Recent crises have increased executive awareness and internal pressure to create a business continuity plan (BCP).
Manufacturing-driven regulations require evidence of sound business continuity practices.
Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.
IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.
BCP requires input from multiple departments with different and sometimes conflicting objectives. There are typically few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.
As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but ultimately, business leaders need to own the BCP – they know their processes and their requirements to resume business operations better than anyone else.
The traditional approach to BCP is a massive project that most organizations can’t execute without hiring a consultant. To execute BCP in-house, carve up the task into manageable pieces as outlined in this blueprint.
Impact and Result
Implement a structured and repeatable process that you apply to one business unit at a time to keep business continuity planning efforts manageable.
Use the results of the pilot to identify gaps in your recovery plans and reduce overall continuity risk while continuing to assess specific risks as you repeat the process with additional business units.
Enable business leaders to own the BCP going forward. Develop a template that the rest of the organization can use.
Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.
Develop a Business Continuity Plan for Manufacturing Research & Tools
1. Develop a Business Continuity Plan for Manufacturing Deck – A step-by-step document that walks you through the process to build BCP within the manufacturing industry.
planning is a complex, interdepartmental project with multiple and sometimes
conflicting objectives. Follow the guidelines in this blueprint to structure
your process to streamline your efforts and stay on track.
3. Process Workflows Examples – A best-of-breed template to help you build a clear, concise, and compelling strategy document for stakeholders.
The sample workflows help you establish steps, dependencies, and alternates for BCP. The tools contain multiple example workflows. Use the conventions in this tool or create your own to visually document business processes and track process requirements.
Workshop: Develop a Business Continuity Plan for Manufacturing
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Module 1: Define BCP Scope, Objectives, and Stakeholders
Define BCP scope, objectives, and stakeholders.
Key Benefits Achieved
Prioritize BCP efforts and level-set scope with key stakeholders.
Assess current BCP maturity.
BCP Maturity Scorecard: measure progress and identify gaps.
Identify key business processes to include in scope.
Business process flowcharts: review, optimize, and knowledge-transfer processes.
Flowchart key business processes to Identify business processes, dependencies, and alternatives.
Identify workarounds for common disruptions for day-to-day continuity.
Module 2: Define RTOs and RPOs Based on Your BIA
Define RTOs and RPOs based on your BIA.
Key Benefits Achieved
Set recovery targets based business impact, and illustrate the importance of BCP efforts via the impact of downtime.
Define an objective scoring scale to indicate different levels of impact.
BCP Business Impact Analysis: objective scoring scale to assess cost, goodwill, compliance, and safety impacts.
Estimate the impact of downtime.
Apply the scoring scale to estimate the impact of downtime on business processes.
Determine acceptable RTO/RPO targets for business processes based on business impact
Acceptable RTOs/RPOs to dictate recovery strategy.
Module 3: Create a Recovery Workflow
Create a recovery workflow.
Key Benefits Achieved
Build an actionable, high-level recovery workflow that can be adapted to a variety of different scenarios.
Conduct a tabletop exercise to determine current recovery procedures.
Recovery flow diagram – current and future states.
Identify gaps and recovery risks.
Identify and prioritize projects to close gaps and mitigate recovery risks.
Create a project roadmap to close gaps.
Evaluate options for command centers and alternate business locations (i.e. BC site).
Evaluate requirements for alternate business sites.
Module 4: Extend the Results of the Pilot BCP and Implement Governance
Extend the results of the pilot BCP and implement governance.
Key Benefits Achieved
Outline the actions required for the rest of your BCMS and the required effort to complete those actions, based on the results of the pilot.
Summarize the accomplishments and required next steps to create an overall BCP.
Pilot BCP Executive Presentation
Identify required BCM roles.
Business Continuity Team Roles & Responsibilities
Create a plan to update and maintain your overall BCP.
3. Maintenance plan and BCP templates to complete the relevant documentation (BC Policy, BCP Action Items, Recovery Workflow, etc.)
Develop a Business Continuity Plan for Manufacturing
Streamline the traditional approach to make BCP development manageable and repeatable.
A BCP touches every aspect of your organization, making it potentially the most complex project you'll take on.
Streamline this effort or you won't get far.
None of us needs to look very far to find a reason to have an effective business continuity plan (BCP).
From pandemics to natural disasters to supply chain disruptions to IT outages, there's no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?
Don't try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:
Focus on one business unit at a time. Keep the effort manageable, establish a repeatable process, and produce
deliverables that provide a starting point for the rest of the organization.
Don't start with an extensive risk analysis. It takes too long and at the end you'll still need a plan to resume
business operations following a disruption. Rather than trying to predict what could cause a disruption, focus on how to recover.
Keep your BCP documentation concise. Use flowcharts, checklists, and diagrams instead of traditional manuals.
No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.
IT Infrastructure & Operations Practice Info-Tech
Senior Research Analyst,
IT Infrastructure & Operations Practice Info-Tech
Manufacturing companies rely so much on suppliers and vendors. Businesses should always consider alternatives and contingency plans for chaotic situations.
Inventory management is very crucial for manufacturing. Understocking the inventory will be detrimental especially during crisis, and overstocking may be a waste of expenses.
Manufacturing is highly dependent on technology. Failure to having solid contingency plans for system failures can jeopardize the whole business.
Failure to comply with financial and legal regulations can cause the failure of the manufacturing company. It's pivotal
to establish industry-relevant BCP regulations.
BCP compliance requires upfront costs, which makes smaller manufacturing companies resistant against such investments.
There should be a consistent and effective collaboration between various departments to ensure that they are on the same page when reacting to a crisis and that the institute will be well versed in communicating the situation status.
Focus on implementing a structured and repeatable process that can be applied to one department at a time to avoid BCP from becoming an overwhelming project.
Enable leaders to own the BCP going forward by establishing a template that the rest of the organization can follow.
Leverage BCP outcomes to refine IT disaster recovery plan (DRP) objectives and achieve
As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but you must enable leaders
to own their department's BCP practices and outputs. They know their processes and, therefore, their requirements to
resume business operations better than anyone else.
Use this research to create business unit BCPs and structure your overall BCP
A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to:
Develop a BCP for a selected business unit (as a pilot project), and thereby establish a methodology that can be repeated for remaining business units.
Through the BCP process, clarify requirements for an IT disaster recovery plan (DRP). Refer to Info-Tech's Disaster Recovery Planning workshop for instructions on how to create an IT DRP.
Implement ongoing business continuity management to govern BCP, DRP, and crisis management.
Overall Business Continuity Plan
IT Disaster Recovery Plan
A plan to restore IT application and infrastructure services following a disruption.
IT leaders asked to develop a BCP should start with an IT DRP
It's a business continuity plan. Why should you start continuity planning with IT?
IT services are a critical dependency for most business processes. Creating an IT DRP helps you mitigate a key risk to continuity quicker than it takes to complete your overall BCP, and you can then focus on other dependencies such as people, facilities, and suppliers.
A BCP requires workarounds for IT failures. But it's difficult to plan workarounds without a clear understanding of the potential IT downtime and data loss. Your DRP will answer those questions, and without a DRP, BCP discussions can get bogged down in IT discussions. Think of payroll as an example: if downtime might be 24 hours, the business might simply wait for recovery; if downtime might be a week, waiting it out is not an option.
As an IT manager, you can develop an IT DRP primarily with resources within your control. That makes it an easier starting point and puts IT in a better position to shift responsibility for BCP to business leaders (where it should reside) since essentially the IT portion is done.
Business continuity management in manufacturing requires proactive planning
Three components of crisis management that manufacturing companies should consider.
This addresses immediate response to the situation. It includes procedures and policies to effectively respond to
chaotic situations such as natural disasters, security incidents, staff well-being, and public health issues. Business
leads should make sure that appropriate business continuity measurements, such as allocation of emergency response team,
evacuation protocols, and communication plans, are in place.
Business Continuity Management
Business continuity management (BCM) involves procedures to ensure that business will maintain its integrity while
leaders are handling the situation. BCM includes identification of the critical systems, resources, and processes that
help the company sustain its critical operations. By enabling BCM, you will enable strategies and processes to minimize
the potential impacts of disruptions.
The COVID-19 pandemic taught businesses the critical need for business continuity planning, including the development of
contingency plans to provide seamless support to front line and other staff. Emergency notification systems, simulation
software solutions, communication platforms, remote monitoring systems, and mobile applications are a few examples of
the tools that are necessary to enable manufacturing companies to run efficient business continuity.
Business continuity planning in manufacturing presents several unique challenges
There are key differences between the emergency preparedness challenges of manufacturing and other industries.
Within the manufacturing industry, companies should make sure that their stakeholder groups, including manufacturers,
suppliers, and customers, are on the same page. Service level agreements (SLAs) should be formalized and realistic
considering ideal situations and potential compromising cases. An enterprise's emergency team should be ready to restore
services ASAP before the service quality gets impacted.
Defective manufacturing goods can lead to a severely negative impact, and even failure of the business. Pricing fluctuation can hugely affect a company's profit margin. Moreover, financial instabilities have introduced an added challenge, leading to uncertainty for allocation of credit to manufacturing businesses.
In a critical situation, a manufacturing company cannot finish the production of its product. When the product is not produced, the company cannot comply with its commitment for delivery. When it does not deliver the product on time, profit
goes down. These series of failures lead to the loss of revenue and decreased customer satisfaction.
Crisis management teams within manufacturing companies should craft mitigation strategies against such scenarios.
Various manufacturing stakeholders tie into the challenges of running an efficient BCP
Manufacturing owners and executives
A BCP program requires up-front investment, which will make it challenging to get executives' buy-in. Manufacturing is
heavily dependent on technology and business leaders would like to invest more in their facilities than just contingency
plans for a potential rainy day.
The ultimate goal of manufacturing companies is brand reputation and customer satisfaction. If the quality of a product
reduces due to a crisis, it negatively impacts customer satisfaction and jeopardizes the whole business. Therefore,
manufacturing companies need to have solid BCP protocols to ensure the quality of their products and the timeliness of
product delivery to their clients.
Labor unions should be trained for BCP protocols. Manufacturing companies should have efficient BCP for the times when there is an employee shortage due to natural disasters (e.g. flood, storm, and pandemics) or socio-political unrest
(e.g. labor strikes).
Economy volatility plays a pivotal role in investments and manufacturing relies heavily on investments. There is a risk
of low participation from investors during times of financial difficulties (e.g. recession), which then affects the
financial liquidity of companies. Having a robust BCP helps manufacturing companies reassure their investors that they
are prepared for a crisis and can handle uncertainties.
Modernize the BCP
If your BCP relies heavily on paper-based processes as workarounds, it's time to update your plan.
Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is
increasingly difficult to resume business processes without IT.
Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It's likely a completely
offline process and won't be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based
solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.
The bottom line:
Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.
The traditional approach to BCP takes too long and produces a plan that is difficult to use and maintain.
The problem: You need to create a BCP but don't know where to start.
BCP is being demanded more and more to comply with regulations, mitigate business risk, meet customer demands, and obtain insurance.
IT leaders are often asked to lead BCP.
The Complication: A traditional BCP process takes longer to show value.
Traditional consultants don't usually have an incentive to accelerate the process.
At the same time, self-directed projects with no defined process go months without producing useful deliverables.
The result is a dense manual that checks boxes but isn't maintainable or usable in a crisis.
The Info-Tech difference: Use Info-Tech's methodology to right-size and streamline the process.
Reduce required effort. Keep the work manageable and maintain momentum by focusing on one business unit at a time; allow that unit to own their BCP.
Prioritize your effort. Evaluate the current state of your BCP to identify the steps that are most in need of attention.
Get valuable results faster. Functional deliverables and insights from the first business unit's BCP can be leveraged by
the entire organization (e.g. communication, assessment, and business continuity site strategies).
Expedite BCP development
Info-Tech's Approach to BCP:
Start with one critical business unit to manage scope, establish a repeatable process, and generate deliverables that become a template for remaining business units.
Resolve critical gaps as you identify them, generating early value and risk mitigation.
Create concise, practical documentation to support recovery.
By comparison, a traditional BCP approach takes much longer to mitigate risk:
An extensive, up-front commitment of time and resources before defining incident response plans and mitigating risk.
A “big bang” approach that makes it difficult to predict the required resourcing and timelines for the project.
A manufacturing company engaged Info-Tech to develop a BCP to make them ready to deal with uncertainties.
INDUSTRY: Manufacturing SOURCE: Info-Tech Research Group
A global medium-sized automotive manufacturing company needed to develop a BCP to safeguard its production during crisis.
The company relied heavily on a group of suppliers, making a holistic BCP strategy challenging. Production was also heavily automated, and any failure in its systems would cause a huge downtime.
As the business was digitally connected to suppliers, the company was vulnerable to cybersecurity attacks.
The business and IT leaders engaged in a BIA to determine their processes and dependencies and to define acceptable recovery and repatriation gaps.
The team identified alternative sources for critical raw materials.
They were trained on strategies for cross training and communication of initiatives.
Through a proactive BCP implementation, the company now has a higher resilience to potential disruptions. If an unexpected event occurs, the company can swiftly activate its contingency plans. If a supply chain is affected by a natural disaster, the company will engage its alternate suppliers to ensure minimal disruptions to production.
This allows the company to keep a good rapport with its customers and minimize reputational damage.
Project Overview: BCP
Identify BCP Maturity and Document Process Dependencies
Conduct a BIA to Determine Acceptable RTOs and RPOs
Document the Recovery Workflow and Projects to Close Gaps
Extend the Results of the Pilot BCP and Implement Governance
1.1: Assess current BCP maturity
1.2: Establish the pilot BCP team
1.3: Identify business processes, dependencies, and alternatives
2.1: Define an objective impact scoring scale
2.2: Estimate the impact of downtime
2.3: Determine acceptable RTO/RPO targets
3.1: Determine current recovery procedures
3.2: Identify and prioritize projects to close gaps
3.3: Evaluate business continuity site and command center options
4.1: Consolidate BCP pilot insights to support an overall BCP project plan
Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.
This document consolidates data from the supporting documentation and tools to the right.
Focus less on risk, and more on recovery
Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.
Small teams = good pilots
Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.
Calculate downtime impact
Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.
It's not no, but rather not now…
You can't address all the organization's continuity challenges at once. Prioritize high-value, low-effort initiatives and create a long-term roadmap for the rest.
Show value now
Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can
rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other
departments right away.
Lightweight testing exercises
Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs
Demonstrate compliance with demands from regulators and customers
Develop a plan that satisfies auditors, customers, and insurance providers who demand proof of a continuity plan.
Demonstrate commitment to resilience by identifying gaps in current capabilities and projects to overcome those gaps.
Empower business users to develop their plans and perform regular maintenance to ensure plans don't go stale.
Establish a culture of business readiness and resilience.
Leverage your BCP to drive value (business benefits)
Enable flexible, mobile, and adaptable business operations that can overcome disruptions large and small. This includes making it easier to work remotely in response to pandemics or facility disruptions.
Clarify the risk of the status quo to business leaders so they can make informed decisions on where to invest in business continuity.
Demonstrate to customers your ability to overcome disruptions and continue to deliver your services.
Info-Tech's Advisory Services lead to measurable value
Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP.*
Why do members report value from analyst engagement?
Expert advice on your specific situation to overcome obstacles and speed bumps.
Structure the project and stay on track.
Review project deliverables and ensure the process is applied properly.
* Based on client response data from Info-Tech's Measured Value Survey, following analyst advisory on BCP.
Info-Tech offers various levels of support to best suit your needs
"Our team has already made this critical project a priority, and we have the tie and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
Diagnostics and consistent frameworks are used throughout all four options.
Your Trusted Advisor is a call away.
Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.
Business Processes and Dependencies
Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds
Conduct a BIA
Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.
Create a recovery workflow based on tabletop planning.
Documentation & BCP Framework
Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.
A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 8 to 12 calls over the course of 4 to 6 months.
Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.
We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.
What Is a Blueprint?
A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.
Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.