# Designing and Developing a Business Continuity Plan Based on Collective Intelligence

Efstathios Fasolis, Vassilios Vassalos, Angelika I. Kokkinaki

► To cite this version:

Efstathios Fasolis, Vassilios Vassalos, Angelika I. Kokkinaki. Designing and Developing a Business Continuity Plan Based on Collective Intelligence. 12th Conference on e-Business, e-Services, and e-Society (I3E), Apr 2013, Athens, Greece. pp.278-285, 10.1007/978-3-642-37437-1_23 . hal-01470540

HAL Id: hal-01470540

https://inria.hal.science/hal-01470540

Submitted on 17 Feb 2017

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Designing and Developing a Business Continuity Plan
Based on Collective Intelligence

Efstathios Fasolis¹, Vassilios Vassalos², Angelika I. Kokkinaki³

¹Information Systems Program, Open University of Cyprus, Cyprus
efstathios.fasolis@st.ouc.ac.cy

²Department of Informatics, Athens University of Economics and
Business, Greece
vassalos@aueb.gr

³ Department of Management and MIS, University of Nicosia,
Cyprus
kokkinaki.a@unic.ac.cy

**Abstract.** This paper proposes a methodological approach that supports Collective Intelligence towards the design and development of a Business Continuity Plan (BCP), in order to minimize the potential of a disaster in the organization. In this framework, Collective Intelligence (CI) is supported by Web2.0 technologies that act as a diagnostic tool, providing the ability to the community of an organization to contribute with their collective experience and their intelligence, in the resolution of factors affecting the success of the Business Continuity Plan (BCP). E-BCP, the platform developed for the BCP and it is supported by CI, is also presented. Some open research issues have been outlined.

**Keywords:** Collective Intelligence (CI), Business Continuity Plan (BCP), Social Networks for optimizing business processes.

# 1 Introduction

In recent years, a number of risk instantiations of significant importance have affected the business sector and more specifically the business continuity of organizations; some of such incidents have even been detrimental to the viability of the affected organizations. These incidents have pronounced the need for a Business Continuity Plan (BCP), a structured action plan to be followed in cases of adversity, which is considered to add value to organizations, creating competitive advantages, saving-money, time and resources [Harris (2010)]. A major success factor for a BCP in every organization, are the people who develop it and the organization community that accepts and contributes to its proper implementation. Factors, such as inefficient
communication, participation and notification of the plan to the employees of the
organization, may also affect the success of the BCP to a great extent.

Web 2.0 technologies and tools have been examined from many different angles, including aspects with respect to consumers and businesses; emerging behaviors; models; ways in which information is searched, evaluated, produced, consumed and services are formulated [Bonabeau (2009)]. In this paper, we examine how the notion of collaborative collective intelligence (CI) could be harnessed to contribute to the formation Business Continuity Plan (BCP).

A major challenge of this research was the ascertainment of minimum references on the design or the development of a Business Continuity Plan (BCP) based on Collective Intelligence (CI). This challenge was at the same time a strong motivation to examine how the Collective Intelligence could support critical aspects affecting professionals in the area of Business Continuity.

The remaining of this paper is structured as follows. Section 2 outlines the Business Continuity Plan, the process for its formation and the factors that affect a BCP. Section 3 outlines the existing platforms for Collective Intelligence. Section 4 examines how a Collective Intelligence platform could be used to support the Business Continuity Plan and section 5 concludes this paper.

## 2 Business Continuity Plan: Development Process and Critical Success Factors

The methodology for the development of a BCP in this paper is based on the BS25999 [BS25999 (2006)]. The lifecycle of the Business Continuity Management (BCM) consists of six elements and can be implemented by organizations of all sizes and sectors. The effort is adjusted according to the needs of each organization. These elements are described below :

### 2.1 BCM program management

The program management provides the ability to establish and maintain business continuity in a manner appropriate to the size and complexity of the organization [BS25999 (2006)]. This is the business continuity policy which states the objectives of the BCM developed by the organization. The key to this element is gaining top management commitment and assigning the appropriate roles and responsibilities to the BCM program team.

### 2.2 Understanding the Organization

The aim of this element is to provide important information to assist the understanding of the organization products, assets and services. This is performed through a process which is commonly referred to as a Business Impact Analysis (BIA). The objective of BIA is to determine the acceptable time frame restoration and the allowable data loss, which does not affect the business continuity. The first stage of BIA is
to identify and prioritize the critical applications/processes and activities performed through the Risk Assessment (RA). This comprises the ongoing process of identifying threats, for assessment of their risk (in terms of impact and likelihood), and driving activities to avoid such risks or reduce such risks to acceptable levels.

**Criticality Assessment.** The purpose of a criticality assessment is to establish how critical a system or process is for an organization in the event of loss of confidentiality, integrity, or availability [Harris (2010)] An example is given in Table 1.

<table><caption>**Table 1.** Criticality Assessment</caption><thead><tr><td>Dimension</td><td>Comments</td></tr></thead><tbody><tr><td>C (Confidentiality)</td><td>Loss of confidentiality, i.e. information may be disclosed to the wrong people.</td></tr><tr><td>I (Integrity)</td><td>Loss of integrity, i.e. information may be falsified or otherwise corrupted</td></tr><tr><td>A (Availability)</td><td>Loss of availability, i.e. information may not be available for processing or use for a specific period of:<ul><li>½ day</li><li>1 day</li><li>2 days</li><li>1 week</li><li>1+ month</li></ul></td></tr></tbody></table>

Criticality ratings (i.e. for integrity and availability) and critical timescales for availability must be verified against the Maximum Tolerable Downtime (MTD), that is, the time period between a disruptive event and restart of normal processing.

**Classification of Systems and Processes.** To assure the criticality classification accuracy of the organization systems/process a benchmark method should be decided. One option could be the creation of a questionnaire evaluating the impact that may cause an organization loss according to the CIA (Confidentiality, Integrity, and Availability) triad and the MTD [Harris (2010)] An example is shown in Table 2.
<table><caption>**Table 2.** Systems and processes classification versus MTD</caption><thead><tr><td>Criticality classification</td><td>Classification description</td><td>Maximum Tolerable Downtime (MTD)<sup>1</sup></td></tr></thead><tbody><tr><td>A</td><td>Extremely critical</td><td>0-24 hours</td></tr><tr><td>B</td><td>Very highly critical</td><td>1-3 days</td></tr><tr><td>C</td><td>highly critical</td><td>up to 1 week</td></tr><tr><td>D</td><td>Important</td><td>between 1-4 weeks</td></tr><tr><td>E</td><td>Important but not critical</td><td>1+ month</td></tr></tbody></table>

## 2.3 Determining Business Continuity Strategy

As a result of the previous element (inputs and outputs of BIA), an organization will have to evaluate and choose the appropriate continuity strategies in order to meet the organizations business continuity objectives. The selection and evaluation of the applicable business continuity strategy depends on the Business Impact Analysis (BIA). The critical systems/processes have been identified; assessed, classified and critical timescales for availability have been considered according to the MTD.

## 2.4 Developing and Implementing BCP's

This element focuses in the development and implementation of the plans. These plans should include all the necessary actions required to meet the organizations business continuity objectives in case of a disaster. Individuals or teams with good business knowledge and expertise in certain domains of organizations are required to be involved. Every plan should be practical, complete, efficient, and include step-by-step instructions on what should be done and who will do it.

## 2.5 Maintaining and Testing the BCP

The aim of this element is to ensure that all the plans are reviewed, updated and tested periodically, to make sure that all arrangements are in place in order to safeguard the organization from a possible disaster. A BCP is a dynamic model that changes as the organization progresses in time.

## 2.6 Embedding BCP in the Organization's Culture

The final element aims for the BCP to become a valuable part to enhance an organizational BCP culture. The key to this element is communication, participation and notification of the plan to the employees of the organization.

<footnote n="1">¹ The MTD values depend on the size and complexity of the organization</footnote>
It should be emphasized that an outdated BCP could be insufficient and may provide a company with a false sense of security; this could be devastating if and when a disaster actually takes place. Companies need a live and flexible structured action plan. In light of these, the following important factors affecting the success and the validity of a BCP in an organization [Harris (2010)] ought to be considered:

* Management commitment

* Effective communication, participation and communication of the plan to the employees of the organization

* Proper assignment of roles and responsibilities among the project team

* Proper identification and prioritization of critical applications/processes and resources

* Identification of the risks that the organization needs to be protected

* Test and regular review of the plan, in order to adjust any new developments and changes in the organization

* A motivated environment inspiring innovative ideas.

When addressing business continuity planning, some organizations may focus only on backing up data and on providing redundant hardware. Even though these aspects are important, these are fragmented attempts towards the organization's overall operational capability. Working and planning a BCP must include the right people at the right places, establish alternative communication channels, and ensure that all processes and applications are properly understood and taken into consideration.

## 3 Collective Intelligence, Motivation and Platforms

Collective Intelligence (CI) may emerge extemporaneously and could be developed in many forms and setting. In recent years, the extensive use of Web 2.0 technologies have contributed to the development of services (i.e. Amazon Turk, Wikipedia, Google etc.) that encompass the principles of collective knowledge and collective problem solving and motivate a virtual community to participate in an innovative idea or design thinking. Various techniques have been reported [Surowiecki (2004)] for the exploitation of CI in organizations aiming to solicit knowledge and experience from the community, discover innovative ideas, enhance skills in various sectors while at the same time they save money, time and resources. Key to the success of CI is the ability of the organization to identify and highlight the appropriate motives in a community or an organization. Some motivational factors identified in [Malone (2009)], are listed below:

* Ideology – participation in a collaborative intelligence contributing to something that it is believed that will make a difference in society

* Challenge – participation which provides a sense of personal fulfillment or self-realization through the acquisition of additional knowledge and skills

* Career – participation in the development of the individual's career

* Social – desire to exchange experiences with others
* Fun - join for entertainment, enjoyment and rest from other activities

* Reward - participation to receive tangible rewards such as money, gifts and prizes

* Recognition - join in order to receive private or public acknowledgement

* Duty - join in response to a promise or commitment to something.

Those organizations that are able to acquire knowledge and use it in such way that they create their own intelligence and collective solutions become more competitive. During the last years, a number of Collective Intelligence (CI) platforms have been proposed. These CI platforms may be conceptualized into two major categories. The first allows the crowd to collectively contribute to a project; for example, the design of an information system. The second leads the crowd to a simple and distinct problem solving and decision making; for example the “Amazon Mechanical Turk” [http://www.mturk.com. In this platform, challenges or problems are published to an unknown number of users; ideas and solutions are solicited through an open invitation. The users referred as the crowd, form and submit solutions, These solutions are evaluated by the original entity assigned the problem/challenge. Reimbursement may be cash, prizes or recognition.

## 4 E-BCP: A Platform that supports Collective Intelligence for a Business Continuity Plan

Collective Intelligence (CI) has been used in organizational settings to achieve increased innovation, productivity and responsiveness, reducing the time required to access the proper knowledge. Could CI assist in the development and design of a BCP by harnessing information, solutions and reducing uncertainly decision making during or before a disaster?

Based on the BS25999 Business Continuity Management (BCM) lifecycle and existing applications of Collective Intelligence [BS25999 (2006)], we reckon that Collective Intelligence can support some BCP elements, as shown in Figure 1.

<figure><img src="image_2.png" /><figcaption>Fig. 1. BCM lifecycle elements which can be supported by CI are highlighted</figcaption></figure>
As a proof of concept, a collective intelligence platform was designed and developed (www.e-bcp.eu) enabling the users community within an enterprise in Greece to contribute their collective experience and intelligence to resolve factors that affect the success of the BCP. A screenshot of the platform (Greek version) is given in Figure 2.

<figure><img src="image_3.png" /><figcaption>Fig. 2. A screenshot of the E-BCP platform</figcaption></figure>

This service platform was powered by innovation centric collaboration techniques, best practices and processes bundled into a single service conducive for open innovation. Mainly, the platform provides a Web 2.0 collective tool rewarding the knowledge and exploiting the intelligence of the organization's community to implement a BCP. Two tools have been implemented to support the “e-BCP” platform. These tools are shown in Figure 3.

<figure><img src="image_4.png" /><figcaption>Fig. 3. e-BCP collective Intelligence Platform</figcaption></figure>
The first tool “Collective Intelligence Tool (CIT)” is based on the ability of the or-
ganization’s BCP project team to raise challenges based on BCP issues that require
resolution. Challenges included: the update of manuals and plans; suggestion on how
to handle risks and recommendation on how to promote the BCP program within the
organization’s community. The user community can act as a problem solver and can
identify the challenge(s) in the area their expertise and domain of their interest. The
user individuals that solved the challenges may get reward, recognition and intellec-
tual satisfaction. Once the predefined schedule for making solution is over, all the
solutions created by solvers are submitted to the BCP project seeker team. The BCP
project team (seeker) evaluates the solutions, and takes the final call on which solu-
tion meets the expectations most optimally and rewards the corresponding solver.

The second tool “Critical Assessment Tool (CAT)” also uses the above CI ap-
proach to apply a BIA analysis creating a critical league consisting of all organiza-
tions systems/processes. This is achieved by raising several questionnaires to the or-
ganizations user community contributing their expertise identifying critical services or
spotting any new ones.

Employees became comfortable sharing their experience, thoughts and ideas that can be used to address critical business challenges that may assist the design and the development of a BCP within the specific organization. Professionals involved in business continuity had the ability to filter out the critical information through the chaos of information which is gathered. Preliminary evidence supports that Collective Intelligence should not be absent from the design of Business Continuity Planning providing a different approach in understanding the organizations business environment harnessing proper information from its community.

5 Conclusions and Future Research

This paper claims that Collective Intelligence is a valuable tool supporting business
continuity for harnessing information and resulting to solutions by reducing uncer-
tainly decision making during or before a disaster. Collective Intelligence is an asset,
which if collected and used correctly has the potential to emerge as a significant tool
to implement and design a BCP providing a strategic advance for an organization
such as saving money, time and resources.

The value of this paper is twofold. First, it has provided a proof of concept that this
is both feasible and contributes positively in the formation of a BCP in an organiza-
tion. Second, it sets the direction for further research on the interdisciplinary issues of
BCP and CI.

The almost complete lack in relevant bibliography denotes that further research in
the theory of Business Continuity based on Collective Intelligence should be priori-
tized. Extending this study is to investigate the approach utilizing the cooperation and
alliance between organizations supported by the logic of collective intelligence re-
garding business continuity matters. Tools offered by the technologies of "Cloud
Computing" can be utilized to this direction. Finally, it would be interesting to con-
sider the opposite approach of Collective Intelligence on the mismanagement of the
user community within the organization on issues relating to business continuity.

In conclusion, the field of business continuity supported by the logic of collective intelligence is in the early stage. It has been identified that it is possible to address aspects of BCP using CI. However a number of research topics remain open and need further exploitation.

References

1. BS 25999 – 1 2006: Business Continuity Management – Part 1 Code of practice. British Standards.

2. BS25999 / BS 25999 News (2006): 'Dedicated to the Emerging Business Continuity Management Standard', British Standards Institution.
http://www.bs25999.net/2006_07_01_archive.html

3. Malone, T., Laubacher, R. and Dellarocas, C. (2010) ‘The Collective Intelligence Genome’. Journal of MIT Sloan Management Review, Vol 51, No3

4. Surowiecki J. (2004) ‘The wisdom of the crowds: Why the many are smarter than the few’. New York: Random House inc.

5. Bonabeau, E. (2009) ‘Decisions 2.0: The Power Collective Intelligence’. Journal of MIT Sloan Management Review, Vol 50, No2

6. Dierks, E. (2012), Intelligence-Based Business Continuity Part 1, 2, 3. Article of Continuity Insights. http://www.continuityinsights.com

7. Harris, S. (2010) CISSP All In One Exam Guide. 5th edn. New York: McGraw-Hill, pp 777-840.

8. Amazon Mechanical Turk: ‘Human intelligence tasks’ <http://www.mturk.com>