Demonstrating the Value of BCP - Maturity Models - Andrews - Oct 2016
- 1. Demonstrating the Value of Business Continuity Planning: Maturity Models Prepared for DRIE Central October 2016 Ron Andrews
- 2. Outline • What constitutes “Value” in a Business Continuity Management program? • Measuring “Value” • How Maturity Models May Help • Exercise • Commentary
- 3. Business Continuity Management …a holistic management process that identifies potential threats to an organization and the impacts to business operations that those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities”… ISO 22301 (2012) Societal Security – Business Continuity Management Systems
- 4. Known Value of BCM • Preparedness • Regulatory Compliance • Risk Identification • Reputation and Brand Protection • Competitive Advantage • Operational Improvement • Knowledge Capture and Measurement • Increased Robustness and Agility • Cost (and Loss) Savings
- 5. Value of BCM & BCMM Organizational Need • Understand the relationship between KPI’s and KRI’s (Availability Risk) • Map their relationship • Determine relevant measures Practitioner Need • Maintain an enterprise-wide perspective • Develop the right tools – including the most relatable indicators for performance benchmarking • Consider a Business Continuity Maturity Model (BCMM)
- 6. BCMM - Overview • A multi-dimensional tool for evaluating organizational capabilities and maturity in certain domains • Criteria for evaluating capabilities can be conditions, processes or application targets and must be measurable • First developed in 1993 as a Capability Maturity Model for software • Uses a sequence of levels that follow a logical path • Used to gauge progress, assure stakeholders and to benchmark against practices of other organizations and professional standards • Are descriptive, prescriptive and comparative • Criticized for being too similar to one another, omitting other possible variables and being oversimplified
- 7. Available BCMM • BCM Self-Assessment (Gallagher, 2003) • BCM Maturity Model (Smit, 2005) • Business Continuity Maturity Model (Virtual Corp, 2005) • BCMS Capability (Sheth, 2007) • BCM Program Metrics (Strong, 2010) • BCM Maturity Model (Randeree, 2012) • BCM Maturity Model (Gartner, 2012)
- 9. BCMM – Virtual Corp
- 10. BCMM - Exercise Table Discussion • Examine the Virtual Corp Business Continuity Maturity Model 2.0 Self-Assessment Workbook provided at your table • Select 2 – 3 Competency Domains from page 2 • Applying these domains to your organization, share your impressions with table members • Provide feedback for all participants 45 minutes
- 11. Commentary • BCMM is receiving increased attention from academics, as well as BCM and Risk Management practitioners • This growth mirrors the increasing popularity in applying ERM frameworks to organizations • Like any multi-dimensional tool, BCMM requires further research, experimentation and application to improve reliability • BCMM is complementary with BCM standards • BCMM offers much potential in defining, measuring and communicating results in ways that improve organizational preparedness
- 12. Resources • Barker (2010) “BCMM” • CSC (2013) “The Business Continuity Maturity Assessment Program” • DRJ (2016) “The Hidden Value of Business Continuity Planning” • Junttila (2014) “A Business Continuity Management Maturity Model” • Langsett (2009) “Business Continuity Maturity Model” • Langsett (2016) “Six Levels of Business Continuity Maturity” • Mitchell (2013) “The Value in BCP – Beyond Preparedness” • Protiviti (2004) “The Business Continuity Maturity Continuum” • Ream, Scott (2002) “How Mature is Your Continuity Program?” • RSA Archer (2015) “Maturity Model: Business Resiliency” • Tucci (2010) “Proving the Value of a Business Continuity Plan” • Virtual Corp (2016) “Business Continuity Maturity Model 2.0 Self- Assessment Workbook”