Regression-Based Recovery Time Predictions in Business Continuity Management: A Public College Case Study

Introduction

Modern organizations, either private or public and non-profit are facing multiple challenges. A challenge of major importance for the organizations of all types is the provision of rapid, quality and ICT – enabled services to customers and citizens. Such services are provided through and supported by electronic platforms and systems for which the operational availability should be ensured. Moreover, security regarding transactions and customer data protection is also a matter of major concern for such services and systems. Apart from the processes which are intended for customer service, the majority of modern business functions and operations rely heavily on information technologies. As a consequence, any event that may result in an operational failure of business information systems should be treated in a timely manner in order to avoid or minimize any negative business consequences. In general, the exposure to such threatening events should urge public organizations apply targeted and effective recovery policies.

In general, public organizations are vulnerable to a multitude of threats. Such threats are distinguished to man-made, natural, technical and biological threats. Cybercrimes, earthquakes, network outages and epidemics are representative examples from each of the aforementioned general categories. The coordinated, timely and effective recovery of the unexpectedly interrupted critical business functions and processes in public organizations is based on the formulation of stable and standard business continuity policies. Business continuity is a “management process that identifies potential factors that threaten an organization and provides a framework for building resilience and the capability for an effective response” (Speight, 2011). One of the most important Business Continuity Management (BCM) objectives is the definition of the time that is required to recover a process, activity and the involved systems. The specific timeframes are unfortunately determined based exclusively on the viewpoint of domain experts (Jaech et al, 2018). Despite the fact that these timeframes satisfy the recovery requirements of the business functions and that they are reasonable and practically achievable, they lack a standard mathematical background that provides further stability and robustness especially for the cases of mission - critical functions and processes. As in the case of other public organizations, business continuity management is a matter of grave importance in universities and colleges, as well. Except for the time required to recover an individual business function at a university, an additional task is the definition of recovery priorities regarding the total of the business functions. The specific task is part of the Business Impact Analysis (BIA). Business Impact Analysis at universities is intended to assist management in identifying critical functions that are essential to the survival of the department. BIA evaluates how quickly a department can return to full operation following a disaster situation. BIA also looks at the type of resources required to resume business (Pace University, 2020).