10 pasos para lograr una resiliencia empresarial integral

Peter Schumacher: Bienvenidos y gracias por participar en nuestro seminario web de hoy, «Diez pasos para lograr una resiliencia empresarial integral», con Alistair Parr, vicepresidente sénior de productos y entregas globales de Prevalence. Mi nombre es Peter Schumacher. Seré el anfitrión del seminario web de hoy. Antes de comenzar, hay un par de cuestiones organizativas que me gustaría comentar. En primer lugar, les recuerdo que todas las líneas de los asistentes están silenciadas. Sin embargo, queremos que esta sesión sea interactiva. Por lo tanto, no duden en enviar sus preguntas a través de la consola de Zoom en directo. Al final de la hora, si el tiempo lo permite, organizaremos una sesión de preguntas y respuestas en directo. El seminario web de hoy se está grabando, por lo que al día siguiente recibirán una grabación por correo electrónico. Sé que no se han unido para escuchar mi voz, así que, en este momento, me gustaría ceder la palabra a Alistair. Muchas gracias y, por favor, adelante, Alistair.

Alistair Parr: Sí, muchas gracias, Peter. Hola a todos, buenos días o buenas tardes, estén donde estén. Por desgracia, no tengo la voz tan rica como la de Peter, pero espero que tengan paciencia conmigo durante la próxima hora. Empezaremos con una breve introducción. Sé que Peter ya ha mencionado los elementos clave, pero para reiterar lo que vamos a tratar, voy a presentar a las personas que están aquí conmigo hoy antes de entrar en materia y abordar algunos detalles. Tendremos una sección de preguntas y respuestas, así que si tienen alguna pregunta, no duden en utilizar la sección de preguntas de la ventana de Zoom y la propia interfaz. Estaremos aquí durante una hora. Trataré algunos de los temas clave durante unos 30 o 35 minutos. Y luego tendremos también a un par de ponentes invitados. Hoy nos acompaña Adam Kales. Adam es uno de nuestros consultores gerentes aquí en Prevant y ha dedicado una cantidad notable de tiempo a trabajar en medidas de resiliencia empresarial con terceros directamente con nuestra base de clientes. Adam va a compartir con nosotros hoy, durante unos 10 o 15 minutos, una visión general del contenido que ha elaborado y que ha visto funcionar en la práctica. Disponemos de estos datos y este contenido está disponible en la página web de Prevant. Hablaremos de ello al final. No hay ningún coste asociado a ello, está a su disposición. Al final de la sesión daremos algunas pistas al respecto. También nos acompaña hoy Thomas Humphre. Hola, Thomas, ¿estás ahí?

Thomas Humphre: Hola. Sí.

Alistair Parr: Hello Thomas. Thank you. So Thomas is our content manager and uh Thomas will be talking a bit about some of the regulations and frameworks that have uh either come out in the recent years or expected to emerge over the next couple of years in regards to business resilience. So to highlight today uh we will be generally talking about good practice around third parties specifically around business resilience. Okay. So to begin I appreciate this is probably quite straightforward for a lot of people. But what is business resilience and why is it valuable? Now, as I’m sure you can see from the screen in front of you now, there is multiple areas that touch on business resilience. It’s not limited to a single factor. A lot of what we tend to focus on is the supply chain resilience piece at the bottom right. And that’s something that’s very often overlooked in day-to-day management of suppliers by and large. A lot of the organizational resilience measures that we’ve seen particularly in the uh in the advent of CO 19 were focused internally. They were looking at in response. They’re looking at business continuity and crisis management, human resources. Yet, very, very few organizations we saw factored in third parties in their pandemic planning, those that have pandemic planning at all. So, when we’re looking at business resilience as we talk over the course of today’s session, we really see it as an amalgamation of of different areas and focus and domains uh which enforce that continuity of service. So, it isn’t just limited to those internal use cases, it is very much external as well. And we appreciate that communications and uh interactions between all of these key facets make up an effective business resilience mechanism. So what is business resilience and why is it valuable? Well, apparently in the last few months, as we’ve all seen, unfortunately, the business does need to prepare for factors which are outside of its control. And that’s not as easy as perhaps a while back where we had somebody sitting there changing backup tapes. Business resilience is a far more encompassing uh environment now where we do have to focus on all these different capabilities and considerations. So where does supply chain factor in the entire business resilience piece? So as a concept most organizations are considering third parties as an external function and rightly so in some respects uh to what they do but the reality is when you actually start looking at third party risk it’s that that blurred line between internal and external isn’t really there. That third party is ultimately on managing systems and assets and enabling us to generate revenue in much the same way as anybody else does in the organization. But the key challenge with it is that we don’t necessarily have the visibility on what they’re doing. We don’t have ownership over how they do it and we have that complexity around integrations. Now a lot of organizations we speak to try and manage that using three key areas. So there’s the communications aspect. So how often do we communicate and how SLAs’s, how do we track success with our third parties and then of course incident management. How do we extrapolate the necessary data that we need from them in the event of an issue? But by and large, most organizations we speak to are still psychologically entwined to that concept of a third party is external and doesn’t necessarily incorporate it into their wider governance uh and business resilience planning. So when we’re looking at mature environments and mature customers, what we typically tend to see now is that every single thing that they apply internally their organization. So the governance aspects of it, the audit and compliance remmits that they mandate, uh the risk management and tracking, the incident management aspects, everything that I showed you a couple of slides ago that needs to be woven into the third party estate as much as it is internal. So this concept of internal external is removed and we are ultimately looking at uh critical assets or critical functions of the organization and that could incorporate contractors, service providers, internal users, assets etc. that that’s The line is certainly blurred now. Okay. So as a tip, what standard processes are typically being used broadly in business resilience? Now what we tend to see is a record, respond, recover concept. So a lot of what we’re focusing on here is is ultimately looking to understand uh how do we manage incidents and events once we’re dealing with all of our critical assets in the business. And that starts of course with with ownership the organizations we deal with who tend to be uh relatively unprepared in the situation they need to really start with that ownership. So who do they need to allocate responsibilities for in the business and this is an endemic issue that we tend to see where the organizations don’t have somebody assigned to manage critical assets and provide visibility to the people who need to know it whether that’s legal procurement infosc uh risk compliance etc. Nobody really tends to understand what is the context around an asset or something. critical for the business, how is it functioning? So, starting with ownership and finding who’ll be able to give us clear answers on on situations is key. And when we start looking at incident management on the whole, we appreciate that we need to do things such as start recording obviously key processes, understand what they’re doing, analyze how they function, build up alternatives wherever we can understand what is truly revenue generating and therefore mandatory, what’s based on regulation is mandatory as well. So, do we need to process data in a particular way? We can’t say transfer all the personal processing to a different third party uh without suitable due diligence or analysis. There’s a lot of complexity involved in identifying and recording what it is that we actually intend to do with that data and that entire data set. Now, in the face of CO 19, a lot of the organizations we dealt with are really starting this whole record process from scratch. They will have business resilience in the form of data outages and shortages, but aren’t necessarily looking at the critical assets and functions of of what they do. Uh for example, is when start looking at sectors uh such as retail where they don’t entirely have the distribution networks available to do say on premise deliveries in the same sense they rely on bricks and mortar stores. Organizations we’re speaking to are a having issues with supply chains understanding how they can source uh the goods that they need and then b in turn focusing on distribution or redistribution as it may be. Now in retail the organizations we’ve spoken to who’ve had the most success have of course considered that from the outset. So they’ve got distribution partners uh for downstream. They’ve been able to scale say with with food deliveries for the food retailers for example, they have those mechanisms in place and that is very much reliant on third parties supporting them. It wasn’t a case of bringing in teams and teams of contractors and short-term while that may help in some brick and mortar stores. It was about understanding how can they work around the issue that they have been presented with. So if a supplier is unable to provide or they’re unable to open say certain sites and facilities, can they think outside the box and other alternative ways of of conducting business in order to drive that revenue. So it’s not just a case here of recording the exact same capability that we would be uh trying to to address. So it’s not a direct mirror. And then finally when we start looking at respond and recover really what we are touching on here is some of the resilience planning for instant response. So once an event has happened how do we communicate effectively and in the face of CO 19 most of the organizations we speak to are really starting to touch now on some of the post invent improvement aspects. Some normalities of course returning to some states in the US and we appreciate now that with uh with that normality comes the ability to start looking at how they can address it for say in the face of COVID a resurgence if if they have to return back to a lockdown situation. How can that be managed effectively without having the same outages that they’ve experienced in the first place? So that ties on recovering, reducing downtime and of course improving uh you know the customer confidence. and being demonstrated as agile and resilient. So, it’s generally a long path, but the key takeaway I’d really share here is that record piece. We need to make sure that we have clear, concise ownership and we’re aware of what it is we’re actually trying to maintain and we focus on critical assets in order to do that. So, what do I actually need in order to make this function and be effective? We need lots of collaboration, clearly work, and certainly luck. I think it’s fair to say most organiz ations we’ve dealt with in the face of COVID 19 for example have been either extremely lucky uh or have in turn had to win and deal with some of the repercussions from a lack of uh resilient planning around business resilience particularly around their third party supply chains and downstream deliverables to customers. So as a brief bit of insight uh there is a resilience gap study that was conducted so 4,000 stakeholders who were responsible and ultimately owned uh the resilience processes in organizations and these ranged from small mom and pop style shops up to large multinationals with hundreds of thousands of employees. But universally, it seems or at least 34% of them blamed complexity as the biggest barrier. So if we look back at our previous process slide here, it’s about the complexity of the working environment. How do we understand what it is we’re actually doing? And I think that shared beyond business resilience, it is again a factor in risk management. compliance audit and so on. 20% of them blamed siloed business units. So a lack of communication internally within the organizations and 24% again blame poor visibility here. So fundamentally complexity and a lack of internal communication is key. So what we generally are recommending here to people is to look inside the organization before you start looking outside at third party resilience. So if we’re looking internally at the business, what types of context ultimately are we looking to uh to consolidate. Now much like data discovery in a whole, it’s the who, the what, the where, the why, the how. So who or what parts of the business have critical information? What is that critical information or services or processes and how they function? Where is it being stored and how is it being stored? And then why? So does it genuinely need to be there? To touch on the point again earlier on, one of the biggest challenges we see when we look at business resilience planning is people try to mirror what they already have and that’s not necessarily the case. Uh we’ve seen situations of co 19 with customers surprisingly where they’ve enforced some robust resilience plans and they’ve realized that they’ve been able to uh function in a in a a less standardized state and they’ve been able to actually maintain some of their resilience plans moving forward. So not actually reverted back. They’ve saved money. There’s some operational expenses is because they’ve been forced into realizing that there are alternatives to how they current function. A good example of that would be the remote working capabilities where we suddenly see reams and reams of uh previously office based workers now suitably working remotely and teams realizing the results of savings by not filling up office space the whole time. So the who the what the where the why and the how. So look at it almost as a data mapping exercise where we want to understand what is critical to the business what is revenue generating and much like when we start looking at uh data mapping again we can start building up visual maps to understand what’s actually happening in the business and letting us prioritize what we need to. The reality is we won’t need to ring fence business resilience around all third parties or around the entire organization. We simply need to be able to classify uh the type of process, identify where it is, how often that we actually tend to conduct that activity, uh whether it’s subject to any governance or oversight. It might be a regulated process for some reason. Does it touch on regulated data? Do they need physical access in order to achieve that and so on. All of that can ultimately be fed into a simple calculator to help you prioritize identify what it is that is most critical and what is ultimately has the uh the highest amount of risk in order to try and maintain it in the event of a uh resilience situation. And to make that effective, of course, organizations change over time. We recommend doing that that internal mapping for business resilience. at least quarterly if you can uh certainly annually for the organizations where quarterly is too aggressive but uh but we would be looking for a regular uh and consistent review on where that data resides. It does need to touch on technology capabilities of course as well. So we need to understand what technologies are necessary in order to make that function happen and then of course you can use things like eiscocovery technologies internally within the business to actually identify if that is truly the case. Quite often one of the issues that we pick up on is that the business will say I am a truly a crisp process. I’m I’m a real necessary function of this organization as they’re naturally going to say but the reality is when you actually start doing things like eiscocovery on what they’re actually doing quite often we find out that reality doesn’t necessarily meet what the business is telling us. So for those who have the capabilities and resources in hand you can certainly work with with teams such as the data loss prevention teams to start actually tracking say key critical information whether it’s business sensitive data uh whether it’s customer information or so on you can usually use to pinpoint some of your resilience uh focus and of course then raising discrepancies to owners and purging uh areas from your resilience planning where necessary. So in the face of naturally co 19 I’m sure we’re all sick and tired of it and in recent months uh this image probably looks like some business centers scattered across the globe but would it have address exceptional circumstances based on COVID 19 and what we’ve seen and appreciate it’s pandemic related but uh the answer is simply well no not necessarily most organizations we’ve spoken to feel that there are things they could have done better uh in the face of say the pandemic but certainly having that additional visibility would have given them the comfort and the insight and the knowledge to be able to react better and that’s ultimately all that we’re trying to do here with business resilience is can we at least try and maintain critical business functions in the best way possible and if we learn a few things along the way we’re all the better for it. So what reporting is important now in order to be prepared for business resilience looking at third parties and internally as coverage visibility ownership and improvement are the key areas that we’ve picked up on. We’ve seen success in using maturity assessments against this. So you can use the Carnegie capability maturity model to self assess yourself between one to five uh across each of these domains and then give you an overall rolled up score. But from a coverage standoint, point is again how frequently are you doing assessments in the business? Do you have comprehensive coverage of the organization? Uh do you have onboarding workflows for the business in order to assess its uh uh the awareness of anything that’s been added or that’s new? And of course, are you including third parties in that piece from a visibility standpoint? Assessment types. Do we look at critical information? Are we focused on outsourcing activities as well? Uh is it limited to just uh data privacy or risk based assessments?. And do we cover resilience and anger, the reporting mechanisms and strength. How do we actually report this back up to the organization and uh of course assessment cadence there again and evidence management. So how do we collect and store evidence and build those plans that enable us to work effectively? Looking at improvement factors. So what audit mechanisms, how do we feed that back to any audit teams that we have? Remediation definition. How do we define what we’re actually going to achieve and what’s viable? And we’ve seen organizations use things such as fair models or their internal own internal calculations to estimate cost versus uh return for business resilience. That certainly is viable. Those program road maps and the steering groups. We do recommend for resilience much like you manage uh risk and you may have risk committees or steering groups or working groups. We’d recommend incorporating business resilience particularly for third parties in some of those sessions. Uh the outages is of course a risk and should get fed into the standard risk models. Now only ship. Something hopefully we’re articulating here clearly is the fact that to manage third party business resilience and internal there is a requirement to own uh to have internal owners within the business who have responsibilities. We won’t be ever successful in managing business resilience. If it’s a small organization, we might be okay because we can generally touch on those processes. But if it’s a large organization or it’s ever evolving, the complexities are there where we need subject matter knowledge experts in the business to feed into our resilience planning. And that feeds into our delegation of duties. The more that we can get uh the various asset or process owners to manage, then the more prepared we’re going to be. We get asked a lot of questions about incident management. Now, incident management is of course pretty key and we saw many many incident management plans come about in the face of CO 19. But any instant management plan really needs to consider uh reporting. So the communications plan needs to understand who we going to talk to and how identification mechanisms do we have simple defined types of incident that we can react accordingly to so we’re invoking the right people the event planning so tied to those cataloged events we should be building those playbooks that are reviewed regularly. Uh we see customers doing things like tabletop sessions to assess their suitability to react to the situations I appreciate some parts of the business see that as a bit of fun but uh the reality is it does actually psychologically start getting people used to this concept of dealing with uh events following playbooks and then of course uh reactions. So coms need to focus on what we doing to fix an issue and overcommunicate. So for those of you who involved in any cutting edge development or technology or anything like that appreciate that the most important thing when you’re offering a service is communicating and overcommunicating is key in an incident. So tied to that timely identification we want to be able to make sure that we are able to identify an event quickly and readily. Uh and part of that is making sure that our third parties have mechanisms to report back to us and say we’ve had an incident where it’s a data breach, a service outage, change of ownership, whatever it may be. There needs to be clear mechanisms internally and externally for highlighting something that’s considered an event. When we’re looking at notifications, appreciate there might be with situations such as GDPR, there might be requirements to notify customers within uh 72 hours of any breaches or issues. So be mindful of time frames whether you have regulatory mandatory time frames or self-imposed time frames. Make sure that anything you build for your resilience plans are embedded into that press release. Something that we’ve we’ve been inundated with again over the last few months is how do we control the talk tracks of piece uh these pieces and something we’ve been exposed to a fair amount here is how do we communicate things well to large volumes of people and quite often you can draw in say obviously the PR teams if you have them. Otherwise, the marketing teams, funnily enough, seem to be very uh very aware on how to effectively communicate a situation. Uh much like you manage third party risk assessments or dealing with third parties where you can speak to your marketing guys because they quite often uh can can support or provide guidance on how to manage these things. Associates. So, inform your providers and partners. Something that gets overlooked very often is uh that lateral communications uh as well as the internal communications. So everybody focuses on in an event speaking to customers and there’s certainly a requirement there to have clear concise guidance for communicating to partners, associates and of course internally. Uh the amount of damage you can see from an incident happening or an outage happening and then not communicating that through the business effectively means you lose lose that internal impetus in order to drive things forward. So uh we we would definitely recommend people focus on that internal communications as well. So moving on then to continuous management. So we’ve spoken about quarterly or annual reviews pulling data from the business as it’s ever evolving and ever changing. Uh something we deem very important here is the cadence on how we manage business resilience. So how do we report it? How do we escalate it? How do we consistently enhance and assess it? So a lot of organizations are dealing with the implementation phase in the last couple of months uh and are now starting to move towards the review and enhancement phases. So for us successful positions Business resilience starts with success criteria. What are we actually trying to achieve? So, not defining too broad a scope is key. It’s got to be very very finite and focused on what we have to uh discovering that within the business, documenting what we need to signing off what that new resilience plan looks like and then getting the stakeholders to self-manage each of their respective elements. Uh and then of course ongoing testing, updates, reporting, uh content alignment as the business evolves and then moving on to general broader business efficiency. So when you look at the continuous management of business resilience on a whole, it’s it’s very much about defining a manageable and accurate scope and then providing the capabilities for the various feeds, whether it’s the internal business users or third parties to update that over time. If it’s a static document sitting on a SharePoint or Teams folder somewhere, then that means we’re halfway already to to losing the battle there. So finally, how resilient should I be of course it’s all about being proportionate. So there are resources of course out there ISO22301 31,000 uh Thomas will be talking a bit about those in in a few minutes but fundamentally it’s about being proportionate. Uh we could certainly use risk management methodologies in order to improve our business resilience capabilities. So speaking to the business understanding what’s happening uh we could focus on being business enabling much like information security it’s very easy for business resilience to start being seen as a blocker as opposed to an enabler when really all it is is making sure that people can get the job done. A costbenefit analysis is naturally very very important to all of this. We need to make sure that any measures we take in order to uh say maintain a hot site that’s available 24/7 may be disproportionate to uh the actual functions that it’s supporting. So we certainly recommend reviewing whatever you’ve built for business resilience to make sure that it’s actually financially viable or justifiable. uh and then of course make sure that from a governance standpoint that you’re not overlooking anything key. We are hearing various conversations of people who have had to make sudden changes in the face of say co 19 uh and are dealing with the potential flack on that downstream. So as regulators etc start querying how people have been reacting to it. Uh the ones we’re talking to generally have a bit of understanding to the situation but nonetheless we are seeing u situations happen where regulators are looking at organizations patients uh to see how their resilience has been in the pandemic situation and for some it has not been looking good and to reiterate the same point there be proportionate everything that I’ve been speaking about conceptually here and we’ll move on to some of the the tactical details in a moment but everything that we’ve been talking about here is about proportionality if we’re dealing with third parties if we’re dealing internally within the business if we’re dealing with business stakeholders etc there’s so many moving parts to this that it’s only effective if we bring fence the very very key and critical aspects of what we need to achieve and work there in order to make it continuous. So finally for me then so business resilience recovery is also important and as we’ve been seeing over the last couple of months that return to normality isn’t as simple as it may have seemed. So we’re seeing as I said certain functions have proven to potentially be more effective in uh in the resilience uh situation. So people working remotely for examp example, there seems to be some continuation of that happening as lockdown is is gradually being used across the globe. Uh but in certain aspects as well, we’re seeing supply chains fall apart as well where entire uh organizations that have been providing core services to some of our customers uh that this just simply disappeared. So there’s been strong efforts to try and find alternatives, backup plans, etc.. Uh and the third party procurement have been back in the fold again to look at alternative providers, backup providers, etc.. So providing things like uh backup lists, etc. for organizations is certainly not a not a bad thing. But by and large, we’re generally seeing that as people revert back from say COVID 19, there have been lessons learned, things that they are taking on board and continuing and of course black holes or situations that they need to fix. So now moving on to some insight into some recommended frameworks. Uh we’re going to talk for about uh five to 10 minutes here. We’ve got Thomas speaking about uh some of the standards and frameworks that he’s been dealing with that could serve as a good foundation for any of your business resilience means. Thomas, are you with us?

Thomas Humphre: Sí. Hola. Gracias, Alistair. ¿Me oyes?

Alistair Parr: Puedo hacerlo. Sí. Gracias.

Thomas Humphre: Excelente. Entonces, sí, me refiero a pensar en la resiliencia empresarial, la continuidad del negocio. Obviamente, uno de los aspectos clave que siempre hay que tener en cuenta es si existen buenas prácticas. ¿Existen marcos de referencia? ¿Existen metodologías y modelos que se puedan utilizar y que no solo sean reconocidos desde la perspectiva del cliente, del socio o del regulador, sino que también ayuden a formalizar y dar forma a la forma en que gestionamos la continuidad del negocio? Sin duda, una de las más utilizadas y quizás más conocidas de estas normas y mejores prácticas es la de la ISO, la Organización Internacional de Normalización. Se trata de la norma 22301, que sustituyó a la norma británica 259 hace muchos años. Y diría que es la norma más utilizada para desarrollar, mantener y mejorar un sistema de gestión de la continuidad del negocio. Ahora bien, al igual que muchas normas ISO, la ISO crea un sistema que permite cierto nivel de reconocimiento formal a través de la certificación. También crea una familia más amplia de normas en torno a ella. A menudo se utiliza la norma inicial, en este caso la 22301, como motor, pero luego se ofrece una orientación más amplia, ya sea para un sector y una industria específicos o para un uso operativo más amplio. Y, de nuevo, esto es algo que yo también he desarrollado. Así que hay normas orientativas para gestionar la continuidad de la cadena de suministro, por ejemplo, la norma 22318, que también es interesante y se encuentra en fase de desarrollo. Lo que también es interesante es que, fuera de las normas específicas de continuidad a nivel internacional, que es donde siempre se sitúa la ISO, hay otras normas, especialmente a nivel local, que pueden tratar cuestiones o intereses locales o tomar algunas de las mejores prácticas de la ISO y crear un marco más nacional. Um, así que, sin duda, una de las áreas que Alistair mencionó en la diapositiva anterior fue la norma BS65000 sobre resiliencia organizativa. Um, Singapur lleva mucho tiempo desarrollando una norma, um, 50 7, centrada exclusivamente en la recuperación ante desastres para el sector de las TIC y las TIC. Y en Estados Unidos, la norma ASUS BCGDL entra en detalle sobre la preparación para emergencias, la gestión de crisis y la recuperación ante desastres, y se está desarrollando en colaboración con ANIE, el Instituto Nacional Estadounidense de Normalización. Por lo tanto, es bastante común ver que los organismos de normalización localizados, e incluso los organismos gubernamentales, den forma a sus propios marcos y mejores prácticas. Y además de esto, si pensamos un poco más allá de la propia ISO, a menudo encontramos otros marcos y normas que se utilizan habitualmente, como la norma 27 000 sobre sistemas de gestión de la seguridad de la información, que también aborda la continuidad, pero de una manera específica. Así, la norma 27 0001 analiza cómo las empresas gestionan los requisitos de seguridad de la información cuando planifican la continuidad y la resiliencia del negocio. Es un tema bastante interesante, sobre todo últimamente, si pensamos en lo que ocurrió al comienzo de la pandemia, cuando muchos países de todo el mundo impusieron confinamientos que obligaron a las empresas a cerrar muy rápidamente. La pregunta es si la seguridad de la información fue una consideración fundamental y si se abordó, dado el poco tiempo que tuvieron las empresas para habilitar el teletrabajo para sus empleados, especialmente para aquellos que quizá no estaban acostumbrados a ese tipo de escenario laboral. Así pues, todas estas normas tratan de formalizar un enfoque de gobernanza y de establecer un marco que permita identificar planes de continuidad, procesos de recuperación y una metodología para evaluar y ejercer continuamente esos planes, con el fin de garantizar que siguen siendo adecuados para su finalidad, basándose en los impactos de los desastres que se han identificado y que son apropiados para la empresa, y mejorando y perfeccionando continuamente la forma en que se configura la continuidad dentro de la empresa, al tiempo que se examinan aspectos críticos más amplios, como la la parte de la comunicación que Alice también ha mencionado anteriormente. ¿Se está comunicando de forma eficaz con los clientes y con terceros? Si tiene terceros críticos, en particular algunos que se consideran proveedores únicos, ¿cómo se tienen en cuenta en su planificación y en su proceso de planificación? ¿Y en qué medida colabora con ellos en caso de que se produzca el peor de los escenarios y tenga que activar su plan y marco de continuidad? Existen muchas normas y marcos. Sin duda, la norma 22301 de la ISO, que se actualizó recientemente en 2019, es quizás la más adoptada y conocida. Pero es interesante ver que hay muchas normas localizadas, como la norma SS507 de Singapur o la norma ASUSBC GDL del Instituto Nacional Estadounidense de Normalización. Alistister,

Alistair Parr: Muchas gracias. Muy bien, genial. Muy perspicaz. Ahora vamos a pasar a algunos ejemplos, algunos ejemplos rápidos para empezar. Hoy nos acompaña Adam. Adam, ¿estás ahí con nosotros?

Adam Kales: Sí. Hola, Alistister.

Alistair Parr: Hola. Voy a pasarle la pantalla y espero que pueda darnos una idea de algunos de los contenidos que normalmente nos gustaría ver para la resiliencia empresarial.

Adam Kales: Perfect. Thank you. So, I’ll share my screen momentarily. Okay, hopefully you should be able to see my screen and business resiliency business resiliency plan. Okay, so what we wanted to do when um all this started with uh COVID 19, we identified that um there may be a number of organizations out there who hadn’t previously concentrated on business resiliency. That wasn’t one of their main focuses. And because of that, they may be considered slightly immature in terms of the documentation, the process and the procedures that they have around business resilience. So we wanted to be able to provide a a suite of templates which are adaptable enough to be used by a range of organizations both in terms of size and type of organization in terms of the services that they deliver and whether they are at the beginning of their business resiliency journey or if they have already got a mature resilience program in place. These documents are designed either to be used as their initial core documentation or certainly elements of it extracted out of it to be um incorporated into their current uh business resiliency program. Uh and the idea of it that this is provided to you as a free resource uh available through our portal through our website of which then you can cherrypick those elements which best suit you and also provide that onward as well to your third parties. If they themselves um need some assistance in improving their business resiliency processes. Uh so what you have in front of you is one of the core documentations that you’d expect to see as part of your business resilience program. So we have the business resiliency plan and this provides those core elements. So certainly I wouldn’t consider this to be the be all and end all but certainly the initial starting point of this um of this template of where you can take this and then start running and start the core ele ments of your business program. Okay. So, it includes things like the business continuity strategy that overarching statements of how you’re going to approach business continuity. Uh the scope responsibilities um plan invocation. So, when is the business resiliency plan and those incident response plans going to be put in place? Who the primary stakeholders are and then falling out of that a number of annexes which will include the business impact assessment, risk assessment, a racy matrix s a critical third party register, critical third party gap analysis and maintenance requirements. So this is certainly one of those core um documents that you would want to see in place. So moving on, we have a third party business continuity gap analysis. So the ability to understand and identify who your critical vendors are. So a critical vendor being somebody who without those in place you would either one not being not be be able to continue uh functioning uh providing the services that you provide or two it would have such a severe impact that it would severely diminish your ability to provide your service and your products. Okay. Um so with that as well as we scroll down um it has some overarching information on how you would approach uh conducting that gap analysis and then u utilizing perhaps some form of automation and and to be able to deliver this at an enterprise level. Okay. Then we have the business impact analysis procedure. Okay. So this lays out in a very short and high level way of the scope responsibilities and the procedure of what you need to follow to conduct a business impact analysis. Okay, including recovery point and time objectives. And as you can see, we have made it adaptable enough that if you wanted to, you can simp simply insert the relevant details to make it specific to yourselves and then you can start using this template uh immediately. What also we have as we linked in with those annexes that we covered on the first uh document that uh business uh continuity plan we have a number of annexes here. So we have the business impact analysis. So a tabular format of where you can identify a critical system or service the process or activity that system um prov provides an impact score. Now, this may be quite subjective or objective depending on the amount of data information that you currently have available to it. And certainly, if you’re able to draw on existing data resources that you may have conducted through any form of information security or data mapping uh process activities, then you can certainly utilize that in determining what the impact and the likelihood of the system failing and if it does fail, the impact that it may have upon your organization. establish RTO and RPO timelines and also uh the minimum um time to um return that service back to full functionality. Okay. Uh the minimum resources needed. So essentially um for these systems and services to continue functioning, what is the minimum requirements you need as an absolute minimum to continue with those systems? Okay. And the priority of what it means to you as an organization. We also incorporated a risk matrix as um uh as some form of guidance as well including a level of terminology. Moving on, we have a template for risk assessments. Okay, being able to conduct a a risk assessment against a particular resource, what that risk the risk description and so on throughout. So in the same manner as you would have a risk register for information security risk for instance, you can have one specifically tailored to business discontinuity requirements. A racing matrix is has been provided and again these are here for uh suggestives as the one of some of the more likely uh areas that you would want to consider but certainly introducing your own or um uh adapting it specifically to how your organization works. We have the critical third party register. So once you have identified those critical third parties being able to record that they are a critical third party and those key contact details of who the service owner is internally, who the external supplier relationship manager is, the supplier contact and any additional doc comments associated with it. So once you’ve conducted a gap analysis, so for instance, if you have a critical third party, if they were to go down, what would be the fallback procedure for that to be? And if you identified that there is a gap, then you’d be able to annotate that in a register such as this. Moving on to maintenance requirements. So this brings into mind so any resources that you would need to use as part of business continuity business resilience. So for instance it was mentioned earlier on about remote working. So certainly before COVID 19 um there may be a number of people who were used to just going into the office and working from the home environment was a rarity more than anything. But suddenly uh you needed all these additional resources uh for instance laptops for instance. and you have these resource of laptops which under normal circumstances wouldn’t be utilized. But what you need to do so for the time that you do need to literally pick them up and run with them as such need to make sure they are in an acceptable condition to be able to you to be able to use straight away. So what that does that what what does that mean? That means that we have antivirus in there, firewalls in there, that software has been updated appropriately simply that they’re charged that they have been checked over recently and all these maintenance requirements whether it’s a laptop some form of generator backup locations or premises whichever the case may be can be stipulated down here and importantly an owner assigned to it so they are aware that they have ownership over that uh and over those particular maintenance requirements. So moving swiftly on a third party discovery template so we mentioned about identifying your critical third parties uh and what are some of the elements wrap around that. So for instance uh we have a number of risk factors associated with it which will help you determine uh if a supplier is considered green, amber or red and a number of highlevel questions of which you may want to consider asking to determine what may uh what may be considered a critical third party and it could be based on type of service uh being delivered. Uh the types of data that they interact with for instance if the supplier is um the sole provider of a service and also um how they transfer data and information across uh including any specifics to you as an organization and any other attributes that you want to include in that which will then start to build up a picture of the criticality of your third parties. Okay. Now what we have designed as well is a number of communications templates. So communication throughout all this process even before this has started communication is key. Communication in terms of understanding what the business resilient plan is what it means not just to uh the organization but to individuals who are key stakeholders in this who have key responsibilities in this as well. But also moving into when we have to enact those business resiliency and those um incident uh response plans for instance in terms of getting the information across directed at the right people at the right level and at the right time and also we have designed a number of communication templates these being just a couple of those examples. both internal. So for instance um to team members to um team leaders uh to those in senior uh management positions for instance we have designed uh a template to fit each requirement. So for instance we have here uh key personnel internal phase one low infection risk. So right at the very beginning um this is something that you may want to consider sending out to the relevant people internally within the organization. Moving on we have a third party email template. So for instance, you want to communicate a clear, concise message directed to the right people in the right manner and in the right format. So whether that’s by email, whether it’s via social media, whether it’s um internal communication, whichever the case may be, you have a template ready to rock and roll so that you can utilize it uh and run with it when you need to. And you’re not scrabbling around in the dark trying to pull something together very quickly. It’s already part of the business resiliency process. What we also have is activation procedures and criteria guidelines. So again certain um prerequisites which um you has predetermined that if these situations occur then you have a clearcut procedure to follow in terms of what is acted what is activated who is activated who is informed and the process to follow that. Okay and those have been laid out in a in a very in a a high level but detailed format. Then we have authorized communication method. So it may be appropriate that actually certain communications may only be appropriate for certain levels of communication or certain types of people that you’re interacting with. And again we have provided a template for you to be able to lay that down and record that as you move forward. So also have escalation paths and we’ve provided some examples here of those various escalation paths for a number of different use cases. Okay. So we have first of all those staff contact numbers of those relevant key stakeholders who need to be informed for office locations for instance critical suppliers. Okay, the information security team and also um uh things like uh security and technology if it’s specifically around that who needs to be informed starting at the CISO for instance and ending with information security analysts and actually all this can be adapted to suit your particular needs. Okay. So again, uh we’ve alluded to a couple of times the fact that one of the big changes that we’ve experienced is the amount of homework in which has had to happen just simply because we have not been able to go into the office locations and that is still continuing very much now and being able to work coherently in the home environment and productively but also ensuring that you’re maintaining good standards. So good data hygiene for instance, making sure that you have the controls, procedures in line um uh in mind um working from the home environment as you would do working in the office environment as well. And what we’ve done is we have designed a um remote working training package for you to either deliver this through some form of online training session or send direct to whichever relevant um users, home workers who are going to benefit from this, which presumably would be the majority of them. And covering topics such as um data hygiene. Um, going down to things like spam and malicious filing uh at the end there, but also covering secure working spaces, making sure that you have those good measures in place. Set up a designated workspace, day-to-day homework, okay, clear desk, clear screen policy, okay, so you can maintain those good working methods at home as you would do in the office environment. And then finally, to accompany that, a remote working policy. So wrapping up that training that you’re um that you can either send or deliver with an actual remote working policy. So you have something that you can actually refer back to and you have guidelines in place for remote working. Okay. So I believe that uh takes me to the end of not not all of that documentation but certainly uh a good representation of what is available to you and as I say as a free resource for you be able to access through our website. So, thank you very much for your attention.

Alistair Parr: Muchas gracias, Adam. Te lo agradezco. Muy bien. Durante los últimos cinco o diez minutos, vamos a pasar a una sesión abierta de preguntas y respuestas. Eso es para mí, Adam, desde el punto de vista del contenido, lo que acabamos de ver y, por supuesto, también para Thomas, desde el punto de vista de los estándares y los marcos. Así que, una vez más, si quieren dejar cualquier pregunta que tengan en la sección de preguntas y respuestas de la sesión de Zoom, estaremos encantados de responderlas. Tenemos aquí una pregunta para ti, Thomas, sobre la alineación de marcos para la resiliencia empresarial. ¿Dirías que es obligatorio alinearse con un marco como lo hacemos con otros requisitos normativos, o es más bien algo recomendable?

Thomas Humphre: Sí, buena pregunta. En realidad, puede ser un poco de ambas cosas. A menudo, las empresas se ven obligadas a obtener una certificación formal como la ISO 22301, ya sea por motivos contractuales o por exigencias de los organismos reguladores. Como hemos visto con otras normas, como la 2701, algunas industrias y organismos industriales la han convertido en un factor más bien obligatorio para ganar licitaciones y contratos, por ejemplo. Es muy posible que eso ocurra desde el punto de vista de la continuidad. Fuera de eso, no es obligatorio, pero yo siempre diría que es muy recomendable, especialmente en el caso de la norma 22301, principalmente porque no solo es la mejor práctica más reconocida, sino que ayuda a cualquier empresa, ya sea una MNC o una organización global con múltiples geometrías, a establecer un marco de gobernanza formal que ayude a dar forma a una práctica de continuidad en el negocio y proporcione un marco para evaluar y mejorar continuamente la forma de abordar la continuidad y los desastres. una multinacional o una organización global más amplia, a establecer un marco de gobernanza formal que le ayude a configurar una práctica de continuidad en el negocio y le proporcione un marco para evaluar y mejorar continuamente la forma en que aborda la continuidad y la recuperación ante desastres.

Alistair Parr: Muchas gracias, Tom. Tengo una pregunta para ti, Adam, en relación con el contenido. De hecho, hemos recibido múltiples preguntas sobre su sector específico. Algunos clientes dicen que se dedican al comercio minorista, otros trabajan en B2B en lugar de B2C. Preguntan cuánto tienen que adaptar ese contenido a su caso de uso. Adam, ¿tienes alguna experiencia, opinión o conclusión tras implementar esto en diferentes sectores? ¿Es necesario realizar muchos cambios entre los sectores B2B y B2C?

Adam Kales: Sí, muy buena pregunta. Gracias. Básicamente, el documento te ofrece un punto de partida. Lo ideal es que, si no tienes nada preparado, esta documentación te proporcione un excelente punto de partida para saber por dónde empezar. Como dije al principio, esto no lo es todo. Bien, esto es lo mínimo que se puede esperar y, en teoría, sí, hay que adaptarlo al sector específico en el que se trabaja para asegurarse de que se ajusta a la organización concreta. Sin eso, sí, seguirá obteniendo valor de ella, pero obtendrá ese valor adicional que le aportará imprimir su propia forma particular de trabajar en su propia organización y, obviamente, eso también conllevará un pequeño análisis de costes de tiempo. Si tienes tiempo para invertir en esa investigación y en ese análisis para identificar dónde necesitas añadir tu propia impronta y tu propia organización, eso solo te ayudará a la hora de utilizarlo realmente en esos planes de resiliencia empresarial, adaptándolo específicamente para ti. Así que sí, diría que es necesario adaptar la documentación para sacarle el máximo partido, pero como punto de partida, sin duda es una buena forma de hacerlo.

Alistair Parr: Fantástico. Gracias, Adam. Tengo aquí una pregunta: ¿recomendaríamos disponer de planes de contingencia detallados y documentados para sus proveedores críticos, además del proceso y los controles para la incorporación y la supervisión continua a lo largo del ciclo de vida? Yo responderé a esa pregunta. Sí, sin duda recomendamos no necesariamente anteponerlos, pero sí integrarlos en sus procesos de incorporación y supervisión. Un buen ejemplo de éxito es cuando aprovechamos el PCF, el marco de cumplimiento normativo predominante, o cualquier alternativa que pueda tener, que es donde realmente incorporamos la información, la resiliencia, los requisitos de cumplimiento normativo y, obviamente, los requisitos de privacidad del tratamiento de datos, todo ello en ese proceso de incorporación inicial. De este modo, obtenemos toda la información pertinente que queremos por adelantado y, mientras realizamos nuestras revisiones contractuales habituales con el cliente, es decir, con el proveedor, nos aseguramos de revisar cada uno de esos aspectos respectivamente. Así, nos aseguramos de que usted cuente con un plan de contingencia con los proveedores críticos como parte de ese proceso de incorporación. Debería ser un riesgo en su proceso de gestión de riesgos si no dispone de vías y procesos de escalamiento claros. Algo que vemos con bastante frecuencia es que los contratos heredados suelen prohibir lo que realmente se puede hacer con el proveedor, ya que es posible que no se tenga necesariamente el derecho a auditar para hacer cumplir los estrictos acuerdos de nivel de servicio, etc. Por lo tanto, estamos viendo que los clientes actualizan sus plantillas estándar y entiendo que no se puede presionar a los gigantes del sector, que simplemente se encogerán de hombros y le darán sus plantillas, pero sin duda hay que intentar incluir en los contratos o en las revisiones de los contratos cláusulas que incluyan aspectos como vías de comunicación, plazos de escalamiento para la comunicación, etc., directamente con el proveedor para la contingencia y la continuidad del negocio. Cuando nos fijamos en las adquisiciones, vemos una tendencia de las organizaciones a empezar a tener un proveedor principal y un proveedor secundario de respaldo con el que pueden contratar a corto plazo. Es evidente que no tendrás condiciones directamente con ellos, pero al menos podrías tener alguna base para poder elegir algo con bastante rapidez. Antes de pasar a la siguiente pregunta, solo quiero decir que Peter va a realizar una encuesta rápida en breve para cerrar el tema antes de pasar a la última pregunta. Así que, por favor, no dudéis en responderla mientras seguimos con esto. Vamos a responder a una pregunta más antes de dar por concluida la sesión. Esta es para ti, Adam. Entonces, ¿consideras que el contenido que hemos visto hoy es completamente transferible tanto a nivel interno como externo? ¿Crees que la gente esperaría que gestionáramos a los proveedores de forma diferente a como gestionamos el negocio interno?

Adam Kales: Sí, diría que hay una diferencia entre la gestión interna de las partes interesadas internas, las unidades de negocio internas, y la forma en que se gestiona a los terceros. En cuanto a las diferencias, eso depende en cierta medida de cómo se gestione la propia organización, pero lo cierto es que se tiene un contrato con los terceros y estos prestan un servicio. Por lo tanto, tienes una posición mucho más sólida a la hora de tratar con ellos en lo que respecta a las expectativas de lo que ellos mismos deben tener en cuanto a indiferencia hacia tus unidades de negocio internas. En lo que respecta a tus unidades de negocio internas, todo se reduce a elementos como los recursos internos disponibles en términos de lo que ellos mismos necesitan para ponerse en marcha. Por lo tanto, yo diría que hay una diferencia entre cómo se debe tratar a las partes interesadas internas y cómo se debe tratar a los terceros críticos o a los terceros en general.

Alistair Parr: Fantástico. Muchas gracias, Adam. Lamentamos no poder responder a todas las preguntas hoy aquí, pero si desean ponerse en contacto con nosotros porque tienen alguna consulta o desean obtener más información sobre alguno de los contenidos que hemos puesto a disposición de forma gratuita, no duden en hacerlo. Estaremos encantados de ayudarles. Solo quiero aprovechar este momento para darte las gracias, Adam, por tus aportaciones de hoy. Te lo agradecemos mucho. Y muchas gracias también a ti, Thomas. Ambos habéis aportado ideas muy interesantes. Os enviaremos un enlace con la grabación y la información sobre esos recursos. Pero, de nuevo, gracias a todos por escuchar y participar hoy. Espero que paséis un día fantástico.