In-House Versus Third-Party Recovery

Which Is Better?

A key decision point in the engineering of business continuity capabilities is whether the recovery environments (operations) will be integrated with other in-house operations or co-sourced/outsourced to third-party providers. An equally important decision is the determination of skills-sourcing to drive the life-cycle phases of establishing/maintaining the operational recovery environments and associated BCP documentation.

The successful business continuity program must consider the continuity of all of the resources of the extended enterprise. These may include people skills, information residing on electronic and manual media, real estate and facility support services, equipment and the software that drives equipment, communications services, raw materials, environmental services, and government services.

As such, the engineering of continuity capabilities must be fundamentally based on the identification and selection of alternative sourcing for all critical resources. In some cases, the basic alternatives of in-house versus third-party sourcing may not readily apply. For example, provisioning raw materials for a recovery environment may be difficult to cost-effectively source in-house versus identifying diverse access or alternate suppliers of such resources. Also, one must hope that the proper planning for continuity of operations (COOP) and continuity of government (COG) has insured the continuity of the government services critical to enterprise operations, because certainly no effective alternative readily exists for such services.

Alternative Source Criteria
The key criteria for evaluating the alternative sourcing options for critical operational resources include:

• Cost – certainly low cost will always be an objective in acquiring access to resources you never expect to utilize (except for testing purposes).
• Availability – the alternate resources must be available so as to conform to the recovery time, point, and capacity objectives.
• Specification Uniformity – the specifications of the alternate resources should be as much in conformance with those of the primary resources as possible to improve the likelihood of a successful recovery.
• Flexibility – the sources of recovery resources should be able to rapidly adjust to the ever-changing resource requirements of the primary operations.
• Operational Domain – for efficiency and effectiveness, especially as recovery intervals are becoming more demanding, the primary and recovery operations of a particular business function should usually be within the same operational domain, though inevitably in different locations (e.g., if the primary operations of a business function are outsourced, the recovery environment and resources will frequently be better deployed in outsourced mode with the same supplier, and likewise for in-house operations – a clear break from the traditional views).
• Design Uniformity – the recovery resources should architecturally integrate with the primary operations as much as possible as if designed together at the same time (which hopefully more often will be the case).

Sourcing Skills
Some final thoughts on sourcing the skills to perform business continuity planning are provided in conclusion. These skills largely fall into two types:

• Engineering – skills including program management, process analysis, business impact analysis, risk assessment, emergency and continuity management architecture, and strategy analysis.
• Deployment – skills including capability and plan development, project management, implementation, training, testing, and maintenance.

These types are analogous to the systems design/architecture versus programmer/testing/maintenance skills in the systems development world. Like programming skills, the continuity deployment skills are becoming more of a commodity due to improved availability of training and lower experience requirements. However, continuity engineering skills are much scarcer due to the higher experience requirements and dearth of available training. A meaningful investment in continuity engineering, like systems engineering, will pay back many times over in more efficient and effective capabilities, optimally determining sourcing for alternative operations resources. For maximum cost-effectiveness, it is often more optimal to provision deployment skills from the same source as the operational recovery environment whenever possible. Yet for optimizing both cost-effectiveness and especially objectivity, it is never appropriate to provision engineering skills from the same source as the operational recovery environment.