Being resilient when faced with an emergency or catastrophic event requires preplanning to ensure that operations can continue with minimal interruption throughout the event or restart soon after the event. Business continuity software can help bridge the continuity gap during these times. Answering these 10 questions before purchasing will help ensure a good match between the software and the user.
Choosing a business continuity software tool can be like choosing a new car. There is an overwhelming abundance of possibilities available in every model, size, and price range. The buyer narrows down the selection by asking themselves questions about functionality, capacity, affordability, and maintenance costs. An organization in the market for a business continuity software package should begin by asking themselves the same type of questions.
Question 1: Does This Organization Really Need Business Continuity Software?
Before shopping for a car, for example, buyers should consider whether they actually need a car at all. Maybe they could get by with a bicycle. Business continuity software is essentially the same at the core: a database capable of aggregating data and producing reports. User must then determine other criteria, for example: whether they need the system to do more than simply store information; and whether they have few enough plans that they can update and maintain the documents manually. If so, a database management system merged with a word processor may suffice.
Business continuity management can present a huge administrative burden. However, business continuity software allows the operator to input data once and have it cascade across multiple plans and reports. One alternative to expensive software is the Department of Homeland Security’s (DHS) Ready.gov website, which offers a free Business Continuity Planning Suite with a training module, automated plan generators, and a self-directed exercise for testing the completed plans.
Question 2: What Does the Organization Need the Software to Do?
In the car scenario, the buyer considers the intended uses – for example, just to go back and forth to work every day, or to haul a trailer. If the user needs business continuity software to perform more complex functions, it helps to identify those needs before purchasing a product. Some features and functions to consider include, but are not limited to: Business Impact Analysis (BIA) tools; risk assessments; incident management capabilities; emergency notifications; tests and exercises; and mobile device applications. Some systems allow users to choose these options individually. The most important factor is that the user interface is simple and easy to use.
An integrated BIA tool can be particularly valuable in determining critical business functions and recovery times, as well as identifying assets and dependencies. The findings can then be integrated into business continuity plans. Many programs offer an incident management tool that can turn response and recovery plans into systematic actionable tasks with timed reminders and an event log. However, be sure the program can accept and store supporting files such as PDFs or Word documents.
Question 3: How Much Can the Organization Afford?
Pricing for business continuity software varies greatly depending on factors such as integrated capabilities, number of users, level of technical support, and hosting options. At some point, car buyers have to determine whether they can afford an initial deposit and monthly payments. Similarly, an organization considering business continuity software should prepare for an up-front implementation fee and annual licensing fees, in addition to potential charges for user training and technological support. Many programs base costs on the number of users. As the organization grows, the software needs to grow with it, which often requires additional user licenses.
Question 4: Who Hosts the Software and How Safe Is the Data?
The car shopper may consider vehicle security: street or garage parking at night; garage locks and security; and car alarm systems. Most business continuity software offered today is hosted in a cloud-based environment, but there are a few self-hosted solutions. For those interested in Software as a Service (SaaS), make sure to look into the security of the hosting data center. Federal government organizations require offsite data centers be certified by the Federal Risk and Authorization Management Program (FedRAMP). If the organization collects personally identifiable information as part of the business continuity cycle, that data should not only be encrypted, but also backed up regularly and quickly recoverable.
Question 5: Will the New Software Integrate With Current Software?
For a car, this may include determining whether a bike rack from the old car will fit onto the new one. For business continuity, whether the existing technology works with the new technology may be a concern. Some business continuity software is designed to integrate with third-party applications, such as human resources databases. This type of functionality saves a great deal of time, especially when personal contact information has to be updated across multiple databases and plans.
Other business continuity software is designed to integrate with emergency notification services like Everbridge. The user can activate the notification feature using personnel contact information inside the business continuity software. Other useful features include integration with existing Geographic Information Systems (GIS) and Active Directory services.
Question 6: How Easily Can the Software Be Implemented?
How the organization has been managing its business continuity to date, how is has been storing its data, and how it has structured its plans help answer this question. The organization should make sure that existing data could easily be imported. Most business continuity software allows for the upload of spreadsheets. When it comes to formatting plans, however, most software is less flexible. If the organization currently creates plans in a word processing program, the new software may not be able to recreate that format exactly. In car terminology, the person buying a new car should not expect the gas tank to be on the same side of the car as the old one.
Other issues may arise for organizations whose business continuity programs are less mature. In the past, the business continuity coordinator may have been doing all the heavy lifting. Once a software program is implemented, individual plan owners may be asked to complete an online BIA or input plan data themselves. If the organization’s business continuity program is not fully mature, it may be difficult for employees to understand and adapt to the demands of the software.
Question 7: How Should the Software’s Output Look?
Car buyers have an idea of what they want the new car to look like – for example, sleek and shiny, or tough and functional. Similarly, business continuity applications produce output differently. Some software create plans as Word documents, but most produce PDF documents, making them more difficult for plan owners to add comments or changes. Many software packages offer custom reports, although some are easier to create than others. Some reports are as easy as drag-and-drop; others require the user to master programs like Crystal Reports. Some software does not allow the user to create custom reports at all; instead, the user must ask the software provider to create the reports for them.
Warning: if the organization depends on call trees for employee notification, make sure the new software will support them – many vendors consider call trees outdated and no longer offer this feature.
Question 8: What Training Will Users Need?
Moving a business continuity program from a word processing document and a spreadsheet to a fully integrated software program can be like going from an automatic to a manual transmission: all of the sudden, there are multiple moving parts and the driver needs to learn coordination to avoid stalling. New software can present a steep learning curve. Not only is there the challenge of learning to operate the programs, there is also the challenge of teaching plan owners to assess and prioritize their business functions. If individual plan owners are responsible for conducting their own BIAs, a significant amount of training may be required. Software owners can either conduct the training themselves, or pay the vendors to do so.
Question 9: How Much Technological Support Will Be Required?
While a car buyer determines the value in purchasing a roadside assistance plan, the business continuity professional determines how much technological support users of the business continuity software will require, as well as when and how the support will be provided. Business continuity software varies in terms of technological support, so several needs must be assessed: time (24/7 support or only during business hours); availability (business’s hours compared to vendor’s hours); accessibility (live support or online portal); and cost.
Question 10: Where Is the Best Place to Start?
Just like car dealerships, there are a multitude of software vendors. The findings of an independent research organization, such as the Gartner Magic Quadrant for Business Continuity Management Program Solutions are a good place to start. Recommendations from peers and professional organizations are also valuable. Vendors will gladly demonstrate their software via webinar; and some even offer a free trial period.
As with any purchase, thorough research and comparison are key. Keep in mind, though, that the organization may be using this software for years to come. It is important to choose a package that is best for the business right now as well as flexible enough to grow along with it.
Erin Valentine is an emergency manager at the University of Maryland Medical Center, a 700-bed teaching hospital in Baltimore which houses the nation’s first shock trauma center. She spent the first decade of her career at the Maryland Department of Emergency Management (MDEM) and went on to support the Social Security Administration as a Continuity of Operations/Continuity of Government specialist. She then spent five years as a business continuity and IT disaster recovery consultant for the Centers for Medicare and Medicaid, the National Institutes of Health, and the Johns Hopkins Hospital. She transitioned to healthcare emergency management in February 2020 and lead the hospital incident command team’s response to the COVID-19 crisis. She is studying for a master’s degree in Emergency Management at Clemson University and is certified by FEMA as a Master Exercise Practitioner (MEP) and Professional Continuity Practitioner (PCP). She is a Certified Business Continuity Professional (CBCP) and is the president of the Central Maryland Chapter of the Association of Continuity Professionals.