Building vs. Buying Solutions: BCP, DR, Risk-Incident Management
I was working with a long-term colleague at a national organization who informed me of his leadership was deciding to build a Business Continuity/Disaster Recovery (BC/DR) solution themselves. He asked “Should I buy a ready-made solution or do you think it’s feasible that we build our own solution?” This gave me pause before I formulated him my response, which is rare for me.
The questions were more of a self-assessment and reflection on the organization. Does your staff have the time and skill set to design a BC/DR compliant software solution, and can they map needs into the functional components of such a solution? Even if you answer is “yes,” there are still other critical points to consider, which are:
- On what platform am I going to build this solution?
- What are my hardware and annual software licensing costs?
- How do I account for scalability, availability, and resiliency?
- Do I have the ability to obtain additional funding for upgrades?
- Does my staff have the skill set to build a software solution with a vendor?
- Can I risk asking for additional funding if we miss dates and need additional consulting from external and internal resources? (52.7% of projects cost 189% of their original estimates. Source: The Standish Group)
- Is it easier, faster, lower TCO, or safer to purchase a system built on the experience of professional BCM practitioners to meet existing standards, regulations, and best practices in my vertical? (Over 50% of all software development projects stall or fail. Source: Definity Partners.)
- If I need outside certified expertise, what is the cost to bring them up to speed in our internal system?
Those who build find themselves facing unforeseen challenges. Staff may not have the time to develop a list of requirements, build user stories, and test solutions during development. Even if you meet these requirements, consider the following challenges after the solution is implemented:
- Support: Who will provide my end users with support on usability? Off hours?
- Access: A BC/DR system will need availability in the event of a disaster. If the event affects the data center, how will employees and Subject Matter Experts get access to the solution?
- Ongoing enhancements based on user feedback, change in regulations or requirements?
- Remote Access: Most disasters occur off hours. The cost of VPN access and off hours support is usually not accounted for.
- High availability of active hardware.
- Mobile Access: During a disaster that employees may not have a computer available. Smartphones with secure plan data becomes paramount to recovery.
- Security: Remote employee and vendor access creates challenges and additional burdens for security, internal audit, and risk.
Those who purchase a ready-made software solution quickly learn that the benefits go beyond the obvious. Buying results in a solution that is ready-to-use in days—not months or years—with demonstrated ROI and fixed costs is no doubt valuable. An intelligent software package does not require your team to become proficient software designers or project and support managers—it empowers you to focus on your core job responsibilities and expertise that ultimately bring success.
As you evaluate your legacy BCM practice of Word/Excel approach, consider the benefits of implementing a secure, industry proven solution with built-in intelligence.
If you would like to discuss the buy versus build approach further, feel free to contact me.