Step 4: Define the Scope, Objectives and Assumptions

Unclear Objectives and Deliverables

IC_More_Step 4 I have often found the objectives of the BCP project to be too vague. Nobody could agree on exactly what was to be accomplished. This is often due to the lack of BCP knowledge.

Before beginning each phase of the BCP project, be sure that the anticipated deliverables of that phase are defined explicitly. You will need to make it absolutely clear to the Executive Management and BCP project participants what the end product of each phase will be. This is to avoid any misunderstanding that may occur during the course of the BCP project.

Key Disaster Scenario

One of the best practices is to define the Key Disaster Scenario6. This Key Disaster Scenario provides a perspective to the Executive Management, Organization BCM Coordinator, BCP team, DRP team, and even the crisis management team.

The scenario should be based on the worst-case possible time, most severe magnitude, total loss of information and equipment.

tip The next section will help the Organization BCM Coordinator develop its Key Disaster Scenario. The detailed development of the Key Disaster Scenario is conducted during the Risk Analysis and review phase. For more details, refer to the “Analyzing & Reviewing the Risks for Business Continuity Planning” book.

Limit Initial Scope

If this is the first time that you are embarking on this project, do not take on a project to develop BC plans for the “dooms” day scenario for the entire organization. The scope of the BCP project will simply be too broad. There is no way it can be kept under control. Most organizations are often too ambitious as they proceed to develop their BC plan based on the broadest scope.

It is recommended that you always start with a scope that is practical and realistic from the Executive Management's perspective. Once the BCP project is successful and the Executive Management is confident of your ability, increase the scope.

Benefits of Having a BC Plan

The major benefits from developing a comprehensive BC plan can be summarized as:

Minimized potential economic loss
Reduced legal liability
Reduced disruption to normal operations
Maximized organizational stability
Ensured orderly recovery
Minimized insurance premiums
Reduced reliance on key personnel
Increased asset protection
Ensured safety of personnel and customers
Compliance with legal and regulatory requirements
Minimized decision making during a disaster

Document Limitations and Assumptions

In any typical Project Management phase, it is important to identify the “IS” and “IS NOT” of a project. You can ensure that there is no confusion or disagreement about what will, or will not, be included within the scope of the BCP project. If, for example, the BCP project will not be addressing multiple site disasters or loss of key personnel, document this as a the limitation which will be addressed in a subsequent BCP project. Here are some examples of assumptions:

Staff are denied access to the office building for a sustained period of seven calendar days
Extend planning to commence on day two or three if a disaster is projected to exceed seven calendar days
Address only critical business functions and not daily operational contingencies
Only critical business functions will be accorded priority during the seven calendar day period
No more than one country will be affected concurrently by the same disaster
Disaster occurs at the most vulnerable time for each business function
Disaster recovery (DR) plan for an IT functional unit is already in place and tested
Alternate staff and replacement equipment are available within planned timeframes

Design Clear Objectives and Scope

One measurement of an Organization BCM Coordinator's success will be whether the final product satisfies the Executive Management's requirements.

In much the same way as the Organization BCM Coordinator needs to know what is expected of him or her as an Organization BCM Coordinator, it is essential that there is agreement as to what exactly the BCP implementation is going to achieve.

The Organization BCM Coordinator needs to consider how much of the business operations will be covered. For example, will it be a staged recovery if you are in a minicomputer or mainframe environment, do you include PCs, are you going to expect "immediate" recovery of all IT applications and business functions to full operating level or only the critical IT applications and business functions or something in between.

It is imperative that these objectives and scope be in writing and signed off by the Executive Management. Any subsequent changes must also be in writing and the timeframe and resource allocations amended as required.

Failure Scenarios

When defining the scope of the plan, one consideration is to define the failure scenario. The BCP literature is full of specific outage scenarios that range from the commonplace to the bizarre. It is not the intention of the Organization BCM Coordinator to catalog all the potential disasters that can

The Key Disaster Scenario provides the BC Team with a perspective of the magnitude of the disaster that an organization is willing to commit the resources to mitigate and is acceptable to the Executive Management, Organization BCM Coordinator, BCP team, DRP team, and even the Crisis Management Team affect an organization. However, in any failure, the context should be considered.

Scenario: Isolated

The first context to be considered is an isolated failure scenario. The organization assumes that the failure is restricted to its immediate physical or logical environment and that it is able to call upon other entities to assist it to get back on its feet. This disruptive scenario is the confinement of the business operation in one physical environment. The organization can still fall back on its other offices and facilities elsewhere in other cities and nearby office areas which are unaffected as well as the national infrastructure and networks. This is a common scenario as most organizations have their major operations located at a geographically distant location. For example, in Asia, major key business operations are located in Singapore and Hong Kong.

An example of a confined logical environment is a network failure caused within your own voice and telecommunication networks. A hacker, virus, or operational error that brings down an IT system or local voice or data network can be as effective in stopping your business as a physical disruption. Even though it is usually easier and faster to repair or replace damaged hardware or corrupted software than an entire worksite, the impact of the damage is a function of your dependencies. An outage of only a few minutes duration can still be devastating in certain critical business environments and IT applications.

Another example is the use of the “denial of access to the building” scenario. I often find this scenario to be fairly generic and yet it covers the most severe type of isolation failure scenario.

tip The key concept is to focus on the effects of the threat (failure scenario) rather than on multiple threats that an organization is expecting.

Scenario: Widespread

The second context to be considered is a widespread (or systemic) outage scenario. Many organizations may be affected along with yours, and your organization's country-wide operations may be affected as well. Examples of such scenarios are the September 11th attack, and the Kobe, Japan, and Taipei, the Taiwan earthquakes, and the Severe Acute Respiratory Syndrome (SARS) epidemic. Organizations that were affected had to employ “out-of-the- region” fallbacks whereby, they were forced to close and transfer their remaining resources to other states, provinces, or even countries.

Scenario: Isolated and Widespread

Your planning is not complete unless you have taken into account the two classes of scenarios. Although at first glance, taking care of widespread loss may seem to also include localized or isolated disruptions, there are often unique problems associated with the isolated failure scenario that gets overlooked in the more global view. Conversely, the widespread plan can contain major instances of overkill when applied to a localized outage. You probably would not have to travel to another country if there is a power outage to your operation processing center. On the other hand, you might if there is a terrorist attack that disrupted all of downtown.

tip It is very important not to develop your planning around one and only one disaster scenario. In the past, many of the plans I have been asked to review were clearly developed with one class of outages in mind (usually a physical disruption and often, even more specifically, fire). While it is also inappropriate to go to the other extreme by trying to cover every eventuality, however improbable, I will discuss several processes in the “Analyzing & Reviewing the Risks for Business Continuity Planning” book that will help ensure you have the most likely bases covered, especially for those situations where your action plans may dramatically differ.

Due to the limitation of resources, the key to implementing a BC project usually starts with an isolated scenario (limited scope), keeping the design in mind that there is a need to upgrade the disaster scenario for the BC plan to a widespread scenario.

Example of Objectives, Tasks & Deliverables

This is a sample of typical objectives for a BCP project. I have included the tasks to be completed for each objective and the expected deliverables.

Objectives

The objectives of the Project Management phase are to:

Formulate a workable BCP project proposal
Seek endorsement and commitment from the Executive Management on the project objective, scope, approach, schedule, and resource requirement
Establish project management structure and control

Tasks

The tasks to complete this phase include:

Review and understand the organization's environment
Agree on and formalize BCP project management structure and resource allocation
Establish BCP project administration reporting and control mechanism
Submit BCP project proposal to the Executive Management for approval

Deliverables

The deliverables of a BCP project are a project plan proposal, a project work plan, and a project reporting mechanism. The project proposal includes:

Definition
Scope
Objective
Roles and Responsibilities

BCM Project Management Steps Click to find out more about the detailed requirement for each steps
Back To	1	2	3	4	5

6	7	8	9	10	11

More Information About Blended Learning BCM-5000 [BL-B-5]

To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org. They are the BL-B-3 Blended Learning BCM-300 ISO22301 BCMS Implementer and the BL-B-5 Blended Learning BCM-5000 ISO22301 BCMS Expert Implementer.