors

Frank Trovato

Andrew Sharp

Contributors

  • Dr. Bernard A. Jones, MBCI, CBCP, Berkeley College
  • Kris Roberson, Disaster Recovery Analyst, Veterans United Home Loans
  • Trevor Butler, General Manager of Information Technology, City of Lethbridge
  • Robert Miller, Information Services Director, Witt/Kieffer
Visit our IT Cost Optimization Center
Over 100 analysts waiting to take your call right now: 1-519-432-3550 x2019