360° Vendor Management

An Outsourcing Vendor’s Business Continuity and Disaster Recovery Plan

Jamaican hurricanes, Costa Rican volcanoes, Philippine political coups, Indian taxi strikes, Chinese government-operated firewalls, Canadian blizzards, and the legendary American backhoe operating behind your data center are dangers to your business when you outsource to offshore locations.

Realistically speaking, geologic, social, political and weather-related disasters his every city of every country. Granted, some events are more or less likely in certain locations, but the unexpected can strike you when you least expect it. What would you do? Do you have a business continuity plan or a disaster recovery plan?

Here’s a place to start:

• Consider the Impact, not the Event - Generally speaking there are four types of impacts that you need to plan for: loss of people, loss of facilities/building, loss of connectivity, and loss of applications. Any given event can cause one or more of these impacts. For example, a political coup could cause your operations team to have insufficient quantities of personnel (loss of people) and loss of connectivity (if the telecommunications company shuts down). Plan for the impacts, not the disaster.
• Consider Time Frame of Impact - An impact can last 5 minutes, 50 minutes, 5 days, 5 months, or be permanent. When an event creates an impact, your plan should provide clear direction based on the expected duration of the impact.
• Have Clear Procedures - A plan that says “open new center in a hotel conference room” is insufficiently detailed. The plan should have clear procedures for retraining, relocating personnel, reconnecting systems, and procuring goods/services necessary to recover. For example, relocation of personnel should have a clear plan for sources of transportation, roadmaps with specific routes to take, and temporary housing.
• Plan for Staged Recovery - Few serious impacts can be instantaneously resolved. For example, telecommunications circuits are generally recovered one at a time. People will return to work slowly.
• Consider Side Effects - A major weather disaster is typically followed by disease. So, while a hurricane is unlikely to cause a loss of people, the cholera, stomach diseases, or other health concerns could.

Finally, test your plan at least once per year by first calling a pre-planned meeting and role-playing resolution and actions. Later, call an emergency meeting when leaders are not prepared. Take notes on the actions (do not critique in the middle - let the disaster and recovery unfold). Afterwards, analyze the actions and provide feedback. Expect your business continuity and disaster recovery plans to improve each time your rehearse. Also, expect your business leaders and vendors to get better each time. Hopefully, the practice will pay off when the next emergency occurs.

This entry was posted on Friday, March 28th, 2008 at 9:02 am and is filed under Vendor Management. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.