Business continuity and recovery planning for manufacturing

16
BY ARC ADVISORY GROUP DECEMBER 2001 Business Continuity and Recovery Planning for Manufacturing BCRP Is Essential for Survival .................................................................. 3 Strategic Objectives ............................................................................... 3 Business Impact and Risk Analysis........................................................... 4 Critical Operations Identification ............................................................ 6 Collaborative Manufacturing .................................................................. 8 Disaster Prevention ................................................................................ 9 Collaborative Asset Lifecycle Management ............................................ 10 Damage Assessment ............................................................................ 12 Recovery Strategy and Procedures ........................................................ 13 Recommendations ............................................................................... 14 Enterprise & Automation Strategies for Industry Executives

description

 

Transcript of Business continuity and recovery planning for manufacturing

Page 1: Business continuity and recovery planning for manufacturing

BY ARC ADVISORY GROUP DECEMBER 2001

Business Continuity and Recovery Planning for Manufacturing

BCRP Is Essential for Survival ..................................................................3

Strategic Objectives ...............................................................................3

Business Impact and Risk Analysis...........................................................4

Critical Operations Identification ............................................................6

Collaborative Manufacturing..................................................................8

Disaster Prevention ................................................................................9

Collaborative Asset Lifecycle Management ............................................10

Damage Assessment............................................................................12

Recovery Strategy and Procedures ........................................................13

Recommendations ...............................................................................14

Enterprise & Automation Strategies for Industry Executives

Page 2: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

2 � ARCweb.com � Copyright © ARC Advisory Group

0%0%0%0%

20%20%20%20%

40%40%40%40%

60%60%60%60%

80%80%80%80%

100%100%100%100%

0000 2222 5555 YearsYearsYearsYears0%0%0%0%

20%20%20%20%

40%40%40%40%

60%60%60%60%

80%80%80%80%

100%100%100%100%

0000 2222 5555 YearsYearsYearsYears

Business Failures After a Disaster without BCRP

Disasters Cause 3 Out of 4 Businesses to Fail within 5 Years

1 2 3 4 5 6 7 8 9 10 11 120123456789

10

Cos

t

1 2 3 4 5 6 7 8 9 10 11 12Level of Protection

InvestmentPotential Loss

1 2 3 4 5 6 7 8 9 10 11 120123456789

10

Cos

t

1 2 3 4 5 6 7 8 9 10 11 12Level of Protection

InvestmentPotential Loss

1 2 3 4 5 6 7 8 9 10 11 120123456789

10

Cos

t

1 2 3 4 5 6 7 8 9 10 11 12Level of Protection

InvestmentPotential Loss

Balance BCRP Investment Cost for the Needed Level of Protection

Page 3: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 3

BCRP Systematic Approach

• Strategic objectives • Business impact analysis • Critical operations identification • Disaster prevention • Collaborative management • Damage assessment • Recovery procedures

BCRP Is Essential for Survival

Business continuity and recovery planning (BCRP) is not a new concept, but it has experienced an enormous amount of renewed interest since the Sep-tember 11, 2001, terrorist attack on America. A recent Web survey shows

that more than half of the businesses responding were not prepared for a disaster with a functional BCRP. However, all businesses are currently con-sidering, implementing, or updating a comprehensive BCRP strategy.

Current events and available statistics support an overwhelming need for disaster recovery planning.

While failure to plan for a major disaster frequently results in many business

failures, the chances of surviving a disaster double with a good BCRP strat-egy. About 40 percent of businesses without a BCRP fail immediately because they have no plans for a rapid recovery and insufficient funds to

cover the expense of extended downtime. Another 25 percent fail within two years from lost business revenues and cash flow problems. In fact, only 1 out of 4 businesses without a BCRP

stay in business more than five years after a disaster.

Survival after a disaster is the name of the game for any busi-ness. The impact may even be indirect if, for example, one of

your primary suppliers or key customers are the victims of the disaster and can no longer do business with you. The inability to obtain critical materials from a supplier or order cancellations from a key

customer can hurt production, revenues, and profits. A serious disaster can impact the entire value chain from sales and production to shipping and bill-ing, regardless of your direct involvement in the disaster. That is why every

business must create a good business continuity and recovery plan.

Strategic Objectives

A comprehensive BCRP should be developed using a systematic approach, beginning by understanding the strategic objectives for business survival. The main objective of any BCRP is to quickly recover from any business dis-

ruption regardless of the magnitude. The recovery plan must insure continuity of important business operations by documenting the most cost effective recovery procedures for many possible scenarios. A cost effective

Page 4: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

4 � ARCweb.com � Copyright © ARC Advisory Group

TerrorismWar, Strike

Natural DisasterTheft, Vandalism

Mistakes, Bad PlanningPower Outage

HW/SW Failure45%

16%

14%

10%8%

5%

<1%

recovery requires a focus on minimizing downtime and lost productivity while maintaining customer satisfaction and avoiding disruption to existing

supply and distribution channels. This is best accomplished by creating a disaster recovery team with assigned responsibilities and expectations.

This team should consist of key personnel and alternates from each group in

your organization. Selected individuals must understand existing processes and workflows within their areas. At the first meeting, the team should agree on a workable schedule for planning, preparing, reviewing, and testing

the plan. The team should initially meet frequently to identify risks and im-pacts from various threats such as terrorism, vandalism, natural disasters, labor strikes, mistakes, and failures. What impact would various threats

have on each team member’s area or department? How could they be pre-vented and what are the best procedures for a fast recovery?

Business Impact and Risk Analysis

Business impact and risk analysis (BIA) are essential elements of any busi-ness continuity and recovery plan. Knowing the probability of different

business disruptions and their impact will help determine the required in-vestment needed for the desired level of protection. The disaster recovery team must determine the correct investment for the level of protection

needed based on a comprehensive BIA.

Certainly, the risks of terrorism have increased, but are still not as probable as the most common business interruptions such as power outages, hard-

ware failures, software problems, or employee mistakes. Over 45 percent of survey respondents said hardware and software problems were

major disruptions, followed by 16 percent for power failures, 14

percent for mistakes, 10 percent for vandalism and hackers, 8 percent for natural disasters, 4 percent for fires, and less than

1 percent for terrorism. All employees make mistakes, but

minimizing their business impact requires an in-depth cause and effect analysis. Proper planning, good train-

ing programs, and enforcement of approved procedures can prevent most

operational mistakes. Bad planning such as inadequate supply chain redun-dancy or lack of backup resources can be avoided with a better understanding of business processes and workflows.

Business Interruption Threats

Page 5: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 5

Most risk analysis can be done using common sense, such as the risk of a natural disaster based upon your geographic location. Similarly, a manmade

disaster such as terrorism, theft, vandalism, or a labor strike can be logically related to the type of business or proximity to a high-risk facility. Minimiz-ing your dependencies on single suppliers, sole distributors, and primary

customers if they are impacted by a disaster can help prevent extended sup-ply and demand chain interruptions. If your business involves a vola-tile or sensitive environment, then unexpected mistakes or failures can

have more serious consequences.

Potentially unsafe or life threatening conditions warrant serious pre-vention and recovery investments. Agencies such as OSHA and the

EPA enforce strict regulations and impose heavy fines for businesses that do not comply with rigid standards defined by industry for creat-ing hazardous environments. For example, the chemical industry is

expected to conduct HAZOP analysis on dangerous materials and processes to determine the proper safety precautions and procedures for both normal and abnormal conditions. Knowing what to do in case of any emergency in-

volving a hazardous environment can prevent injuries and save lives.

The primary objectives of a risk analysis are proper safety and avoiding finan-cial losses, but it should also consider the impact of business interruptions on

profitability. BIA minimizes cumulative losses by establishing business conti-nuity objectives and identifying the cost of various outages with and without BCRP. Losses can become very significant as the time period for recovery in-

creases due to a lack of a proper plan. ARC’s survey placed average downtime losses at $35,000 per hour, ranging from less than $10,000 per hour for small businesses to over $100,000 per hour for large companies.

A comprehensive BCRP can speed recovery to profitability by minimizing tangible and direct losses such as lost sales, lost production, and missed de-liveries. A good BCRP requires a BIA matrix that identifies the best

procedures for most business interruption scenarios. The BIA identifies and can eliminate tangible and indirect losses resulting from penalties, fines, un-expected fees, and lost market share. It should also include the best ideas for

avoiding the less visible, but equally serious, intangible losses from lack of confidence in meeting expectations, eroded customer satisfaction, and dam-age to reputation.

Loss from Disaster

LOSS

DAYS

WithoutBCRP

With BCRP

Page 6: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

6 � ARCweb.com � Copyright © ARC Advisory Group

Critical Operations Identification

A comprehensive BIA includes mapping the current operational model of your business with the major profit and loss centers and their primary proc-ess workflows, procedures, and information requirements. This exercise will

provide the disaster recovery team with a better understanding of the critical business dynamics and permit identification of the critical operations re-quired for a faster disaster recovery. Knowing the critical operations will

help with financial justifications for special precautionary duplication of im-portant functions and information. Duplication means faster recovery times, but it can be expensive to implement fully redundant and fault tolerant envi-

ronments, disk and server mirroring, or backup wireless communications. Limiting duplication techniques to criti-cal operations is a good way to balance

investment costs with the needed level of protection.

Production Once critical operations are identified, then a minimum working business model is determined, consisting of product sales, production, and delivery. For most manufacturers, recovery of plant floor operations will be the most

challenging, given the complexity of production logistics. The first challenge is how to complete or recover any Work In Progress (WIP) operations for both damaged and undamaged goods. The next is future production plan-

ning and scheduling based on capabilities versus expectations. Production objectives after any interruption must be based on predetermined options, influenced by real-time data such as the extent of damage, supplier & cus-

tomer commitments, revenue opportunities, and backup production options.

Supply chain problems such as insufficient materials are a common cause of production downtime following an unexpected disaster or business interrup-

tion. The BCRP must identify how to obtain sufficient raw materials internally from inventory and externally from suppliers that are essential to sustain production along with maintenance, repair, and operating materials

to keep critical equipment running reliably. Any problems with perform-ance, availability ,or reliability of equipment assets can severely impact production and jeopardize compliance with quality standards and regula-

tions. Lack of compliance can easily ruin product quality or shutdown operations, resulting in significant losses.

Page 7: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 7

IT Operations In most manufacturing environments, information technology is deployed

throughout the facility from the shop floor to the top floor. Network infra-structure and communications exist for all organizations from sales and marketing, through production and engineering, to distribution and service

support. Recovering all these complex systems and maintaining levels of inte-gration enjoyed prior to a disaster is extremely difficult if not impossible. The 9/11 disaster totally destroyed the facilities and infrastructure of many busi-

nesses, making alternate site redundancy the only option for fast recovery. Fortunately this type of disaster is rare, but must still be covered by the BCRP.

Many IT disasters are self-inflicted through poor planning and lack of proper

change management. Large manufacturers often paralyze their business op-erations by improperly implementing a new enterprise application such as enterprise resource planning (ERP), customer relationship management (CRM)

or supply chain management (SCM). Examples include the three year com-bined ERP, CRM and SCM implementation at Hershey that interrupted order processing and shipping functions for three months, causing third quarter

sales and profitability to drop 12.4 percent and 18.6 percent respectively. Other companies experiencing business interruptions from poorly planned enterprise application implementations include Nike, Whirlpool, Dow Chemi-

cal, Boeing, Dell Computer, and Apple. Implementation problems are frequently caused by bad timing for a switchover and the complexity of appli-cations. In any case, most of these mistakes can be avoided or quickly

recovered with a good contingency plan within the scope of BCRP.

A good contingency plan requires guaranteed system and data availability, tested backup procedures, and proven implementation methodology with

best practices for change management. The ability to recover all systems, applications, and information for critical operations is an essential require-ment for contingency planning, business continuity, and disaster recovery.

The methods may vary from comprehensive system backups or fully redun-dant and fault tolerant environments to a duplicate backup site. No matter what the approach is, the ultimate objective is to return to normal operations

with no loss of functionality or information.

Sales and Service Customer satisfaction is the key to success for any business. Maintaining it

following a disaster or major business interruption is paramount. That is why every business continuity plan must consider the best ways to continue

Page 8: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

8 � ARCweb.com � Copyright © ARC Advisory Group

A Web-based portal can becomea primary communication vehicle

for employees, suppliers, andcustomers following a disaster.

meeting customer expectations during difficult times. Automating sales and support processes using appropriate enterprise applications such as ERP and

CRM can help with recovery efforts for orders, deliverables, financials, and service. Although ERP and CRM are often complex applications, they do create a comprehensive database of customer sales and support requirements

that can easily be backed up and recovered by IT operations. Automation can be the medicine for quick recovery. But as a minimum, every business

should document a manual system for sales, delivery, and support

as a last resort recovery procedure.

In many cases, a good e-business strategy can provide sufficient capabilities to satisfy customer requirements for ordering prod-

ucts and obtaining needed support. A web-based communications portal with e-commerce and e-support functions should be considered for collaboration between your company employees, key suppli-

ers, and existing customers. The actual network hardware and software infrastructure can be outsourced to a reputable service provider, reducing your risk of losing all capabilities after a disaster. The portal can also act as

the primary communication vehicle for your disaster recovery team while planning, communicating, and even executing the BCRP.

Collaborative Manufacturing

The new Internet economy has greatly improved the efficiency of product and asset lifecycle management from on-line ordering and just in time pro-

duction, to rapid delivery, and real-time support. A new Collaborative Manufacturing Management (CMM) model has evolved that encourages suppliers, customers, and partners to share knowledge and best practices for

optimizing business operations and improving profitability. CMM improves supply and demand chain operations by optimizing product and asset lifecy-cle phases. It shortens latency times between ordering and product delivery

by significantly improving process workflows through collaboration.

These highly optimized CMM models rely heavily on proper coordination of the supply chain between suppliers, manufacturers, and customers to opti-

mize production costs and maintain lean inventory levels. Any extended interruption to this business model can result in major supply chain disrup-tion and significant losses. Manufacturers that adhere to this very

Page 9: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 9

competitive and efficient business model must consider multiple recovery options

to minimize losses from unscheduled business interruptions.

The preferred options are to transfer

production to another existing manufac-turing line within your plant or to another plant site with equivalent capa-

bilities and extra capacity. Many industries such as food and pharmaceu-ticals already use multiple production

lines and plant sites to optimize produc-tion costs based on regional demand, and they should deploy these options in their BCRP. Other manufacturers with-

out redundant production capabilities must consider using third party manufacturers or even competitors to survive an unexpected disaster. The competitive approach must be handled carefully to avoid losing customers,

but is possible through contracting, repackaging, or even negotiated referrals.

Disaster Prevention

Avoiding an unnecessary disaster is a far less disruptive approach to busi-ness continuity and recovery planning. The old saying “an ounce of prevention is worth a pound of cure” has significant meaning with respect to

business interruptions. The losses from unexpected downtime can be very significant and often avoided by simple precautions. There are many policies and procedures that can be implemented to prevent accidents and protect a

business against common disasters. Fire and water damage can be prevented through periodic safety audits and careful facilities planning using fireproof-ing, proper drainage, and other proven techniques. Power interruptions can

be minimized with a UPS and backup generator for critical equipment and operations. Even theft and vandalism can be deterred by implementing a basic security model.

ARC’s basic security model focuses on prevention and detection of security threats and rapid recovery of impacted operations when security is breached. The model looks at securing tangible assets such as equipment and facilities

ARC�s CMM Model

Design

Support

Business

Customers

Production

Automation

Suppliers

CPMLogistics

Lifecycle AxisLifecycle AxisLifecycle AxisLifecycle Axis

Value Chain Value Chain Value Chain Value Chain AxisAxisAxisAxis

Enterprise AxisEnterprise AxisEnterprise AxisEnterprise Axis

Lifecycle AxisLifecycle AxisLifecycle AxisLifecycle Axis

Value Chain Value Chain Value Chain Value Chain AxisAxisAxisAxis

Enterprise AxisEnterprise AxisEnterprise AxisEnterprise Axis

PAMPAM

MASMASRPO/PSORPO/PSO

PIMPIM

PLM/D

CRMSCM

BPM

PLM/S

GLSGLS

TMSTMSPro-curePro-cure

EAMEAMCPS/APSCPS/APS

FINFINHRHR ERPERP

Buy-Side ExchangeBuy-Side Exchange Sell-Side

ExchangeSell-Side Exchange

LogisticsExchangeLogisticsExchange

Buy-Side ExchangeBuy-Side Exchange Sell-Side

ExchangeSell-Side Exchange

LogisticsExchangeLogisticsExchange

Buy-Side ExchangeBuy-Side Exchange Sell-Side

ExchangeSell-Side Exchange

LogisticsExchangeLogisticsExchange

Page 10: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

10 � ARCweb.com � Copyright © ARC Advisory Group

as well as intangible assets such as software applications and information. Securing physical assets starts with locks for protection, alarms for detection,

and spares for recovery. Similarly, protection against environmental threats on assets such as power failures can be protected as previously mentioned with a UPS and generator. Once a power failure is detected the equipment

can undergo an emergency shutdown to avoid damage and be automatically restarted for rapid recovery when power is restored.

Business knowledge and information is probably the most valuable asset for

many companies and is usually the most difficult to capture and preserve. Most IT organizations spend considerable time managing critical business systems and data that is often integrated with plant floor production sys-

tems. The security threats to critical data have increased exponentially as more manufacturers rely on Web-based solutions to optimize operations and generate additional revenues. Protection, detection, and recovery of business

information is an essential part of every BCRP.

Software applications and data

must be protected from com-puter viruses introduced by

hackers or unintentionally by employees during everyday operations. Ac-

cess by hackers and unauthorized users must be prevented using password protection. Business data must be protected using scheduled backup proce-dures in case of corruption or accidental loss. Breaches in information

security must be quickly detected with scan algorithms for viruses, trace routes for unauthorized user logins, and notification of successful data back-ups when completed. Rapid recovery of critical business applications and

data must be guaranteed to minimize downtime and enable continued opera-tions. Recovery procedures include data cleaning procedures to eliminate computer virus signatures, password changes to prevent future unauthor-

ized access to business systems, and system backup restores to repair corrupted applications and information.

Collaborative Asset Lifecycle Management

The complexity of many new assets requires extensive training and costly equipment for proper maintenance, forcing customers to share maintenance

Security Model Physical Viral Access Backup Power Failure

Protection locks shield passwords scheduled UPS / Generator

Detection alarms scan trace notification shutdown

Recovery spares clean change restore restart

Security Model Physical Viral Access Backup Power Failure

Protection locks shield passwords scheduled UPS / Generator

Detection alarms scan trace notification shutdown

Recovery spares clean change restore restart

Page 11: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 11

responsibility with suppliers. For example, repairing a new automobile re-quires expensive diagnostic equipment and frequent training to understand

computerized performance indicators and fault detection parameters. Only dealerships can justify the cost of this equipment, forcing customers to rely on them for most maintenance requirements. This embedding of intelligence

in new products is becoming popular because it reduces support costs and optimizes performance, availability, and reliability.

Smart technology is driving Collaborative Asset Lifecycle Management

(CALM), which promotes collaboration between suppliers, customers, and internal organizations for sharing knowledge and integrating important ap-plications for optimization of the various asset lifecycle phases. Customers

are demanding better support from suppliers through the entire asset lifecy-cle, from sourcing to redeployment. Suppliers are assuming more asset management responsibilities through out-

sourcing agreements with performance guarantees.

Placing more responsibility on suppliers is a

best practice for business continuity and rapid recovery from a disaster. A fast and proper response to a business interruption

can prevent a serious disaster. Knowing how to contact the right person or supplier immediately or having access to the right asset information and spare parts will minimize downtime. Having a good supplier contractually

involved with revenue responsibility can expedite a rapid response to your problems.

A rapid response from anyone will require an accurate and fast evaluation of

the situation. Several new remote monitoring, access, and notification tech-nologies can expedite the recovery process. Simple network management protocol (SNMP) can monitor device health, performance, and configuration

over an IP network, while global positioning systems (GPS) and radio fre-quency identification (RFID) can track asset location. These and other technologies properly supplemented with email notification can identify

problem areas, expedite spare parts and tools, and notify the needed re-sources for the solution. Remember that action speaks louder than words in an emergency and that CALM provides strong decision support based on

proactive asset management.

DecommissionMaintainOperateSource

Manufacturer Supplier & Manufacturer 3rd Party Service

Collaborative Asset Lifecycle Management

Current EAM Solutions

Capital Equipment Lifecycle

Page 12: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

12 � ARCweb.com � Copyright © ARC Advisory Group

Damage Assessment

A successful recovery requires identifying the problems and potential dam-age. A good measure of disaster magnitude is the time and cost to recover. Recovery in less than a day is usually minor, although short outages may

hide less obvious damages such as loss of customer confidence. Comprehen-sive damage assessment procedures will help quickly assess losses. The best way to identify and measuring damage should be documented. Before and

after photos of assets and operations can help determine losses and damage when a major disaster destroys all or a portion of your facilities.

In fact, loss of facilities, such as in the case of the Oklahoma City bombing,

should be a special consideration of any BCRP with provisions for backup mobile communications and replication of operations at an alternate or mir-rored site. Availability of an alternate site is an important safeguard for

rapid recovery from any disaster where damage is extensive. Safety concerns or extensive damage to the facility, information center, or any other critical operation makes relocation to the alternate site a practical decision. Reloca-

tion time to the new site will depend on the estimated time for recovery as determined by the damage assessment process. A mirrored site can normally assume full redundant operations very quickly with minimum business in-

terruption because it provides real-time backup for business information. The right level of protection will depend on the likelihood of various threats, the risk tolerance of the business, and the cost of deploying redundant opera-

tions. Any manufacturer fortunate enough to have similar multi-site operations should consider mirroring each other’s information as a more cost effective solution.

Event Category Extreme Impact Major Impact Minor Impact No Impact

Health and Safety Loss of Life or Limb Hospitalization Local First Aid None

Financial Loss $$$ $$ $ 0

Information Loss $$$ $$ $ 0

Compliance FDA Revoke License FDA Suspend License FDA Review License None

Production Loss Days/$$$ Hours/$$ Minutes/$ None

Environmental Damage Permanent /Offsite Long term/ Onsite Temporary/ Local None

Loss of Trust or Reputation Permanent Long Term Temporary None

Page 13: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 13

Recovery Strategy and Procedures

Mirrored hot sites that can immediately takeover operations for another damaged site is the ideal scenario for BCRP. Unfortunately, very few busi-nesses or manufacturers can afford this model. Results from our survey

showed a very small percentage of companies performed real-time backup of data, and few could tolerate more than a day of unexpected downtime. Most companies relied on comprehensive planning and daily backups for a fast

recovery, with smaller businesses even settling for weekly data backups. The survey showed that a 1-to-3 day downtime, although costly, was not fatal. It also indicated that the average BCRP solution was 3 years old, with annual or

periodic updates. Unfortunately, less than half of the companies tested their BCRP, and only a few companies had adequate recovery teams in place, with the average being five or fewer members.

In any case, successful recovery requires a complete backup of current information, available

spares, and properly trained personnel. This is best accom-plished by frequently moving

mission critical data offsite, cross training personnel in im-portant areas, and maintaining

the right spares and latest documentation at multiple sites. The BCRP should be docu-

mented, updated, and tested periodically, as well as shared with strategic suppliers and cus-

tomers. It is also wise to participate in the BCRP of your key suppliers and primary cus-

tomers, since their failures can seriously impact your opera-tions. Every BCRP should include provisions for alternate supply and distri-

bution channels for suppliers, partners, and customers.

There are many BCRP service providers including Compaq, Ernst & Young, HP, and IBM, but only a few large software solution suppliers such as Strohl

BCRP SuBCRP SuBCRP SuBCRP Supplierpplierpplierpplier SolutionsSolutionsSolutionsSolutions ReferencesReferencesReferencesReferences

Binomial Phoenix Disaster Recover Bayer, Unocal, Chevron, Glaxo, Raychem, Trane

Comdisco Revolution, ComPAS, Complete BIA, CPT, Continuity Resource

IFF, Dow Chemical, Union Pacific, Thomson Consumer Electronics

Compaq DRTape, Storageworks Molson, Borden Chemical

Ernst & Young e-Risk, e-Security Morgan Stanley, American Express

HP Business Continuity Services Mitsubishi, Rockwell, Pacifica

IBM Business Continuity & Recovery Services

Degussa, Eli Lilly, Inver House, Gillette,Tenneco

Presage Business Recovery Planner AT&T, Braun, Chrysler, Coca Cola, Emerson, GM, Sie-mens, US Navy

SunGard Precovery, e-Planner, CBR, Megacenter

Domco, NYSA and other WTC Companies

Strohl Systems BIA Professional, LDRPS (web server), Incident Manager

Alabama Power, Lockheed Martin, Nestle, Solectron

Page 14: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

14 � ARCweb.com � Copyright © ARC Advisory Group

Systems, SunGard, and Comdisco. SunGard provides software and services to its customers. Several service providers including IBM and Compaq de-

ploy Strohl Systems BCRP solutions for their clients. SunGard is acquiring ComDisco, and HP may merge with Compaq creating several stronger BCRP solution suppliers. For do it yourself companies, Binomial International,

Presage, and several other suppliers offer a low cost entry-level solution.

Most BCRP suppliers provide critical support after tragic events such as fires, storms, floods, and terrorism. IBM, SunGard, and Strohl Systems operate

worldwide recovery centers that can mirror sites or load backup tapes to support IT operations during a disaster. For example, both Gillette and Mer-cedes Benz took advantage of IBM’s Sterling Forest, New York, recovery

center to support operations during hurricanes in Puerto Rico and New Jer-sey. Morgan Stanley built its own fully redundant data center at the World Trade Center, which was completely destroyed on September 11. Mirroring

permitted the original site 15 blocks away in Manhattan to continue full op-erations with little disruption. Morgan Stanley is currently working with Ernst & Young to recover and rebuild WTC redundant data center operations

at another location.

Recommendations

According to the ARC survey, most businesses have implemented strong user authentication and data integrity security with user passwords, daily backups, and virus protection software. Few businesses, however, have in-

vested in proper BCRP documentation with good risk analysis and understanding of security threats, nor have they adequately prepared a dis-aster recovery team to deal with an unexpected disaster. The likelihood of a

serious manmade disaster has increased significantly since 9/11 making BCRP an important investment for most companies. ARC suggests that every company focus on the following.

• Determine business interruption risks and action responses • Identify the recovery team and strategic objectives in advance • Deploy safety and security measures to minimize risk

• Understand and automate repetitive critical operations • Develop procedures to quickly assess extent of damages • Document and periodically test a comprehensive BCRP.

Page 15: Business continuity and recovery planning for manufacturing

ARC Strategies � December 2001

Copyright © ARC Advisory Group � ARCweb.com � 15

Analyst: Houghton LeRoy

Editor: Ed Bassett

Distribution: All EAS Clients

Acronym Reference:Acronym Reference:Acronym Reference:Acronym Reference: For a complete list of industry acronyms, refer to our web page at www.arcweb.com/arcweb/Community/terms/indterms.htm

B2B Business-to-Business B2C Business-to-Consumer BCRP Business Continuity and Recovery

Planning BIA Business Impact Analysis BPR Business Process Reengineering CAGR Compound Annual Growth Rate CALM Collaborative Asset Lifecycle

Management COM Component Object Model CNC Computer Numeric Control CPG Consumer Packaged Goods CRM Customer Relationship Management CMMS Computerized Maintenance Management System EPA Environmental Protection Agency EPM Enterprise Production Management ERP Enterprise Resource Planning

GPS Global Positioning System HMI Human Machine Interface IT Information Technology ITRAM IT & Remote Asset Management MRP Materials Resource Planning OSHA Local Area Network PAM Plant Asset Management PIMS Process Information Management System RFID Radio Frequency Identification ROI Return on Investment SCM Supply Chain Management SNMP Simple Network Management

Protocol UPS Uninterrupted Power Supply TMS Transportation Management System WIP Work In Progress WMS Warehouse Management System

Founded in 1986, ARC Advisory Group is the leader in providing strategic plan-ning and technology assessment services to leading manufacturing companies, utilities, and global logistics providers, as well as to software and solution suppli-ers worldwide. From Global 1000 companies to small start-up firms, ARC provides the strategic knowledge needed to succeed in today�s technology driven economy.

ARC Strategies is published monthly by ARC. All information in this report is pro-prietary to and copyrighted by ARC. No part of it may be reproduced without prior permission from ARC.

You can take advantage of ARC's extensive ongoing research plus experience of our staff members through our Advisory Services. ARC�s Advisory Services are specifically designed for executives responsible for developing strategies and di-rections for their organizations. For subscription information, please call, fax, or write to:

ARC Advisory Group, Three Allied Drive, Dedham, MA 02026 USA Tel: 781-471-1000, Fax: 781-471-1100, Email: [email protected]

Visit our web page at ARCweb.com

Page 16: Business continuity and recovery planning for manufacturing

Three Allied Drive � Dedham, MA 02026 USA � 781-471-1000 � Fax 781-471-1100

Cambridge, U.K.

Düsseldorf, Germany

Munich, Germany

Hamburg, Germany

Tokyo, Japan

Bangalore, India

Boston, MA

Pittsburgh, PA

San Francisco, CA

Visit ARCweb.com forcomplete contact information