Call of Duty: The New Demand for Business Continuity Professionals

Once Seen as "Insurance," BC/DR Pros Now Valued for Information Assurance Upasana Gupta • November 12, 2009 When Anne Marie Staley first became a business continuity/disaster recovery (BC/DR) professional, many organizations minimized the role.

"Until recently, most organizations treated business continuity like health insurance," says Staley, Senior Manager of Business Continuity Planning and Disaster Recovery for North America at the New York Stock Exchange. "[They focused on] getting the cheapest coverage, hoping nothing ever happens, reluctantly paying the premium each month and praying that when the inevitable happens, they have enough coverage."

Times clearly have changed. In this post-9/11 world, BC/DR functions have emerged to play critical roles in protecting organizations from natural, man-made and pandemic disasters. "We are now seeing a wonderful convergence and subsequent maturity in the form of a new paradigm of business continuity management which involves more formal risk management practices integrated with information security," Staley says.

With the emergence of BC/DR comes a greater emphasis on hiring professionals with the right skills and credentials.

The Right Stuff
Risk assessment skills have become significant in business continuity, says Stephanie Balaouras, Principal Analyst at Forrester Research. In the past; organizations often focused their BC/DR efforts on natural disasters and overlooked mundane events that actually cause most disruptions -- power outages, IT failures and human error. But leaders have come to realize that they must take the time to conduct a more comprehensive risk assessment to identify all probable risks to safeguard company reputation and meet the expectations of customers, external parties and internal auditors.

"Executives are forced to pay close attention to the areas where businesses are struggling: testing more thoroughly and frequently, involving business owners in the process from start to finish, and ensuring the business continuity readiness of strategic partners," Balaouras says.

Also, the emergence of increased threats such as pandemic outbreak, recession, power outages, terrorism and cyber fraud pushes the need for qualified business continuity professionals. "All of these events are uncomfortably recent, and as we've learned, any of them can bring a country or community -- let alone a single firm -- to a standstill," says Steve Ross, Executive Principal, Risk Masters, Inc., a New York-based business continuity and crisis management consulting firm.

The key questions: Who are the right people, and what role do they play within an organization?

"The right fit for business continuity function is professionals coming from a risk management background with exceptional risk monitoring, measuring and mitigating skills," says Cheyene Haase, President of BC Management, Inc. an executive search firm that places business continuity, disaster recovery, information security and emergency management professionals internationally. Key Credentials

Among the business continuity credentials most demanded by employers, Haase says:

Certifications: Professionals holding industry certifications such as CBCP, CISSP, CEM, PMP are largely preferred, as they show individuals will stay current with the industry through continuing education.

Academic qualification: A college degree is very often a requirement for BC/DR positions. "Furthermore, to achieve a leadership position, holding a master's degree puts a candidate in a more favorable position compared to competitors," says Hasse.

Business and technology focus: Strong understanding of business and technology issues in contingency planning, emergency response, crisis management and communications, risk management, organizational resiliency, IT continuity, testing, implementation, and regulatory issues is essential.

Prior business continuity planning experience: Previous experience developing contingency and business continuity programs globally is often an experience highly sought after by potential employers.

'Soft skills' a must in leadership roles: Individuals with well-rounded backgrounds in business and technology understanding are largely preferred for leadership roles. They also must possess the abilities to build business cases and to communicate with peers, as to senior management.

Industry associations: Professionals need to be associated with specific industry associations dedicated to business continuity, as well as related disciplines including: Association of Contingency Planners (ACP), Disaster Recovery Institute (DRI), Business Continuity Planners Association ( BCPA).

In addition to their primary roles of business continuity planning, business impact analysis and understanding of key risks and vulnerabilities to the organization, business continuity professionals also must:

Seek Input - from executive management on risk tolerance, areas of concern and unknowns. Discussions on risk perception, business strategy and trends should become key aspects of moving beyond the traditional focus on natural disasters, fires and data corruption. "It's important to plan for these threats," says Ross, "but also to get input from executive management team about other financial and operational risks that may not be receiving focused attention."

Get Engaged - move beyond executing methodology and begin learning the business, break down organizational barriers that get in the way of understanding all aspects of business continuity risk, and get involved by building teams to address business continuity risk and lead them toward a solution.

The recessionary impact is that organizations are selective in hiring, continuing to try and "do more with less." Which means employees often need to wear several hats in performing their role as BC professionals. A good background in related skills such as information security, risk management, incident response and business is hot in the job market. The career growth in business continuity is tremendous, says Ross, and individuals can branch into risk management, crises management, incident response, physical security, strategic planning and policy roles as well as get into upper management positions such as chief risk officer and chief strategic advisor.

Beyond insurance, BC/DR now is valued for the level of assurance the role brings to an organization, Staley says. "A key strength of successful business continuity professionals is their ability to facilitate a group of people toward a solution to mitigate risk to an acceptable level."