However, we did see a major change directly related to 9/11 on the federal, state and local government side. The formation of the U.S. Department of Homeland Security in 2002 started the ball rolling. DHS/FEMA has done a very good job in maturing the readiness of federal, state, local and tribal nation emergency operations, but it has taken years for DHS/FEMA to have an impact on private sector BCM programs. The focus on improved public/private sector communications through multi-state and national-level exercises (especially for the healthcare, financial services and public utilities sectors), the introduction of Ready.gov, and the Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) are three influential changes for private enterprises.

Even though 9/11 did not have an immediate impact on BCM maturity, it did set up the framework for preparedness, response and recovery improvements since for both the public and private sectors. The majority of these improvements have been a result of the confluence of three areas:

1. Increasing natural and man-made disaster events such as SARS, Hurricane Katrina, the bird and swine flu threats, the London and Mumbai bombings, the Iceland volcanic ash event, earthquakes in Haiti, Chile, New Zealand and Japan, oil spills, the global financial crisis of 2008, major ice and snow storms and so forth;
2. Technology innovations such as Internet broadband in the home, the real-time infrastructure, virtualization, hosting/outsourcing, smartphones and tablets, social media and cloud computing; and
3. Business operating practices such as regulatory changes in response to financial fraud, telework initiatives and outsourcing non-core competencies.

Without these changes to business and IT practices, many of the improvements we see today in BCM maturity would not be possible.

We have come a long way in BCM since 9/11 and we have a longer way to go for organizations of all sizes and operating models to be prepared from even the smallest, localized threat. Gartner is committed to your success in preparedness, response and recovery activities and continues to offer clients foundational and timely research in BCM and IT-DRM through our BCM key initiative for business and IT leaders. Take our maturity self-assessment called ITScore for Business Continuity Management to jump start your journey.

Key Findings

• The earthquake and tsunami that struck the Tohoku district in March, and the power plant failures and other infrastructure problems that followed, continue to disrupt communications, transportation and other infrastructure.
• The Japanese government and Tepco have implemented a plan for rolling electrical blackouts across Tepco’s coverage area, designed to reduce power usage and avoid total power failures.
• These blackouts present serious challenges for Japanese enterprises, particularly in maintaining the operational integrity of their data centers and offering alternative system access to remote workers.

Tepco has said it will not carry out its planned rolling blackouts this summer, but electrical supply continues to present challenges for Japanese enterprises. Gartner has developed a set of best   practices for various scenarios and affected parties for IT organizations in Japan and worldwide. The appropriate response to the rolling blackout depends heavily on whether or not the enterprise’s data center has its own dedicated backup power generator.

Read more about the best practices – if you are an organization impacted by the earthquake/tsunami or not – in the full report by my colleagues  Masahiko Ishibashi, Eiichi Matsubara, Nagayoshi Nakano and Katsuo Hori.  Being a Gartner customer may be required.

The findings in this research are based on a joint Gartner and Business Continuity Institute (BCI) survey of business continuity management (BCM) consulting firms conducted during the first quarter of 2011. The survey objective was to better understand the breadth and depth of BCM service offerings. It was sent by BCI to its self-identified consultant membership and by Gartner to members on its BCM consultancy list that opted to participate. The survey closed on 4 March 2011.

Key Findings

• Many firms say they cover many BCM disciplines, but terminology varies across industries and countries, and so, misunderstandings are common.
• There is an increased need for consultants with specific skill sets:
  • Strategic program development
  • Tactical program improvements
  • Pragmatic, situation-based expertise
• A strong BCM program cannot be run by consultants alone. Therefore, BCM expertise must be brought in-house to ensure its continuing success.
• Due to the 2008 global financial crisis (GFC), consultant ranks have risen due to the layoffs of BCM professionals, and many of these people have taken jobs as consultants while waiting for a full-time BCM practitioner position.
• Fifty percent of BCM consultancies are small, with one to four full-time consultants onboard.
• Organization certification support is low — 13% of firms surveyed have BS 25999 Lead Auditor certification — in alignment with the existing low level of organizations that have such certification.
• Ninety-two percent of BCM consulting engagements are for planning services.
• Only one-quarter (24%) of BCM consulting firms offer a guarantee for services rendered.

Read the full report here: BCM Consultancy Survey, 2011. You may need to be a Gartner client to access the report.

The feedback from the organizations I met with pointed to a few classic problems in crisis and emergency management:

1) the lack of an authoritative source for accurate and timely information;

2) the lack of coordination regarding evacuations; and

3) the  lack of coordination regarding power shutdowns.

These problems caused 1) government web site overload from people seeking accurate information which then led to falsehoods being spread via social media sites such as Facebook and Twitter, 2) gridlock out of Brisbane on January 11, 2011 after evacuation notices were sent to central district tenants, 3) organizations not being able to gracefully shutdown their data centers due to short notice of power shutdowns, and 4) confusion and frustration between the workforce and management – not every organization immediately issued an evacuation notice to their workforce. Compounding the tension were workforce communications problems due to the lack of Internet, cell phone and land line access as well as the lack of personnel on site on January 11, 2011 due to the northern area flooding where many people live – as one would expect, they stayed home to tend to their personal crises instead of coming to work.

On the positive side, the Queensland Police Service has been glowingly praised for countering the falsehoods being spread, including one that the Wivenhoe Dam would break and annihilate all of Brisbane.

All of the organizations I spoke with stood up their crisis command/emergency operations centers – many lost IT services for a few days, many were out of their production facilities for a few weeks and as mentioned previously, some lost their buildings for good. But all managed their way to recovery success and have returned to business as usual.

I will be publishing a more detailed report on these findings in the coming months, so watch for it on www.gartner.com.

But isn’t it obvious to do so? Are Americans THAT removed, resigned, scared, numb or distrustful to take action on what we inherently know as something “fishy”? Or, is DHS taking a page from a prior era with the major marketing success of “Smokey Bear” for fire prevention?

Depending on how Wal-Mart rolls out the program, shoppers may not even notice the announcement. I know for myself, as soon as I enter a store, I bypass anything and everything – notices, greeters and so forth – that distracts me from getting my shopping finished. It’s a rare occasion for me to lollygag. And putting diapers next to the milk has absolutely no effect on me – maybe because I don’t shop for either. But I have my list and that’s what I buy.

DHS has already rolled out “If You See Something, Say Something” in transportation environments, but in many of those forums, you are typically a captive audience – you can’t easily get off the subway to avoid the message.

What do you think? Would you notice the announcement  in a store? Would you take time out of your busy life to watch it? Are there better ways for DHS to consumer-enable the message? Let me know: I’m of two minds on this one: national security is of utmost importance but is the message channel the right approach?

I’m wondering what tools your firm is using during such events? They have to be hosted by the vendor since your data center is down. What about Yammer, SocialCast, SocialText Signals, Sametime/LotusLive from IBM, Lync/BPOS from Microsoft, Google Apps? Is anyone using them or another tool for emergency purposes, and if so, how?

Business Continuity Management Governance Defined, 2010

Without a governance framework in place, BCM programs will not progress as needed in the desired time frame. Use Gartner’s BCM governance framework to establish governance oversight according to your organization’s business model and availability needs.

Toolkit: BCM Governance and Implementation Responsibility Decision Matrix, 2010

Without a governance structure in place, business continuity management programs will not progress or succeed in the time frame desired. Use the BCM Governance and Implementation Responsibility Decision Matrix to document the governance oversight according to your organization’s business model.

Toolkit: Business Continuity Management Charter Best Practices and Template

A BCM charter is one of the most-effective tools for establishing and communicating effective preparedness, recovery and resiliency practices. Make the Gartner best-practice-based charter the foundation of an enterprisewide BCM program.

Toolkit: Business Continuity Management Policy Template

A business continuity management policy is an important component of the operational model for BCM governance. Combined with a BCM charter, BCM governance responsibility and implementation matrix, and the BCM activity cycle, it completes the Gartner BCM governance framework.