Scrutinising Networks for your Business Continuity Planning
At least once a week, gardeners at my apartment building do a thorough job of mowing the lawn and clearing the brush underneath my window. I question the necessity of this exercise when it’s especially loud and I’m trying to converse client on Disaster Recovery and resilience in general.
In theory, if the pathways and garage exit weren’t clear, someone in my building could get injured or be impaired from getting to work. It’s something that could be documented by a risk management team - what if staff are impeded from coming onsite - a far less demanding scenario to track and mitigate than weather events, active shooters, or global pandemics.
The problem facing business continuity planning (BCP) and disaster recovery (DR) specialists in scenario adaptation was often “how far down do you go” - but in the modern age of global companies and "efficient" supply chains, today’s organizations aren’t going far enough.
It’s a simple (but not easy) task to analyze the effect of a cargo container wedged sideways in the Suez Canal[1], or the disruption of people and products in war-torn Ukraine - but what about a ship crashing into a bridge[2] on the other side of the ocean?
Consider the full stack
Further down the stack: if one of my roommates can’t get to work because of landscaping and your latte comes late, it’s not going to trigger your BCP - but when thousands can’t cross a bridge because of a traffic accident or passionate protestors, even in another country, your contingency planning can only stretch so far.
These incidents are worth revisiting as part of BC/DR planning, because not only has the world gotten more “complicated”, but the infrastructure and agencies underpinning the basic movement of goods and services is not as resilient [3] [4] as 25 or even 10 years ago. The butterfly effect is more impactful to modern organizations, especially when your span of control needs to encompass indifferent governments or low-margin networks (shipping, airlines, cellular) that do not have contractual obligations to meet your organization’s redundancy requirements.
We’re encountering more scenarios where assumptions about third-party services - cloud providers, shipping companies, healthcare entities - do not match the “best efforts” reality of today. The hope that your company will get preferential treatment - based on an SLA, customer relationships, or even good-will - is dwindling as infrastructure ages, labour strikes occur daily, and government systems that underpin our operations are underfunded and politicised[5] [6] . For example, the UK rail network[3], or federal agencies in the US[4].
The chemical spill causing your staff to shelter-in-place will be tackled by the city’s hazmat team asap … but what if it’s not? It's unlikely your company owns a bridge or transit system or fire-station or private communications network, so organisations need to challenge the low-level assumptions about outside their control. Disruptions are more likely to cascade around the planet in our global economy, requiring more depth to the org’s plan B than in more idyllic times.
So, what can you do?
As part of your DR/BC planning, consider:
- Mapping critical dependencies beyond Tier 1. Include ports, bridges/transport corridors, telecoms/cloud, utilities, and key public agencies.
- Tightening vendor oversight. Pre-arrange alternates (e.g. multi-carrier logistics, multi-cloud/telecom services) and realistic escalation paths when SLAs meet systemic constraints.
- Buffer where it matters. Revisit just-in-time; hold contingency inventory or nearshore options for critical SKUs and services.
- Monitor weak signals. Track and anticipate infrastructure and mobility indicators (shipping, aviation, labour action) and set triggers that prompt early response.
- Engage locally, plan globally. Build relationships with relevant public bodies/industry groups.
You can argue whether the world (and its supply chains) have become more fragile and convoluted or not - but organizations need to spend more time understanding the foundations of their BC/DR plans, our shared risk, and the repercussions that will affect safety and customers.
More on
About the author
Michael Hoff
Senior Manager, IT Resilience
For almost 40 years, Mike has been active in all areas of IT operations, design, and management, including key roles at BlackBerry, The Forzani Group, ATB, the Calgary Health Authority, and TransLink. He specialized in Disaster Recovery programs, and regularly speaks at events in support of the Google Developer Group and other organizations. Mike is also an avid movie buff, offering his opinions on-air and online in Canada and the US.
