Components supporting Business

Business continuity has been promoted mainly by two industries: financial and insurance. This two industries have some common characteristics that could explain this maturity in business continuity programs:

• They have specific regulation, usually related with economic sanctions, like Basel and Solvency.
• Their principal business process are focused in not too much locations, mainly data centers and call centers, which makes that resilience could be grant in an easy way. It would be enough backing up  this central locations because others facilities are not such important for the continuity of the business.
• The grade of industrialization and automation of their processes are very high. This makes that they are highly dependent on the information technology infrastructure, what makes that backup and restoration measures will be a in this high in a high percentage too.

In Spain, this two industries have been historically highlighted because their preparation. One of them with recovery services related with their data centers and others making a further step with recovery facilities with workstations.

As a result of the over-development of IT Service continuity, nowadays each data center, doesn't matters if is big or small or if it's hired or owned,  has their own recovery measurements, granting a false feeling of protection. A high number of directors thinks that they have a good business continuity program only because they have a recovery data center, although the main business process were not supported by IT infrastructure, and therefor, are not backed up.
 

There wouldn't be effective to recover the IT infrastructure in a hospital when a legionella virus infection has taken place, for example. In a similar way it would be in most of disaster scenarios that could be included in the scope of the business continuity program of a hospital. What's the problem then? We must identify what the components that supports business are.

The best way to identify this resources are use the ones identified in the BS-25999-2, that is:

• people (7.3)
• premises (7.4)
• technology (7.5)
• information (7.6)
• supplies (7.7)

Without using any statistic method, it could be possible to identify the dependency on business from different type of resources described above of each industry. This is what I want to describe in the following graphs:

It's clear than, in the financial industry, IT infrastructure supports a high percentage of business, taking into account other issues, like providers which are in charge of distributing cash around all customers every morning in order to cover their necessities. So it would be easyer for them to be prepared that, for example, a hospital, in which all components has to be taken into account in a similar way.

As a conclusion, one of the first steps required to develop a business continuity program is to identify which component is essential to grant product and services delivery to their customers for each of the scenarios included in the scope of the program. It's a good practice use the five components of business continuity identified in BS-25999-1.