What Should You Look for in Business Continuity Management (BCM) Software? 

Running a Business Resiliency Program is no easy task. Truly effective, mature Resiliency Programs need input from all parts of the business, and there are core program functions that need to be performed at varying intervals throughout the year. Resiliency programs also need to gather and analyze a tremendous amount of data in order to make sure that the needs of the business our best served, particularly when business interruptions occur. Whether impacts to the business are operational, contractual, financial, legal, or reputational, a good continuity management software package will allow you to account for and prioritize response needs throughout the enterprise. 

  A good package will also allow for some level of customization.  Different industries have different needs, and every business has its own unique set of individual needs; a good software package will allow itself to be molded to meet those needs. The types of analysis done to predict the impact of a business interruption in manufacturing, for example, are very different than the types of impact analysis done in financial services. 

 I have managed Resiliency Programs, both for small and large companies, and with and without the use of management software. In every case, the efficiencies seen by using BCM software more than outweighed the costs. I think these efficiency improvements could be felt in any size business as well. Larger businesses will have more data and more departments to analyze, and a good management software package will help wrangle all that data. Small to medium businesses will not have as much data, but they are much less likely to have full-time resources to allocate to resiliency management. For them the efficiencies gained by using software would make a tremendous difference in the company’s ability to grow and mature the program. 

Features of Business Continuity Management Software

 While Sayers does have partnerships with multiple vendors in the resiliency management space, I think it’s best to take a look at the general features of business continuity management software. As a practitioner, I would encourage you to look for the following features in any BCM software package You are evaluating (not in any particular order of importance): 

• Risk assessment and business impact analysis (BIA) integration – A good software package should simplify the day to gathering process for performing a BIA. It should help you by providing a consistent format for data gathering and should also help you analyze the data once it’s gathered. Ideally packages will offer integration with various status sources in your business to further bolster the level of analysis performed.  

• Plan development and management – Most packages offer capabilities to create plans, but the better ones offer customizable templates that are adaptable to different types of continuity plans (such as IT recovery, plans, operational, plans, crisis, response, plans, communication, plans, Etc.) the best packages also have version control features and audit logs to help track who makes changes to documents. Related to that, packages that include customizable plan approval workflows will assist in governance and compliance.  Plan management should also include some sort of notification process to remind users when their data and plans are up for review; nearly every package on the market these days offers that. 

• Incident and crisis management capabilities – most packages offer some sort of capabilities around keeping track of recovery order during an incident. The better ones have some sort of real-time collaboration tools built in, and mobile accessibility. Several of them also include integration with… 

• Communication and notification systems – A good package will not only help you develop a communication plan, it will also help you execute it. Several systems out there have some type of integration with mass notification systems, and the more advanced ones have two-way communications built in so employees can check in with status updates directly during an incident. Zone tools are also starting to develop integration with mainstream office collaboration tools such as slack and Microsoft Teams. 

• Testing and exercising tools – Best practices say that you should test your plans annually, and the better packages in this space support you in meeting that goal. Features in this area might include drill and simulation capabilities, and proactive scheduling and tracking of tests. 

• Compliance and reporting tools – While most packages support alignment with some set of best practices, the better ones have built in compliance tracking to see how well you align with those standards. To keep executive management happy, look for tools with automated compliance dashboards; To keep auditors happy, look for tools that also have audit trail functionality and regulatory reporting included. 

• Integration and scalability – the more advanced tools out there these days have API support for integrating with existing enterprise tools (like your ERP system, your HR system, and your CMDB). Most tools offer scalability to support multilocation and international businesses, but if this is something that is important to you, make sure your tool has it. 

• An intuitive user interface – I can’t emphasize enough how important this is to the success of your program.  In most companies, users only go into the BC management system a couple of times a year (or less), to update their data. If the user interface is difficult to navigate, it will make the update experience far more painful for your user community, and support for the platform will evaporate across your enterprise.  

• Flexible licensing options– Unless you’re a large company that’s planning on assigning full time staff to Resiliency Management, there will probably be some cost savings for you if there is some flexibility in licensing. Look for packages that let you provision licenses by the number of currently connected users, rather than having a specific number of named users in the package. Considering how infrequently many users will be using the application, flexible licensing has the potential to save a great deal for most small to medium businesses. 

• Multi-year licensing discounts – If you’re going to go to the effort of purchasing and implementing a BCM software package, it’s highly unlikely that you’re going to only use it for a year and decide to get rid of it. For any business, I would recommend signing up for at least a three-year term so you can get a better annual license price on your contract. Some firms may even give you a discount on the upfront implementation cost if you sign a longer-term contract, making the software even more economical in the long run. 

• Implementation and customization services – most of the better packages out there do allow you to customize your implementation to better suit the needs of your business, but make sure that customization support is available after the sale as well. As an example, one company I worked for changed their corporate typefaces and logos which required us to recreate all our plans and reports from the system. If post sale support was unavailable on our BCM package, we would have had a very difficult time complying with this corporate mandate. 

• Some form of “Software as a Service” (SaaS) application model – While I recognize that there are certain specific industries that require such a high level of confidentiality that they need to host their business continuity management package internally, the overwhelming majority of companies these days would be better served by using a SaaS based package.  Maintaining data integrity in a business continuity management package is difficult enough without also having to maintain application and database servers along with it. 

• The ability to safely “clone” work group datasets – This is a powerful work saving feature.  While individual departments in businesses are rarely identical, from a continuity management point of view the planning and recovery needs of departments are often quite similar.  Better BCM packages will have the ability for you to take a piece of finished work product and use that as a model for other business units, whether that is a plan or a recovery method.   

• The ability to do bulk data updates – This is another powerful work saving feature, and the better the application implements it, the more work it can save you in maintaining your data.  Let’s say, for example, that you have several dozen applications that are moving to the cloud as you downsize your on-premises data footprint.  A bulk data upload could make it so you can upload changes to the recovery plans of those applications wholesale, rather than individually updated several dozen individual recovery plans.  Want to make sure your CMDB or HR data gets sent over to your BCM system once a month? Bulk data uploads can be great for that.   It’s a robust feature that has saved me hundreds of hours over the years. 

• Training – While it’s worth noting that not many companies do this anymore, I can still remember the days when you would buy a BCM package and be left on your own to figure out how to use it. The best companies these days will not only provide you with training for your end users, they will also train your BCM staff to handle basic system administration tasks on their own (without burning billable hours). 

 I realize that seems like a lot to think about, but if you are going to make the investment in a BCM software package, these features would help you get the most for your money. They would also ensure that the time you put into managing the program is multiplied thanks to the capabilities built into the software. 

Need some help navigating features on specific BCM software packages? Not sure if you’re getting everything you can out of your current solution? Sayers is here to help.  Our team has helped dozens of companies build and mature their Resiliency Programs, and we can help your business too.   

Questions? Contact us at Sayers today to discover extensive technology solutions, services, and expertise to cover all areas of your business.