Continuity & Resilience Q2 2019

THE MAGAZINE OF THE BUSINESS CONTINUITY INSTITUTE | Q2 2019

PIONEER FOR CHANGE Gloria Olive Bakakunda champions the importance of Business Continuity in Uganda

Cover_Q2 2019_Continuity & Resilience Magazine 1

03/06/2019 15:40

BCI.Q2.2019.002.indd 2 ContSA FP.indd 1

31/05/2019 23/05/2019 15:18 15:01

Q2 2019 | ISSUE 6

12 REGULARS 04 Welcome 06 News

16

Preparing for the worst, Energy blackouts ‘likely’, Risk report hails benefits of history

36 BCI News BCAW 2019, Looking ahead to BCI World, C&R nominated for association award

10 Debate

SPECIAL REPORT

F E AT U R E S

20

16 Coming in from the cold

Elizabeth Mos, New Zealand Inland Revenue

Opinion: Making Resilience personal for personnel Expert View: Validating Business Continuity Plans

20 SPECIAL REPORT: Back to the future BCI members and industry experts recall the biggest challenges since the Institute’s formation in 1994, and how Business Continuity has grown into the profession it is today

In Uganda, the BCM consultant is leading a cavalry charge on behalf of the importance of Business Continuity to African businesses

37 Next Generation

12 Interaction

At the start of its Business Continuity journey, Russia is placed in a precarious position amid political and cyber infrastructure issues

28 PROFILE: Gloria Olive Bakakunda

What can the BC/R community do to get more people to consider a career in the industry?

38 My Lightbulb Moment BCI UAE Forum Chair Yasmine Elhamouly on managing risk in everyday situations

14 Tech Round-up

28

News from: Druva, Quest, Everbridge, Earth Networks, JetStream

32

32 Letting the right ones in Business Continuity has a role to play in the recruitment process and assessing future insider threats, but how does the discipline define it?

COVER PHOTO: ESTHER RUTH MBABAZI/ TWENTYTWENTY

03_Contents_Q2 2019_Continuity & Resilience Magazine 3

03/06/2019 15:40

LEADERS’ MESSAGES

WELCOME Continuity & Resilience is the magazine of the Business Continuity Institute and is published four times a year.

BUSINESS CONTINUITY INSTITUTE 10-11 Southview Park, Marsack Street, Caversham, Berkshire, RG4 5AF tel: +44 (0) 118 947 8215 bci@thebci.org | www.thebci.org EDITOR DeeDee Doke deedee.doke@redactive.co.uk A S S I STA N T E D I TO R Patrick Appleton patrick.appleton@redactive.co.uk REPORTERS Colin Cottell colin.cottell@redactive.co.uk Graham Simons graham.simons@redactive.co.uk CONTRIBUTING WRITERS Sue Weekes DESIGNER Will Williams

TIM JANES

The value of longevity

T

he BCI’s 25th anniversary is not the only notable milestone to celebrate this year. We have also recently published the 10th edition of the BCI Supply Chain Resilience Report along with a special report examining the trends noted over the past decade.

This provided the BCI’s Thought Leadership team with a perfect opportunity to reflect on the findings from the successive annual reports. The analysis contains not just the results from this year’s survey, but also highlights patterns that have emerged since 2010.

Next year will be the eighth edition of the BCI Horizon Scan Report, which will bring a further chance to observe the rise and fall of disruptive forces and examine how the Business Continuity industry has adapted to relentless evolution in our organizations, economies and technology.

And the BCI’s bedrock, the Good Practice Guidelines, will soon be 20 years old, having gone through multiple editions in that time.

These examples demonstrate how, as a result of its longevity, the BCI can now draw on an extensive archive of reports

PRODUCTION EDITOR Vanessa Townsend PICTURE EDITOR Claire Echavarry SENIOR SALES EXECUTIVE Andrew Penny Tel: +44 (0) 20 7880 7661 andrew.penny@redactive.co.uk

D AV I D T H O R P

A Resilience Alliance is the answer

PRODUCTION DIRECTOR Jane Easterman Tel: +44 (0) 20 7880 6248 jane.easterman@redactive.co.uk PUBLISHING DIRECTOR Aaron Nicholls Tel: +44 (0) 20 7880 8547 aaron.nicholls@redactive.co.uk PRINTER The Manson Group, St. Albans PUBLISHED BY Redactive Publishing Ltd Level 5, 78 Chamber Street, London, E1 8BL Tel: +44 (0) 20 7880 6200 www.redactive.co.uk

I

recently discussed at an industry gathering the work we will be carrying out over the next six months on the BCI brand. This invited the question of whether this is the right time to reposition the BCI as the ‘Resilience Institute’ or something similar.

My response: we don’t think there will be a right time. We have one of the two most powerful global brands in Business Continuity (BC) in terms of recognition and reputation. Our expertise has been built on the back of our members’ excellence as BC practitioners and the adoption and standing of the BCI Good Practice Guidelines.

We are one of the most credible organizations in our field with a

© Business Continuity Institute 2019 The views expressed in C&R are not necessarily those of the Business Continuity Institute.

All efforts have been taken to ensure the accuracy of the information published in C&R. However, the publisher accepts no responsibility for any inaccuracies or errors and omissions in the information produced in this publication.

No information contained in this publication may be used or reproduced without the prior permission of the Business Continuity Institute. ISSN 2517-8148

Recycle your magazine’s plastic wrap. Check your local facilities to find out how.

4 C O N TIN UITY & R E S IL IE N C E | Q2 2019

04-05_Chair's me_Q2 2019_Continuity & Resilience Magazine 4

03/06/2019 15:40

and papers built up over two-and-a-half decades. Like other mature professional bodies, the BCI’s growing knowledge repository represents an invaluable resource that brings beneficial insight to the analysis in current and future publications.

It can be tempting for organizations that are focused on maximising future opportunities to regard past events as irrelevant. However, as a wise teacher once said, “study the past if you aim to define the future”.

DEEDEE DOKE

Editor’s comment

D

P H OTO G RA P H Y: A K I N FALOP E

Tim Janes Hon FBCI, MBA, BCI Chairman

brand that has built considerable equity. Would we still enjoy that credibility if we announced that we would now be known as the Resilience Institute, faced with a 25-year task to rebuild discarded equity?

Of course not. We are experts in Business Continuity, not risk, not security, not emergency planning, not cyber security, not facilities, nor supply chain management or any of the other disciplines represented along the Resilience spectrum.

We would lack credibility if we suddenly tried to re-invent ourselves in this way: ‘Resilience’ is not a single field where you can realistically be a jack-of-all-trades, expert in all areas.

Our approach, therefore, is to work with similar organizations to ourselves, each representing different professional disciplines within the Resilience spectrum, each bringing an expert

and unique perspective and approach to the question of Resilience anchored on its field of professional activity and representation.

We have already reached an agreement with a number of bodies that will form the basis of this Resilience Alliance, and will announce its launch later this year.

Work has begun to develop common approaches to issues that affect Organizational Resilience and to explore joint research on the impact of activities aimed at building Organizational Resilience.

Key functions will be to use each other’s networks to share best practice in the disciplines that contribute to Organizational Resilience and to share each other’s expertise for the benefit of all our members.

Watch this space…

ebate continues to sizzle about the various dimensions of security culture – how many are there, for instance, and what are they?

CLTRe, a Norwegian company that helps organizations assess, build, maintain and measure a strong security posture, looks at seven dimensions of security culture: behaviour, responsibilities, cognition, norms, compliance, communication and attitudes. At the same time, the overlap between security and Business Continuity and Resilience (BC/R) is also a subject of animated discussion.

In this issue, we take these debates a step further and put them in the context of preventing insider threats, a space where some of CLTRe’s dimensions come into play. What is BC/R’s role here and where does it start? Find the discussion on p32, and let us know your thoughts on the way of the future here.

In this issue also, get an insight on p16 into how our Russian colleagues in BC/R are starting from the ground up in developing the profession as Business Continuity rises up the priority list for organizations in that country. And on p28, meet the talented Gloria Olive Bakakunda who is doing the profession proud in Uganda!

We’d love to hear from you: what’s going on in your world?

DeeDee Doke Editor

David Thorp Executive Director, BCI

5 CONTINUITY & RESILIENCE | Q2 2019

04-05_Chair's me_Q2 2019_Continuity & Resilience Magazine 5

03/06/2019 15:41

G LO BA L N E W S U P D AT E

21% According to Cambridge Centre for Risk research, corporate finance is the highest risk (21%) identified in annual company reports

RESILIENCE

‘Hope for the worst’ to prepare for all eventualities

By Patrick Appleton Business Continuity professionals must embrace the possibility of things going wrong and “get comfortable being uncomfortable”.

That’s according to Jeff Grant, Founder of Hillseeker Coaching, who spoke recently at the Risk-!n conference in Basel, Switzerland.

Relating his own experiences to Business Continuity, the coach said that learning from experiences and failures is an important facet of personal development and a key component in creating resilient people.

Recalling the use of ice water baths at a mental toughness event, Grant said that those following someone who was not mentally prepared for the challenge also found the exercise difficult.

The amateur endurance

athlete encouraged BC professionals to learn from failure and “allow it to inform your paradigm”, not write it. “The way you see it is how you write the script in your own life.”

Grant also mentioned the usefulness of adversity checklists, similar to those found in Business Continuity planning, in “getting comfortable being uncomfortable” and visualising things that could go wrong so that when the time comes for adversity, it is recognisable and easily dealt with mentally.

In 2018, he was part of a team that headed to Normandy, France to commemorate the D-Day landings by being dropped 10km offshore in the English Channel before swimming to Omaha Beach and proceeding onwards by foot to the town of Saint Lô.

On the day, the team suffered treacherous weather

that saw them veer off course by five kilometres, forcing the French coastguard – accompanying the swimmers – to abort the attempt.

Sea sickness, thrashing waves and a fear that one of the team was missing tested the mettle of everyone aboard, but once it became apparent the latter was false information, Grant and others were allowed back in the water and made it ashore before trekking on to Saint Lô.

The life coach said that for all of the physical training he endured in the icy waters of Lake Zurich over the winter, it was the mental preparation for expecting the worst that paid off most.

Encouraging BC professionals to tap into such a method, if not literally, Grant said: “Everyone endured when we were sick, cold and confused because of the Resilience we had trained ourselves for. That

came from putting ourselves in adversity to prepare, but it wasn’t exactly what we thought we were preparing for.

“We usually say ‘prepare for the worst, hope for the best’. It sounds so optimistic,

but I encourage you to ‘hope for the worst’. You fully put your mindset and your trust behind your ability to perform in the worst conditions, so much so that you hope it happens because you know that you’re ready.

“You know you can handle the worst and those hard moments are the key to growth. Resilience is all about adaptability.”

6 CONTINUITY & RESILIENCE | Q2 2019

06-09_News_Q2 2019_Continuity & Resilience Magazine 6

03/06/2019 15:41

VISIT THE WEBSITE FOR MORE NEWS: WWW.THEBCI.ORG

The 20th century experienced:

25

240

financial crises

conflicts

55

92

wildfires

large earthquakes

Source: Centre for Risk Studies, Cambridge Judge Business School

RISK INSURANCE

Learn from the past, say risk experts

You trust your ability to perform in the worst conditions – you hope it happens because you know that you’re ready

IMAGES: ISTOCK / ALAMY

By Patrick Appleton Organizations should use the past as a tool to gauge emerging threats, leading experts in the field of risk have suggested.

A Cambridge Risk Briefing entitled Understanding the Next 10 Years of Risk was held at Lloyd’s of London in May, where speakers spoke of the benefits of looking at the past to plan ahead and insure the business against emerging risks.

Tamara Evan, a Research Assistant at the Cambridge Centre for Risk Studies (CRS), said “history is the first stress test” and implored organizations to look at the past to understand global tensions, and the impact of pandemics and how they

happened. Daniel Ralph, Professor of Operations Research at CRS, added that the topics currently on the risk spectrum “were not really being discussed at the boardroom even six years ago” and said much could be learnt from studying past conflicts and trade wars as those factors take shape again today.

Evan said looking at the wide-reaching impact of

Top 5 risks facing businesses Financial Operations Regulations Reputation Cyber Source: Centre for Risk Studies, Cambridge Judge Business School

events in the 20th century, how they developed and the aftermath, could help businesses understand the emerging risks populating the modern business world.

Oli Carpenter, a fellow Research Assistant at CRS, also explained that in terms of insurance, organizations need to be more aware of “risk from all angles”.

Explaining that businesses must be able to recognise threats that could affect them, he said that in the case of the collapse of Monarch Airlines, although the carrier wasn’t directly involved, terror incidents in Egypt and Tunisia were contributory factors to the company’s demise as key markets closed in the wake of the attacks.

Carpenter said that by using the CRS Taxonomy of Threats for Complex Risk Management, risks coming from various causes can be identified and explored to see where the danger lies for corporates, the wider economy and geopolitics.

“Climate change is seen as an environmental risk initially,” he said. “But data and history shows we know it materialises into social, humanitarian, geopolitical issues, which in turn affects the macroeconomy.

“Companies can use the Taxonomy model to stress test, and we need to be able to anticipate the unknowns.”

7 CONTINUITY & RESILIENCE | Q2 2019

06-09_News_Q2 2019_Continuity & Resilience Magazine 7

03/06/2019 15:41

NEWS

IN BRIEF

Dutch bank’s blockchain tracker

Cryptocurrency scams top £27m

ABN Amro has launched a new digital blockchain platform to provide real-time insight into trade inventories.

Forcefield is an Internet of Things (IoT) solution which allows monitoring of physical trade inventories, using sensors and near-field communication chips.

The Dutch bank said the system will lead to more secure physical handling processes and reduce costs in the management of commodities used as collateral for loans.

The UK’s financial regulatory body announced in May that scams involving cryptocurrency amounted to more than £27m in the 2018-19 financial year.

The Financial Conduct Authority and Action Fraud – the UK’s fraud reporting centre – have called for vigilance when investing following an increase in cryptoasset and forex investment scams in the past fiscal year. Scams tripled in 2018-19, rising to more than 1,800.

R I S K M A N AG E M E N T

Blackout threats ‘on the horizon’ in US and Europe Increased deregulation in the US is putting the water and electrical systems under threat, according to a risk expert.

During a panel session at the Risk!n conference, President of technology consulting firm TMG-emedia Anna Murray said that the last 15 years in American politics has fostered a culture where the current level of deregulation is able to exist.

“I think everyone focuses on the last two years of American politics for obvious reasons, but a decrease of regulations has been going on much longer than that,” Murray told delegates in Basel, Switzerland.

“Companies are mentally operating in an environment where they think ‘the government isn’t going to regulate me and if they fine me, it’ll be [relatively] tiny’. In addition, organizations will have a legal challenge to that.

“In terms of the infrastructure of the US, I foresee that we will have the first large-scale attack on the water system or the electrical system because of the lack of regulation. Until somebody has to pay, nobody is going to do anything.”

Moderated by Petra Wildemann of the Swiss Cyber Think Tank, the panellists were asked whether other states or organizations could get involved due

to the global nature of the companies being discussed – such as Microsoft – but Max Klaus, Deputy Head of the Swiss government’s cyber security unit, MELANI, said that in his view, this would be an impossible task.

“Our organization is mandated to protect critical infrastructures in Switzerland, but we do not have any right of command outside the government,” said Klaus, adding that

IMAGES:ISTOCK / SHUTTERSTOCK

By Patrick Appleton

defining what a critical infrastructure is also proves difficult. He also covered the rise in crimewave, but disagreed a total blackout of the internet was plausible as it would also disadvantage the attacker.

“Probably we will have a large energy blackout,” said Klaus, echoing Murray’s sentiment that the risks are real and present. “But the motivation for an attack is not to shut down the whole internet, because if the internet is down worldwide the attacker can’t do anything anymore.”

Murray added that a sizeable amount of her company’s customer base was going analog in different ways – including paper – due to fears over cyber security, and wondered if the internet might “collapse under it’s own weight” rather than suffer a direct attack.

“Encryption only goes so far,” she said.

8 CONTINUITY & RESILIENCE | Q2 2019

06-09_News_Q2 2019_Continuity & Resilience Magazine 8

03/06/2019 15:41

VISIT THE WEBSITE FOR MORE NEWS: WWW.THEBCI.ORG

46%

Analysis from Databarracks showed that 46% of organizations believed their BC plans were not as up-to-date as expected of them.

CYBER SECURITY

Report finds top 10 cyber trends to watch for

By DeeDee Doke Ten key trends that organizations should be keeping track of to successfully manage their cyber risk have been identified in a new report by the Centre for Risk Studies at the University of Cambridge’s Judge Business School.

Released in May, the report summarises the current trends that are “likely to persist for the next year or two.

Businesses, however, need to plan over time cycles of multiple years”.

The report goes on to say, “One of the greatest challenges for cyber risk

analysts is to help organizations plan their multi-year business cycles to combat loss and justify investment in cyber risk reduction.”

In addition, researchers must further

step up to the challenge of providing longer-term guidance for “the potential shape of the cyber risk landscape over the next decade and beyond”, the report adds.

The report specifies the following trends: Increasing exposure to digital attack and disruption

Cyber attacks becoming increasingly political

Increasing propensity for cyber-induced business interruption Attacks on digital supply chains

Changing motivations of threat actors Improving security standards in corporates Improvements in law enforcement

Increasing potential for cyber physical loss events Changes in the regulatory environment Growth of e-commerce and reliance on internet for revenue

PLANNING

UK businesses lagging behind on BC strategies

By Patrick Appleton Almost half of UK businesses lack confidence in the suitability of their Business Continuity plans, a report has revealed.

Databarracks polled businesses ahead of Business Continuity Awareness Week (May 13-17) and found that businesses are frequently exposed to potential

need to be expensive or difficult,” he said.

Groucutt added that refreshing BC plans regularly should become the norm and suggested organizations use expected events such as London tube strikes to practice their strategy.

“This enables them to go through the processes staff

disruptions due to a lack of strong BC management.

The analysis showed that 46% believed their BC plans were not as up-to-date as they should be.

Peter Groucutt, Managing Director at Databarracks, said investment in Resilience is vital for organizations, yet for half of UK organizations this is not the case.

“Good BC planning doesn’t

should undertake during an incident,” said Groucutt.

“If you don’t have a BC plan, you should start by conducting a Business Impact Analysis (BIA) to determine and evaluate the potential effects of disruption to critical business operations.”

9 CONTINUITY & RESILIENCE | Q2 2019

06-09_News_Q2 2019_Continuity & Resilience Magazine 9

03/06/2019 15:41

D E BAT E

THE BIG QUESTION

H A M I D E T E K I N K A R A K AYA , GERMANY

Be loud about BC Awareness is the key point for potential Business Continuity (BC) candidates. It is very significant to explain to young people the importance of BC. Case studies, examples from the industry, infographics and social media campaigns can be effective tools to spread the word about BC. In addition, attending career days in universities, sharing success stories and making people aware of the job opportunities will also help attract more potential candidates into the career pool.

It is very important for all industries to keep their businesses up and running.

In order to achieve this goal, qualified BC representatives are one of the key roles in the organizations. New aspects such as global warming, cloud services (and the threats attached), Internet of Things (IoT) and virtual currencies bring more risks, and it is our job to be prepared and respond effectively if needed. The future brings new risks, therefore we need more Business Continuity experts.

Hamide Tekin Karakaya, CBCI, AMBCI, Senior Consultant, Deloitte

What can the BC/R community do to get more people to consider a career in the industry?

E A R L DA RY L S . FO R T U N A , PHILIPPINES

Relate to other professions There are several factors that one could consider in choosing a career: better pay, work shift flexibility, job stability, opportunity to travel and a lot more. But these primarily depend on an available career in the industry.

In some way, risk management is like Business Continuity management (BCM). I saw the evolution of risk management as it branched out

to specific aspects – enterprise, financial, operational, technology, environmental and cyber security.

Name it, and risk management has it. I am a fan of the work of Charles Darwin – the theory of natural selection, which defines the survival of the fittest and adaptation to change. If only BCM, like risk management, could also branch out to specific aspects of BC, people might want to consider a career change to this sector of the future. There will be an increase in opportunity and an increase of professionals in the industry – the law of supply and demand.

10 CONTINUITY & RESILIENCE | Q2 2019

10-11_Big Questi_Q2 2019_Continuity & Resilience Magazine 10

03/06/2019 15:42

D E B AT E

C AT H E R I N E D O L L E - S A M U E L , AUSTRALIA

Self-promote the opportunities The BC community should market itself and let potential recruits know in the first place what great opportunities exist in the profession. We could engage people in future BC careers in three ways: how an understanding of critical processes/functions provides an insight into an entire organization and can be leveraged into other functions (project/ change management, IT, risk, security, HR, strategy); how BC contributes to Organizational Resilience (strategy and operational) and explain to graduates how an understanding of their study area (humanities, risk, finance, etc) can apply to careers in BC & Resilience (BC/R). Plus, it would be a great idea to include BC/R in graduate options at careers fairs.

IMAGE: ISTOCK

I have observed that BC professionals have some differences in the delivery of the BCM plan. It goes back to the ancestry of their career – from which you’ve learned the roots of your skills and gained a lot of work experience prior to making a career change – which becomes your strength in the BCM industry. If we hone these skills and talents, new careers in BCM will evolve that will drive the creation of new BC professionals in the industry. By then, we will be able to easily request an increase in manpower for the BCM operation from top management.

Earl Daryl S. Fortuna, MBCI CBCP, BCM and Shared Services, The Philippine American Life & General Insurance Company

M A R K H O F F M A N , C A N A DA

A fun, fulfilling future One of the things that I enjoy most about being at this stage of my career is that I have an opportunity to mentor people who are new to the industry. What if we expanded that to attract new people? What would we tell them? Three ‘f-word’ messages: 1) this is an industry for the Future; 2) the work is Fulfilling; 3) the work is Fun. Industry of the Future: In the past, it was much harder to find an organization that hired BC professionals. Now, due to widely accepted best practices and regulatory pressures, the careers are plentiful. With more and more positions available, you won’t have to be a subject

The other key challenge is to change the perception that there isn’t a career in BC, or at least, not a career within an organization – particularly when there are few BC roles in many companies.

Our community can work with talent management and succession planning professionals to attract people to the BC profession who will be able to succeed in a number of different roles in an organization. Connect that to building a career in an organization, industry or sector, and mention that the number of roles is set to increase as is the remuneration, and I think the BC community could well experience a rise in applications.

Catherine Dolle-Samuel, AMBCI, Business Continuity & Resilience Specialist, Risk Management Division of Enterprise, University of New South Wales

matter expert on day one. Learn and grow by working under an industry leader.

The work is Fulfilling: By implementing sound BC principles, you can have a direct impact on the resiliency and success of your organization. By preparing a company for a worst-case scenario, you can dramatically increase their survivability. A job in our industry is fulfilling because you can make a huge impact on your organization! The work is Fun: Yes, it’s tedious at times, but for the most part, it’s a lot of fun. Being armed with the knowledge that you are making a difference is enjoyable. Running exercises and demonstrating improvements to your organization’s readiness is fun work!

Mark Hoffman, Consultant of Preparation, Continuity, Response & Recovery, Anesis Consulting Group

11 CONTINUITY & RESILIENCE | Q2 2019

10-11_Big Questi_Q2 2019_Continuity & Resilience Magazine 11

03/06/2019 16:49

INTERACTION

OPINION M I C H A E L H AY E S

Making Resilience personal for personnel

R

esilience has become the new buzzword among Business Continuity, disaster recovery and emergency management practitioners.

Organizational Resilience, IT Resilience, supply chain Resilience, community Resilience and just about any other business function with Resilience tacked on to the end. Within the realm of Resilience, there seems to be a misconception when it comes to the most essential form, personal Resilience.

There is no argument that as practitioners we include strategies that are related to workforce disruptions, but the incorporation of these strategies allows us to validate that our corporate assets are protected and that we can resume operations as quickly as possible.

We exercise our plans, and the personnel involved with their implementation, rigorously, and are continually looking for ways to improve roles and responsibilities. Personnel Resilience is a great asset for a company to possess, but at the end of the day, the plans and strategies have the limited scope of daily business operations and not the Resilience of our employees when they go home for the day.

Chances are that if business operations are disrupted by a disaster and we have experienced significant losses in our assets, our employees are suffering the same impacts when they return home.

Often, we see corporations stepping up to the plate to take care of their employees by offering benefit funds, no interest loans, paid time-off donations, and other types of pay or leave programmes.

While these are great offerings, they often don’t consider the whole employee when attempting to make them more personally resilient.

As practitioners, we need to work towards verifying that offerings exist – such as employee assistance programmes, physical and mental health services, and social service referrals.

While Walgreens offers many of the previously mentioned benefits to our employees, the company takes additional steps to help make our workforce resilient with an ‘employee first’ approach in our culture.

Assisting personnel in becoming more personally resilient is an essential benefit to corporations. Helping our employees bounce back quickly to allow them to hit the ground running reduces the number of leave days they may require, and ultimately helps get operations back up and running promptly.

So, as we begin to review the latest round of BC plans, let’s make sure that we are working towards making personnel personally resilient.

Assisting our personnel to be more personally resilient is essential

Michael Hayes MScEM, CBCP, AMBCI is Program Manager, Business Continuity at Walgreens

THIS QUARTER’S BEST TWEETS TWITTER @THEBCEYE

Andrea Bonime-Blanc @GlobalEthicist Mar 21 #Europe led the world on #Privacy with #GDPR - why not on taming the #Technology wild west? It’s time to turn #tech #risk2value - my thoughts here: http://bit.ly/2PeSobE

Helen Yu @YuHelenYu April 23 In era of ‘defend forward,’ what does success look like? Is our infrastructure ready for cyberPearl Harbor? #CyberSecurity https://bit.ly/2VGW5sL

AIA Resilience @AIA_Resilience May 9 The need to design for resilience is clear: After a flood, 40% to 60% of small businesses close down, and 90% fail within a year of the disaster, unless they are able to reopen their doors within five days, according to @pewtrusts bit.ly/2AQ6smi

Stephen S. Musoke @ssmusoke May 22 The hard thing about Business Continuity and disaster recovery plans is not the implementation - but rather the thinking that goes into how to do it effectively.

And the million dollar question - What is the response when things go awry?

12 CONTINUITY & RESILIENCE | Q2 2019

12-13_Opinion_Ex_Q2 2019_Continuity & Resilience Magazine 12

03/06/2019 15:43

INTERACTION

EXPERT VIEW S Y LVA I N P R E F U M O

Validating the Business Continuity Plan

R

igorous exercising in realistic conditions is necessary to assess the effectiveness of the Business Continuity Plan. This exercising phase contains important verification steps which enable validation of the Business Continuity Plan (BCP). The validation can be used to verify policies, plans, procedures, training, equipment and is an opportunity to identify areas of improvement for the BCP. It is important to establish an exercising program in order to ensure a coordinated approach of the validation process. The scope of the exercising program should be defined according to the level of maturity and size of the organization. Information such as date of exercising, timeframe, objectives, scenarios, expected results, resources needed and budget should be included.

This list is non-exhaustive and may vary depending on the type of exercise for example the safety of the participants.

The exercise scenarios should not be too complex but should be sufficiently challenging to enable decision-making and actions. Each scenario should have three levels: events, incidents and injects (new element during the exercise).

Consequential actions Events describe the general context of the scenario, and their numbers depend on the exercise’s aim and performance objectives. Each event has consequences known as incidents. The number of incidents should keep participants occupied but not overwhelmed. Injects are used by the exercise project team to provide information to participants and specific problems for them to

solve. Injects can also be used to avoid dispersal of efforts from participants and prompt decision making and action.

Perform a needs analysis beforehand by considering for example the legislative and regulatory requirements, plans, procedures, capabilities and resources that require attention as well as potential threats to the organization.

The outcome of the needs analysis should establish the foundation of testing to perform during the exercising process. These exercises need to take into account related risks and constraints on conducting these activities, the geographic boundaries and the involvement of stakeholders.

environment for testing. Some logistical considerations include transportation, infrastructure, staffing services (catering, medical support and site security) and appropriate meetings and briefing arrangements.

Safety is critical when exercising involves participants being exposed to potentially dangerous situations or hazardous materials. A safety officer should therefore identify necessary risk controls if any. Consequently, risk management should be embedded in all aspects of the organization's exercising practices and processes.

Strategic communications Communication before, during and after an exercise is crucial. It is important to manage communication in order to have the commitment of involved parties; project team, participants and internal and external parties.

A communication strategy should be designed to allow the exercise project team to communicate effectively throughout the exercise to support delivery of an effective exercise. A clear communication strategy avoids any confusion during an exercise and enables the project team to start, perform, monitor and terminate the exercise in the best condition.

Finally, any good Business Continuity Plan must include a rigorous debriefing that should be analysed and developed into an action plan. The action plan should ensure that corrections are being done within a reasonable timeframe and improvements of the process are being implemented. Once correction and improvements have been proven in subsequent evaluations, only then can we say that lessons have been learned.

The number of incidents should keep participants occupied but not overwhelmed

Put faith in your people The outcome of the needs analysis will also help to identify the scope of the exercising project including the support required from top management, participants and stakeholders.

A person should be designated responsible for good coordination between teams involved in the exercising process. This person shall also chair the planning committee and be accountable to the organization. Training should be provided before exercising to ensure that teams and participants have knowledge and competences to perform assigned roles and responsibilities.

The exercising team should also identify materials, equipment and facilities needed as they develop scenarios and inform those responsible for logistics in order to provide a suitable

Sylvain Prefumo is Head of Business Continuity Planning at SBM Bank Ltd, the second largest bank in Mauritius.

13 CONTINUITY & RESILIENCE | Q2 2019

12-13_Opinion_Ex_Q2 2019_Continuity & Resilience Magazine 13

03/06/2019 15:44

Expert Voice

Advertorial

image (if applicable)

SPO NSO RE D FE ATURE R I C A R D O E N E R G Y & E N V I R O N M E N T

S PO N SO RED CO L UMN C O M P A N Y N A M E

Business continuity: a force for leadership development

Heading Sub Heading

By Chris Lewis, Senior crisis management consultant Apero vent occus arcipid et et ulpa denieturia quamus.

Si dolorro doloritatior ad es sunt la sunt.

Simagnam quatioreptis venisci cullaut debisqui dolesTemporumque ressi delibus nam, alia simpos eos volorit, susam ut ea volessunt ad que sim simus sitas experae sequi offictatqui dolorecabo. Unt arumquae volessit qui ow an organisation a crisis can thevoluptatum ability to be an effective communicator is non nimus accullatem lautem aria volorepelis quae.

Ut conmanages nem am eos a consecae nis sin core que CHRIS LEWIS Senior have a significantporum impact on itsrepudi business paramount. mo doluptae officipist, odit aut oditatatest, quodigni quatur culpa sitaten daerum, omni odit, crisis management continuity.

Frequently, leading responsevolorum to volorit modit, occumet aut velit volupta quamet, Ricardo ex esti occumqu istiaethe cupieniate a et inihil illenit qui consultant, NAME, an organisational crisis temque is thought to be the Team work assuntio in high-pressurecomnimenient environmentsveri hassitbeen Energy &nonsequae Environment omnihicatia debissitae delessi earchil moluptatur?

Qui officatet Job title, responsibility ofname senior management.

However, these key topic of researchers recently, whensimet magnimet pedis simet Company ersperspeespecially volupta tiaspis ea di solor sant omnis id qui nonsecu a scilluptas magnam, managers may not have the specific non-technical considering the heavy reliance onquae stringent health andut dolupta sincide rehendi et odit ex earum quam quibusa nimillupta volum que con restiatur autem facepreskills required to effectively lead such a response. This safety policies and procedures, and duty of care. si que minis receaque ex explitatatis volori omni intion ictur sitae aut es aut odio inctem faccae nusaessed este can result in an ineffective response and consequent nobita quo dis nit acit que odis eos essinihil eicae odipitat re simo esedis delenet incime disitin pe sum enture plandi negative impact on business continuity.

Coping with mental stress and fatigue. The types and assi dolorum et ipsustiis ium consequuntur arcius, voloressum res etur simolorum levels of stressisthat individuals – particularly those in estrum hicto blaborr orestot atinimendent id maionse non nonet pos ata inus quat. blatatis quibyalignati intio. Aximiliqui beatem fuga.

Organisational resilience milliqui will be improved selected leadership roles in teams responsible forqui responding quoof invenis serferu and ndebit et quat.

Etemergency oditis as ilitae.

Et quae expernatur serum dem qua-under duringSed members of staff receiving management to crises – are times emergency Molores sitatum simaxim fugia nullictiis quo optia dignihillmusam facculparia sime nonvellorere pliberatus, custo coratur? training, being given the opportunity to develop crisis tend differ from ‘day-to-day’ stresses.

Certain oresenses numquunt as dolesti dessum doluptat. fugite ipicimenis maxim volorest, tem idus of millent technical skills and being Itregularly exercised to keep levels stressiusdae can heighten and lamet place repratis the brain Odist ommoluptas reptatem alicaec epraturi autes sitisinobitia saepudaeptat et unt, quia vent ctatisin their skills ‘sharp’. onearunte ‘red alert’.

With effective training and exercising, will be able todolupti channel theiramus emotional ma busciis dellaboreria quis ent voloreptas praturio optatur? Qui omniam, cus nesresilient am qui leaders nobis excea Ricardo’s crisis management team hasre been involved response to a stressful situation positively. sum iduciti oreication repudae ctatem quas rendias di temquatur porrum et aut odi dolori omnis explibus in delivering business continuity andveliquis exercising pedisquis simolescium erferro vendam fuga. On eum ad ut vellab istraining id essenim ea quamenecte id ut fugiafor many years. We consider the fundamentals These core non-technical skills perioneed dunt.to be developed mendus rem fugit ius. of effective crisis management to be centred around and practised by appointed members of staff.

In et et ulpa denieturia quamus.

Apero vent occus arcipid Apero vent occus arcipid et et ulpa denieturia quamus. the ability to recognise the need for andressi usedelibus of non-nam, alia this way, senior management can be confident the nam, alia simpos eos volorit, Temporumque ressi delibus Temporumque simpos eos volorit, technical skills such as: organisation is in the best possible position to deal sequi offictatqui dolorecabo. Unt arumquae volessit qui sequi offictatqui dolorecabo. Unt arumquae volessit qui with a crisis and the impact on business continuity will con nem am eos a consecae nis sin core voluptatum que con nem am eos a consecae nis sin core voluptatum que Leadership in a crisis is often carried out on a ‘needsbe minimised. porum quatur repudi culpa sitaten daerum, omni odit, porum quatur repudi culpa sitaten daerum, omni odit, must’ basis rather than by people who have been istiae cupieniate volorum a et inihil illenit qui occumqu management istiae cupieniate volorum a Ricardo et inihil illenit qui to discussoccumqu trained specifically for emergency tasks. is happy how non-technical skillset temque earchil moluptatur? Qui officatet assuntio Effective leaders possess delessi the relevant management development can become delessi part oftemque a core earchil crisis moluptatur? Qui officatet assuntio di solor sant omnis id qui di solor sant qui nonsecu management scilluptas magnam, experience to lead a crisisea response, andomnis have id a range and businessea continuity programme. ● nonsecu scilluptas magnam, quibusa nimillupta volum que con restiatur autem fac ● quibusa nimillupta volum que con restiatur autem facepreof management styles they can adopt. ictur sitae aut es aut odio inctem faccae nusaessed este Effective decision makingre is simo the process of reaching esedis delenet incimeadisitin pe sum enture plandi judgement or making the consequuntur choice between options to arcius, voloressum res etur simolorum is achieve a successful outcome – during that milliqui blatatisincidents qui alignati intio. Aximiliqui beatem fuga. can often be required very with Etquickly oditis asand ilitae.

Et limited quae expernatur serum dem quainformation. musam facculparia sime vellorere pliberatus, cus coratur?

It fugite ipicimenis maxim volorest, tem idus millent iusdae Situational awareness is the ability to understand what nobitia saepudaeptat et unt, quia vent earunte ENERGY ctatisin & ENVIRONMENT RICARDO is going on in the vicinity of an incident. Situational praturio optatur? Qui omniam, cus nesFor am qui nobis excea please visit: further information awareness can be best described in three levels di temquatur re porrum et aut odi dolori omnis explibus www.ricardo.com/crisis-management – information gathering, interpreting information vellabEveryone is id essenim veliquis ea quamenecte id ut fugiaand anticipating future states. perceives mendus fugit ius.

COMPANY NAME information differently within theirrem own context, Apero vent This occus arcipid et et ulpa denieturia quamus.

Address Line 1 subconscious bias and experiences. means that Address Line 2 Temporumque ressi delibus nam, alia simpos eos volorit, they need to be able to demonstrate strong situational sequi the offictatqui dolorecabo.

Unt arumquae volessit qui awareness to fully understand implications of For further information please visit: acting on information received. con nem am eos a consecae nis sin core voluptatum que website porum quatur repudi culpa sitaten daerum, omni odit, Telephone: Crisis communication is largely overlooked as a tool occumqu istiae cupieniate volorum a et inihil illenit qui tel no. for crisis management. Asdelessi a result, specific crisis temque earchil moluptatur? Qui officatet assuntio Email: communication is often relegated a defensive role. ea di solortosant omnis id qui nonsecu scilluptas magnam, email address For those involved in any form of incident command, quibusa nimillupta volum que con restiatur autem facepre

H

company logo

↗

↗

14 14

CONTINUITY CONTINUITY & RESILIENCE & RESILIENCE | Q2| 2019 Q2 2019

BCI.Q2.2019.014.indd Ricardo advertorial.indd 1414

31/05/2019 28/05/2019 15:10 15:24

TECHNOLOGY

JetStream is helping cloud service and managed service providers offer enterprise customers continuous data protection as well as virtual machine (VM) Business Continuity and disaster recovery with its new product release.

JetStream DR replicates data at the moment it is written to local storage for “near-zero” recovery point objective (RPO) and recovery time objective.

In the event of a failover, the VMs and their data can be rehydrated on demand into a temporary VMware recovery environment, which JetStream claims provides a much more economical disaster recovery solution. www.jetstreamsoft.com

Recovery and back-up at every level Data protection and security software provider Quest Software has launched a disaster recovery edition of its Recovery Manager for Active Directory package, which claims to give businesses the ability to recover and restore from catastrophic events down to operating system level. Bringing another layer of protection to Quest’s Recovery Manager, it claims to help organizations implement an active directory recovery plan and cope with any disaster, whether caused by “mistakes and corruption” or “full-on disasters”. The disaster recovery edition allows the domain’s operating system to be restored without depending on other IT functions. www.quest.com

Cloud-based DRaaS claims 60% cost reduction Cloud data protection and management firm Druva, whose software-as-a-service (SaaS) disaster recovery solution is built on Amazon Web Services (AWS), has boosted its disaster recovery-as-a-service (DRaaS) with a range of features that it claims can reduce costs by up to 60%. These include automated runbook execution, simplified orchestration and testing, as well as a one-click failover to the cloud.

Druva claims its solution can meet enterprise compliance needs at scale with a recovery time objective of within minutes and a recovery point objective of an hour across any AWS regions. www.druva.com

TECH ROUND UP Best new tech this month

BEST NEW TECH

IMAGES: SHUTTERSTOCK/ISTOCK

Early weather warnings Businesses in the Philippines will be alerted more quickly to severe weather conditions to better inform decision-making. Earth Networks has collaborated with the nation’s agencies to deliver the service, which will provide information for the country and broader region. The 10-year programme is powered by a network of sensors and real-time automatic weather stations. It helps provide real-time severe weather data and short-range point forecasts, enabling emergency response planning for specific disaster-prone sites. www.earthnetworks.com

60%

Continuous protection from the cloud

Managing in a crisis Everbridge, the critical event management and enterprise safety firm, has announced a new crisis management solution to help organizations manage the lifecycle of a critical event and accelerate response and recovery times.

Crisis Management is fully integrated with Everbridge’s Critical Event Management suite and centralises incident response tasks, activities and resources through a common operating picture. It claims that Business Continuity, Resilience, crisis and security teams can all use the solution to launch response plans and add tasks, as well as collaborate with all stakeholders, wherever they are, to ensure employee safety and quickly restore operations. www.everbridge.com

15 CONTINUITY & RESILIENCE | Q2 2019

15_Tech Round Up_Q2 2019_Continuity & Resilience Magazine 15

03/06/2019 15:44

BC IN RUSSIA

COMING IN FROM THE COLD

BY COLIN COTTELL

B

usiness disruption is a major concern to companies in Russia, with 48% of respondents to a recent PwC survey reporting that they had faced a Business Continuity (BC) incident in the last year that resulted in more than four hours of disruption.

Faced with existing and future threats on this sort of scale, what is the state of development of BC in Russia, and how well prepared are companies across this vast country for the type and magnitude of threats they face?

“Most of the companies in Russia are at the start of implementing BC,” says Roman Chaplygin, the Moscow-based Director, Cyber Security and Business Continuity at PwC. Only just less than a third (31%) have had BC measures and processes in place for more than five years. More than half (57%) have begun to implement BCM only within the last three years,

A recent report found Business Continuity in Russia lacking in vital areas, but the appetite to learn and improve is genuine

Chaplygin says, adding, “Business Continuity in Russian companies is undergoing development.”

The PwC report resulting from the survey, ‘Business Continuity in Russia’, revealed that IT failures and cyber attacks are considered the top two existing threats to Russian organizations. Over the next five years, hacking, high reliance on information technology and cyber attacks are cited, respectively, as the first, second and third-ranked perceived threats to them, said the report, which was released in March.

“Cyber crime is one of the major world threats,” says Chaplygin, “with annual losses to the Russian economy from cyber crime estimated at between 600-650m (£8m) roubles, according to Russian banking experts.”

The digitalisation of Russia’s industries is just one of the underlying challenges facing the practice of BC in Russia as it works simultaneously to establish

“Russia is right at the start of its journey, and I can only see the BC industry snowballing in the medium term” Rachael Elliott Head of Thought Leadership, BCI

16 CCONTINUITY O NTIN UITY & RESILIENCE R E S IL IE N C E | Q2 2019 2 019

16-19_Russia_Q2 2019_Continuity & Resilience Magazine 16

03/06/2019 15:45

IMAGES: GETTY / ALAMY

BC IN RUSSIA

itself and develop as a professional function.

Although 60% of companies overall have implemented some element or elements of BCM, the level and sophistication of BC in Russia depends very heavily on the sector. It is most advanced in the banking, oil & gas and telecoms industries.

An important factor driving BC in banking is the Bank of Russia, which is “the main BC regulator in the country”, Chaplygin says.

In the oil & gas, metal and mining sectors, the especially dangerous nature of producing their products means that companies operating in these sectors have the advantage of having well-established emergency plans, he says.

External pressures from outside Russia are also a factor driving the development of BC in Russia. “For example, economic sanctions imposed on Russia led companies to develop strategies in case of loss of foreignservice providers and equipment,” Chaplygin says.

Russian privacy laws are also something that organizations need to be aware of in a BC context.

These rules require all personal data operators to store and process any personal data of Russian citizens within databases located in the country.

The penalty for violation is ultimately the blocking of websites, with potential disruption to business that this may cause.

1.5% ONLY 1.5% OF RESPONDENTS IN PWC’S SURVEY ON BUSINESS CONTINUITY IN RUSSIA WERE LISTED AS DEDICATED BC MANAGERS

1177 CCONTINUITY O N TIN TTIIINN UUIT ITTY T Y & RESILIENCE R EESS IL IILIE L IE I EENNNCCCEE | Q2 Q 2 2019 2200 19 19

16-19_Russia_Q2 2019_Continuity & Resilience Magazine 17

03/06/2019 15:45

BC IN RUSSIA

“When choosing service providers, companies should pay attention to where they store customers’ personal data. An alternative may be the depersonalisation [anonymisation of citizens’ personal data] transmitted abroad,” says Chaplygin.

One of the biggest obstacles to the development of BC in Russia, Chaplygin says, is determining who has responsibility for it within organizations. “The difficulty is that BC responsibilities in most Russian companies are distributed between different divisions – there is no dedicated responsible person,” he says.

According to PwC’s report, those with BC responsibilities are working in risk, internal audit, finance and even sales. Furthermore, only 19% of survey respondents were dedicated BC managers. More than a third of companies have not identified which function has responsibility for implementing and maintaining Business Continuity.

And while there is high awareness (94%) among business leaders of the importance of BC in achieving their business’s strategic objectives, this is not reflected in the amount of money allocated to BC, with 26% receiving no funding at all, and 34% saying funding is insufficient.

Looking to the future, Chaplygin says that in the next five years he expects that “more and more companies will actively implement BC processes”. In part, he explains this will be driven by the demands of state regulators. And unlike up to now, he says the impetus given to BC by regulators will not be confined to the banking sector.

57%

RUB 650m ANNUAL LOSSES TO THE RUSSIAN ECONOMY FROM CYBERCRIME ARE ESTIMATED AT BETWEEN 600-650M ROUBLES (£7-8M), ACCORDING TO RUSSIAN BANKING EXPERTS

MORE THAN HALF (57%) OF RUSSIAN COMPANIES HAVE BEGUN TO IMPLEMENT BCM ONLY WITHIN THE LAST THREE YEARS

As throughout much of the world, the World Wide Web is part and parcel of everyday commercial life in Russia, so anything that threatens the Web has to be taken very seriously by companies and those with responsibility for BC. To test its Resilience, Russia is considering the possibility of disconnecting from the World Wide Web for one day.

“The main task is to ensure reliable operation of the Russian part of the global network, which needs to be stable in the event of failures in the internet structure outside of Russia or of targeted large scale external influence,” says Chaplygin.

However, he adds that “there is no official information” to confirm that this disconnection will actually happen.

Although take-up and interest in the ISO

18 CONTINUITY & RESILIENCE | Q2 2019

16-19_Russia_Q2 2019_Continuity & Resilience Magazine 18

03/06/2019 15:45

BC IN RUSSIA

In the oil & gas, metal and mining sectors, the especially perilous nature of producing their products means that companies operating in these sectors already have wellestablished emergency plans

“The difficulty is that Business Continuity responsibilities in most Russian companies are distributed between different divisions – there is no single dedicated responsible person to deal with BC” Roman Chaplygin Director, Cyber Security and Business Continuity, PwC

standard for BCM, ISO 22301, in Russia is low, according to Chaplygin, this does not reflect a lack of interest in or a commitment to driving up standards. “There is interest among companies for quality training in BC, for example through case studies, and learning from the experience of Western countries,” he says.

The BCI’s Russian Chapter can also play a pivotal role in raising awareness of BC in Russia and driving up standards.

In March, Rachael Elliott, Head of Thought Leadership at the BCI, attended an event in Russia that drew around 50 representatives of companies based there, and gave a presentation on the BCI’s ‘Horizon Scan Report 2019’. Representatives from the banking and mining industries also spoke.

“Participants expressed interest in holding similar seminars, roundtables and conferences on BC,” says Chaplygin. He adds that regular such events are planned, with the next one devoted to crisis management expected to take place in October.

Elliott says the Moscow event was an “eye-opener” for her. “Russia is towards the beginning of its Business Continuity and Resilience journey, and the event I attended was, for the attendees who spoke to me, the first chance they had ever had to network with individuals from the BC industry.

“They placed such high value on the ability to knowledge-share with other individuals, and were able to share and resolve issues they had within their own businesses for years simply from meeting other individuals at the event.”

She continues: “There were a lot of financial services (FS) companies there – the FS industry is, as we see globally, ahead of the curve with BC (mainly due to regulatory issues). The Moscow Exchange gained ISO 22301 accreditation in October last year, and they were hopeful more would [follow] as BC grows in importance.

“Russia is right at the start of its journey,” Elliott says, “and I can only see the Business Continuity industry snowballing in the medium term. Knowledge sharing between organizations is a barrier – but through increased appetite for workshops and events like the one run by PwC, I foresee BC being shunted to the forefront of Russian board agendas perhaps quicker than many may expect.”

19 CONTINUITY & RESILIENCE | Q2 2019

16-19_Russia_Q2 2019_Continuity & Resilience Magazine 19

03/06/2019 15:45

SPECIAL REPORT

25 YEARS OF BC

BACK TO

SPECIAL REPORT

BY SUE WEEKES

FUT 20

CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 20

04/06/2019 09:11

25 YEARS OF BC

In 25 years of the BCI’s existence the Business Continuity landscape has changed immeasurably, and continues to do so

THE

URE 21 CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 21

03/06/2019 17:27

SPECIAL REPORT

25 YEARS OF BC

B

usiness Continuity’s (BC) roots go back to the 1970s and the age of the mainframe computer and early data centres. Part of the job was to protect the cooling pipes that ensured the computers remained at the right temperature. The 1980s witnessed the shift away from mainframes and the advent of the personal computer (PC) revolution, with end-user machines sitting on desktops all over the organization. This started to broaden the role away from just IT hardware.

Business impact analyses (BIA) started appearing to ensure the right governance and policies were in place around this new distributed approach to infrastructure and by then the remit had extended to business processes too.

Since then the remit has continued to widen in tandem with the launch and evolution of the BCI in 1994. From the start, the very nature of what BC did meant it was business-critical but it didn’t always get the recognition it deserved. This began to change, though, in the mid-1990s, where our 25-year retrospective of the development of BC begins begins.

1994 2001

CIVIL EMERGENCY AND Y2K By 1994, the world of business was becoming acutely aware of the need to insulate itself from the threat of natural disasters and man-made attacks. Hurricane Andrew, for instance, which hit the Bahamas, Florida and Louisiana in 1992, became the then-costliest disaster onrecord for the US and brought a “paradigm shift” in quantitative business thinking, says Daniel Ralph, Academic Director of the Centre for Risk Studies at Cambridge Judge Business School. “It drove regulatory and business need for catastrophe risk management,” he says.

Meanwhile, terrorist threats loomed large. The 1993 bombing of the World Trade Center in New York killed six people and injured more than 1,000, and disrupted hundreds

of businesses. The UK had also suffered devastating successive attacks in its financial districts with the City of London’s Baltic Exchange (1992) and Bishopsgate (1993) bombings by the Provisional IRA. Charlie Maclean-Bristol, a former Army captain, entered the sector in 1995 as an emergency planning manager at Anglian Water, at a time when civil emergency was very much on the agenda. “My predecessor did post-nuclear war planning but I was one of the first to do planning for no water, contaminated water or serious flooding,” he said.

The profession was growing up fast and there was a recognition that a more structured approach to areas like crisis management and disaster recovery was needed that went far beyond IT. There was also clearly a need to share knowledge and best practice.

In 1994, a group of

1994 1994 October: Netscape releases Navigator browser, heralding the birth of online service companies

1995 February: Barings Bank collapses

individuals from the disaster recovery and BC network, Survive!, led by Andrew Hiles from the Kingswell Consultancy, established the Business Continuity Institute (BCI).

“The sector was about 10 years young,” recalls Paul Kirvan, BCI member number 20 and an independent IT consultant/auditor in the US, who explains that it later joined with US-based Disaster Recovery Institute (DRI).

“Both organizations wanted to promote and expand awareness of the profession in public and private sector, and establish credentialling/ certification processes as a way to further formalise the profession.”

The first BCI Annual General Meeting was held in London in 1995 and in 1997 it became an independent membership organization.

The timing of the BCI’s formation proved to be

prescient, not least because society was at the dawn of a period of huge technological transformation for the world of business.

A year earlier in 1993, the European Organization for Nuclear Research (CERN) had made Tim Berners-Lee’s World Wide Web interface available on a royalty-free basis while organizations were starting to adopt the use of email as a method of communication. Technology was freeing up businesses to be more disparate, distributed and remote but this would bring new challenges for the BC community.

Indeed, by 1999 organizations were increasingly relying on a digital infrastructure for their processes, communication and operations, so the spectre of the Millennium Bug was taken extremely seriously. Money and resources were ploughed into protecting companies

2001 1999 March: Melissa virus unleashed causing an estimated $1.1bn damage worldwide and affecting 300 organizations

1999-2000 December-January: Y2K Millennium bug

22 CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 22

03/06/2019 16:17

25 YEARS OF BC

9/11 AND THE RISE OF THE TWO ‘R’S

IMAGES:GETTY / ALAMY

The Provisional IRA bombings in London’s financial district in consecutive years caused extensive damage with major rebuilding required

from Y2K, a coding problem that would kick in when computers had to deal with dates after 31 December 1999. Ultimately, it caused relatively little disruption as the world flipped into the 21st Century but it brought about a shift in attitudes and gave the BC function organization-wide recognition as a protector of business value.

“Post Y2K was a heyday for BC,” says Maclean-Bristol. “I can remember even small councils investing £100,000 in BC at that time.”

Technology was only just beginning to show its dark side though. In May 2000, the ILOVEYOU worm virus infected around 50 million computers in 10 days. Travelling by email, it clogged up servers in offices around the globe and cost businesses, governments and other users more than $6bn globally in just a few days. It was a nasty taste of what was to come.

2001 September: 9/11 terrorist attacks

2003 December: Bam (Iran) earthquake

The ILOVEYOU worm virus infected around 50m computers in 10 days

An unprecedented number of global events in this relatively short period put the world in a heightened state of fragility and vulnerability from which it is still recovering.

For organizations, the response to events such as 9/11, the 2003 Bam, Iran earthquake, the 2004 Boxing Day tsunami and the 7/7 terrorist attacks in London put a new emphasis on building in corporate Resilience as part of Business Continuity (BC) and it marked a major transition.

“One of the biggest changes is the shift in how BC and Resilience is perceived and valued by organizations, moving from a compliance necessity to an integral part of Organizational Resilience,” says Tracey Forbes Rice, Vice President, Customer Engagement at Fusion Risk Management, who has worked in the sector for more than 25 years.

Her sentiments are underlined in the paper, The evolution of Business Continuity management: A historical review of practices and drivers by Brahim Herbane and published by Routledge. The author writes that the terrorist attacks of 11 September marked a change in BC management (BCM) practices to incorporate the notion of enterprise/organization-wide Resilience in which “there are shared notions” about Resilience by employees and greater flexibility in how to respond to large-scale disaster scenarios.

Herbane adds that the period that followed saw an acceleration in the introduction of guidelines and regulations for organizations, initially emanating from the US but in other regions, too.

These included the UK Civil Contingencies Act (2004) and the Singapore Standard for Business Continuity/disaster recovery Service Providers.

2001

2001 2007

2007-08: Financial crisis which triggered the global recession

2004 December: Boxing Day tsunami South-East Asia

2004 February: Facebook launched

23 CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 23

03/06/2019 16:17

SPECIAL REPORT

25 YEARS OF BC 2010 June: Stuxnet virus attack on Iran’s nuclear facilities (world’s first “cyber-weapon”)

$74bn

ENRON WAS REVEALED TO HAVE FALSIFIED INFORMATION ABOUT PROFITS AND CONCEALED DEBTS, WITH LOSSES OF $74BN (£58.8BN) WHEN IT COLLAPSED Resilience wasn’t the only ‘r’ word affecting the sector at this time. In 2001, what was then the biggest corporate bankruptcy in history made the headlines, bringing the threat of operational risk sharply into the spotlight. Enron was revealed to have falsified information about profits and concealed debts, with losses of $74bn (£58.8bn) when it collapsed.

Shortly afterwards an accounting scandal over $3.8bn of expenses at telecoms company Worldcom saw it usurp Enron as the largest bankruptcy ever. These examples of exposure to risk, of course, were precursors to what was to trigger the credit crunch of 2007 in the shape of the US Freddie Mac and Fannie Mae mortgage crises.

Reputational as well as operational risk are among the factors that have merged other disciplines with the BC function marking another major shift.

This was also a particularly busy period for the BCI, publishing its first Good Practice Guidelines (2002), which drew on the knowledge of practitioners around the world and a year later the joint BCI/DRII 10 Standards of Professional Competence.

The Boxing Day tsunami of 2004 devastated much of Sri Lanka’s coastline and cost thousands of lives, causing chaos to people and businesses alike

2008 2014

GLOBAL RECESSION AND INTERNATIONALISING

200 20

The global recession followed the credit crunch, during which time BC, like all functions, had to contend with reduced budgets. It also had a key role to play though in ensuring that prolonged cost-cutting and austerity didn’t expose the organization to operational risk or business interruption.

Alongside the recession, Mother Nature continued to exert herself and cost businesses dear. The Icelandic volcano Eyjafjallajökull eruptions of 2010 had an economic impact across the world. The airline industry was particularly badly hit with flights disrupted for days and the eruptions alone estimated to have lost the industry $200m per day.

Meanwhile, rebuild costs following the Great Sendai Earthquake off the coast of Japan a year later were reported by the BBC at the time to be as much as $309bn, 6% of the country’s economic output. In February of the same year (2011) the city of Christchurch in New Zealand was struck by a devastating earthquake that killed 185 people and from which it has been claimed the

007

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 24

03/06/2019 16:17

25 YEARS OF BC 2010 April: Deepwater Horizon oil spill

2011 March: Earthquake off the Pacific coast of Tohoku, Japan

INDUSTRY 4.0 TO PRESENT DAY

IMAGES:ISTOCK

08 014

2015 2019

The Icelandic volcano Eyjafjallajökull cost the airline industry alone $200m per day 2017 May: WannaCry ransomware attack cripples NHS and international shipment company FedEx

2018 May: General Data Protection Regulation (GDPR) introduced

2019 March: Tropical Cyclone Idai strikes in Mozambique and Malawi

“Post Y2K was a heyday for Business Continuity. I can remember even small councils investing £100,000 in BC at that time”

In 2015, Klaus Schwab, Executive Chairman of the World Economic Forum, declared that the world was entering the Fourth Industrial Revolution, which he says is fundamentally different and is characterised by a range of new technologies that are “fusing the physical, digital and biological worlds, impacting all disciplines, economies and industries”.

A new generation of tools that make use of technologies such as artificial intelligence (AI), machine learning and the Internet of Things (IoT), along with the rise of big data and analytics, empowered BC to be more responsive, reactive and agile.

“We now have new and more effective approaches to evaluating risk and threats, assessing impact and communicating internally and externally, which enables practitioners to make data-driven decisions during incidents,” says Forbes Rice.

Another hallmark of this period continues to represent one of the biggest modern day threats to business, the cyber incident, which ranks alongside business interruption as the top risk to organizations in the 2019 Risk Barometer from Allianz. In May 2017, the WannaCry ransomware attack targeted computers that used the Microsoft Windows operating system, infecting around 200,000 machines in 150 countries. One of the organizations that was most affected was England and Scotland’s National Health Service.

While cyber-attacks are the domain of security as well as risk, the cost to business interruption around the world was reported to be more than $8bn, with WannaCry demonstrating the overlap between the functions.

This and other cyber-attacks, along with the natural disasters that the US in particular fell foul to in this period (Hurricanes Harvey, Irma and Maria and the California wildfires of 2018), emphasised the importance of the new

2015

city would take up to 100 years to recover from economically.

The protracted global recession and natural disasters continued BC’s focus on Resilience. Pete Frielinghaus, Managing Director of ContinuityEastAfrica, says what began with “Operational Resilience” progressed ultimately to “the holistic Resilience” of the organization.

By this time the profession was also in what Herbane describes as its “internationalisation phase”, marked by national standards “breaking out” and becoming international. He adds that a “front-runner” in the race to become an international standard was the British Standard BS 25999, which derived from the work of the BCI. Some in the profession doubted the need for international standards with the existence of so many domestic ones but Kirvan says there is no doubt that the establishment of global ISO standards and best practices marks a “crowning achievement” and BCI was a “key force” in making this happen.

“Due to the existence of standards, regulations and good practice guidance worldwide, the profession is practised largely the same everywhere with modifications based on local, regional and national requirements,” he says.

Frielinghaus agrees, saying that after the emergence of standards and methodologies, “the entire landscape changed”. “Professionals could talk the same language and be measured in a similar way,” he says.

“We could speak out about BCM lifecycle implementations, not vague oddities open to misinterpretation.”

It wasn’t just standards and methodologies that were shaping how BC professionals did their work though. Software and business systems were moving to the cloud, processes were becoming data-driven and towards the end of this period, business had a new buzz phrase: digital disruption.

Technology was changing both how BC did its job in the terms of its own systems used and how the organization worked but also new threats to the business.

Charlie Maclean-Bristol, Director, Plan B Consulting

25 CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 25

03/06/2019 16:17

SPECIAL REPORT

25 YEARS OF BC BUSINESS CONTINUITY AND RESILIENCE: WHAT HAPPENS NEXT? Five leading figures from the industry predict the future mission and remit of Business Continuity and Resilience professionals

generation of predictive tools, as well as processes such as scenario analysis.

“Scenario analysis is a key tool in quantifying risk exposure and therefore is the basis for continuity and Resilience,” says Ralph. “Bringing data, models and analytics together is the next big thing for risk management and BC. The firm that knows itself – can quantify its vulnerabilities, exposures and Resilience – is going to be a natural market leader because of its ability to efficiently allocate its financial, operational and human capital.”

Of course, there was another major datarelated event in this period that organizations had been preparing for months, if not longer: the introduction of the General Data Protection Regulation (GDPR) in May 2018. Non-compliance with GDPR would put the organization at risk and BC had to play its part in planning for it.

Putting an organization’s house in order as far as data storage and governance is concerned involved considerable work for some organizations but it also helped to break down silos and elevated the understanding and importance of data, which ultimately helps the BC cause.

“Data-sharing and an integrated information foundation are critical,” says Forbes Rice.

“Concerns around data privacy and cyber-attacks are driving the introduction of regulations such as GDPR, so establishing protocols is paramount.”

Indeed, sharing knowledge as well as data will be an important part of BC’s next chapter, which for some organizations will be as much about culture change as technological transformation.

“Creating a culture where more people are involved in contributing information to the information foundation is a big win,” says Forbes Rice. “More visibility equals greater understanding and allows for more informed business decisions.”

This will help BC gain a wider understanding and appreciation from across the organization, which will position it well for the next 25 years.

Tim Janes, Chairman, BCI

019

“Ever since I joined the BC industry 25 years ago, the discipline has evolved ceaselessly. The BC industry is reactive, adapting to inexorable change in organizations, economies and technology. There is every reason to believe this will continue. “The driving force over the next decade will be the move towards organizational resilience, as an understood and accepted management discipline.

The BCI is already developing a range of resiliencefocused information, tools and training, which will act as enablers for our members and the wider community as they build on their proven competencies and broaden their knowledge and skills across related areas that come together to enhance organizational resilience.”

Paul Kirvan, Independent IT Consultant/Auditor “Continue facilitating the awareness, growth and acceptance of the profession to all levels of business and government. Establish collaborative relationships with allied professions, such as information security, cyber-security, facilities management, risk management, emergency management and others, eliminating the silos that have existed among the disciplines. Identify and prepare the next generation of professionals to take the profession to new levels of acceptance.”

Pete Frielinghaus, FBCI and Managing Director of ContinuityEastAfrica “The rapid explosion in the deployment and use of the Internet of Things (IOT), AI and robotics, together with the exponential growth in big data within the broader cyber landscape, is going to completely change how we look at our approach to Resilience.”

Tracey Forbes Rice, Vice President, Customer Engagement at Fusion Risk Management “Increased engagement and the convergence of BC and risk management are two big things to watch. To run BC successfully in your organization, practitioners must create a culture of engagement and show the value it delivers.

People take ownership and pride when they are a part of something, so the more you engage with everyone about the importance of BC in your organization, the more it is embedded into the fabric of the organization.”

James Royds, Independent Risk, Crisis and Continuity Management Consultant “Ending the hubris of management and the persistent idea that ‘it will never happen to us’. Ending the idea that a resilient organization is a compliant organization.

Recognition that being resilient is a strategic choice not an exercise in ticking boxes.”

26 CONTINUITY & RESILIENCE | Q2 2019

20-26_Special Re_Q2 2019_Continuity & Resilience Magazine 26

03/06/2019 16:17

Expert Voice SPO NSO RE D FEATU RE I N V E R R O Y C R I S I S M A N A G E M E N T

Communication, communication, communication

By Matthew Wardner, Founder of Inverroy Crisis Management

W

hether it’s an explosion on an oil rig or water contamination on a university campus, the key to any crisis management is communication.

What’s the first priority? How is that communicated?

Who needs to be told first? Who’s responsibility is it make those calls?

Thanks to technology advancements there are now numerous applications available to make communication more efficient than the traditional “phone tree”.

But this technology is just a tool, and a tool is only as good as the person using it.

Scenario 1: This is not a drill Company A is a global enterprise employing thousands involved in both land and sea-based operations. During an active incident, the duty manager notifies the Incident Management Team via their crisis comms app.

Each employee uses the app every day, they are required to check in and -out of different areas of the facility using the app and evacuation drills are run on a quarterly basis. This meant when each employee heard the evacuation alarm they knew to check in once safely evacuated, which enabled the IMT to see within minutes that 3 people were unaccounted for.

Thanks to the check-in and out function of the app, emergency services had a much clearer idea of where they needed to search to find and recover the individuals safely.

The duty manager was relatively new to the role and had never needed to use it before. Upon accessing the app, he had to login but did not know his password.

In the review of the incident, it was discovered that an app update should have been installed, but was not carried out due to the absence of the Business Continuity Lead. The update would have fixed an issue where an un-logged-in person could not register an active emergency. Had the duty manager known his password this would not have been an issue. Equally, had the update been carried out this would not have been an issue.

So what? Yes, technology can vastly speed-up processes and, in some instances, have likely saved lives.

But unless your teams are completely familiar with the technology and have achieved “muscle memory”, under the stress of a real incident, that technology could be useless. Especially if a key person responsible for managing the software is either unavailable or, heaven forbid, actively implicated in the incident.

After 25 years of the BCI, as we look forward to what the next 25 years bring, one thing is certain, technology will play a massive part. The question is, are you ready to use it effectively to aid your response and recovery? ● Do you have a tale to tell of how the real experience differed to your preparations?

BCP: Being Crisis Prepared | The Business Continuity Podcast would love to hear from you. Share experiences to help others be better prepared BCP@inverroy.com ●

↗

Scenario 2: Forgot your password?

Company C employs 500 people across the UK. Late one evening, a fire broke out at one of their sites, the duty manager first called the emergency services then tried to inform the IMT via their emergency communications app.

Continuity Lead, there was no answer. He went to the next number on the list, they confirmed they had not received notification from the app, and that their Business Continuity Lead was currently signed off sick.

MATTHEW WARDNER Founder, Inverroy Crisis Management

INVERROY CRISIS MANAGEMENT For further information please visit: www.inverroycrisismanagement.com

Thankfully there was a fail-safe alternative and an emergency could still be recorded along with the incident team being notified by clicking the ‘Active Emergency’ button. He clicked the button and waited.

When nothing happened, he followed the backup protocol, using the phone tree to call the Business

27

27 CONTINUITY & RESILIENCE | Q2 2019 CONTINUITY & RESILIENCE | Q2 2019

BCI.Q2.2019.027.indd Inverroy advertorial.indd2727

31/05/2019 28/05/2019 15:18 15:24

PROFILE

A PIONEER FOR Championing the impact of Business Continuity in Africa, Gloria Olive Bakakunda says that helping organizations understand the beneďŹ ts of tailored programs will see the industry thrive in the region PHOTOGRAPHY BY ESTHER RUTH MBABAZI / TWENTYTWENTY

28 CONTINUITY & RESILIENCE | Q2 2019

28-31_Profile_Q2 2019_Continuity & Resilience Magazine 28

03/06/2019 16:17

PROFILE

“

I

probably shouldn’t say this,” says Business Continuity management (BCM) consultant Gloria Olive Bakakunda, with a chuckle, “but growing up I really wanted to be an investigator, a detective” – albeit not in a uniformed role, she adds, “so it’s not clear what I’m doing.”

Not long into our conversation from the Ugandan capital Kampala, comes one of several moments in which Bakakunda exhibits the humour and easy charm that have served her well in her career.

That career may be in BCM rather than the UPF (Uganda Police Force), but she reflects that BCM “kind of gave me” a similar set of professional tools – the detective skills required for continuity work; building up a picture of complex situations, investigating leads, teasing out key details – that would have been required in policing.

Childhood police dreams long discarded, Bakakunda is now a woman in unchartered waters, a pioneer building the case for BCM as a business imperative in markets where it is currently little understood.

Even if the specific challenges she faces vary from those facing fellow practitioners in more developed markets, Bakakunda’s combination of soft skills, pragmatism and long-term vision for the profession have proven a winning formula. Not, of course, that it has always been plain sailing.

The daughter of farmers, Bakakunda grew up in Fort Portal (“the most beautiful town in Uganda”, she opines) before moving to

BY SAM BURNE JAMES

Just because someone is in the senior management team doesn’t make them the best person to handle a crisis – it’s more a personal thing Kampala aged 17 to study, and then in 2001 on to London, earning an MSc in information technology. On her return to Uganda she taught IT at an international school, before her first experience with BC came calling at Barclays.

She recalls: “I remember I got the call for the job, the HR lady said ‘We’re supposed to interview for something to do with back-ups, we’re really not sure what it is’.” Having organised call centre database back-ups in an IT job as a student in London, she thought she’d give it a go – whatever it was.

Bakakunda got what turned out to be a BCM role based in the bank’s Uganda operations team. She was lucky not to be based within the IT team “because

CHANGE 29 CONTINUITY & RESILIENCE | Q2 2019

28-31_Profile_Q2 2019_Continuity & Resilience Magazine 29

03/06/2019 16:18

PROFILE

it meant I didn’t get lost in the IT world” – but she also had the misfortune of her boss leaving almost immediately, leaving her stranded, with an understanding of her overall goals but not of how to achieve them.

Having bravely confessed to the bank’s new CEO in Uganda that she didn’t really know what she was supposed to be doing, she reflects: “I think he was a good guy, because maybe [otherwise] he would have had me fired, but he saw something different,

CAREER

GLORIA OLIVE BAKAKUNDA 2018-PRESENT Independent BCM consultant

2016-2018 Global BCM and corporate security analyst, FINCA International, Kampala

2013-2016 Regional BCM and disaster recovery analyst, FINCA International, Kampala

2008-2013 Country BCM manager, Barclays Bank Uganda

2006-2007 Head of IT, Rainbow International School, Kampala

EDUCATION Kensington College of Business, London American City University, London

The more people we have, the more spread out, the bigger a voice the Business Continuity community will have he saw bravery and said: ‘Right, well I know this is a new field, I will send you off to Nairobi so you can do your induction’.”

Bakakunda spent time with that four-strong Nairobi BCM team, and also met Ken Clark, who oversaw Barclays’ African BCM from London.

He introduced her to the BCI, advising her to get certified.

Relationship-building was at the heart of her work building the profile of BCM across the business. “If you don’t have a relationship with people they’ll never see it. People buy from people they like,” she says, adding that another challenge was convincing colleagues she wasn’t a HR mole sent in ahead of redundancies.

Her forensic detective skills also came in handy.

“You’re not going to help people build plans unless you really know what they do. I’m not about to give support if I haven’t had time to get enough knowledge about the topic,” Bakakunda adds.

At Barclays, Bakakunda experienced the challenge of crisis management when tensions between two of Uganda’s kingdoms turned into riots. “We had people within branches who couldn’t come out, people evacuated at 11 o’clock at night. That was a very good bit of experience,” she reflects, unfazed.

It also reaffirmed the importance of relationships.

“Just because someone is in the senior management team doesn’t make them the best person to handle a crisis – it’s more a personal thing,” she says.

In contrast, the person whose uncle is a police officer, or who has a good understanding of local health services, can be key. “I try to look out for that,” she says.

From Barclays, she joined FINCA International, a US-based non-profit provider of microfinance across the developing world. She also spent a period, overlapping these roles, consulting for the Bank

30 CONTINUITY & RESILIENCE | Q2 2019

28-31_Profile_Q2 2019_Continuity & Resilience Magazine 30

03/06/2019 16:18

PROFILE

Bakakunda left FINCA in November and has since spent her time in different consulting roles related to BC in Uganda

of Kigali in neighbouring Rwanda, on a continuity review mandated by the African Development Bank.

She speaks fondly of FINCA, which she departed in November. While the chance to work and make friends across the globe was exciting – her role initially covered Africa, and later the Middle East, Eastern Europe and Latin America – she expresses a frustration at having her time spread quite so thinly.

“Ideally every country should have had its own BCM person,” she says. An effective way to advocate for the importance of BC in developing markets was to relate it to colleagues’ home lives, Bakakunda reports. She explains: “A lot of countries we worked in could relate to having no power, so you buy a Kanda [diesel generator] before that power goes off; you don’t wait until 10pm and then the power goes off, and you’re looking for alternatives.”

Does that make it easier to work in BCM than in richer countries where utilities and infrastructure – and civil order more generally – are more reliable?

“Ideally you’d think that it would be,” she says, “but we’re more lax because we’ve survived through all this chaos [more than] someone who has never known what it is like to have the internet off.”

Through her career, Bakakunda recalls “a lot

of campaigning with the finance director” to get budget, with training and professional development a priority. The BC consultant believes firmly in the importance of professional development, which she views hand-in-hand with the goal of increasing awareness of and demand for BCM skills.

She recalls a graduate she recruited at FINCA wondering whether he would “have to wait for you to retire for me to get your role”, and noting the lack of relevant job adverts externally. Bakakunda says: “Since I left FINCA in November, I haven’t seen a job advert for anything local.”

Sitting on the board of the BCI’s Southern African Development Community (SADC) Chapter, increasing membership is a priority.

“The more people we have, the more spread out, the bigger a voice we’ll have,” she says, which will in turn raise awareness of BCM and to a point where more companies are proactively embracing it. “The companies that are talking BCM, it’s only if the regulator is asking for that,” says Bakakunda.

She has tried to leverage that, asking regulators to probe further – not just asking whether companies have a certain plan in place, for example, but whether they have tested it – to create an internal urgency.

Since leaving FINCA to become a selfemployed consultant in November, Bakakunda has been taking advice and mentorship from other practitioners who have advised her to take on training and advisory work instead of solely consultancy.

Six months on, is business strong, is Bakakunda & Partners in demand? Bakakunda is, as ever, honest. “Yes and no – it’s a bit too early to say, but I’m very hopeful,” she says.

While she is doing some work in financial services, renewable energy and agriculture, she reveals that a number of potential clients don’t see the urgent need to get their Business Continuity house in order, thinking “Maybe we can put it off for now”.

They might be able to, for now. But one suspects that in the long term, nothing will be able to hold back Bakakunda – not just as an entrepreneur, but as an advocate for BC in African and global business.

31 CONTINUITY & RESILIENCE | Q2 2019

28-31_Profile_Q2 2019_Continuity & Resilience Magazine 31

03/06/2019 16:18

FUTURE GAZING

I

nsider threats come in many different guises: from a disgruntled employee seeking revenge to someone who has joined the organization intent on causing it harm – driven by terrorism, organised crime or a personal vendetta.

Identifying such people at the recruitment stage could eradicate much of that threat.

Yet while increasingly sophisticated tools for screening, robust background checking and algorithms for predicting behaviour may point to something that sounds an alarm bell in an employer’s mind, early detection is extremely difficult.

While it might not seem immediately practical or appropriate for Business Continuity (BC) to have a direct role in recruitment across organizations, at a time when technology is blurring departmental lines, involvement in aspects of selecting employees, contractors and

Do Business Continuity professionals have a role to play in the employment process to lessen the risk of the insider threat?

LETTING THE RIGHT ONES IN

BY SUE WEEKES AND COLIN COTTELL

32 CONTINUITY & RESILIENCE | Q2 2019

32-34_Recruit_Q2 2019_Continuity & Resilience Magazine 32

03/06/2019 16:45

FUTURE GAZING

temporary workers could bring a number “Having C&R involved from the BE OPEN TO THE of benefits. start, might also make it easier for POSSIBILITIES Such benefits of limited BC them to identify when behaviours Cheyene Marling, Executive Vice involvement include: breaking down change further down the line,” she says, President, Firestorm Solutions, organizational silos, sharing critical adding that the benefits of improved and Founder and President of BC knowledge about the organization, and screening could be considerable from Management Inc, has more than 22 years’ experience as an executive educating the recruitment and HR a cost perspective. “A bad hire costs recruiter with specific emphasis on functions in the importance of BC. a company far more money, not just Business Continuity. She says she Also, it is increasingly evident that rogue employees, but those who are has never heard of any discussion organizations must draw on all their cultural detractors.” around BC professionals being resources to combat threats – especially However, she suggests that BC involved in screening/hiring protocol in the digital age when they rely on professionals might be better off across an organization but “it is an technology to carry out most of their spending their time on reviewing interesting suggestion”. “A few of operations and processes. For example: artificial intelligence (AI) tools that can my clients use different personality cyber incidents joined business more objectively spot the patterns of tests to predict future behaviours, interruption at the top of the Allianz behaviour linked with rogue employees but unfortunately many client companies do not use predictive Risk Barometer for 2019. Meanwhile, and that an advisory role would be “far personality tests at all,” she says. the frequency with which cyber incidents less contentious and time-consuming”.

“This could be an interesting gap can be traced back to an insider threat “HR could then invite BC into any that many BC professionals are not is alarming. According to the Cloud interviews where they feel they need even considering.” She urges BC extra help, perhaps for high-risk Adoption and Risk 2019 report by cyber professionals to review and be aware positions,” she says. “Advising on the security software company McAfee, of the hiring/screening protocol use of AI or monitoring employee organizations experience an average of that is used from a governance behaviour would also add considerable 14.8 insider threat incidents each month, perspective but does not think they value. And training employees on what and most (94%) experience at least one a should be involved in the day-to-day to look for with their colleagues or how month on average. interviewing or screening processes. to avoid obvious risk would help the Some are small scale but even these whole business.” can expose the organization to significant Predictive analytics technology is used by many risk. Professional services firm EY lists such threats as employers to analyse behaviours and help assess how a including fraud, theft of intellectual property or trade secrets, person is likely to perform in a role, as well as to identify unauthorised trading, espionage and IT infrastructure sabotage. high-flyers. It could well prove valuable in the future at It defines the insider threat as coming from a current or former mapping and identifying personality traits that suggest employee, contractor or business partner who has “authorised a person might become a threat to the organization. AI access” to an organization’s network systems, data or premises systems such as IBM’s Watson are already being used by and uses that to compromise “confidentiality, integrity or banks and financial institutions to monitor activity to help availability”, whether or not out of malicious intent. spot fraud or rogue trading, for instance, before it happens.

Allianz Global Corporate & Speciality, which undertakes the Also, a key speciality of the controversial technology survey for the barometer, describes business interruption and firm Autonomy, whose clients at one time included the US cyber incidents are “increasingly interlinked”. Hence stopping cyb Department of Homeland Security, has been the analysis of any ccyber crime at the earliest opportunity has to be a unstructured data and connecting dots where links might priority for BC professionals. not be easily apparent.

So is there a case to become more engaged with Currently, many BC and Resilience professionals do not recruitment practices and the hiring process to help recruitm identify a direct role for themselves in the recruitment reduce redu the threat at the earliest opportunity? process. Antje Jürgens, an emergency response, BC and The question generates interesting debate and leads travel risk specialist based in Germany, says security and/ on to a bigger one about the function’s role in areas or sanction list screening before hiring is imperative but such as employment contracts, job descriptions and if anyone is to work with HR on recruitment it should be identifying skillsets. the fraud, compliance and IT incident and security teams Karla Reffold, International Managing Director rather than BC. and Founder of US and UK-based cyber-security Similarly, Russell Price, Chairman of the Continuity recruitment firm BeecherMadden, believes some Forum, which provides independent advice, information BC professionals have heightened skills in analysing and support to the private and public sectors, agrees that behaviours and could be more alert to those with background checks on individuals need to be done more bad intentions.

33 CCONTINUITY O N TIN UITY & RESILIENCE R E S IL IE N C E | Q2 2019

32-34_Recruit_Q2 2019_Continuity & Resilience Magazine 33

03/06/2019 16:45

FUTURE GAZING

regularly but agrees this is a security-led issue. “It is about vetting and procedures, ensuring there are internal processes that mitigate the threat but that is not the BC manager’s job,” he says. “It is security and performance is achieved a job for security or HR.” through people, in a challenging day or an While Price says the last thing he average storm-free day,” he says. would expect to see is BC involved There is also a case for BC getting in the hiring process for sales and involved in the onboarding process, says marketing and other positions, François Meyer, BC Manager, Clearstream he adds that there is a difference Banking in Luxembourg. Involving BC between hiring activity and the in the hiring process is unlikely to deliver development of policies, such as further gains in the screening process, he contracts of employment, where they says, but he believes there is an important could have a role. role to play creating awareness and “There are lots of conditions of demonstrating the importance of aspects of employment that need to be thought BC when employees are being onboarded. about that can fall within the BC framework,” he says, and “This includes awareness and training adds that BC could also identify the skills required for business to perform actions concerning health and recovery and have this added responsibility built into terms safety, but also knowledge of actions and and conditions. support when BC plans are activated.”

Price’s sentiments are echoed by Charles Motau, Managing Although perhaps it is debatable whether Director of Motau Consulting in South Africa, who believes one BC can add another layer of protection when of the competencies in the job advertisement for management it comes to identifying an insider threat at positions could be an understanding of BC management. He the recruitment stage, one point is clear: it adds that BC practitioners in the organization could provide is incumbent on the function to learn about training to heads of business units and these skills could be some of the AI-based technologies that factored into performance management or scorecards so that could predict and identify behaviours, traits they take the full responsibility for education and awareness of and activity that ultimately contribute to BC of their direct reports. reducing the risk of business interruption Paul Kudray, Head of Resilience, Royal Commission Saudi across the organization.

Arabia Jubail and Yanbu and Founder of Kudray Consulting, agrees that the issue is more about getting BC into everyone’s job description – “especially THREATS IN THE CLOUD supervisory and management roles 31.3 and this would help enable wider Average # of ownership and security”, he says. compromised This, he suggests is a more practical account threats in 24.5 12.2 approach than “believing we will cloud per month ever get BC on recruitment panels as per organization 20.4 a norm”.

8.6 This would also help fully connect Average # of 6.2 4.3 the contribution BC makes to the privileged user business, which Kudray believes the threats per month 3.6 3.3 function doesn’t always do. “We still per organization approach the ‘selling’ of our discipline 12.3 14.8 and its capability as a ‘big bang’ and Average # of 10.9 ‘rising tide’ protector,” he says, adding insider threats in that it should be sold more on the cloud per month everyday business benefits it brings. per organization 2016 2017 2018 “[We need] to show how amazingly effective it is in ensuring safety, Source: Cloud Adoption and Risk 2019, McAfee

“There are lots of conditions of employment that need to be thought about that can fall within the BC framework”

34 CONTINUITY & RESILIENCE | Q2 2019

32-34_Recruit_Q2 2019_Continuity & Resilience Magazine 34

03/06/2019 16:45

Last chance to grab Early Bird Tickets for

BCI World 2019 thebci.org/bciworld2019

5 - 6 t h N o v e m b e r 2 019 N o v o t e l L o n d o n We s t , L o n d o n

Register by 30th June to secure your place at this discounted price

SAVE £100

BCI members receive special pricing!

Visit our website for a sneak peek at our programme and speakers JOIN US FOR AN EVENING OF GLOBAL CELEBRATIONS, A THREE COURSE DINNER, ENTERTAINMENT AND MORE ON 5TH NOVEMBER 2019.

Individual gala dinner tickets and tables of 10 are available.

Visit thebci.org/bciworld2019 for more information and booking.

www.thebci.org BCI.Q2.2019.035.indd 35

31/05/2019 15:13

NEWS FROM THE BCI

BCINEWS C A M PA I G N

C A M PA I G N S

BCAW 2019 enjoys far-reaching impact

Build-up begins to BCI World 2019

Business Continuity Awareness Week (BCAW) 2019 saw practitioners and organizations across the world between 13-17 May exploring the many different interpretations of Investing in Resilience, this year’s theme, in yet another successful series of observances.

The week started with an ‘Investing in People’ webinar that looked at what training personnel required, but also the tools they need to be confident and competent in their roles.

Closing the week out, ONI’s Rusty King discussed how to improve the resiliency of IT functions by preparing for both unplanned and planned disruptions to IT services in the popular ‘Beyond Disaster Recovery – Achieving IT Resilience’ webinar.

In the US, Indiana State Governor Eric

Holcomb issued a proclamation inviting all citizens to note the occasion. In addition, BCI Chapters & forums held events around the world as the BCI launched its latest video – ‘Introduction to Organizational Resilience’, which received a huge 40,000 views in the first few days after going live.

The BCI thanks BCAW sponsors ClearView Continuity and Assurance Software, and the thousands of volunteers, individuals and organizations that took part in this week. We look forward to doing it all again next year!

• To find out more and catch up on all the webinars, visit www.thebci.org/BCAW2019

EVENTS

June-Nov BCI Netherlands & Belgium Conference, 13 June, Utrecht, Netherlands GRCCS International Conference & Exhibition, 29 July, Kuala Lumpur, Malaysia BCI Australasia Summit 2019, 30-31 July, Sydney, Australia Asia Risk & Resilience Conference, 28 August, Singapore BCI World Conference & Exhibition, 5-6 November, London, UK

AWA R D S

C&R nominated for awards Continuity & Resilience, found that of the BCI membership, 82% had read every issue of the new magazine, 88% would recommend C&R to a colleague, and 80% say the magazine is more relevant to them now since the re-launch.

These positive responses from BCI members are the main reason the magazine has been shortlisted for this award. Winners will be announced on 20th June.

Following the BCI’s success at the 2018 Memcom Awards for its new website, this year the organization is up for another award in the Best Magazine Launch or Re-launch category.

The Memcom Awards are a celebration of the work carried out by professional bodies, associations, charities and the wider notfor-profit sector.

A survey carried out by Redactive, publishers of

The first wave of speakers for the BCI World Conference and Exhibition at Novotel London West has been announced.

Following on from BCAW, the theme for this year’s conference is also Investing in Resilience. This will be the last year the event takes place at the London venue before its highly anticipated move to a much larger, dedicated conferencing venue at Birmingham’s ICC. In the first of the keynote addresses to be announced, Professor Sir David Spiegelhalter will discuss the challenges of communicating uncertainty and risk. Eren Aslan’s Empathy in Continuity presentation delivers a take on the benefits and opportunities of utilising empathy and the emotional quotient alongside experience and the intelligence quotient to improve important interactions. Providing a highlevel introduction to AI, Allan Cytryn will take audiences through how businesses may begin to address the risks of unexpected AI outcomes and design frameworks to implement controls to mitigate those risks.

These are just some of the sessions you will have the opportunity to see on 5–6 November. Early bird rates are available until the 30 June, and BCI members receive a further discount.

Check out the BCI World website in the coming weeks and months for further keynotes and sessions.

36 CONTINUITY & RESILIENCE | Q2 2019

36-37_BCI News_N_Q2 2019_Continuity & Resilience Magazine 36

03/06/2019 16:46

Q&A

NEXT GENERATION PRACTITIONER

N E X T G E N E R AT I O N

Elizabeth Mos NATIONALITY: New Zealand TIME IN THE PROFESSION: Nine months FIRST JOB IN BUSINESS CONTINUITY/ RESILIENCE: Senior Advisor, Business Continuity management CURRENT EMPLOYER: New Zealand Inland Revenue CURRENT ROLE: Senior Advisor, Business Continuity management FAVOURITE ASPECT OF THE WORK: I really enjoy facilitating and completing scenario exercises, and spreading my passion for BC throughout our business

What attracted you to the industry and how did you get into it?

Prior to my appointment in Business Continuity (BC) I worked in the Inland Revenue (IR) assisting people with tax obligations. In November 2016, Kaikoura suffered a 7.8 magnitude earthquake that twice led to earthquake strengthening in our offices in Wellington, displacing my entire business unit.

As luck would have it, we were temporarily repositioned next to the Business Continuity team.

I found myself drawn in by a range of discussions around the earthquakes, site emergency planning and found myself enjoying learning more and more about BC. After we moved back into our old building I found I really missed the team and our discussions, so when a job vacancy came up, I quickly applied.

What is your biggest learning to date?

Every day I’m learning, and I’m fortunate to have the best manager and colleagues who show me how to be a good practitioner. But I’ve found that everyone can bring their unique skillsets and as a team – you buffer out any weaknesses and boost each other’s strengths.

I’ve found my emergency management, public speaking and account management experience

incredibly useful but possibly the most important learning is to always expect the unexpected.

directly by interacting with people, through interactive learning videos and by putting theory into practice.

What is your career ambition?

I’m really keen to complete my AMBCI in August and I’m excited about where this profession will be in the next five to 10 years, as technology and organizational risks change. I’m hoping to see BC increase in awareness and engagement across the public and private sectors until it is a standard practice for every organization. My motto in my current organization is that I want everyone to get as excited about Business Continuity as I am.

What changes would you like to see in the profession?

I would love to see a repository toolbox with information and templates for new practitioners.

Sometimes it is very easy to get overwhelmed with information that is organization specific, when it may be time to try something new or to be able to utilise a template that may have worked well by another organization.

I’m not sure there is such a tool available.

What is the best career advice you have received?

I was once told by a colleague that women tend to be cautious when looking at career options and often won’t apply unless they meet all the job requirements.

If it wasn’t for her, I would never have applied. I’ve learnt not to hold myself back and that if you’re passionate, you give yourself the power to change yourself and others through your actions.

What is your preferred mode of learning?

My learning style is primarily auditory, followed by kinaesthetic.

So, I’m best learning

In your opinion, why should more people be joining the BC community?

Business Continuity is increasingly critical to the stability and sustainability of organizations in both the public and private sectors, particularly when considering the technology, environmental and globalisation trends we’re seeing. Business Continuity should, and I believe will, become a standard practice, so now is the time to become a part of it.

It’s also one of the few careers where you’re able to have a positive impact on people’s lives, directly and indirectly helping real people, businesses and organizations, which most practitioners will agree is incredibly rewarding.

37 CONTINUITY & RESILIENCE | Q2 2019

36-37_BCI News_N_Q2 2019_Continuity & Resilience Magazine 37

03/06/2019 16:47

A T A G R E AT I D E A W H AT

“My relationship with risk management doesn’t end once I leave the office”

MY LIGHTBULB GHTBULB U MOMENT OMENT OMENT

Yasmine Elhamouly is Chair at the BCI’s UAE Forum

Risk Management is a lifestyle. My relationship with it doesn’t end once I leave the office. Good understanding of risk management techniques can keep your life organized and help you recover quickly from unpredictable events.

For example, on my son’s sixth birthday with a house full of children running around, I had to make sure every possible risk sk was identified and mitigated accordingly. I tried to transfer the he location to a playground and share the risks with other parents, ts, but the main stakeholder – my son – didn’t approve. I had to o treat the major risks by reducing their impact and probability.

To reduce my overall risk, I shortened the party’s length.

I was prepared to tolerate some events, such as children spilling juice, as contingency plans were in place to make such a situation safe quickly. We survived the party and the stakeholders involved were pleased. Most importantly, I met the he key objective to make my son happy. Whether your objective iis business, family or leisure, understanding your risk exposure and the steps you can take to ensure minimum disruption is something all of us can do more of.

38 CONTINUITY & RESILIENCE | Q2 Q 2019

38_Lightbulb_Q2 2019_Continuity & Resilience Magazine 38

IMAGES: ISTOCK / SHUTTERSTOCK

Risk never stops

03/06/2019 16:47

Keeping your people safe, informed and connected ... ... no matter what the outcome!

•

ĜĵŞĬåØ ųåĬĜ±ÆĬåØ ĵ±ŸŸ ĹŅƋĜĀϱƋĜŅĹ ŸåųƴĜÏå ƵĜƋĘ ± čĬŅƱĬ ųå±ÏĘ

•

Ability to create unlimited teams and message templates

•

ŅĹĀčƚų±ÆĬå Ú±Ƌ± ĘŅŸƋĜĹč ±ĹÚ ŞųŅÏ域ĜĹč ě ) Ø U ±ĹÚxŅų

•

eƚƋŅĵ±ƋĜÏ ĹƚĵÆåų ƴ±ĬĜÚ±ƋĜŅĹ üŅų ĬŅϱĬ ±ĹÚ international phone numbers

•

aƚĬƋĜ ĬåƴåĬ ޱųåĹƋxÏĘĜĬÚ ±ÏÏŅƚĹƋ structure • 30 languages

+44 (0) 1733 785 999 BCI.Q2.2019.039.indd 39

info@alertcascade.co.uk 31/05/2019 15:14

RISK ERADICATOR

YOU are ready for anything. You’re poisedˏ

WE are Sungard Availability Services.ˏWe

to anticipate risk, mitigate the impact and capitali/e on the outcomes. You’re revamping production and recovery processes to keep IT systems in sync and cyberthreats at bay.

But the risk and complexity of IT transition can run companies ragged.

help transform IT and deliver resilient, recoverable production environments— protecting risk eradicators from the perils of IT disruption every day.

Lead with resilience at www.sungardas.coȐ1'.

Transforming IT for resilient businessTM

BCI.Q2.2019.040.indd 40

31/05/2019 15:18