Minimum Business Continuity Objective

Term History and Usage

Minimum business continuity objective is a term from Singapore's Technical Reference for Business Continuity Management (TR19) released in 2005 and later in the replacement standard, Singapore Standard 540. The British Standard 25999 (BS 25999) introduced a similar term, maximum tolerable period of disruption (MTPD).

The ISO 22301:12 (expected for release in summer 2012) is expected to replace BS 25999 and to include the term MBCO. As of this writing the ISO 22301:12 was not yet published.

The minimum business continuity objective is used to encourage executive management to take ownership and guidance of continuity programs. Revisiting the MBCO throughout the process of business continuity is important. As business objectives change, the MBCO should also be reviewed to ensure it remains consistent with the goals of the organization.

Determination

To establish an MBCO, the organization must identify the business activities and processes that shall not be disrupted. The identification begins [Page 621]with the detection of critical business functions or time-sensitive business functions. The SS540:2008 standard maintains that MBCO shall be defined after a risk analysis is performed and before the business impact analysis.

The completion of a business risk analysis and business impact analysis provides quantitative and qualitative impacts if these critical business functions are lost. The business impact analysis can provide the information needed to understand the organization and the level that it requires to maintain continuity during any incident or disruption. It is important to identify dependencies for the critical functions identified in determining the MBCO. Other key information essential in determining minimum business continuity objectives includes recovery time objectives, recovery point objectives, and minimum resource requirements. The recovery time objective of an organization is the length of time in which a business process must be restored after disruption. This time period may be referred to as the maximum tolerable period of disruption. Beyond this duration, the damage to the organization becomes critical and often beyond recoverable. It should be noted that the terms MBCO and recovery time objective are not interchangeable.

The recovery point objective is the maximum duration of time over which information data or service may be lost. This time period is also known as the maximum acceptable outage. Again, the extension of disruption beyond this time produces a severely negative impact on the organization.

The minimum resources required for business continuity and recovery are also necessary in determining MBCO. All of these objectives and standards are integral in setting the proper MBCO. Neglecting to take this factor into consideration results in an MBCO that does not provide levels of service that increase the resiliency of the business.

When setting the MBCO, it is important to understand that these objectives can be viewed in many different perspectives. For example, an MBCO can be seen as either the minimum amount of time that service can be unavailable or as the amount of time it takes to recover the service. Clarifying the objective so that everyone within the organization understands it is critical. The MBCO differs from maximum tolerable period of disruption (MTPOD) because it is based on a level of service or product rather than an amount of time within which an organization must resume normal function.

...