S 6.113 Providing adequate resources for business continuity management

Initiation responsibility: Top Management

Implementation responsibility: Emergency Officer, Top Management

In order for business continuity management to reach the goals set for it, it must be provided with adequate resources.

Planning, implementation, operation, maintenance, and improvement of business continuity management require sufficient financial and personnel resources, as well as suitable equipment. The top management of the organisation must provide adequate amounts of these resources.

It is recommended to have the Emergency Officer point out what resources are needed based on the potential risks and the goals and tasks of contingency planning and emergency response. On the one hand, this serves as a basis for making the required management decisions regarding the allocation of resources, and on the other hand to specify the project plans and implementation deadlines.

Appointing a person in charge business continuity management

Even the most expensive technical solutions are useless without a properly functioning organisational structure for business continuity management. For this reason, the top management should appoint one person from the management level to be responsible for business continuity management.

Appointing persons in charge of planning, implementation, operation, maintenance, and improvement of business continuity management

Suitable personnel are to be assigned to each of the business continuity management roles specified. The roles must cover all phases of the business continuity management process, i.e. the initiation, planning, implementation, maintenance, compliance, and examination of the business continuity management system. The roles only needed temporarily to overcome an emergency or a crisis must also be taken into account. In particular, an Emergency Officer must be appointed, acting as the central contact person for business continuity management and responsible for coordinating all pertinent tasks.

Personnel resources for business continuity management

All employees in the business continuity management team should be granted adequate authorities so they can perform the tasks assigned to them through the roles they fulfil. They must have access to the required resources and have enough time available to do their work. This applies especially when an employee assumes a role and is still responsible for doing his normal job. The business continuity organisation chart must be authorised by the top management of the company and/or government agency.

Provision of resources for IT operation

If additional requirements are placed on the IT by business continuity management, it must be ensured that IT operations are provided with sufficient resources. In general, the typical problems arising in IT operations (tight budgets, overburdened administrators, and an unstructured or poorly maintained IT landscape) must be solved first in order to effectively and efficiently implement the contingency safeguards.

Access to external resources

In individual phases of business continuity management, for example in the conception phase or in the emergency response phase, you can expect workloads to peak. In order to overcome these peaks, it may be necessary to re-assign additional internal employees or deploy external experts. In addition, it may make sense to deploy experts temporarily if the corresponding expertise or experience is unavailable in the organisation. The need for external experts must be communicated by the internal business continuity management experts so that the management can provide the required resources.

Economic aspects

The business continuity management strategy should also consider economic aspects right from the start. When selecting the contingency safeguards to be implemented, the resources currently available should also be taken into account. If there is not enough financial, technical, or personnel support available for certain measures, then the strategy must be revised. However, if the goals formulated for business continuity management and the financial, technical, or personnel capacities available to reach these goals are widely disparate, the goals and the strategy must be reconsidered in general. In this case, management must be informed of these discrepancies so that they can take the necessary corrective actions.

When specifying contingency safeguards, the personnel and financial resources required for their implementation must be mentioned specifically. This includes stating who has been appointed the person in charge, as well as additional contact persons, but also specifying detailed schedules and which materials need to be purchased. It is also recommended for all planned contingency safeguards to document whether the resources planned were made available on time as well as the reasons for any deviations in the project. This is the only way to achieve long-term improvement and avoid disruptions.

Review questions:

© Federal Office for Information Security. All rights reserved.