Business Continuity Lessons Not Learned From Sept. 11

A recent Gartner survey shows many enterprises aren't doing enough to ensure business continuity following a catastrophe. Gartner urges enterprises to make disaster preparedness a higher priority.

On 23 January 2002, Gartner released the results of a survey conducted in cooperation with the Society for Information Management (SIM). The survey found that found few enterprises have business continuity plans to deal with the consequences of catastrophic damage or physical attacks. Among the findings were:

• Only 13 percent of enterprises surveyed said they are "mostly" prepared for a major loss of life resulting from catastrophic damage or attacks.
• Only 28 percent report business continuity plans for dealing with the consequences of physical attacks.
• Only 36 percent have a plan for complete loss of physical assets and workspace.

The Gartner/SIM survey reveals depressing news: Many enterprises have not yet learned a key lesson of Sept. 11 and have not put significant resources into establishing operational resilience in case of catastrophic damage. Sept. 11 prompted a great deal of talk about improving planning for business catastrophe; unfortunately, this survey suggests that much of this talk has not yet translated into substantive action.

Gartner continues to recommend that enterprises act now to make the kinds of policy changes that will ensure business continuity in case of natural or man-made disaster. Gartner regrets to say it, but events such as Sept. 11 create a relatively short window of opportunity, usually about 12 months, during which awareness is raised, and executives are motivated to take action and devote their time to making real changes. Should enterprises continue to act sluggishly in creating new and improved business continuity practices, they will have missed an important opportunity. As a result, many enterprises run the risk that nothing will have improved the next time a catastrophe occurs. Sept. 11 raised the level of what constitutes best practice for business continuity planning (BCP), but few enterprises will get over that bar unless they act soon.

Analytical Source: Simon Mingay, Networked Systems Management

Need to Know: Reference Material and Recommended Reading

• "A Letter to the CEO: BCP Does Not Come for Free" (COM-15-1669) There's a difference between what enterprise executives say and what they do about BCP for a catastrophic event. By Simon Mingay
• "Aftermath: Business Continuity Planning (AV-14-5138) During the past 10 years, BCP has grown from planning for disaster recovery to include planning for business recovery. By Vic Wheatman, Donna Scott and Roberta Witty

(You may need to sign in or be a Gartner client to access all of this content.)