The global health crisis has meant that companies and organisations have had to drastically change their way of working in a short time. For many, this has (once again) put business continuity management on the agenda. How can you, as an organisation, prepare yourself as well as possible for the unexpected? And what are the points for attention? We spoke with Jean-Christophe Real, BCM Manager at Belnet.
How is business continuity management (BCM) organised at Belnet?
Jean-Christophe Real: "In our organisation, the ITSM (IT Service Management) team is responsible for BCM. The continuity of our services is, in fact, an integral part of the management of our services. The ITSM cell is responsible for all activities linked to the development, planning, delivery and monitoring of IT services to our customers. This is done according to a clear framework structured in processes and procedures. Of course, the BCM team works very closely together with all other units within Belnet. For example, our CISO is a key stakeholder in raising awareness about cybersecurity."
Why is BCM so important to Belnet?
Jean-Christophe Real: "We offer our customers services that are often of primary importance for the functioning of their organisation. That is why we make every effort to continue offering them these services in all circumstances, even in the event of a crisis. During this Covid-19 pandemic, our network is all the more crucial for our member organisations, whether they are hospitals, government departments, research centres or higher education institutions."
"Also, we must not lose sight of the human aspect. The current pandemic shows once again that in this type of crisis, the BCM manager should focus primarily on protecting the personnel. Once staff safety is assured, we can see how we can ensure that our services continue to work."
How did Belnet implement BCM?
Jean-Christophe Real: "We tackled this in the form of a project, which took about a year. Because of this, we called in the help of external consultants who are specialised in this domain and had experience with setting up BCM in similar organisations. All Belnet units have been involved, and management has made a personal commitment so that everyone within the organisation understood the importance of BCM. Each unit now has an up-to-date BCP plan."
BCP, CM, DRP, etc. What's the difference?
Business continuity management (BCM) is a management process that optimally prepares organisations to offer a valuable service to customers in all circumstances. BCM includes anticipating a crisis, managing the crisis and restarting after the crisis.
- BCP (Business Continuity Planning) focuses on continued service delivery. A business continuity plan includes the procedures and measures that an organisation takes in order to be able to continue critical business functions within an agreed and acceptable level when faced with a crisis.
- CM (Crisis Management) is the overall coordination of an organisation's response to a crisis situation. The focus is on managing and resolving the crisis. A crisis plan lays down, among other things, who is on the crisis team and what criteria an event must meet in order to represent a crisis. Of course, this goes wider than just IT services.
- DRP (Disaster Recovery Planning) focuses on repairing or replacing the damaged (IT) infrastructure as quickly as possible. But the most important goal is to protect people's lives. The DRP plan is usually quite technical and focuses on specific deadlines (RTO, recovery time objective) that must be met in order to prevent catastrophic damage.
- BRP (Business Resumption Planning) is an extension to DRP and refers to the recovery of IT and all other business aspects (administration, accounting, etc.)
"After the implementation was completed, the follow-up was entrusted to me as BCM manager. In my position, I am responsible for keeping the plans and procedures up to date, but also for organising tests. They help us to adapt our plans even better to the target scenarios. I report directly to management."
What did you learn from the BCM trajectory?
Jean-Christophe Real: "It turned out to be very complicated to make everyone aware of the importance of this work in 'normal' times. Asking people to provide an umbrella at a time when the sun was shining brightly was a difficult task. Internal communication and awareness-raising have, therefore, been crucial success factors."
"Performing a test, even if it is one with no impact on the organisation or customers, requires an enormous amount of resources. The cost of such a test is sometimes difficult to justify. But our tests immediately produce concrete and usable results. They allow us to improve and refine our processes further. Besides, every 'real' crisis has its opportunity. This is clearly the case for the current corona crisis. This has enabled us to put one of the scenarios from our business continuity plan into practice."
For what other scenarios is Belnet prepared?
Jean-Christophe Real: "Our business continuity plan provides five scenarios. After a thorough risk analysis, these were identified as the most likely for Belnet. The advantage is that they allow us to handle many different types of incidents. In the field of crisis management, we have supplemented the scenarios with criteria that make it possible to objectively define the difference between a crisis and a 'major incident', and this for both technical and non-technical incidents."
"In addition to the scenario that our offices in the WTCIII building are no longer accessible (for a short or long time), we are also prepared for major incidents in our infrastructure: both the failure of our internal IT or one or more datacentres or (network) nodes. Finally, we also foresee a scenario around various forms of cybercrime."
Jean-Christophe Real, BCM Manager
What tips do you have for other organisations that work with BCM?
Jean-Christophe Real: "To start with, I would advise smaller organisations to use their resources intelligently and to be pragmatic. It is not feasible to achieve everything in one go, so focus on the most important risks and scenarios. Work transversally: correctly assessing risks and choosing the right priorities based on this is not an easy task, even in a small organisation."
"The Covid-19 crisis also shows that it is very challenging to take the most appropriate precautions. You need to be able to reassure the most anxious without being too extreme, while protecting everyone, including those who are not convinced of the risks. This is an ongoing balancing act that requires a lot of diplomacy and quality communication."
What are the next steps within Belnet?
Jean-Christophe Real: "We recently did an assessment. We plan a full audit later this year. This will allow us to accurately assess our maturity in the field of BCM and to identify points of attention that we can or should improve. Internal awareness-raising actions are also planned to further increase awareness among our employees. Continuity of service requires vigilance on the part of everyone."
BCM during the corona crisis: what measures has Belnet taken so far?
- Switching to 100% homeworking for everyone, including the reception staff
- Accelerated implementation of a unified communication tool for online collaboration and meetings (internal and external), including training courses
- Signing documents electronically
- Intensified monitoring of attendance to ensure continuity within the various teams
- Customised incident management for critical customers and upgrades on request
- Change freeze on the entire Belnet network and BNIX platform
- Anticipating orders to/deliveries from suppliers (e.g. of network equipment)
- Ensuring access to our datacentres and PoPs
- Support in teleworking/e-learning through the provision of a simple videoconferencing tool (Jitsi) and promotion of the specific offer of the European research network GÉANT