This exchange was published in Hansard on 01 July 2009:

Business Disruption Plans

Lorely Burt (Solihull) (LD): What steps her Department is taking as part of its civil contingencies responsibilities to increase the proportion of small businesses which have a business disruption plan. [283135]

The Minister for the Cabinet Office and for the Olympics, and Paymaster General (Tessa Jowell): The Civil Contingencies Act 2004 places a duty on local authorities to provide business continuity advice, which ensures that advice reflects local conditions at times of emergency and meets local needs. To support that work, the Government have set up a business continuity advice line and in 2008 we published a national risk register to encourage organisations to prepare for the impact of business disruption. In addition, we are supporting the quality of that advice by the adoption of a British standard for business continuity.

Lorely Burt: In March, a Cabinet Office survey found that the proportion of small businesses that had a business continuity plan fell from 25 per cent. to only 14 per cent. The possibility of allowing a premium discount with insurers was being considered to see whether that would reverse the trend in respect of companies that had a business disruption plan. Will the Minister say whether she agrees with that strategy and how far the Cabinet Office has got with that investigation?

Tessa Jowell: It is clearly the responsibility of local authorities to pursue that policy with their small businesses and through their local organisations. However, the figures to which the hon. Lady refers rightly give cause for concern, and I am happy to write to her further about that matter.

Julian Thrussell BSI’s BS 25999 Standards Manager commented: “The low number of smaller firms with Business Continuity plans is disappointing. Often when I talk to smaller firms they are under the impression that Business Continuity has to be a big, complicated or expensive project. Nothing could be further from the truth. The best Business Continuity plans I see are remarkably simple and concise.

• What does the business do?
• How is it done?
• What can be done to minimise potential problems?
• How would you respond if something did happen?

“If a small firm can ask itself these key questions and produce answers that work for them, that may be all that’s needed. The British standard BS 25999 sets out how this can be done most efficiently. Business continuity is well within the abilities of all small firms.”

According to a report from the Information Commissioner’s Office (ICO), a total of 711 bodies have reported security breaches in the past two years, 231 of which related to theft.

A series of formal undertakings have been signed to increase measures designed to protect sensitive information and Deputy Information Commissioner, David Smith, told an audience this week that incidents can result in “a significant fine”.

“The majority of organizations get data protection right, but regrettably a significant minority of management teams are failing to take data protection seriously enough,” he added.

In related news, the ICO recently found Maidstone and Tunbridge Wells NHS Trust in breach of the Data Protection Act and the health board has agreed to boost security measures with regards to patients’ personal information following the theft of an unencrypted laptop.

The survey found that data failure was one of most common causes of disruption.

Philip Caulfield, Managing Director at Adam Continuity, commented:
“Data failure is one of the most common disruptions to business continuity. If not managed properly, these incidents can escalate quickly to cause excessive downtime that wastes hundreds of thousands, if not millions of pounds. To ensure that they are dealt with quickly and to minimise their negative impact, companies should be developing robust business and data continuity plans and communicating them to all staff. These should include clear strategies for retrieving compromised data in suitable recovery times.”

According to Adam Continuity, the three most common causes of data failure relate to power outages, hardware problems or broken air conditioning systems. But while data warehousing firms can protect and backup data, many businesses are missing part of the puzzle.

Caulfield continues:
“Too many business leaders focus on data backup only without considering how they would retrieve that data in the event of an invocation. It is a common mistake that if your data is safely stored your business is safe. If a contingency plan does not incorporate a strategy for returning that data to staff who need it, in a format they can use and within an acceptable timeframe then the fact that it is stored safely is meaningless.

“In some sectors, such as finance, organizations need to comply with data continuity requirements set by the government. But the threat of lost data applies to any business that relies on information to operate successfully. This is why we ensure our clients rehearse strategies for retrieving data regularly, which means in any instances data failures are dealt with immediately and not even noticed by front office staff.”

For more information, reference the links below:

http://msdn.microsoft.com/en-us/library/ms177429.aspx
http://www.databasedesign-resource.com/sql-server-restore-database.html
http://msdn.microsoft.com/en-us/library/aa237568(SQL.80).aspx