There is an extensive webinar programme which can be accessed from the BCI website and you canalso refer to page 7 for all ContinuitySA webinars.

In this issue we cover the dangers of insourcing your business continuity and what the benefits are foroutsourincing them are. The BCI showcases their annual BCI Africa Conference taking place in Septem-ber – be sure not to miss out and book your seats early, it is my understanding that there will be a hostof local and international speakers at this conference.

ContinuitySA is also hosting a cyber security event on the 19th May in Midrand aimed at C-level exec-utives from board members to the CIO, CFO, COO, CTO and CEO the event will give answers to ques-tions such as how to quantify a cyber threat? Reflect and get advice on how prepared you are forthese threats and look at how the threat landscape can be monitored. Be sure to view the invitation onpage 5 and click on the link to register as seats are limited.

Read about resilient office space as a service and how this is a growing integrated approach towardsoffice space.

Come and visit the ContinuitySA stand at the MyBroadband Cloud and Hosting event on the 25th May2016 and find out more about our Disaster Recovery as a Service solutions that we provide.

Last but not least diarise the LAN Gaming event that we will be hosting in August. Sponsorships will opensoon. So watch this space

Wishing you, health, wealth and resilience.

Cindy Bodenstein

Q2 2016In this Issue

Editor’s Note

Business Continuity and Resilience AwarenessThe general theme for our quarterly newsletter is business continuity and re-silience awareness. This goes hand in hand with Business Continuity AwarenessWeek which takes place from 16 to 20 May 2016. The theme for BCAW is returnon investment and this is designed to help raise the profile and demonstrate thevalue of business continuity.

1

2 Dangers of insourcing yourbusiness conti-nuity

5 Cyber Securityis a Businessand ExecutiveIssue

7 BCAW 2016Webinars

9 Data Recoveryas a Service

10 Cloud & Hosting Conference2016

11 Resilient officespace as aservice

14 ContinuitySAopens Durbanresilience centre

13 ContinuitySA Training Dates

Learn More:Click on the interactive

links

2

“If Africa is to realise its massive potential, it has to presentitself as a safe place to do business,” says Olivier. “Crediblebusiness continuity plans and arrangements are one wayof doing that. Based on my many years of working withAfrican companies, I feel that outsourcing to an expertbusiness continuity provider is the smart way to go. Africanbusiness people have many challenges to overcome, sowhy add another, especially one that is both importantbut non-core?

“There’s a reason so many successful companies globallyoutsource business continuity: they realise its importancebut do not want the distraction that comes with setting upand maintaining an environment on which they will utterlyrely in the event of a crisis. African companies should fol-low suit.”

Olivier lists some of the main dangers of insourcing businesscontinuity based on his experience in Africa particularly:

• Lack of process and a corporate champion. Giventhat the business continuity environment is not yet mature across much of the continent, responsibility forbusiness continuity is likely to be assigned to a relativelyjunior manager. What this means, says Olivier, is thatwhile companies spend a great deal of money acquir-ing premises and fitting them out with hardware andfurniture, equipment is often “borrowed” from the IT disaster recovery centre when needed, and not replaced. Over time, the disaster recovery capabilityloses its capacity to provide the company with sufficient backup in an emergency.

“When the company’s disaster recovery facility is thecontractual responsibility of a third party, this cannothappen. We’ve had occasions to lend a client a serverin exceptional circumstances, but only for a very limitedtime,” he says. “Outsourcing is a way of making surethat the discipline of process is followed – somethingthat can be forgotten internally.”

• Testing is patchy and lacklustre. The best businesscontinuity plan and facilities are worthless unless theyare continuously tested. Most companies lack the dis-cipline to test properly and regularly because they areimmersed in their core business, and bad test results areseen negatively. Testing has to be regular and failuresare actually good because they ensure the businesscontinuity plan is constantly improving, Olivier says. “It takes an expert to run a testing programme thatstrengthens the company’s ability to survive a disaster.Insourced testing in most cases tends to be more a tick-box exercise and can be attributed to the lack ofspecialised BCM and IT Service Continuity Skills. This isexactly the skill that a company such as ContinuitySAprovides to its clients”.

• Practical issues are often overlooked. It’s easy to seedisaster recovery purely as a technical issue. Not so,says Olivier, as many companies find to their cost whenthey have to move for example 30 or 100 staff membersto the disaster recovery site. For one thing, employeesneed more than a computer and a telephone to dotheir work – in practice, they will have a library of linksto corporate or partner sites they habitually use, orneed a security token to log into payment systems. “AtContinuitySA, we have developed the concept of the‘battle box’, a physical and virtual store of everythingthat individuals need to work at a strange site,” saysOlivier. Other practical points that can be overlookedbut that dramatically affect productivity include canteen facilities and access to public transport.”

• Incorrect siting of the disaster recovery facilities. Anumber of important considerations have to be takeninto account when siting the disaster recovery facilities,and it’s easy to make errors, Olivier says.

Dangers of insourcingyour business continuity

Evaluating the benefits of insourcingversus outsourcing your businesscontinuity requirements

As more and more African organisations wake up to the need for business continuity, ContinuitySA’sGM: Africa, Willem Olivier, says that while insourcing might seem like the easy option, there aresome significant pitfalls – as well as higher costs over the long term.

These would include ensuring it is far enough away fromthe production site not to share the same telecommu-nications, water and power infrastructures, while stillbeing accessible to staff who might have to use publictransport. “I have seen an apparently good disaster re-covery facility a block away from a big fuel depot, withall the risk that entails,” says Olivier. “For a non-expert, itis easy to miss this kind of thing, but a specialist shouldnot make this kind of mistake.”

• Loss or change in BCM skills profile. Companies thatdevelop their own recovery solution often overlookthe skills that are required to build, implement,manage and test a recovery facility. Inmost of the cases the BCM manager willbe skilled in some of the disciplines re-quired but it is inevitable that at somepoint there will be a gap. To makematters worse, people change jobswhich then means the new BCMmanager will in all likelihood need totake over an arrangement that was implemented by someone that nolonger works for the company. Thesecircumstances places the new BCMmanager in a very difficult position as it willtake up a long time for him or her to under-stand the full scope of the insourced recovery setup.In an outsourced model it is a lot less complex as theoutsourced party will be driven by a contract and aService Level Agreement making the change over forthe new BCM manager very simple.

• Skills profile of the Outsourcer. BCM skills in Africa areextremely scarce and often very expensive. In a com-

pany such as ContinuitySA over twenty years of special-ising in Business Continuity supplying advisory services,work area recovery, IT disaster recovery (or IT systemscontinuity), server hosting, data replication, high avail-ability and several other specialised skills comes natu-rally as this is built into our DNA, adds Olivier. Whencompanies outsource, they get access to these skillswhich they will normally not get from just one BCMmanager in their organisation.

• Syndicated versus dedicated. When companies buildtheir own recovery facilities they will in all cases be

dedicated to just that company. This makesthe internal solution more expensive over

time without the company realising it.When outsourcing there are several op-tions where cost saving can be estab-lished through syndicated models,says Olivier. These include syndicatedoffice recovery seats which is severaltimes lower in cost than a dedicatedseat. Not all companies require their

office recovery to be dedicated. Thiscost saving can be further extended

into data centre space, racks within a syn-dicated area and even individual rack slots

in a syndicated rack.

• Cannibalisation of critical recovery equipment.Companies that insource their IT recovery equipmentare often faced with a situation where they need to remove equipment from the recovery centre to putinto production to act as a stop gap until the next financial year. This will then attract another capital expense motivation which could face the axe due to

3

budget constraints or financial cost savings. In these circumstances the critical recovery equipment is neverreplaced so then at a much later stage, the companycan be exposed to this risk. In an outsourced model,Olivier adds, this will not occur. ContinuitySA can assistcompanies in these situations that are outside of con-tractual obligations.

• Financial misconceptions when building a recovery fa-cility in an insourced model. Many companies believethat they can build a recovery facility at a lower costcompared to a recovery company such as Continu-itySA. In many cases this can be achieved by using re-dundant furniture and computer equipment which isthen installed in an old office or branch the businessmay have. This way the initial capital expenditure is lowand there are several hidden costs which the com-pany’s BCM is not considering. These being utilities,rental or depreciation of the building, legal costs, staffcosts from other departments such as Facilities Man-agement, change management attracting capital expenditure, interest, maintenance, cleaners, resiliencyon one or two BCM specialist that may work for thecompany and reflecting a capital expenditure versusan operational expenditure model. Capital expendi-ture models remain on the balance sheet and will continue to attract additional capital expenditureevery year. Olivier argues that outsourcing removes allthe above issues and is reflected as a full operationalexpense for the business. Changes to the recovery configuration in years after the signing of the originalcontract will not require the internal BCM or IT SCMteams to re-motivate for capital, in an outsourcedmodel it is simply an additional operational expense.

• Influencing factors to consider. When considering insourcing versus outsourcing, companies should con-sider the following factors and analyse each of thembefore considering insourcing a recovery solution:

o Costs hidden and direct

o Capex versus Opex solutions

o Skills and training of staff to ensure they are spe-cialised in understanding BCM

o Experience in testing or performing a recoverywhen a disaster hits.

o Available resources in terms of people and intel-lectual capital

o Demand on strategic resources such as only oneor a limited number of BCM or IT Continuity man-ager in a company

o Redundancy of hardware and staff during periodof downsizing

o Capacity of the recovery facility to take the fulloperational load in a major disaster and the ca-pability to scale up after such an event

o Infrastructure cost to maintain which include allhidden costs

o Maintenance and change control

o Measurement, quality and testing. Will the BCMmanager ensure an independent confirmation ofa test

o Focus. Is BCM the company’s core business orwould they rather outsource to a specialist

4

In conclusion, says Olivier, business continuity is a complexand an ongoing process, not a single event. For that rea-son alone, it makes sense to partner with a specialist.Doing so also has cost benefits because it effectively al-lows the company to share costs, while moving expensesfrom its capital to its operational budget.

5

www.thebci.org

7

WEBINARSBy ContinuitySA

7

Risk and Business Continuity Management – Addingvalue or just ticking boxes?Date: 18th May 2016Time: 10:45 – 11:45Speaker: Junita van der Colff, Senior Manager Advisory ServicesURL: https://www.brighttalk.com/webcast/1476/203711Risk and Business Continuity Management is often regarded as “grudge” compliancepurchases or appointments – there are many truths in this negative feeling and per-ception for a lot of organisations. This presentation will look at how we should approachrisk and business continuity management to ensure it adds to the overall business re-silience of our organisations and will unpack the value of resiliency.

Measuring the BCM maturity to optimise the ROIDate: 16th May 2016Time: 11:45 – 12:45Speaker: Karen Humphris, Senior BCM Advisor at ContinuitySAURL: https://www.brighttalk.com/webcast/1476/204581A demonstrable ability to survive and recover from major disruptive events has becomeone of the most important success aspect of any business continuity management(BCM) programme. Measuring the organisations BCM maturity is essential as the resultsare highly useful both as a measure for BCM capability and as a decision-making fa-cilitator regarding areas in need of greater attention in order to improve BCM maturity.It is therefore a model which addresses the need by management to assess the effec-tiveness of their programmes as well as optimise their BCM spend.

Insourcing versus Outsourcing and the ROIDate: 17th May 2016Time: 13:15 – 14:15Speaker: Willem Olivier, General Manager: Africa ContinuitySA

URL: https://www.brighttalk.com/webcast/1476/204567BCM insourcing does seem too many organisations as more advantageous and manydo believe insourcing will also provide them with a cost saving, there are howeversome significant pitfalls as well as many unquantified costs over the long term. Thetopic will cover these pitfalls many organisations do not take into consideration wheninsourcing BCM.

8

9

Take advantage of the cloud computing model and latest technologies to outsourceyour IT disaster recovery to Africa’s leading provider of business continuity managementservices, ContinuitySA. Our fully managed, end-to-end, remote Disaster Recovery as aService (DRaaS) offering will:

• Reduce disaster recovery costs through economies of scale and shared infrastructure• Reduce complexity and eliminate management/ IT loss of focus• Save time—in implementing disaster recovery strategy, in managing it and, most importantly,

in getting your systems back up and running when disaster is invoked• Provide a comprehensive disaster recovery solution that genuinely mitigates your specific risks

and will keep your business running

Contact us NOW to arrange a consultation: 011 554 8000ContinuitySA is Africa’s leading provider of business continuity management services to deliver business resilience.We can help clients scope and design a disaster recovery service that is expertly managed and takes advantageof the latest technologies in server replication, disk-based backup and virtual server hosting. With 24/7 support, man-agement, monitoring and reporting, Disaster Recovery as a Service from ContinuitySA will give CIOs, directors, boardsand shareholders total peace of mind.

Disaster Recovery as a Service:Guaranteed peace of mind

www.continuitysa.co.za

10

11

”Companies are increasingly concerned to make surethat their offices are disaster-proof, and that they cancontinue trading through power, water and network out-ages, or any other incident,” Wolfaardt says. “But at thesame time, they are unwilling to assume the burden ofmaking all that happen – ensuring resilience is a movingtarget as risks shift.”

An additional factor is that many companies are lookingfor better ways to procure and manage their officespace in general. Offices are complex to set up andmaintain and office renovations can be costly- asidefrom all the conventional issues relating to office man-agement—furniture, canteens, cable infrastructure andthe like—installing and managing sophisticated IT and te-lephony systems are critical and burdensome obligations.

For several years, ContinuitySA has been offering aturnkey solution to companies who want the peace ofmind offered by a resilient office space, and also want amore integrated approach. “This is particularly true ofthose with fairly demanding requirements; for example,a contact centre with lots of agents needing sophisti-cated telephony and robust ICT, a bank head office ora security company.

For such organisations, the office space has to be highlycustomised, and it has to be ultra-reliable, no matterwhat,” Wolfaardt says.

Located as part of its premises in Midrand and Randburg(2 000 m2) as well as Tyger Valley in Cape Town (300 m2),ContinuitySA’s office space is fully furnished and config-ured to client needs, right down to hardware and top-of-the-range telephony. Common areas, like canteens,meeting areas and boardrooms can be dedicated orshared. It benefits from ContinuitySA’s fully redundant ICTplatform hosted at the onsite data centre, including fullpower and water backups as well as a full range of con-nectivity options – all the major network providers termi-nate at ContinuitySA’s facilities.

“Best of all, the facility comes fully managed via our ownservice desk, so there’s no impact on the client whenthings need fixing or replacing, or a network or IT systemgoes down. Think of it as ‘resilient office space as a serv-ice’,” Wolfaardt explains. “Best of all, aside from an up-front implementation fee, it’s all a fixed operationalexpense paid for on a single invoice. As it says on the box,‘No mess, no fuss’!”

Resilient office space as a service – no mess, no fuss In today’s difficult economic climate, companies are increasingly looking for smarter ways to pro-cure the office space they need—especially now that the added expense and management bur-den of resilience is added to the mix. Ernst Wolfaardt, GM: Operations at ContinuitySA, says that agrowing trend is to take an integrated approach, effectively procuring resilient office space, ratherthan spending the time and money to make conventional office space resilient.

“For many years, we have serviced KwaZulu-Natal clientsvia a partner but the steady growth our client base in thearea, in part thanks to our close working relationship withour parent company, Internet Solutions, has enabled usto commission our own facility,” says Michael Davies,CEO of ContinuitySA.

The 750m2 Mount Edgecombe recovery centre is conve-niently located close to the N2 highway, and is wellserved by public transport. As with all ContinuitySA facili-ties, it has excellent 24-hour security, adequate and se-cure parking, and backup power for complete resilience.In addition, all services run off a centralised uninterrupt-ible power supply. It offers the full range of business con-tinuity management services, including work-arearecovery. ContinuitySA will continue to deliver its businesscontinuity advisory services from the new facility.

“Many of our national clients have offices in KwaZulu-Natal, so we will be able to service them from the newrecovery centre. We also aim to expand our client basewithin the region’s growing number of businesses,” con-cludes Davies. “In today’s economic and geo-politicalenvironment, companies are paying ever-greater atten-tion to making their businesses resilient, and are turningto expert specialists like ContinuitySA to help them.”

ContinuitySA opens DurbanResilience Centre

ContinuitySA has announced the opening of its first dedicated facility in KwaZulu-Natal. The new resilience centreis located in the Fairways Office Park in Mount Edgecombe, just north of the Umhlanga/ La Lucia business node.ContinuitySA is Africa’s leading provider of business resilience solutions, including business continuity advisory, withrecovery sites in Gauteng, the Western Cape, Mauritius, Mozambique and Botswana as well as its new site inKwaZulu-Natal.

12

The 5 day Complete Continuity® Practitioners Programme is designed to equip Business Continuity prac-titioners within any organisation in all aspects of implementing,managing and maintaining an effective Business Continuityframework in their respective environments.

The course is based on the Business Continuity Institute’s GoodPractice guidelines and ISO22301 international standard.

Key elements of the 5 day Complete Continuity® PractitionersProgramme include:

• Introduction and Origins of BCM• Trends and Observations• Standards and Compliance• Elements of the BCM Lifecycle

• BCM policy and Programme Management• Embedding BCM in the Organisations culture• Understanding the organisation

- Business Impact Analysis- Continuity Requirements Analysis- Risk Assessment

• Determining BC Strategy- Selecting strategies and tactical responses- Consolidating Resource levels

• Developing and Implementing a BC response• Exercising, Maintaining and Reviewing• Measuring BC Maturity

Make the Reaction Routine

Africa’s largest Business Continuity service provider, ContinuitySA, Complete Continuity Training Academy

To register or to find out more please contact the training department on 011 554 8000 oremail us on training@continuitysa.co.za or simply register online via www.continuitysa.co.za

13

Complete Continuity Practitioner Programme (5 Day Training)25 – 29 May, Johannesburg7 – 11 November, Johannesburg