This latest Microsoft outage serves as another example of why organizations must invest in proper business continuity and resilience. While it is too early to say what actually caused this event, we can all agree its impact has been significant. And the cause, while interesting, really doesn’t change what organizations should do to be better prepared next time.
Recommendations
Having talked to organizations around the globe in my previous work, my recommendation remain unchanged. Using email as the latest example, a prepared organization (one who has committed time to the pursuit of resilience) would know ahead of time that email is a Tier 1 solution that is critical to the organization’s goals. And luck indeed favors the prepared.
With the knowledge in hand that email is critical, a resilient organization has already taken steps to respond and recover from events like the one unfolding today. Ensuring one’s platform is properly distributed across availability zones is increasingly not enough to ensure “continuity” of services. In this case, a prepared organization already has a different email solution agreement in place with some accounts already provisioned.
With this alternative agreement already established, the organization can quickly extend email functionality to other critical areas of their business. Of course again here please note that a prepared organization already knows which areas are most critical where less prepared organizations do not. Extrapolating the impact in this Microsoft outage demonstrates that a prepared organization is able to offer an alternative email solution in minutes as compared to days or weeks. A less prepared organization is often impacted doubly – once by the initial event and then again by their lack of preparedness.
The Good News
The good news is that being better prepared next time doesn’t require buying additional expensive cloud services or new hardware. Instead, organizations should invest in proper business continuity. They should perform regular business impact analysis (BIA) and then incorporate those results into their technology stack, policies and plans. The BIA results provide the foundation for all things resilience. For example, knowing your most critical business functions (Tier 1) helps ensure you are focused in the right areas to strengthen. Sorry marketing and sales – these areas are typically not as important as email.
As another example, lets say in addition to email being identified as a critical business function, processing invoices is deemed to be Tier 1. A resilient, well prepared organization will know ahead of time what is involved in processing invoices. Lets assume there are internal staff that must perform a part of the work, but there are likely third parties involved as well. These are all rolled up together and treated as Tier 1 also, as they inherit the criticality of the function they enable.
Third parties who support Tier 1 business functions should be evaluated differently than those that support less critical business functions. A one size fits all vendor checklist is also no longer enough. Instead, match the rigor and efforts to the criticality of the function they support.
Tier 1 dependencies must be treated differently than Tier 3 or Tier 4 functions. Unfortunately, businesses often treat them all the same. This translates to overspending in some areas and underspending in others. An easy for example is that a resilient organization will already have alternative third parties identified and under contract to ensure business continuity, should something happen to their primary (our initial email discussion applies here).
Going Forward
A final example of how the BIA results help guide an organizations efforts relates to their testing and training strategies. Initially, efforts should be made to ensure regular testing of plans through table top exercises that target those most critical business functions. As organizations mature and become more resilient, they may begin to include their most critical third parties to join them in their testing efforts.
Building a proper business continuity program is not rocket science. It requires investing in proper staff, and as the program matures can be augmented through very mature software platforms that harmonize business continuity, crisis management, and disaster recovery just to name a few. Forward thinking organizations around the globe are watching closely the increasing resilience regulations that are governing many regulated industries. Doing so will help them stay ahead of their competition and quite possibly may be the difference in remaining a viable organization as demonstrated by the latest Microsoft outage.
