10 Questions you need to ask when buying Business Continuity Management Software

Knowing what questions to ask can make the decision on whether or not or which business continuity or disaster recovery planning software system to purchase easier. It doesn't have to be a leap of faith if you ask the right questions.

• Never be afraid to ask questions
• Ask for as many demos as you need to ensure the software is the right fit
• Understand how the solution best fits with your specific industry and organizational needs.

1. Is the business continuity software comprehensive, but still easy to use?

A business continuity and IT disaster recovery planner needs to be comprehensive. In some systems, this can mean it is complicated and difficult to use. A great planner is both comprehensive and uncomplicated. The planning time in the software will typically take between 5-10 hours per year, however, the planning software should be operational and “working full-time” to perform its daily operational responsibilities. A great BCM planner is developed specifically to provide direct, uncomplicated access to plan data and documents. This includes the ability to train new planners. If it takes longer than 30 minutes to train a new user to access and the planner, it may be over-complicated. Even a large matrixed organization, which might maintain over 10,000 plans within the BCM software system, should be able to train a novice user in less than 30 minutes and enable then to have a 95% retention 12 months later. No retraining required.

2. Can we use the BCM planning software out of the box?

This is a double edged sword. You definitely want to be able to start your planning process immediately following implementation, so having a ready to use BCM software is important, as long as it is comprehensive, intuitive and still customizable. Don’t be limited to what the vendor defines. Ensure that your software is adaptable.

3. Can I use my own planning methodology? Does the BCM software include customized templates for our industry/vertical?

Most BCM and IT disaster recovery planning tools are largely “locked down” and force users into a limited planning methodology created by the software vendor. Why would you want that? Every sector or vertical market and even individual businesses have differientiating needs and requirements.  Ask if the software has been proven in a “templating environment.” Even better, find out if they have customizable templates specific to your industry, to make customization even easier. A great planner should be able to work out-of-the-box, and allow you to easily customize. Make sure that these templates can be easily enhanced with your terminology or unique data requirements to exactly match organizational requirements.

4.   Is the BC management software Adaptable as your planning program mature?

Make sure that the vendor and the BC planning solution understand and address the variability of how business, healthcare, government and military organizations evolve in their planning practices. You want a BC software solution that is designed to complement this vision. Folder hierarchy, plan content and data elements should be completely changeable. Ensure that the BCM planner incorporates functionality that assists the Administrator in managing an orderly migration as enhancements to the planning template(s) are completed and ready to be rolled out.

5. Will our data really be secure?

Don’t forget to get a deep understanding of security before you sign the purchase order. Ask about the security policies and flexibility depending on your organization’s needs. Does it offer options to meet the needs of high and ultra-high security environments? What is difference in security if the software is hosted by my organization vs. SaaS with the vendor? Can micro-services  be distributed across multiple physical and / or virtual hosts in discrete demilitarized zones (DMZs) or a perimeter network isolated by industry standard networks and firewalls.

6. Can the BCM software be hosted by us or is SaaS the only option?

SaaS  is defined as “software that is owned, delivered and managed remotely(in the cloud) by one or more providers.” The vendor delivers software based on one set of common code and data definitions that is used in a one-to-many model by all customers at any time on a pay-for-use basis or as a subscription based on use metrics. If your security policy demands that you host internally, you should be able to have that as an option. Make sure your vendor is flexible to your needs and requirements.  

7. What kind of customer support and ongoing reinforcement is available?

Even the best BCM planning software solutions, should come with customer support. From user error, training, system outages, etc. ; customer support should be an essential component of the software package. Is support available 24/7? Are we limited to the number of calls? What is the knowledgeability of support team? Is customer support included in the price? These are all valid questions that you will want to ask upfront.

8. How long does installation take & what is involved?

An optimal BCM planner should require minimal installation time. Of course, you may want to include training and a program launch along with installation. Find out if the vendor has a quick start launch to get your planning enterprise ready to go.  You should be able to use out of box software and industry proven templates as is, but you may want to customize.

9. Does the vendor invest a large share of their budget to research & development (R&D) for future release enhancements?

You want a continuity management system that will grow with you and the ever-changing global, national and regional markets.  That is why it is important to understand the R&D investment that your prosepctive vendor has budgeted toward future development.  If they spend more on marketing than they do on R&D, it might be time to move on.

10. What is/isn’t included in the cost?

When you get a quote from a BCM system, think of it like your mobile phone or cable TV bill. You get one quote that gives you an estimated price that someone falls short of the actual total bill, as they don’t include tax and other “unknown” charges.  Ask upfront if there are additional charges. Also be sure to ask if modules or customization are included in the price of the software.  Many vendors charge for their modules and many key components may be essential to your program and will significantly raise the price of the “base” system.  This rings true for customization. Some purely out of the box solutions don’t allow you to customize for your companies specific needs, but they will be happy to charge you a hefty premium to make some of these customization requests for you. 

Find out if technical support is included, when it is available, and if there are limits to accessing support.

Never be afraid to ask questions and ask for proof points.  If you need to see multiple demos, any vendor should be able to accommodate.  The business continuity and disaster recovery solution you choose will become an integral part of your enterprise, so you can't afford surprises.

If you want to practice your questions, I would be very happy to help you out!  :)