ICT continuity: Are you spending enough or too much?

Image: www.freedigitalphotos.net

Harmse also questions just how well such solutions will support business continuity when they are called upon; if they don't, of course, any money that was spent on them is wasted.

"IT people sometimes don't know what the actual business requirements for recovery are. They know they need to get the ICT services back up and running, but, owing to the traditional disconnect between IT and business, don't have the necessary insight into the business requirements to ensure that the system recovery can support the people and process recovery requirements," says Harmse.

The result is an absence of good corporate governance for what is a traditionally technical discipline and either a cost blowout through overinvestment on one end of the spectrum, or exposure of the business to unreasonable risk on the other.

He notes that ICT continuity is distinct from business continuity; the former is the technical component of the latter which also includes people and process. "ICT continuity is typically seen as a technical function and not as part of the management of risk - but that has to change," Harmse adds.

He says the implementation of an ICT Service Continuity Management (ICTSCM) framework, aligned with the ISO27031 standard for ICTSCM, supports a clearer understanding of business requirements for recovery. It also helps ensure that the ICT Service Continuity strategy is tailored to meet specific organisational needs.

The ISO27031 standard provides guidance to business continuity and IT disaster recovery professionals on how to plan for IT continuity and recovery as part of a more comprehensive business continuity management system. Importantly, it is now referenced by the more recent ISO22301 standard for business continuity.

"The aim is to bridge the gap between business requirements and actual capabilities and incorporate ICT requirements analysis with business analysis. Understanding the business requirement better and involving IT in the discussion leads to more relevant strategy development and a strategy which is fit for purpose," Harmse adds.

He turns his attention to cost, noting that it is the business which holds the purse strings, while the IT department tends to require the contents of the purse to provide services including those for ICT recovery. "With the establishment of a fit for purpose strategy, access to the purse is eased: business has a better view of what it is paying for," says Harmse.

In developing a business continuity management and ICTSCM strategy, he says cognizance of "the facts" is necessary in order to align cost with benefit. Points to bear in mind are: