1 Business Continuity Maturity Model SM Presented by Scott Ream, President, Virtual Corporation

1

Business Continuity Maturity ModelSM

Presented by Scott Ream, President, Virtual Corporation

2© Copyright Virtual Corporation, 1994 - 2003

BCMMSM Pilot Assessment OverviewAgenda

Virtual Corporation Overview

BCMMSM Conceptual Overview

Assessment Methodology & Toolkit

Questions & Discussion


Business Continuity CredentialsVirtual Corporation’s Value

Business Continuity is our core competency 95% of project revenues 20+ active BCM consultant stable 50+ screened consultants available Extensive stable of technically skilled consultants

Corporate Philosophy centered on “nurturing” and “interdependence”

Know what the client wants and deliver it every time Deliver knowledge transfer within each engagement Begin each engagement planning for our departure Produce timely results by adapting our methods to specific client

requirements

Extensive relevant “large corporate” Business Continuity background

Kaiser Permanente United Government Services Pfizer Nike


Virtual Corporation UpdateBusiness Continuity Service Offering

BC Program Implementation Building the “business case” BC program design Emphasis on “sustainability” Proven toolkit minimizes work Example: Kaiser Permanente

Crisis Management / Incident Command

Emergency Operations Models Executive awareness and exercises Example: Citigroup

Disaster Recovery DR organizational design Internal recovery strategy

determination 3rd party vendor selection Example: Schering Plough


Where are we now and what’s next? “Public Domain” reference model BCMMSM program assessments “Intuitive” and “Rigorous” methods

Innovative Training Services “How to” Workshops Sustainable BC Program Launch BCMMSM Assessment Building internal consulting teams Comprehensive toolkits

Sustainable Planner Large-scale BC program software platform Open architecture (Oracle / ASP) Development licensing Integrates data collection & document

mgmt Makes BC planning accessible to company

management team


Business Continuity Maturity ModelSM Development History

1997 Initial Research

2000 CPM Baseline Survey

2001 Introduction Article in CPM Formation of BCMMSM Working Team

2002 Professional Practices Mapping Project Initiated Corporate Competencies Identified

2003 Follow-Up Article in Disaster Resource Guide On-going work with BCMMSM Working Team Pilot Assessment Workshop at Continuity Insights BCMMSM Assessment Toolkit Developed Numerous Self-Assessment Workshop Public launch – Q4/03


What is Business Continuity?The four central disciplines

Incident Management All aspects of emergency response, crisis management, and any

other activities involved in command, control, and communications during a disastrous event

Security Management Physical security, information security, and any other activities

associated with protecting the integrity of targeted information and resources

Technology Recovery Ensuring that critical information systems hardware, software,

networks and applications are recoverable within defined recovery time objectives

Business Recovery Ensuring that critical business functions and resources are

recoverable within defined recovery time objectives



Conceptual Overview

Increasing Business Continuity Competency Maturity

Program Basics Program DevelopmentSr. Mgmt

CommitmentProfessional

Support GovernanceAll Units

ParticipatingIntegrated Planning

Cross-Functional

Level 1 Self-Governed No No No No No No

Level 2 Supported Self-Governed Marginal Partial No No No No

Level 3 Centrally Governed Partial Yes Partial No No No

Level 4 Enterprise Awakening Yes Yes Yes Yes No No

Level 5 Planned Growth Yes Yes Yes Yes Yes No

Level 6 Synergistic Yes Yes Yes Yes Yes Yes

Competency Maturity Level

Program Basics Senior Management

Commitment

Professional BC Support

BC Program Governance

Program Development All Business Units Participating

Conducting Integrated Planning

Implementing Cross-Function Capabilities

Original Business Continuity Maturity ModelSM Attributes



Conceptual Overview






Cross-Functional








Level 1 - Self-Governed

Business continuity management has not yet been recognized as strategically important by senior management.



Conceptual Overview






Cross-Functional








Level 2 - Supported Self-Governed

At least one business unit or corporate function has recognized the strategic importance of business continuity and has begun efforts to increase executive and organization-wide awareness.



Conceptual Overview






Cross-Functional








Level 3 - Centrally-Governed

Participating business units and departments have instituted a rudimentary governance program, mandating at least limited compliance to standardized BCM policy, practices and processes to which they have commonly agreed.



Conceptual Overview






Cross-Functional








Level 4 - Enterprise Awakening

All critical business functions have been identified and business continuity plans for their protection have been developed across the organization. For the first time, all four BC disciplines have been “fully” implemented.



Conceptual Overview






Cross-Functional








Level 5 – Planned Growth

Business continuity plans and tests incorporate multi-departmental considerations of critical enterprise business processes.



Conceptual Overview






Cross-Functional








Level 6 - Synergistic

All business units have a measurably high degree of business continuity planning competency. Business protection strategies that accurately model the critical business functions are formulated and tested successfully.



Latest Work of the BCMMSM Working Team

Level 1Self GovernedMaturity Model Levels

Level 2Supported Self

Governed


Level 3CentrallyGoverned

Level 4EnterpriseAwakening

Level 5Planned Growth

Level 6Synergistic

Athlete Analogy

Comparative Model

Able to Crawl Able to Walk Able to Run “Fit” Runner Competitive Runner Olympic Runner

Organization “At Risk” “Competent” Performer “Best of Breed”

Summary Descriptors for How an Organization Evolves

The “Athlete Model” Describes each Level of the Business Continuity Maturity ModelSM in

terms of a maturing runner

The “Comparative Model” Clusters Levels into three groups of relative competency valuation


Business Continuity Maturity ModelSM Latest Work of the BCMMSM Working Team

Leadership VL L M H H HBC Awareness

BC Program Structure

Program Pervasiveness

Metrics

Resource Commitment

External Coordination

VL L L M H HVL L L M H H

VL L L M H HVL L M H H HVL L M M H HVL L L L M H

Corporate Competencies General Attributes of an Organization at Each Maturity Level

BC Program Content VL L M H H H

Maturity Model LevelsLevel 1

Self-GovernedLevel 6Synergistic

Level 5PlannedGrowth



Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model

Able to Crawl Competitive Runner Olympic Runner“Fit” Runner”Able to RunAble to Walk



The Corporate Competencies Used to objectively measure the organization’s developmental maturity.

Rankings shown above represent strawman “standard” scores at each Level of maturity.




Leadership

The commitment and understanding demonstrated by executive management regarding the implementation of a scaled, organization-wide business continuity program. The degree to which the “business case” has been articulated and understood.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model







BC Awareness

The breadth and depth of business continuity conceptual awareness throughout all staff levels of the organization.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model








The scale and appropriateness of the business continuity program implemented across the organization. The degree to which the BC Program matches the articulated business case.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model








The level of business continuity coordination between departments, functions and business units. The degree to which business continuity considerations have been incorporated in other business initiatives / programs.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model







Metrics

The development and regular reporting of quantifiable criteria used to monitor the BC Program performance. The establishment of a baseline and on-going tracking of established business continuity competency goals.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model







Resource Commitment

The application of sufficient, properly trained and supported personnel, financial and other resources to ensure the sustainability of the BC Program.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model








Coordination of business continuity issues and requirements with external community including customers, vendors, government regulatory bodies, unions, local 1st responders, etc. Insure that critical supply chain partners have in place adequate BC Programs of their own.




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model







BC Program Content – Business Continuity DisciplinesThe degree and quality of implementation of each of the four central disciplines

of BC:1. Incident Management2. Technology Recovery

3. Business Recovery4. Security Management




Metrics

Resource Commitment











Level 2Supported

Self-Governed

Athlete Analogy

Comparative Model





BCMMSM Assessment Toolkit“Controlled-Access” public domain & proprietary materials “Controlled” Public Domain Materials

Key Concepts Competency Grids Requirements (Corporate Competencies) Requirements (BC Disciplines)

Proprietary Materials Delivered to participants in Assessment Training

Proofs Assessment Questionnaire Assessment Methodologies Acquisition & Analysis Checklist

BCMMSM Calculator Submit completed questionnaire to be scored Data retained for aggregation

The BCMMSM Service Center Regularly scheduled and custom Assessment training Web-based access to BCMMSM resources Maintains aggregate databank – publish benchmark results Maintains / updates Business Continuity Maturity ModelSM


BCMMSM Assessment ToolkitCorporate Competency Grids

Key Concepts Summary descriptions of how the Corporate Competency

evolves from Level to Level

Criteria Categories Specific characteristics inherent to each Corporate

Competency

Criteria Descriptors Descriptions of how each Criteria evolves from Level to Level

7 Corporate Competency Grids BC Program Content treated summarily – defies “patterning”


BCMMSM Assessment ToolkitSample Competency Grid – BC Program Structure

General Characteristics Level 1 Level 2 Level 3 Level 4 Level 5 Level 6

Athlete Analogy Able to Crawl Able to Walk Able to Run “Fit” Runner Competitive Runner Olympic Runner Comparative Model Organization “At Risk” “Competent” Performer “Best of Breed” BC Program

Structure

SELF-GOVERNED

SUPPORTED SELF-GOVERNED

CENTRALLY GOVERNED

ENTERPRISE AWAKENING

PLANNED GROWTH

SYNERGISTIC

Key Concepts Unstructured, potentially counter productive

Increasing understanding of BCM, common terminology in use.

Awareness & adoption Integration Explicit vertical and horizontal integration

Prominence

Strategy / Culture / Goals Definition: relevant to business goals & competitive environment Excellence: "Impedance match" between S/C/G & BCP

No definition Dept/BU BCM activities in sync with relevant portions of enterprise strategy, culture and goals.

A business case is established for BCM

Mandatory BCM strategy review requirement in place and integrated into budget cycle Change management procedures with BCM coordinators in place at Dept/BU level Audit findings across enterprise begin to reflect more positive BCM response

BCM considered in development of enterprise business strategies

BCM and its relationship to available products and services has become a quantifiable and marketable competitive advantage. BCM is one of the drivers contributing to enterprise business strategy development. Management explores new technologies and innovative BCM solutions.

Organizational Design Definition: explicit methods of company Excellence: supports enterprise approach & is definitive

Self Defined Identification of key internal linkages and working agreements

Identification of BCM critical functions and roles

Enterprise BCM process is compatible with overall Enterprise business strategy

Sustainability & survivability are principles of enterprise

Innovative processes piloted and incorporated into enterprise BCM program.

Roles & Responsibilities Definition: who & what Excellence: accountability & clarity

Undefined Dept/BU staff has responsibility for BCM. Overlapping roles may occur.

Participating Dept/BUs have common BCM chain of command.

Formal BCM linkages of responsibility and relationships defined and adhered

Formal BCM linkages to performance goals and compensation

Formal BCM linkages to performance goals and compensation

Policies & Processes Definition: how (i.e. rules of operation) Excellence: consistent & clear

One or several Dept/BUs implemented a few self selected components of BCM

Active Dept/BUs have formulated policies, standards & practices. No enterprise policy for BCM exists.

Dept/BUs share common BCM policies, standards & practices. Business Continuity Charter published for participating Dept/BUs.

Enforceable BCM policies, standards, & practices in effect across the enterprise

Regular reviews of enterprise BCM policy, standards, and practices.

Pro-active executive participation in development of new BCM policy


BCMMSM Assessment ToolkitAdditional Toolkit Materials

Performance Requirements Content

Criteria used to determine completion percentage Documents completeness of each Corporate Competency at each BCMMSM Level

Format “Master BCMMSM Assessment Questionnaire”

Use: Intuitive and Rigorous Assessments

Proofs Content

Auditable measures and deliverables that verify completeness at each BCMMSM Level Format

“BCMMSM Proofs Acquisition and Analysis Checklist” Use: Rigorous Assessments only

BCMMSM Calculator Content

Algorithmic tool using Performance Requirement data and proprietary weighted algorithm Format

Automated program accessible on Virtual’s website (available Q4/03) Use: Returns Business Continuity Maturity ModelSM Scorecard


BCMMSM Assessment ToolkitPreview BCMMSM Assessment Methodologies Primary Assessment Ground Rules

Target holistic “organization” for most accurate results Apply methodology and tools consistently and thoroughly Share feedback with BCMMSM Service Center for aggregation and model enhancement

Intuitive Assessment Assessment Focus: Where are we now & where should we be headed next? Quick turn-around (< 4 weeks elapsed time) Minimally invasive process (analysis based on questionnaire) Assumes “expert” knowledge available Identifies BC program gaps and immediate opportunities Deliverables:

Business Continuity Maturity Level Scorecard State-of-Preparedness Report including recommendations for immediate action

Rigorous Assessment Customized implementation includes Intuitive Assessment deliverables plus these

options: Executive briefings and other business continuity awareness training programs Enterprise business impact analysis BC program design plan including staffing and budget models BC program implementation plan

Auditable proofs collected and evaluated Granularity of proofs review can be tweaked to meet specific assessment requirements


BCMMSM Assessment ToolkitSample Timeline for an Intuitive BCMMSM Assessment Step 1 – Scope the Assessment (week 1)

Determine organizational scope Review BCMMSM Master Questionnaire Identify respondents Prepare and distribute Assessment announcements

Step 2 – Collect Assessment Data and Information (weeks 2 and 3) Prepare & distribute respondent questionnaires Respond to questions as needed Collect and validate questionnaires

Step 3 – Complete Assessment Analysis (week 4) Apply answers to BCMMSM Assessment Calculator Document findings and validate where appropriate

Step 4 – Prepare Assessment Report (week 4) Calculate BCMMSM Organizational Maturity Rating Document BC program strengths, gaps, and recommended next steps assessed against BCMMSM

Corporate Competencies including high-level BC Program Content: Incident Management Security Management Business Recovery Technology Recovery

30

Innovative & Adaptive Solutions for Business

227 Route 206, Building #1Flanders, New Jersey 07836(973) 927-5454 (973) 927-1807 (F)

www.virtual-corp.net