Q4 2014Keeping ContinuitySA

clients informed

In this Issue

Editor’s NoteThis is my favorite time of year; I love thetraditions, festive spirit and being aroundfamily and friends and not to mentionthe delicious food.

2 Why your com-pany should con-sider businesscontinuity man-agement

3 Alan Hilburgbreakfast event

4 ContinuitySA offersCertified ISO 22301Lead ImplementerCourse

5 Certified ISO 22301BCMS courses

6 Which businesscontinuityprovider? Fourquestions to ask

8 How many para-chutes does yourbusiness have?

9 Crisis managementMasterClass

11 ContinuitySA Training Dates

All Links are now

Interactive!

1

It’s been a busy year indeed and a highlight for us this year was our awardfor Business Continuity Provider of the Year at the BCI SADC awards earlierthis year.

Inside this edition, Miles Murray delves into why companies should considerbusiness continuity management and that it should not just be a box to tickto comply.

As part of our recent partnership with PECB (Professional Evaluation and Certifications Board) we have a host of Certified ISO Lead ImplementerCourses lined up for 2015. Take a look at our website and book your seat atany of our upcoming courses.

Michael Davies, CEO of ContinuitySA lists four factors to consider when assessing which Business Continuity supplierto use and do they offer an end-to-end service.

We have lined up some exciting events for 2015, first is our breakfast event on 29th January 2015 where our guestspeaker, Alan Hilburg will discuss brand and communication mistakes to avoid when trying to keep the BusinessContinuity lights on. Don’t miss this event, book your seat today.

In February 2015, Alan Hilburg in association with ITWeb and ContinuitySA will be hosting his Crisis ManagementMaster class. As the sponsor of the event ContinuitySA offers our readers and valued clients a 30% discount whenyou register. View the advert on page 9 for more details.

Have you considered how many parachutes your business has and do you have a plan B in place?

Diarise Business Continuity Awareness Week which takes place from the 16th – 20th March 2015, we will have ahost of events and webinars taking place in that week and we don’t want you to miss out on this. Focus for thiscoming year will be around testing.

Finally, a big thank you to all our readers for your continued interest in our newsletter, it’s been an amazing year,with its successes and challenges all rolled into one, and from the ContinuitySA family we would like to wish all ourreaders, clients, suppliers and patrons a peaceful holiday season, travel safely and a Happy 2015 ahead.

Wishing you health, wealth and resilience this festive season.

Cindy Bodenstein

22

Why your company should considerbusiness continuity managementIt’s hard to imagine, but some companies still don’t see any positive value in implementing aBusiness Continuity Management (BCM) programme. For many, it’s just a box to tick in orderto comply with King III or other governance codes to which the board adheres.

“The tick-box approach to compliance is always counterproduc-tive because there’s usually good reason for the requirement inthe first place. That’s particularly true when it comes to BCM because it deals not only with overcoming disasters but a company’s long-term sustainability and, in fact, it’s general abilityto succeed,” argues Miles Murray, General Manager: Sales atContinuitySA.

Murray says that BCM’s greater role can be seen in the broadterms of the ISO 22301 standard for BCM published in 2012, whichpositions the discipline within the broader concept of “societalsecurity” and thus makes BCM part of the drive to build sustain-ability. The growing interest in sustainability, he says, is the resultof the acknowledgement that business success is built not just on a company’s own efforts, but those of its partners, and thecommunities amongst which it exists.

In other words, BCM has broadened its focus in line with the realisation that stakeholders in a business are also shareholders ina sense, and thus that more than one group has a vested interestin a company’s ability to recover from a disaster, whether it’s aflu pandemic, a warehouse fire or a hurricane.

When a company starts thinking about business continuity, itspoint of departure is an assessment of the risks that it faces andwhat their impact would be. This analysis will take into accountthe obvious internally focused risks but also those that are exter-nal. The latter would include business risks along the supplychain – What happens if Supplier A can’t deliver? What’s Plan B? – to non-business risks like a natural disaster or, more

currently, the inability to get products to or from certain WestAfrican countries owing to Ebola.

Once a company starts taking this approach, its resilience inbouncing back from a disaster is increased but that’s not wherethe benefits end, says Murray. At the same time, its whole gover-nance framework is strengthened with all the positive benefitsthat entails, and the board can manage its financial exposuresmuch more proactively.

“Another key benefit of BCM is that it enhances employees’ confidence in the company, and thus contributes to employeeengagement, something that’s absolutely vital,” he notes. “Clientconfidence is also strengthened, which is always good for landingcontracts. It goes without saying that the company needs tocommunicate its BCM stance to these important stakeholdergroups.”

Murray goes further, saying that this type of approach creates aforward-thinking organisation, one that’s in a better position toidentify looming risks but also opportunities as well.

“Being proactive about risk mitigation also means that the company is more likely to be proactive about spotting gaps inthe market that it can exploit,” Murray explains. “Such a com-pany is inevitably going to be more successful in the long run, tothe benefit of both its shareholders and its broader body of stakeholders. When a company truly embraces the business continuity journey, it sets itself on the path to success.”

3

Alan Hilburg is an American communications and branding consultant and one of the world’s leading senior ad-visors to CEOs, Boards of Directors, international presidents, corporate general counsels and senior leader-ship teams when brands, reputations and businesses are being threatened. He is one of the world'sleading authorities on the alignment of institutional brands, organizational engagement and deploymentand reputation management. Recognized as a pioneer in crisis management and litigation communi-cations, his leadership of the classic J&J Tylenol crisis wrote the textbook on managing crises. Sincethen he has been a ‘first call’ for organizations and high profile individuals facing reputational threatsworldwide and has written more than 150 crisis plans. He is the award-winning best-selling author oftwo NY Times bestsellers on leadership, has won six Silver Anvils (public relations' highest award) andfive Clios (advertising awards).

He has served as a senior counselor and strategist to 52 international CEOs, 26 Boards of Directors,five country presidents and over 200 leadership teams on institutional branding and navigatingorganization transitions. His clients have included numerous Fortune 500 companies and he hasbeen a counselor on the alignment of financial service brands, country brands (Ireland, Ja-maica, Dominican Republic, Slovenia), institutional brands (National Geographic, Johnson Wax)and consumer product brands (GE, Gillette, HP, Johnson & Johnson, Wendy's etc.) As a speaker,Mr. Hilburg has been invited to deliver more than 100 speeches in the past seven years on crisismanagement and brand protection.

4

The five-day intensive course takesplace in Cape Town from 10 – 14November and in Johannesburgfrom the 24 – 28 November culmi-

nates in an examination and certificationrecognised by the Professional Evaluationand Certification Board.

The Lead Implementer course enablesparticipants to develop the necessary ex-pertise to support the implementation andmanagement of a BCMS. Participants alsogain a thorough understanding of bestpractices used to implement BusinessContinuity processes as described in theISO 22399 standard.

Furthermore, the training is consistent withthe project management practices es-tablished in ISO 10006 (Quality Manage-ment Systems – Guidelines for QualityManagement in Projects) and fully com-patible with BS 25999 (Business ContinuityManagement specification) and ISO27031 (Guidelines for information andcommunication technology readiness forBusiness Continuity).

Those who should consider attending in-clude:

• Project managers or consultants seek-ing the expertise to prepare and tosupport organisations in the implemen-tation of a BCMS

• Business Continuity auditors who wishto fully understand the implementationof a BCMS

• Persons responsible for the BusinessContinuity conformity in an organisa-tion

• Members of a Business Continuityteam

• Expert advisors in Business Continuity

• Members of an organisation who wantto prepare for Business Continuity or fora BCMS project management func-tion.

By attending the course, delegates gaina comprehensive understanding of theconcepts, approaches, standards, meth-ods and techniques required for the effec-tive implementation, maintenance andmanagement of a BCMS.

ISO 22301 Foundation Certification is ahighly recommended as a prerequisite forattending the Lead Implementer Course;those with basic knowledge of ISO 27031or BS 25999 and general Business Continu-ity concepts are also recommended toattend.

After successfully completing the 3-hourexam, participants can apply for the cre-dentials of Certified ISO 22301 ProvisionalImplementer, Certified ISO 22301 Imple-menter or Certified ISO 22301 Lead Imple-menter, depending on their level ofexperience.

With Business Continuity recognised as an essential practice within more companies than everbefore, demand for certified professionals capable of delivering sound programmes to preventinterruption to commerce is on the rise. ContinuitySA, the specialist in Business Continuity, ispleased to announce availability of its Lead Implementer course for Business Continuity Man-agement Systems (BCMS) based on the recognised standard for business continuity, ISO 22301.

ContinuitySA offers Certified ISO22301 Lead Implementer Course

The Lead Implementer Course costsR16,500 excluding VAT.

For more information please contact Faith Mdiniso on

011 5548000 or visit www.continuitysa.co.za

ANSI Accredited ProgramPERSONNEL CERTIFICATION

#1003

5

6

Here are some factors to consider when assessing which supplierto choose:

Does it offer an end-to-end service? Many companies believethat implementing Business Continuity Management is a once-offaction, whereas it’s actually a process that has its own life cycle.A provider that understands the cycle and how to progress fromone stage to the next is preferable. This is true even if a companybelieves it just needs one thing – disaster recovery, for example –it’s just as well to have a partner that understands the full picture.“Make sure that the partner you choose can provide the fullrange of services, from advisory right through to implementationof both the ICT and physical infrastructures (including an alterna-tive site to work from),” advises Michael Davies, CEO of Continu-itySA, Africa’s leading provider of BCM services.

Another reason for choosing an end-to-end BCM integrator is thatsuch a company will have experience in all of the components

of BCM to enable the client to scope the nature of the solutionrequired better, as appropriate to the stage within the life cycle ithas reached and its business strategy and risk appetite.

Does it have sufficient experience in BCM and the right level ofspecialist skills? BCM as a discipline has evolved significantly fromits beginnings as a way to recover from IT collapse. Since then, ithas expanded to cover the business’s ability to continue servicingcustomers – how to ensure its business processes can be pro-tected or reinstated.

“Now we are starting to talk even more broadly about businessresilience – moving beyond simply understanding risks and puttingcontingencies in place to fine-tuning the business in the light of itsrisks so that it is less likely to suffer a setback, or can recover fromone much more quickly,” Davies observes. “A company like Con-tinuitySA has been involved with that change as a member of therelevant industry bodies, so we understand it fully.”

Which Business Continuity provider?Four questions to ask

Having decided why they need to implement Business Continuity Management (BCM)in order to become more resilient, most companies will then start to look for a specialistservice provider to help them turn that decision into action. For all but the smallest com-panies, this is probably a wise move because Business Continuity is a highly technicaldiscipline, and specialist assistance is likely to save time and money in the long run.

A related point, says Davies, is whether the supplier adheres toand is accredited by the various BCM standards authorities, suchas the Business Continuity Institute (BCI) and, of course, the Inter-national Standards Organisation (ISO).

Is it technology and vendor-agnostic? Technology plays a big rolein providing contingencies against disaster – it’s vital the provideris independent and thus in a position to choose the right BusinessContinuity solution for the client’s needs, without any predisposi-tion for a specific technology or vendor.

Are its solutions flexible, scalable and tested? By its nature, a dis-aster invocation takes place at a time of high stress, when failureis not an option. It’s worth enquiring how many times a potentialprovider has actually provided “last-resort” services.

“One of our proudest achievements is that a financial servicesclient had to relocate its treasury and trading operations to ourrecovery site – and was able to record its best trading day everwhile it was using our infrastructure,” says Davies. “Having credibleintellectual property around BCM plus a genuine track record isreally what one should be looking out for.”

7

8

When somebody jumps out of a plane, he or she always has two parachutes in caseone malfunctions. It hardly ever happens but when it does, it’s vital there is a Plan B –especially if the parachutist has dependents.

The same logic is true for your company. If the parachute (soto speak) doesn’t open, then the destruction would affectnot only your employees but also their dependents, at leastfour per employee when one takes into account their fami-

lies, suppliers and their families, the people supported by the taxthey all pay and the charities they support, in fact it’s probablymore like 10 people per employee in reality.

Such an event is particularly devastating in South Africa, where un-employment is high, officially it’s 25 percent but we all know it’smuch higher.

The truth is simple. Nobody, and particularly anybody with respon-sibilities would jump out of a plane without a backup parachute.And yet many, if not most, businesses are blithely operating withoutBusiness Continuity Plans, despite the fact that the only certainty ischange and that Murphy was an optimist.

As Socrates said, “If a man truly understood the consequence ofhis actions, then he would do no wrong.” Now consider the con-sequences of a disaster if you don’t have a Business Continuity Planin place. Think of your staff and their families, your shareholders andother stakeholders and what would happen to them.

And then then make sure you have that second parachute ready,just in case.

How many parachutesdoes your business have?

Should you have any enquiries as to how you can make a difference orwould like to be included in regular communication,

please contact: Chene Maartens via chene.maartens@bciafrica.com

BCI SADC Chapter Forums

The one-day course, the ICT Continuity Training is tar-geted at IT and Business Continuity Management (BCM) profes-sionals responsible for the continued uptime of IT services withintheir organisations.

Key elements of the ICT Continuity Course include:

• The link between BCM and ICT Continuity Management;

• The evolution of ICT Continuity;

• The latest concepts and trends in ICT Continuity;

• Conducting an Infrastructure Impact Analysis;

• Formulating and implementing cost effective ICT Continuitystrategies to meet business requirements;

• Security management in ICT Continuity;

• Testing the ICT Continuity framework; and

• A Continuity-as-a-Service case study.

Attendees will not simply be bombarded with theory, but will be taught skills proven in the real world by active BCM practi-tioners with MBCI (Member of the Business Continuity Institute)certifications.

The course is based on the Good Practice Guidelines of the BCIand complies with the new ISO22301 standard to ensure it is onpar with international best practices.

The 5 day Complete Continuity® Practitioners Programme is designed to equip Business Continuity prac-titioners within any organisation in all aspects of implementing,managing and maintaining an effective Business Continuityframework in their respective environments.

The course is based on the Business Continuity Institute’s GoodPractice guidelines and ISO22301 international standard.

Key elements of the 5 day Complete Continuity® PractitionersProgramme include:

• Introduction and Origins of BCM• Trends and Observations• Standards and Compliance• Elements of the BCM Lifecycle• BCM policy and Programme Management• Embedding BCM in the Organisations culture• Understanding the organisation

- Business Impact Analysis- Continuity Requirements Analysis- Risk Assessment

• Determining BC Strategy- Selecting strategies and tactical responses- Consolidating Resource levels

• Developing and Implementing a BC response• Exercising, Maintaining and Reviewing• Measuring BC Maturity

Make the ReactionRoutine

Africa’s largest Business Continuity service provider, ContinuitySA, has enhanced its Complete Continuity Training Academy

To register or to find out more please contact the training department on 011 554 8000 or email us on training@continuitysa.co.za or simply register online

via www.continuitysa.co.za

10

ICT Continuity Training Programme (1 Day Training)

23 February 2015 – Botswana16 March 2015 – Johannesburg

Complete Continuity Practitioner Programme(5 Day Training)

26 – 30 January 2015 – Johannesburg16 – 20 February 2015 – Cape Town9 – 13 March – Johannesburg