From Disaster Recovery to Business Resilience

Chris Connelly

IBM Risk and Resilience COE

Scope

• From Disaster Recovery to Business Resilience• The Resilient Enterprise Blueprint• The IBM 2011 Global Business Resilience and Risk

Survey

What is Business Resilience?

Governance

IT Disaster Recovery

Business Continuity

Crisis Managemen

t

Risk Managemen

t

A (very!) simple business map

Areas of shared resources and shared (linked) risks

Business Functions

Line of BusinessA

Line of BusinessB

Line of BusinessC

Dependencies forService Delivery

Dependencies forService Delivery Dependencies for

Service Delivery

Linking the Resilience requirements across the enterprise

Areas of shared resources and shared (linked) risks

Strategy & Vision

Organization

Processes

Technology

Applications & Data

Facilities

Line of BusinessA

Line of BusinessB

Line of BusinessC

Dependencies forService Delivery

Dependencies for

Service Delivery Dependencies for

Service Delivery

Integrated View of Service Delivery

Business Functions

The layers are broken down into Business and Infrastructure objects; objects are refined by attributes

250+ objects and over 4000 attributes

Linked across layers to provide

different resilience views like

continuity, compliance, security etc.

Evaluated for their current and target

levels of business resiliency maturity

STRATEGY

PROCESS

PEOPLE

APPLICATIONS & DATA

TECHNOLOGY

FACILITIES

The Resilient Enterprise Blueprint

The 2011 IBM Global Business Resilience and Risk Study

In conjunction with the Economist Intelligence Unit

390 Participants

8

Geography Company size

North America — 39%

Western Europe — 39%

Asia-Pacific — 20%

Eastern Europe — 3%US$5M or less — 39%

US$10B or more — 23%

US$1B to $5B — 15%

US$500M to $1B 13%

US$5B to $10B 10%

What organisations have done

9

Create a business continuity plan

Invest in new risk-related IT solutions

Establish company-wide risk management team

Discuss issues with supply-chain partners

Assign overall responsibility to a single executive

Develop communications or training program

Respond to recent natural disasters by rethinking strategies

Develop integrated business resilience strategy

Engage external advisors

Source: Q5a. Which of the following measures has your organization adopted?

Next 3 yearsAlready doneNext Steps

10

Develop communications or training program

Invest in new risk-related IT solutions

Respond to recent natural disasters by rethinking strategies

Engage external advisors

Discuss issues with supply-chain partners

Create a business continuity plan

Establish company-wide risk management team

Assign overall responsibility to a single executive

Source: Q5b. Which of the following measures is your organization most likely to adopt in the next three years?

Develop integrated business resilience strategy

Barriers

11

Silos within the organization — 28%

Budget limitations — 20%

Inability to predict ROI from improvements — 17%

Lack of C-level vision and commitment — 14%

Lack of understanding about best practices — 9%

Lack of understanding about emerging technologies — 8%

Lack of buy-in from employees — 4%

Source: Q10. What is the biggest single barrier to implementing a holistic approach to business resilience planning?

2010 Study comparison:Implementing necessary procedures

Securing budget

Obtaining full risk picture from depts

“An effective business resilience plan will provide a robust foundation on which to build a long-lived competitive position supported by end-to-end risk management.”

2011 IBM Global Business Resilience and Risk Study report

Principal Findings

12

100%

An integrated approach to business resilience and risk management offers a significant business opportunity for organizations of all sizes

Appointing a single individual with overall business resilience and risk management responsibility is essential to integration success

Input should be sought from throughout the enterprise — including employees and partners

Cloud technologies have matured significantly and now have the potential to deliver significant business resilience benefits

The newly integrated business resilience and risk management strategy can be levered to seize unexpected opportunities and deliver measurable business value

In Summary• Businesses are moving beyond Disaster Recovery

to Business Resilience• IBM has introduced the Resilient Enterprise

Blueprint to provide this framework• The 2011 IBM Global Business Resilience and

Risk Study shows what organisations world wide are addressing

• www.ibm.com:– “Resilience Survey”– “Risk and Resilience”