BCP Stage 2: Understand Current Capabilities & Core Resources
During the first step of developing a Business Continuity Plan, we established the organisation’s priorities and thresholds for disruption based on considerations such as customer goodwill, revenue, and contractual commitments. This next stage of development ensures that we have a foundation of intrinsic capabilities to meet those priorities and mitigate the exposures related to a failure to meet them.
This step can be described as the ‘Dependency Analysis’. In its simplest form, it is the understanding of what parts of an organisation’s infrastructure categorically need to be in place so that operational priorities can continue at an acceptable level.
BCP Stage 2: The Four Categories of Dependency
These ‘dependencies’ fall into four main categories:
- Information Technology – the critical systems and communications systems that we need.
- Workplace – The premises and any specialised equipment required.
- People – the skills and number of employees we need to perform critical activities.
- Supply Chain – the stock, raw materials and logistics we need to market our products.
This information needs to be understood so that we can:
- Understand the resources most critical to recovery and continuance.
- Ensure that we understand how robust these dependencies are and whether they can be effectively recovered to mitigate the risks associated with operational disruption.
- Understand what parts of the organisation need to provide input to develop our business continuity capabilities further.
The identification of priorities and tolerances helps us understand what we will need in various disruption scenarios and who needs input to confirm and build our recovery capabilities. The assessment of core resources establishes whether we have the intrinsic capability to meet those priorities following a major disruption.
To complete this step, we need to collect information as follows:
Phase 1 – Identify recovery needs
- What systems and other resources need to be available to perform the activities that deliver our operational priorities? In addition, when do these systems need to be recovered or made available?
- These may fall into several categories:
- Information systems
- Workplace – whether an alternative site is required or whether remote working is an option (typically, there is a blend of both)
- Minimum staffing levels
- Supplies and any specialised equipment
Phase 2 – Obtain assurances of capabilities
- Ensuring that there is the capability to recover or restore these resources in line with recovery needs.
- Aligning the different parts of the organisation responsible for managing these resources and ensuring they can meet the required recovery requirements.
- If there are shortfalls, decisions may be required to close these gaps.
This step requires gathering considerable information from several areas of the organisation. A good plan is required to understand how this is accomplished and how to collate the information. Below is an example of data that we gathered in Phase 1—understanding the organisation’s priorities. It shows the priorities and how their perceived interruption thresholds ‘flow’ through to create a more detailed picture of core capabilities.
Example:
In this simplified example, the priority services are identified, and the exposures and tolerances of each service are established. Next, the Recovery Requirements section details the systems and equipment required and their recovery ‘window’. Any shortfalls have been highlighted for further consideration and discussion.
In this hypothetical example, the organisation is in reasonable shape. There is sufficient capacity to provide physical accommodation and support remote working.
Next week, we will focus on Stage 3 and discuss in more detail how to develop the response and recovery plans.
If, in the meantime, you have any questions about this document or any other enquiry about your BIA or BCP plans, please do contact our experts in CiContinuity. A summary of all the key steps in developing a BIA and BCP can be found here. To learn more about Centerprise International Group, please visit our website.
Key Takeaways from BCP Stage 2
– BCP Stage 2 focuses on identifying the core resources and dependencies needed to support critical operations during disruption.
– It involves a structured Dependency Analysis across IT, workplace, people, and supply chain categories.
– This stage helps determine whether existing capabilities align with recovery priorities and tolerances.
– Information gathered during BCP Stage 2 highlights gaps, informs decisions, and strengthens business continuity planning.
– Collaboration across departments is essential to ensure accurate data and realistic recovery capabilities.
