Designing and Developing a Business Continuity Plan Based on Collective Intelligence

. This paper proposes a methodological approach that supports Collective Intelligence towards the design and development of a Business Continuity Plan (BCP), in order to minimize the potential of a disaster in the organization. In this framework, Collective Intelligence (CI) is supported by Web2.0 technologies that act as a diagnostic tool, providing the ability to the community of an organization to contribute with their collective experience and their intelligence, in the resolution of factors affecting the success of the Business Continuity Plan (BCP). E-BCP, the platform developed for the BCP and it is supported by CI , is also presented. Some open research issues have been outlined.


Introduction
In recent years, a number of risk instantiations of significant importance have affected the business sector and more specifically the business continuity of organizations; some of such incidents have even been detrimental to the viability of the affected organizations.These incidents have pronounced the need for a Business Continuity Plan (BCP), a structured action plan to be followed in cases of adversity, which is considered to add value to organizations, creating competitive advantages, savingmoney, time and resources [Harris (2010)].A major success factor for a BCP in every organization, are the people who develop it and the organization community that accepts and contributes to its proper implementation.Factors, such as inefficient communication, participation and notification of the plan to the employees of the organization, may also affect the success of the BCP to a great extent.Web 2.0 technologies and tools have been examined from many different angles, including aspects with respect to consumers and businesses; emerging behaviors; models; ways in which information is searched, evaluated, produced, consumed and services are formulated [Bonabeau (2009)].In this paper, we examine how the notion of collaborative collective intelligence (CI) could be harnessed to contribute to the formation Business Continuity Plan (BCP).
A major challenge of this research was the ascertainment of minimum references on the design or the development of a Business Continuity Plan (BCP) based on Collective Intelligence (CI).This challenge was at the same time a strong motivation to examine how the Collective Intelligence could support critical aspects affecting professionals in the area of Business Continuity.
The remaining of this paper is structured as follows.Section 2 outlines the Business Continuity Plan, the process for its formation and the factors that affect a BCP.Section 3 outlines the existing platforms for Collective Intelligence.Section 4 examines how a Collective Intelligence platform could be used to support the Business Continuity Plan and section 5 concludes this paper.

Business Continuity Plan: Development Process and Critical Success Factors
The methodology for the development of a BCP in this paper is based on the BS25999 [ BS25999 (2006)].The lifecycle of the Business Continuity Management (BCM) consists of six elements and can be implemented by organizations of all sizes and sectors.The effort is adjusted according to the needs of each organization.These elements are described below :

BCM program management
The program management provides the ability to establish and maintain business continuity in a manner appropriate to the size and complexity of the organization [ BS25999 (2006)].This is the business continuity policy which states the objectives of the BCM developed by the organization.The key to this element is gaining top management commitment and assigning the appropriate roles and responsibilities to the BCM program team.

Understanding the Organization
The aim of this element is to provide important information to assist the understanding of the organization products, assets and services.This is performed through a process which is commonly referred to as a Business Impact Analysis (BIA).The objective of BIA is to determine the acceptable time frame restoration and the allowable data loss, which does not affect the business continuity.The first stage of BIA is to identify and prioritize the critical applications/processes and activities performed through the Risk Assessment (RA).This comprises the ongoing process of identifying threats, for assessment of their risk (in terms of impact and likelihood), and driving activities to avoid such risks or reduce such risks to acceptable levels.
Criticality Assessment.The purpose of a criticality assessment is to establish how critical a system or process is for an organization in the event of loss of confidentiality, integrity, or availability [Harris (2010)] An example is given in Table 1.

C (Confidentiality)
Loss of confidentiality, i.e. information may be disclosed to the wrong people.

I (Integrity)
Loss of integrity, i.e. information may be falsified or otherwise corrupted A (Availability) Loss of availability, i.e. information may not be available for processing or use for a specific period of: Criticality ratings (i.e. for integrity and availability) and critical timescales for availability must be verified against the Maximum Tolerable Downtime (MTD), that is, the time period between a disruptive event and restart of normal processing.

Classification of Systems and Processes.
To assure the criticality classification accuracy of the organization systems/process a benchmark method should be decided.One option could be the creation of a questionnaire evaluating the impact that may cause an organization loss according to the CIA (Confidentiality, Integrity, and Availability) triad and the MTD [Harris (2010)] An example is shown in Table 2.

Determining Business Continuity Strategy
As a result of the previous element (inputs and outputs of BIA), an organization will have to evaluate and choose the appropriate continuity strategies in order to meet the organizations business continuity objectives.The selection and evaluation of the applicable business continuity strategy depends on the Business Impact Analysis (BIA).The critical systems/processes have been identified; assessed, classified and critical timescales for availability have been considered according to the MTD.

Developing and Implementing BCP's
This element focuses in the development and implementation of the plans.These plans should include all the necessary actions required to meet the organizations business continuity objectives in case of a disaster.Individuals or teams with good business knowledge and expertise in certain domains of organizations are required to be involved.Every plan should be practical, complete, efficient, and include step-by-step instructions on what should be done and who will do it.

Maintaining and Testing the BCP
The aim of this element is to ensure that all the plans are reviewed, updated and tested periodically, to make sure that all arrangements are in place in order to safeguard the organization from a possible disaster.A BCP is a dynamic model that changes as the organization progresses in time.

Embedding BCP in the Organization's Culture
The final element aims for the BCP to become a valuable part to enhance an organizational BCP culture.The key to this element is communication, participation and notification of the plan to the employees of the organization.
It should be emphasized that an outdated BCP could be insufficient and may provide a company with a false sense of security; this could be devastating if and when a disaster actually takes place.Companies need a live and flexible structured action plan.In light of these, the following important factors affecting the success and the validity of a BCP in an organization [Harris (2010)] ought to be considered:  Management commitment  Effective communication, participation and communication of the plan to the employees of the organization  Proper assignment of roles and responsibilities among the project team  Proper identification and prioritization of critical applications/processes and resources  Identification of the risks that the organization needs to be protected  Test and regular review of the plan, in order to adjust any new developments and changes in the organization  A motivated environment inspiring innovative ideas.
When addressing business continuity planning, some organizations may focus only on backing up data and on providing redundant hardware.Even though these aspects are important, these are fragmented attempts towards the organization's overall operational capability.Working and planning a BCP must include the right people at the right places, establish alternative communication channels, and ensure that all processes and applications are properly understood and taken into consideration.

Collective Intelligence, Motivation and Platforms
Collective Intelligence (CI) may emerge extemporaneously and could be developed in many forms and setting.In recent years, the extensive use of Web 2.0 technologies have contributed to the development of services (i.e.Amazon Turk, Wikipedia, Google etc.) that encompass the principles of collective knowledge and collective problem solving and motivate a virtual community to participate in an innovative idea or design thinking.Various techniques have been reported [Surowiecki (2004)] for the exploitation of CI in organizations aiming to solicit knowledge and experience from the community, discover innovative ideas, enhance skills in various sectors while at the same time they save money, time and resources.Key to the success of CI is the ability of the organization to identify and highlight the appropriate motives in a community or an organization.Some motivational factors identified in [Malone (2009)], are listed below:  Ideologyparticipation in a collaborative intelligence contributing to something that it is believed that will make a difference in society  Challengeparticipation which provides a sense of personal fulfillment or selfrealization through the acquisition of additional knowledge and skills  Careerparticipation in the development of the individual's career  Socialdesire to exchange experiences with others  Funjoin for entertainment, enjoyment and rest from other activities  Reward -participation to receive tangible rewards such as money, gifts and prizes  Recognitionjoin in order to receive private or public acknowledgement  Dutyjoin in response to a promise or commitment to something.
Those organizations that are able to acquire knowledge and use it in such way that they create their own intelligence and collective solutions become more competitive.During the last years, a number of Collective Intelligence (CI) platforms have been proposed.These CI platforms may be conceptualized into two major categories.The first allows the crowd to collectively contribute to a project; for example, the design of an information system.The second leads the crowd to a simple and distinct problem solving and decision making; for example the "Amazon Mechanical Turk" [http://www.mturk.com.In this platform, challenges or problems are published to an unknown number of users; ideas and solutions are solicited through an open invitation.The users referred as the crowd, form and submit solutions, These solutions are evaluated by the original entity assigned the problem/challenge.Reimbursement may be cash, prizes or recognition.

E-BCP: A Platform that supports Collective Intelligence for a Business Continuity Plan
Collective Intelligence (CI) has been used in organizational settings to achieve increased innovation, productivity and responsiveness, reducing the time required to access the proper knowledge.Could CI assist in the development and design of a BCP by harnessing information, solutions and reducing uncertainly decision making during or before a disaster?Based on the BS25999 Business Continuity Management (BCM) lifecycle and existing applications of Collective Intelligence [BS25999 (2006)], we reckon that Collective Intelligence can support some BCP elements, as shown in Figure 1.

Fig. 1. BCM lifecycle elements which can be supported by CI are highlighted
As a proof of concept, a collective intelligence platform was designed and developed (www.e-bcp.eu)enabling the users community within an enterpise in Greece to contribute their collective experience and intelligence to resolve factors that affect the success of the BCP.A screenshot of the platform (Greek version) is given in Figure 2.

Fig. 2. A screenshot of the E-BCP platform
This service platform was powered by innovation centric collaboration techniques, best practices and processes bundled into a single service conducive for open innovation.Mainly, the platform provides a Web 2.0 collective tool rewarding the knowledge and exploiting the intelligence of the organization's community to implement a BCP.Two tools have been implemented to support the "e-BCP" platform.These tools are shown in Figure 3.

Fig. 3. e-BCP collective Intelligence Platform
The first tool "Collective Intelligence Tool (CIT)" is based on the ability of the organization's BCP project team to raise challenges based on BCP issues that require resolution.Challenges included: the update of manuals and plans; suggestion on how to handle risks and recommendation on how to promote the BCP program within the organization's community.The user community can act as a problem solver and can identify the challenge(s) in the area their expertise and domain of their interest.The user individuals that solved the challenges may get reward, recognition and intellectual satisfaction.Once the predefined schedule for making solution is over, all the solutions created by solvers are submitted to the BCP project seeker team.The BCP project team (seeker) evaluates the solutions, and takes the final call on which solution meets the expectations most optimally and rewards the corresponding solver.
The second tool "Critical Assessment Tool (CAT)" also uses the above CI approach to apply a BIA analysis creating a critical league consisting of all organizations systems/processes.This is achieved by raising several questionnaires to the organizations user community contributing their expertise identifying critical services or spotting any new ones.
Employees became comfortable sharing their experience, thoughts and ideas that can be used to address critical business challenges that may assist the design and the development of a BCP within the specific organization.Professionals involved in business continuity had the ability to filter out the critical information through the chaos of information which is gathered.Preliminary evidence supports that Collective Intelligence should not be absent from the design of Business Continuity Planning providing a different approach in understanding the organizations business environment harnessing proper information from its community.

Conclusions and Future Research
This paper claims that Collective Intelligence is a valuable tool supporting business continuity for harnessing information and resulting to solutions by reducing uncertainly decision making during or before a disaster.Collective Intelligence is an asset, which if collected and used correctly has the potential to emerge as a significant tool to implement and design a BCP providing a strategic advance for an organization such as saving money, time and resources.The value of this paper is twofold.First, it has provided a proof of concept that this is both feasible and contributes positively in the formation of a BCP in an organization.Second, it sets the direction for further research on the interdisciplinary issues of BCP and CI.
The almost complete lack in relevant bibliography denotes that further research in the theory of Business Continuity based on Collective Intelligence should be prioritized.Extending this study is to investigate the approach utilizing the cooperation and alliance between organizations supported by the logic of collective intelligence regarding business continuity maters.Tools offered by the technologies of "Cloud Computing" can be utilized to this direction.Finally, it would be interesting to con-sider the opposite approach of Collective Intelligence on the mismanagement of the user community within the organization on issues relating to business continuity.
In conclusion, the field of business continuity supported by the logic of collective intelligence is in the early stage.It has been identified that it is possible to address aspects of BCP using CI.However a number of research topics remain open and need further exploitation.

Table 2 .
Systems and processes classification versus MTD