continuity
is a simple and effective standard which
From this lifecycle we drew our required fi ve phases of BCM, (noted in the coloured has become, though not an international
boxes). Each application and IT site within the scope was required to pass through these standard, one which is an internationally
shop
phases until they had established a fully tested plan – tested that is not by just a tabletop used standard.
discussion but a detailed technical exercise, often including data recovery. Each plan is My network tells me, as I write this in
now reviewed quarterly and fully exercised each year. early November 2009, that a draft ISO
continuity standard could be available by
Visit the BCI’s Second China Conference
In training the end of this year or if not then certainly
The training we put in place was intensive and, for the IT continuity team, time consuming early next year. The word is that it will
as we presented at many of our international sites. This incurred signifi cant travel costs be very similar to the simple, effective 18-19 May 2010
– fortunately, an investment well worth making at that time. approach of BS25999. Good news, but I
Conducting this training resulted in very positive responses from Nokia IT teams based won’t hold my breath on the production of
outside Northern and Western Europe, and particularly those in Asia. Here the enthusiasm a fi nal version. In the meantime, I have no
and 2010 Shanghai World Expo
for our work was palpable. Crowded training rooms fi lled with people eager to learn hesitation in advocating the use of BS25999
and ask questions. Indeed, such a response directly helped to fuel the gentle fi re which and encouraging others to comply with it.
was now melting the frozen views of the sceptics and, with the added assistance of our Within Nokia, the largest factory which
全球业务持续与灾难管理专家论坛
management team, transforming this view to one of – “Of course we have a BCP, doesn’t produces our phones – or more accurately
everyone?” these days, communication devices – is
Following the success of the training it was important to offer this, or a similar currently undertaking a project to become
programme, for new application owners and others new to the BCM lifecycle and their certifi ed to BS25999. This in turn gives
The BCI’s conference is running at the same time as the
roles within it. As a result, last year we established a series of e-learning modules. This has the opportunity to those who internally
proved to be far more effi cient, enabling huge savings in time and money. The modules supply them a service to comply with this
World Expo – visit both
cover all aspects of the lifecycle, with the added potential to create future modules looking standard. Please note I say comply, as I do
more deeply into a number of the specifi c components of the wheel, e.g. exercising. The not believe it is necessary for the whole of
added attraction of such e-learning is that the student can look and listen over and over to an organisation such as Nokia to become
BCI conference delegate fee - £500+Vat or £400+Vat if booked before 1 December 2009
the lessons offered – an attractive proposition for those whose fi rst language is not English. certifi ed. Only where it makes sound
In the past twelve months, we have completed over 100 individual plans and business reasons should this be pursued.
subsequent exercises for our critical applications and in turn the key infrastructure which I do, however, strongly recommend Table top exhibition space £1,000+Vat, includes one delegate place
hosts these. A very successful achievement and one, which we have clear evidence for, compliance with the standard, that is to
that has resulted in the handling of internal incidents which would in the past have cost have in place processes, templates etc.
or £1,250+Vat, including two delegate places. (Government grants may be available
many thousands of Euros in lost production instead being correctly managed and systems which closely follow the BC lifecycle and for exhibiting for SMEs – contact us for details)
etc. recovered with transparency to the rest of the business. This has proved a clear return could, if required by any external party e.g.
on the investment we have made in training and travel. regulator or key customer, be audited to
prove this.
To book, contact Geoff Howard. +44 (0) 161 743 3554 or +44 (0) 7811 408 739
To lose a factory which produced fi ve million units
An interesting development for
or ghoward@continuityshop.com
per week for even just a few hours was clearly an
possible wider use of BS25999 has been
the announcement in the US from the
unacceptable risk for the business
Department of Homeland Security regarding
its shortlisting as one of three standards
Part of everyday life recommended for possible adoption for use
The success of establishing the high quality BCM system now in place across the Nokia in the US private sector.
IT environment was not achieved overnight, and nor will its continual development and
improvement ever fi nish. However, it has now become embedded to the point that it has New challenges
become an everyday part of business and recognised for that. Nokia has recently entered an exciting new
Our work is of course never fi nished and we have, during this past year, identifi ed market as an internet company offering a
time and again an issue which requires our focus to ensure that we are able to have full wide range of services and applications via
confi dence in the continual supply of our services. new smart phones. This change has brought
Nokia, like many organisations, have outsourced signifi cant areas of support and our with it new challenges in managing these
reliance upon the external supplier is greater now than it has ever been. As a result, like applications and the data they handle with
others, we have recognised the importance of these suppliers, and possibly in turn their of course considerable emphasis on the
key suppliers, having a credible BCMS. provision of an ‘always on’ IT environment.
We have embarked upon a journey to challenge our key IT suppliers to provide us with Please allow me to close by stating that at
if not their plans, understandable for security reasons, then at least a ‘body of evidence’ Nokia we have a small but very experienced
of the plans, and their subsequent validation via exercising. Once received, it is important team of qualifi ed and certifi ed BCM
to review these plans via interview with the supplier and in turn be allowed to observe an professionals responsible for IT continuity.
exercise. In fact, it is even better to be invited to participate in a joint exercise which will They have worked hard to carefully establish
validate the ‘between companies’ management of an incident. Ideally, of course, plans ‘battle-proven’ BCM programmes consisting
will have been created using a recognised standard and so hugely improving the value and of processes, templates, validation criteria
the confi dence of any customer. This brings me to my fi nal focus for the past year. and thoroughly practised training modules. I
have been proud to be part of this team and
The standards approach to have helped lead it to the considerable
A parallel issue has been the awareness of the growing international visibility of BS25999 success it has achieved.
Parts 1 & 2, the Business Continuity code of practice and its subsequent specifi cation.
This I have strongly welcomed as, over the years of developing BCMS within Nokia IT, I
Colin ivE mBCi
have personal experience of external organisations which have taken a different approach
colin ive is chief it risk and continuity
to that laid out in the code of practice. This recurring invention of wheels has personally
manager at Nokia
proved at best tedious and for the creator a waste of their valuable resources. BS25999
0  Continuity  November/December 2009
Cont Nov/Dec 09_insides.indd 40 27/11/09 14:14:51
Oct 09 flyer.indd 1 7/10/09 09:33:25