We help Mútua de Propietaris ensure the recovery of its critical business processes in the event of a disaster or unwanted interruption.
Challenge
The IT services that support Mútua de Propietaris’ business processes play a fundamental role in achieving its business strategies, as they help position the company to improve the loyalty of existing customers and to become a benchmark insurance company for new clients. This combination of factors creates a need to ensure an agreed level of service quality and, therefore, to maintain optimal security levels to prevent inadequate responses or errors that could negatively affect the services demanded by its users. For this reason, Mútua de Propietaris requested our support to develop a business continuity plan for its information systems. They wanted to incorporate business processes into the plan and ensure that the organization could recover and restore its most critical functions within an appropriate timeframe following a major contingency or disaster that disrupts these processes.Project
The resulting project had these four distinct phases:
Phase 1 – Analysis
To ensure the success of the final solution, we conducted interviews with all departments responsible for critical business processes. In projects like this, it’s essential to gather insights from the people executing these processes, as they have first-hand knowledge of the requirements needed to maintain an acceptable level of quality.
In this first phase, we analyzed the impacts of potential disruptions and defined the possible data losses (RPO) and the maximum allowable downtime (RTO) for the services provided. Based on this information, we conducted a Business Impact Analysis (BIA) and a Risk Analysis (RA).
Phase 2 – Strategies
Once we gathered all the process information, we selected the risk scenarios—that is, the situations which, if they occurred, would trigger the contingency plan (for example, a fire at the main headquarters, a data center outage, a corporate network failure, a mass illness among staff, etc.). Finally, we defined practical and realistic alternatives that would ensure the continuity of the critical business processes in the event of an incident.
Phase 3 – Implementation
The previous phases were more theoretical than practical, as they focused on gathering information and defining strategies. The subsequent phases involved implementation—bringing this theory into the reality of the company’s business. In this implementation phase, it was necessary to take into account:
- The roles, people, and contacts that should be involved. This defines the crisis teams and entails confirming the responsibilities of the Mútua de Propietaris employees involved, as well as the specific timing for each individual’s actions.
- The same documentation of the Plan, viewed as an operational continuity plan, incorporates a summary of the consequences and the actions to be taken, both during the contingency and once normality has been restored.
Phase 4 – Operational management
To conclude the project, we conducted a test of the continuity plan by simulating a risk scenario that affected one or more critical processes. The purpose of this test was to verify whether the implementation of the proposed alternatives was viable and functioning correctly, to serve as training for the organization, and to identify potential proposals to further improve the plan and its results—ultimately ensuring the required level of service quality.Results
With this continuity plan, Mútua de Propietaris has obtained the following benefits:
- Identify and agree on its most critical processes and their maximum downtime.
- Have real alternatives to ensure the continuity of the identified critical processes.
- Have defined roles and responsibilities among the employees involved.
- Know how to act in the face of possible risk scenarios.
- Have a planned calendar for a periodic test of the plan.
- Know the aspects that can be improved, according to the results of the tests.
- Be aware of the importance of keeping the Plan updated in terms of the global organization.
