1

In This Issue

Wishing you Health, Wealth and Resilience.

Cindy Bodenstein

All things Resilience

I’d like to kick off this edition by wishing our Mozambiquan branch a resilient 10th Anniversary. The company’s Mozambiquan journey began with a small work area recovery facility and data centre in Matola, just south of Maputo, in October 2008. The branch is set to expand its services, especially its advisory services offered in both English and Portuguese over the coming next couple of months.

Congratulations goes out to all Continuity and Resilience Award nominees at the recent BCI Africa Awards in September 2018 and particularly for the winners in their respective categories which you can view via the link provided https://www.thebci.org/comm/awards/bci-africa-awards-2017/2018-africa-awards-winners.html .

As a company we are honoured and delighted that Michael Davies, CEO of ContinuitySA was honoured with Industry Personality and Movashan Moodley, a Consultant at ContinuitySA was awarded Continuity and Resilience Newcomer 2018. I would like to personally wish all award winners best of luck for the Global Awards taking place in London on the 6 November 2018.

We recently embarked on our customer service research and the positive results are shared in our article, ContinuitySA’s commitment to customer service and how building a loyal client base and developing long term relationships is key to our journey which we hope you will find of interest.

As a business looking either to insource or outsource business continuity management, do you put cost above value or do you consider VALUE as a key criterion. Review the article, what’s the value and decide for yourself. Recent building fires in Johannesburg are a wakeup call for both the public and private sectors which clearly reminds us of the need for business to ensure they can recover quickly from a disaster. Our article on Page six, explores this further.

Read more about the Exagrid and ContinuitySA success story via the link provided https://www.exagrid.com/wp-content/uploads/ExaGrid-ContinuitySA-Customer-Success-Story.pdf

Do you require an application for your day to day and crisis management requirements, why not read about the BCM app that is in testing phase?

Finally, read about how the Veeam Hyper Availability Suite assists ContinuitySA in ensuring client data recoverability when and if they experience outages.

I hope you enjoy the latest ContinuitySA Chronicles and that it provides value related to Resilience, Risk and Recovery.

Q3 2018Editor’s Note

Welcome to the third edition of Continuity Chronicles for 2018, our quarterly resilience newsletter featuring articles around business continuity, crisis management and disaster recovery.

ContinuitySA’slong journey to

customer-service Excellence

Page2

Africa’s LeadingBCM Services

Provider SecuresClient Data Using

ExaGridPage 3

What’s the Value?Page 5

Recent building fires inJohannesburg

are a wake-up call forbusiness andgovernment

Page 6

BCI AfricaAwards 2018

Page 8

BusinessContinuity

ManagementMust Keep

Pace With TheDigital Age

Page 10

Veeam EnablesContinuitySA to DeliverHyper-Availability and

Compliance Confidence

Across AfricaPage 12

2

ContinuitySA’s long journey to customer-service excellence

Our Net Promoter Score of 52 percent shows that our ongoing commitment to customer service is building a loyal client base and developing long-term relationships.

2

The Net Promoter Score (NPS) has become a commonly used measure of how a company’s customers see it and, crucially, how strongly they would recommend its services to others. These “promoters” are the loyal bedrock on which companies rely for growth.

Developed by Bain & Company, the NPS offers a simple way for companies to measure customer loyalty. It asks customers “How likely are you to recommend [Company A] to a friend/ family/ business associate?]” in combination with a few other questions. Consolidated across the customer base, these questions provide companies with an NPS and the reasons behind their rating.

“The fact that a customer is prepared to recommend you is the ultimate proof that you are providing them with a service or product that they value,” says Cindy Bodenstein, Marketing Manager at ContinuitySA. “It’s thus no surprise that CEOs see customer experience as the most important lever of competitive advantage, because satisfied customers are those who will become promoters.”

The Walker B2B CEO Survey 2017 shows that 39 percent of CEOs see customer experience as their most effective method for creating a competitive advantage, outstripping talent (20 percent) and product (15 percent) quite significantly. The same showed that the strategic importance of the customer experience would actually increase by 2020.

“The NPS provides a snapshot of how loyal a company’s customer base is at a particular time but it’s much more powerful than that, it gives companies the opportunity to take actions that will improve customer experience and so promote growth,” says Andrew Clare, whose company, reLiance Advisory Services, has been researching ContinuitySA’s NPS for six consecutive years. “ContinuitySA’s steady improvement of its NPS, which this year stands at 52 percent, shows that it is one of that rare breed of companies that truly understands what its customers want, and is getting better at giving it to them.”

To put ContinuitySA’s achievement into perspective, it is worth considering that the average NPS of South African companies audited by reLiance is 33 percent, there is no comprehensive NPS benchmark for the B2B sector in South Africa. Globally, the NPS average for Information Technology and Services companies is 60 percent, according to Customer Gauge.

Mr Clare says that the research shows that the key drivers behind ContinuitySA’s high NPS are excellent service and support, good relationships and responsiveness. In addition, its customers highlighted the value it delivered rather than the price it charged for its services. “We have steadily improved our score over the past six years to get to 52 percent, but we are not satisfied, we aim to continue improving our understanding of what customers want as a basis for achieving our growth strategy,” Ms Bodenstein says in closing.

3

ExaGrid®, a leading provider of hyper-converged secondary storage for backup, announced that ContinuitySA, Africa’s leading provider of business continuity management (BCM) and resilience services, has chosen ExaGrid’s disk-based backup systems as its standard offering and go-to-market strategy for clients needing to establish or upgrade their backup environments.

In an age of escalating events that threaten mission-critical busi-ness data, ContinuitySA’s fully managed services assist clients in understanding their risk profile and developing an appropriate risk-mitigation strategy to enhance business resilience, including Information and Communications Technology (ICT) resilience, enterprise risk management, work area recovery, and BCM advisory.

“We offer fully-managed solutions to our clients for protection of their environments. Using ExaGrid is pivotal in our offerings of backup-as-a-service and disaster-recovery-as-a-service,” said Bradley Janse van Rensburg, CTO of ContinuitySA. “We evaluated a number of virtualized backup solutions but weren’t able to find one that offered the level of price-performance that would meet our clients’ requirements until we looked at ExaGrid and were impressed with its performance and data deduplication. The system scales quite efficiently, and there are encrypted versions of its appliances at attractive price points. We converted from other technology to ExaGrid, and we’re happy we did.”

A growing number of ContinuitySA’s clients have switched to ExaGrid, most of whom are running Veeam as their backup application. “Over 90% of the workloads that we protect are virtual, so our main strategy is to use Veeam to back up to ExaGrid,” said Janse van Rensburg. “The ExaGrid-Veeam solution provides long-term retention for our clients through the deduplication capabilities of both products. Reliability and consistency of the solution are critical to us to ensure that we can quickly recover a client’s data if they experience an outage.”

ContinuitySA and its clients are pleased with the many improvements to their backup environment since adding ExaGrid, including:

•ExaGrid-Veeam data deduplication reduced storage consumption across the board.•One client’s backup window was reduced from two days to one hour, and restoring a server took four hours instead of four days when using its previous backup solution.•Despite a few ransomware attacks, backups remain uncompro- mised.

“There have been several ransomware attacks on client data, but our backups have been safe and uncrackable. We are always able to restore our clients’ data and save them from complete data loss or the need to pay ransomware funds. We have had zero data loss while using ExaGrid,” said Janse van Rensburg.

Read the complete ContinuitySA customer success story below to learn more about the company’s experience using ExaGrid.

ExaGrid’s published customer success stories and enterprise stories number over 360, more than all other vendors in the space combined. These stories demonstrate how satisfied customers are with ExaGrid’s unique architectural approach, differentiated product, and unrivalled customer support. Customers consistently state that not only is the product best-in-class, but ‘it just works.’

ContinuitySA Chooses ExaGrid as its Standard Go-to-Market Strategy

Africa’s Leading BCM Services

Provider Secures Client Data Using

ExaGrid

ContinuitySA customer success story Customer success stories Enterprise Stories

www.continuitysa.com

5

Once a company decides it needs to take business continuity and resilience seriously, it becomes necessary to consider whether to insource or outsource the capability. A particular sticking point is the recovery facility to which staff can move if the primary site becomes unusable, and a backup data centre.

More often than not, the discussion quickly becomes one focused on cost. After adding up their figures, companies sometimes conclude that commissioning their own recovery site and data centre is cheaper than what an expert service provider can offer.

On closer examination, though, these cost-savings are misleading. This is because calculations typically only include direct costs, the indirect costs such as procurement, planning and design, furniture and equipment, cleaning, security and utilities costs are seldom included. Many of these are hidden away in other budgets, and are hard to separate out. The same is true of ongoing rental and maintenance costs, as well as management, which can be considerable.

These calculations also seldom take into account the cost of adding to the workload of existing staff members when insourcing, nor the heightened risk of distracting already busy people still further not only during normal working conditions but even more importantly, during times of crisis and incidents.

Non-experts also often forget to cost in the connectivity and communications needed both for the data centre and the back-up office, which might include highly specialised call centre seats. A key consideration for CFOs is that many of the costs of insourcing will have to be recognised as capex on the balance sheet which can be a source of worry to investors, and generally disliked by many CFOs as non-core capital expenditure for the business.

By contrast, an outsourced solution will cover all these costs, including the hidden ones, in a single, monthly payment that would not appear on the balance sheet because it is an operating expense. Because the facilities would be “shared” with the outsourcer’s other clients, so are many of the fixed costs.

When deciding whether to insource or outsource business continuity management, many organisations let cost guide the discussion. Cost is important, but the real criteria should be value.

There are also other ways an outsourcer can help cut costs; for example, by offering syndicated seats or data centre space for a proportion of the solution, based on a proper business impact analysis. The savings can be substantial and still result in a comprehensive business continuity solution.

Searching for valueThere is, however, a much more important conversation that needs to take place about value. The essential point here is that whatever the solution costs, it must deliver results. As noted above, insourcing means relying on staff who are “free” in the sense that their salaries are already being paid, but who are unlikely to have the time (and possibly the inclination) to become experts on business continuity. In addition, BCM is something that needs to be updated regularly as circumstances and risks change, something that is seldom undertaken.

More than likely, then, when the chips are down, the backup plan simply won’t work satisfactorily or at all.

By contrast, engaging with a reputable BCM provider means that the solution can be scoped after a proper business impact analysis and threat assessment has been done resulting in a customised business continuity plan, and it will benefit from being run by experts. BCM is far from easy, and thousands of details have to be considered. A BCM provider with years of experience will understand how the BCM life cycle works and how to assist a company during tests and disasters.

Most important of all, a BCM provider will undertake regular, rigorous testing of the solution to improve it continuously to ensure that, when the chips are down, it actually does work. It’s also worth mentioning that planning for a disaster is very different from surviving one, the presence of experienced people who have dealt with this many times is not the least of the value that an outsourced solution can bring.

A final consideration: statistics in United States show that 40 per-cent of businesses never reopen after a disaster. Our personal experience shows that companies with an effective BCM solution that has been regularly tested can recover within a very short time, reducing financial impacts of business interruption and protecting the company’s reputation which can be seen as invaluable to the business in terms of long term sustainability.

WHAT’S THE VALUE?

6

A number of fires in office buildings have recently been reported on, resulting in businesses evacuating their staff to safety. These must serve as a wake-up call for organisations in both the public and private sectors, says Willem Olivier, GM: Africa at ContinuitySA.

Specifically, organisations need to consider their ability to mount an emergency response to similar disaster, and then how quickly they would be able to recover.

“When a disaster like this happens, it’s natural to focus on its causes and the emergency response by the authorities but, for businesses, the real issue is how well and how quickly they will be able to recover,” he says. “The organisation’s resilience is intimately linked to how sound its business continuity plans are and whether it has a suitable work-area recovery facility in place. It’s just not acceptable if it takes the business two or three months to recover. One also has to consider the impact of the recovery time on the total supply chain many organisations might be affected.”

An organisation’s ability to recover quickly and effectively is vital. According to the Federal Emergency Management Agency (FEMA) in the USA, 40 percent of businesses never reopen after a disaster, and of those, only 29 percent are still operating after two years.

“Organisations should be using this tragedy to prompt them to ask three critical questions,” Mr Olivier says. “Only once they can answer them satisfactorily will they be able to enjoy some peace of mind.”

Do we have a proper crisis management response plan and process in place? When any disaster happens, the first priority is to safeguard one’s people and information. This emergency response is only the beginning though the organisation must have a proper process and team in place to handle communication with stakeholders, including the media, and initiate the recovery process. Most crisis management plans are extremely lengthy, and are likely to be left behind in the office anyway.

Crisis management plans must provide members of the crisis team with the essential process flow that they must follow in the heat of a crisis, and enable them to switch from emergency to crisis management mode. Many crisis management teams miss this crucial shift between emergency and crisis management execution.

Do we have a work-area recovery facility if we need it? In the face

of a major disaster such as the abovementioned fire, it is essential to have a fully functional and tested alternate workplace ready to receive at least the critical staff. Too many organisations focus on the costs of such a facility but the real costs of not having one really come into focus when it is needed. Obtaining suitable office space and equipment only once a disaster has happened is both time-consuming and extremely expensive.

Mr Olivier says that a key consideration is whether to insource or outsource the recovery facilities. He cautions that insourcing has many pitfalls, not the least of which are the difficulty of establishing the hidden costs, such as management and procurement costs, and the need for ongoing capex. By contrast, outsourcing is totally transparent, is an easily budgeted monthly operating expense, and includes access to expert help.

“There are many ways of reducing the cost of developing a recovery solution once a proper business impact analysis has been completed. For example, seats in the recovery facility can be syndicated between organisations, or dedicated to just that one organisation, as can space in the recovery data centre, the savings from carefully planned syndication can be massive,” he says. “But, in the final analysis, the cost has to be seen in light of the value of the business itself.”

Are we sure our crisis and business continuity management plans actually work? Regular testing under crisis-simulation conditions is absolutely vital. A crisis is no time to find out that you don’t have enough seats at the recovery site, or worst of all that there aren’t any, or that the crisis management team does not know how to cope with the temporary absence of one its members. Some companies may also have a high reliance on paper-based processes, such as claim forms for a medical aid, that require special processing technology. All of these eventualities need to be included in the testing of one’s recovery solution.

Mr Olivier cites the example of a government office that was unable to access its building for two months last year owing to a sewage leak. Thanks to rigorous planning and testing, 200 staff members were able to successfully relocate within a day to their recovery facility and their vital work was continued uninterrupted.

“Disasters often result in tragic consequences and questions are raised as to why it happened. As proactive as an organisation may be to avoid disasters, sometimes incidents outside of the control of an organisation affects its ability to function in the future,” he concludes. “Proper business continuity planning and testing is the only way to ensure a disaster isn’t permanent.”

Recent building fires in Johannesburg

are a wake-up call for business and government

8

The Business Continuity Institute (BCI) Industry Personality of the Year highlights an individual who has “added value to the continuity and resilience industry over the past year”.

An inspiring leader who regularly speaks at conferences on topical resilience and BCM events has made ContinuitySA CEO Michael Davies a worthy recipient of the award for 2018. A 26-year international veteran of the industry, he is passionate about the multiple facets of business continuity and has recently worked on advancing cyber security as a core component with the Institute of Risk Management of South Africa.

With an aim of growing awareness of resilience and business continuity to establish a common language across different industries, Davies has written multiple contributions on business continuity topics and has presented on BCM in Kenya, Botswana, Mozambique, Mauritius and South Africa. He is also a respected BCM figure in the United States and the United Kingdom.

A regular participant in round tables and thought leadership initiatives, Davies has long supported graduate programs to bring new people into the BCM industry and train them to become skilled consultants.

Davies is an ambassador for BCM and a hands-on leader who supports ContinuitySA’s teams by advising on strategy, assisting in proposals, assisting with client recoveries and being a core part of the team developing BCM in Africa.

Over the past year, Davies was instrumental in driving to success the Central Delivery Office (CDO), a global technology business unit in ContinuitySA which delivers Technology Recovery. The CDO provides these services from South Africa to countries as far afield as New Zealand.

As a true inspiration and avid supporter of BCM on the continent, Davies is a driving force for ContinuitySA and now a recognised industry Personality of the Year. “It’s an honour to have received this award, but it’s as much for the whole organisation as it is for me, I have only achieved anything because of their support,” Mr Davies says.

ContinuitySA CEO Michael Davies named Industry Personality of the Year

9

It is people who make the difference in the business continuity and resilience industry and the entry of capable, motivated and ambitious individuals charts the future of the profession. Movashan Moodley is a deserving winner of the Business Continuity Institute’s Newcomer of the Year category for Africa, having rapidly established himself as a highly competent member of the team since joining ContinuitySA in 2017 as an intern.

Within just five months, Mr Moodley was promoted to Continuity and Resiliency Consultant, demonstrating a firm grasp and ready practical application of the six professional practices outlined in the Good Practice Guidelines.In a short space of time, he has worked successfully across multiple industries including telecommunications, cyber-security, technology, financial, banking, aviation, professional services and production. He is skilled at leveraging this cross-industry experience to develop innovative and cost-effective recovery solutions for his clients whilst aligning to good practice and international standards.

He has further been involved in the development of a new facet to Organisational Resilience termed “Operational Resilience”, which acts as a management tool to identify single point of failures within day to day processes of an organisation.

“Since joining ContinuitySA, I’ve welcomed the opportunity to learn on the job and hone my skills while adding value to clients by hardening their businesses against risk. It’s a great honour to be named Newcomer of the Year and I look forward to further developing my career in business continuity,” says Mr Moodley.

Mr Moodley’s passion for embedding BCM has led to a role supporting the management of the training academy, which offers a range of business continuity and training services. He has been involved in developing ideas that encourage organisations to further embed continuity and resilience. He has conducted research into enabling an anytime, anywhere online training course that focuses on continuity and resilience.

With a degree in accounting from the University of Kwa-Zulu Natal, Mr Moodley has attended the ContinuitySA five-day BCM Practitioner Training Programme, and this May he achieved his CBCI certification from the BCI, passing with merit. He has also attained a certificate in understanding the requirements relating the General Data Protection Regulation which has come into effect in the European Union.

Movashan Moodley named Continuity and Resilience Newcomer of the Year 2018

10

With a few diminishing facets of business not seeking to leverage the use of digital technology, the expectations placed on organisations have increased exponentially, not just as part of day-to-day operations, but also during crisis situations.

Forget the luxury of having time to prepare a well-structured media release, executives sometimes only learn on a crisis in their organisation once it’s gone viral on social media. Thus, it’s about time that Business Continuity practitioners elevate an organisation’s response to disasters in light of emerging expectations, says Padma Naidoo, General Manager: Advisory Services at ContinuitySA.

“Competitive business landscapes have urged businesses to adopt just-in-time supply chain principles and lean operating models. Simultaneously, however, the “instant gratification” trend has reduced the tolerance for business downtime, and customers expect to receive a continuous and reliable supply of products and services. Thus, the cost of downtime, tangible and intangible, has risen steeply over the years, and studies show, can reach up to $70 000 per hour for certain large organisations,” she says. “As business continuity practitioners, we understand the need for organisations to respond rapidly and effectively to disruptive events. Consider the 911 incident, 40% of companies without a strong disaster recovery capability were out of business within 6 weeks. We therefore need to start using tools and technology available to accelerate response times and empower decision-makers.”

There are several ways in which technology may be leveraged to improve the implementation, monitoring and reporting of business continuity practices, from increasing the efficiency of roll call during an evacuation, successfully managing perception during a crisis, through

We live in a digital age, and the use technology pervades every aspect of our lives. The world, particularly the business world, has grown an integral reliance on digital platforms, and access to accurate information at one’s fingertips.

BUSINESS CONTINUITY

MANAGEMENT MUST KEEP

PACE WITH THE DIGITAL AGE

11

to ensuring business continuity plans are easily accessible at all times. Such progressions can prove to be life-saving and business-saving.

In addition to opportunities that digital advances afford, we need to be cognizant of the increased pressures that organisations face. Regulations like the General Data Protection Regulations (GDPR) and the Protection of Personal Information Act (PoPIA) make it increasingly important for organisations to protect personal information, and therefore having multiple paper copies of business continuity plans in team members’ cars or homes is no longer a viable option for ensuring that plans are available when needed.

ContinuitySA has therefore been working on a mobile application for business continuity and resilience. A mobile application would offer a myriad of benefits to organisations, including easy, 24/7 access to response plans; improved protection of the data contained in plans; increased awareness regarding the plans and their contents, additional functionality that paper-based or PDF documents could never provide; and peace of mind, to name a few.

“ContinuitySA prides itself on thought leadership in continuity and resilience, and responding to the emerging needs of our clients,” she says. “We are extremely excited about our mobile application and the value that it will bring to our clients. Watch this space as we prepare to go live, and launch the “CSA BCR App” in the market.”

BUSINESS CONTINUITY MANAGEMENT MUST KEEP PACE WITH THE DIGITAL AGE

12

Veeam Enables ContinuitySA to Deliver Hyper-Availability and

Compliance Confidence Across Africa

Veeam Availability Suite added to integrated managed services offering, providing predictable recoverability to ContinuitySA customers across five

African countries

Veeam® Software, the leader in Intelligent Data Management for the Hyper Available Enterprise™, announced that ContinuitySA, a leading African provider of business continuity management services to public and private sector organisations, has selected Veeam Availability Suite™ to help deliver dependable disaster recovery and business continuity solutions as a fully managed service with predictable recoverability for its customers across industry sectors.

Headquartered in Johannesburg, ContinuitySA’s client base consists mainly of large and listed organisations, government departments, and the in-country operations of multinational organisations. It operates the continent’s biggest network of recovery centres, with more than 20 000m² of space in Gauteng, the Western Cape, and KwaZulu-Natal in South Africa, as well as in Botswana, Mozambique, Kenya, and Mauritius.

“Our clients are looking for dependable intelligent data management solutions to protect them from operational and security threats in an evolving landscape, while managing costs and ensuring their IT staff can focus on profit-generating activities. There is also a strong drive to ensure client data is better protected and aligned to compliance requirements. Veeam is able to fulfill those demands and deliver high-speed file recovery from verified backups in a matter of seconds,” says Bradley Janse van Rensburg, CTO of ContinuitySA.

From a business perspective, ContinuitySA customers can deliver on their strategic mandates while Veeam manages their replication and data availability needs. Veeam is an enabler for effective business growth by allowing the internal resources of companies to be repurposed for innovative product development and services delivery.

“The positive impact extends to time-savings as well. We have had a client migrate from a backup configuration that took longer than 12 hours to perform daily backups and 72 hours for weekly ones to a Veeam environment that reduced the time to less than 75 minutes and 10 hours respectively. This reflects the growing importance of being hyper-available to meet stakeholder demand,” adds Janse van Rensburg.

“Modern business requires a new level of data uptime, which we refer to as ‘hyper-availability’. As data continues to sprawl and new compliance requirements add complexity, downtime and unplanned outages become even greater an issue for IT teams to manage. By giving an onsite IT team peace of mind around data protection and

data management with the strength of our technologies, we free them up to focus on other key tasks within the data centre. Working with ContinuitySA, we are able to provide its customers with a data management solution that gives that confidence that their business will be ‘always on’ when they need it most,” says Kate Mollett, regional manager for Africa South at Veeam.

Most of ContinuitySA’s customers have stringent Service Level Agreements (SLAs) and availability requirements in place. Downtime on critical systems during essential times could result in significant financial and reputational damage if recovery does not happen quickly enough. One of the biggest challenges ContinuitySA had prior to partnering with Veeam was the fact that other solutions were slow to adapt to new technologies. This meant clients were unable to make use of all the latest ICT innovations as legacy backup and recovery solutions were not keeping pace with technological change. In particular, this negatively impacted on their ability to use replication technology.

“Initially, we chose Veeam because of its excellent compatibility with virtualisation technologies at an attractive price point. As we started using it more extensively, we were satisfied with its ease of use and their continued development and improvement as well as their exciting roadmap of future features and benefits. They became a great company with which to work and partner.

“Our clients have been very satisfied with Veeam’s hyper-availability offering. From data corruptions, system failures, accidental deletions, and malicious ransomware attacks – we have been consistently successful in recovering our clients’ data when they have experienced outages, and in doing so have helped their businesses overcome data downtime,” concludes Janse van Rensburg.

For more information, please visit https://www.veeam.com.