The Minimum Business Continuity Objective: The Cinderella of the BIA
This week I explain what the minimum business continuity objective (MBCO) is and how to use it.
The minimum business continuity objective (MBCO) is, in my opinion, an extremely important component of the business impact analysis (BIA). I have always thought that it is the poor cousin to the MTPD (maximum tolerable period of disruption): not used very often and not really understood by many people.
MBCO is defined in the Business Continuity Institute’s ‘Good Practice Guidelines 2018’ (GPG) as the “minimum level of services and/or products that is acceptable to the organisation, to achieve its business objectives during a disruption”. The MBCO sits alongside the recovery time objective (RTO). The RTO defines how quickly we want an activity to be recovered but equally as important the MBCO defines the level at which that activity should be recovered.
An example is if we have a call centre / center which has 1000 people operating from a single site. During the BIA the RTO of the call centre is set at 24 hours. Setting the MBCO is now key. If the MBCO is set at 1 percent of normal activity we have to recover 10 call centre agents, which in terms of devising a strategy for their recovery is not too difficult. Alternatively, if the MBCO is set at 80 percent, we have to develop a strategy to recover 800 agents within 24 hours, which is much more complex and probably a lot more expensive. So it is often the level at which the MBCO is set which will define the strategy for recovery rather than the RTO.
Within the GPG it states that an MBCO can be more than 100 percent of normal activity. So the MBCO of a manned customer helpline could be set at 130 percent of normal activity as during an incident they are likely to take more calls than on a normal day. In the same way IT technical staff may have more work during an incident.
In setting an MBCO we are defining the level at which the activity must be recovered. I have often asked people to show me their MBCO and what they have shown me is a list of resources required to achieve their stated RTO. This is not technically the same. You should first state the level at which the activity should be recovered and then look at the resources needed to achieve that level of recovery. The reason this is important is that there may be a number of different ways to achieve the stated MBCO which can take different levels of resources. You should always state the level of recovery required by the activity first and then look at the strategy and the required resources to achieve the stated MBCO. It must also be noted that you could have a number of different MBCOs and RTOs over time as the activity is recovered.
When teaching MBCO I say that there are a number of different ways of stating the MBCO and I give the following examples:
- “Activity carried out at 75 percent or 50 percent or 25 percent of normal level”
- “Crew of two people available to do the work” or “one person on standby to carry out the activity”
- “We will aim to turn around a task within four days rather than the normal two days”
- “We will check the generators every three months rather than monthly”
- “We will not carry out the normal checks before granting access to the data centre”.
When looking at developing the MBCO of an activity I firstly look to see if I am going to do the activity at less than the existing level. If this is possible then I look at the following:
- Can I reduce the volume of activity that is carried out?
- Can I take longer to carry out the activity?
- Can I reduce the quality at which the activity is carried out?
By asking activity owners to think about how they will reduce their activities it gets them thinking rather than just making a random decision, for example “I will reduce my activity by 50%”, but then not really understanding what a reduced activity looks like.
If you haven’t looked at MBCOs as part of your BIA then I suggest you define them next time you have a review.