Image description

Business Continuity as a Service

Image description

Business Continuity as a Service –what you should be looking for


A number of existing Disaster Recovery as a Service (DRaaS) service providers are looking to expand their offering to include Business Continuity as a Service (BCaaS).  This is hardly surprising: virtualisation and cloud service offerings such as Amazon Web Services and Microsoft’s Azure have enabled many to enter the DraaS market without incurring the capital expenditure of establishing a physical data centre. This this is good for the purchaser of these services – technology improvements and fierce competition have lowered costs. But for the players in the market it creates pressure for them to differentiate in order to stand out from the myriad of “me too suppliers”.  The problem is of course as soon as one supplier “puts it out there” that they are offering a Business Continuity as a Service, others will follow with similar assertions, regardless of their intrinsic capability to deliver the service.  (by the way, I’m not implying dishonesty here, but in a competitive arena it’s very tempting to announce “we can do that, too”, without fully understanding what’s required to deliver a world-class BCaaS capability)   So be prepared, if you are offered Business Continuity as a Service here a few questions that you should be asking of any “wannabe” supplier

Business Continuity as a Service allows an organisation to outsource maintenance of your business continuity strategies, response plans and assurance framework and should cover, as a minimum, undertaking the activities to ensure strategies and plans are relevant, fit for purpose and are proven to be effective.  In essence, Business Continuity as a Service is a Business Continuity Management System (BCMS) that is operated by a third party.


Some of the main considerations for evaluating a Business Continuity as a Service supplier are:


How does the supplier embed a management process in your organisation?

This really is a success or failure issue.  Offering to operate a business continuity management framework (or any other risk/compliance framework for that matter), requires that an external organisation is capable of “keeping a finger on the pulse” within your organisation. This means that they can see what’s going on (or not going on) and can collaborate across physical organisation boundaries.  This requires more than a “how’s it going” email and a few conference calls. What this requires is that your Business Continuity as a Service supplier is capable of continuously acquiring actionable intelligence of the status and disposition of all aspects of your business continuity activities. 


Do they know how to deploy Business Continuity as a Service

Another success or failure issue: providing Business Continuity as a Service, is not the same as developing a business continuity plan or providing access to a platform, it’s a continuous process and your supplier needs the skills and knowledge to ensure sustained adoption of the service throughout your organisation. They’ll need to show that they can advise you of the implications of deployment, how to drive adoption of the service and how you – the customer – can monitor adoption and engagement


Will they use someone else’s work?

Do you have to adopt their methodology or can they absorb your current framework? If you have something that works for you and is familiar to your organisation, do you really want to rework it completely?  It may be out-of-date, but a short remediation project could be all you need to make your plans “fit for purpose”.  And what if you have a BCM Consultant in place who knows your organisation and with whom you want to keep working, can you continue with this relationship and have the flexibility for your existing consultant to operate the suppliers Business Continuity as a Service platform?


Do they go beyond plan content maintenance?

Ensuring that the content of plans and strategies is basically a content management activity which can and should be automated, but a business continuity management system is more, much more than this.  When looking to appoint a Business Continuity as a Service provider ensure that they can do more than host your plans. Look for capabilities like:

  • Operation of an overall assurance framework including, but not limited to, incident management and business continuity exercises;

  • Creation and delivery of awareness management campaigns

  • Issue tracking and management (with something a little more sophisticated than spreadsheets!)


Business Continuity as a Service done well, will solve many of the perennial problems associated with the adoption and operation of a business continuity management system. Delivered with the right tools it avoids trying to manage a process via a blizzard of spreadsheets, freeing people up to focus on high value knowledge work.  But choose your supplier well because, as the idea gains momentum, Business Continuity as a Service could become a “fashion”: make sure that would-be suppliers have the tools, skills and capabilities to deliver the service you are being asked to pay for.