Magic Quadrant for Business Continuity Management Planning Software

Magic Quadrant for Business ContinuityManagement Planning Software26 August 2013 ID:G00217265

Analyst(s): Roberta J. Witty, John P Morency

VIEW SUMMARY

The 2013 business continuity management planning market, in which there is no perfect product, hasa 2012 revenue estimate of $130 million, 30% more than our 2010 estimate. This Magic Quadrantranks 18 enterprise-class vendors.

Market Definition/DescriptionBCMP products have been in the market for more than 20 years, growing from word-processingtemplates to sophisticated, interactive decision support products. The increased need for usablerecovery plans of all types (see Note 1), as well as for a consistent and repeatable plan developmentprocess, has resulted in increased sophistication in the products. In addition, they now integrate withother BCM products, such as emergency or mass notification service (EMNS) and crisis/incidentmanagement (C/IM), GIS/geospatial, IT asset management, change and configuration managementdatabase (CCMDB), and more. Mature BCM programs use BCMP products for business and programmanagement analysis, with a goal of building more resilience into the day-to-day business process.

A BCMP product will typically include the following components:

Risk assessment for BCM (more clearly differentiated from the business impact analysis [BIA]due to governance, risk and compliance [GRC] product influence)

BIA a core BCM activity

Business process and IT dependency mapping

Resource libraries of business and IT equipment, processes, personnel, facilities, third parties(suppliers/vendors), etc.

Plan development and management

Workflow management for plan development and maintenance actions

Analytics capability to provide BCM program metrics so that the appropriate investments can bemade in risk mitigation controls, day-to-day operations and recovery operations

Some products include additional features, such as:

A modeling capability that lets the organization assess the impact on the business as a result ofan outage whether it be an application, location, business process, third party, etc.

An exercising capability that assists organizations when they test the functionality of theirrecovery plans

A lighter-weight C/IM function that can be used when the organization experiences a businessdisruption and, therefore, needs to execute its recovery plans; this function should not beconfused with pure-play C/IM products in the market that provide a much richer set of functionsthan those described in this research

With over 30 vendors, the BCMP market has a 2012 revenue estimate of $130 million, a 30% growthsince our 2010 estimate of $100 million. Average revenue growth for 2009 to 2010, 2010 to 2011,and 2011 to 2012 is 33.3%, 18.6% and 19%, respectively. Pricing for this market remains verycompetitive for the simpler implementation; pricing for large, multinational implementations can be inthe six figures or higher. Large or regulated enterprises, as well as government agencies, are typicalusers of these products, while small and midsize firms are increasingly looking to use them so theycan provide structure and standardization to a BCM program, even one just starting out. The financialservices market and organizations with complex business operations lead in the number ofimplementations and vendor marketing efforts.

The significant growth in adoption of BCMP products, as measured in our annual security and riskmanagement survey 23.8% from 2010 to 2011; 8.5% from 2011 to 2012 and 51% from 2012 to2013 is an indication that organizations are realizing the importance of the use of these products tohelp standardize and manage recovery plan development, as well as management of the BCMprogram itself. (Note: The question response option in the 2013 survey was combined with riskassessment and BIA. In prior years, the survey question response options were separated.)

Having current, effective and exercised recovery plans is the key to success during a disaster, andthese products are essential for effective BCM response, recovery and restoration activities. Weanticipate adoption to continue to grow during the next five years, given the increased focus fromgovernment agencies federal, state and local as well as private-sector preparedness initiatives.Some of this additional growth will come through the GRC product market: more GRC vendors areproviding BCMP capability as part of a broader operational risk management program.

STRATEGIC PLANNING ASSUMPTION

By 2015, 80% of organizations at a Level 4 maturitylevel for their business continuity management (BCM)program will be using BCM planning (BCMP) productsto help them perform recovery plans and exercisemanagement, as well as to analyze and manage BCMprogram metrics.

EVIDENCE

1 Gartner provided the 18 vendors included in thisMagic Quadrant with a survey resembling an RFP (see"Toolkit: Business Continuity Management PlanningSoftware RFP Template, 2012"), with multiplequestions for each evaluation criteria. The completedsurveys were returned in December 2012 and January2013. In addition to the vendor survey, in-depthvendor briefings regarding product, portfolio, strategyand messaging were conducted with each vendor.Sixty-two customer reference checks were conducted 59 through a 23-question online survey and threethrough phone calls.

2 Gartner takes hundreds of call annually regardingthe BCMP market; it made up 18.5% of our callvolume from July 2010 through April 2013. These callsalso inform our understanding of the market andvendor capabilities.

NOTE 1TYPES OF BUSINESS CONTINUITYMANAGEMENT/RECOVERY PLANS

Following are the various types of BCM/recovery plans:

Damage assessmentEmergency responseC/IMCrisis communicationsExternal communicationsBusiness process/department recoveryLocation logisticsEvacuation proceduresInsurance supportTravel supportLegal supportProcurement/vendor managementCustomer/partner supportShelter in placeIT recoveryBusiness recoveryBusiness resumptionThird-party availability managementRestorationStand-downDevolution/resolution

NOTE 2GARTNER HYPE CYCLE BENEFIT RATINGSCALE

Table 3. Hype Cycle Benefit Rating Four-PointScale

Benefit Rating Definition

Transformational Enables new ways ofdoing business acrossindustries that will resultin major shifts inindustry dynamics

High Enables new ways ofperforming horizontal or

In "Hype Cycle for Business Continuity Management and IT Disaster Recovery Management, 2013,"we moved the BCMP market position by one spot to post-trough 15%, from the 2012 BCM Hype Cycleposition of post-trough 10%, and placed BCMP as early mainstream adoption with 20% to 50%penetration of the target audience and as having a benefit rating of high out of a four-point scale (seeNote 2).

This BCMP product Magic Quadrant is a market snapshot that ranks vendors according to competitivebuying criteria. Vendors in any sector of the Magic Quadrant, as well as those not ranked on the MagicQuadrant, may be appropriate for your enterprise's needs and budget.

Return to Top

Magic Quadrant

Figure 1. Magic Quadrant for Business Continuity Management Planning Software

Source: Gartner (August 2013)

Return to Top

Vendor Strengths and Cautions

Avalution ConsultingAvalution Consulting is headquartered in Cleveland, Ohio. It is a privately held company with anemployee head count of 15 dedicated to the BCMP product. The BCMP product version evaluated forthis Magic Quadrant was The Planning Portal (TPP) version 2012; the current version is TPP 2013.With a BCMP offering in place since 2005, the reported number of BCMP product customers for thisevaluation period was 28. The key markets supported are financial services (including insurance), lifesciences, healthcare and nonprofits. TPP is offered only in a vendor-hosted delivery model. Theproduct architecture for TPP is based on Microsoft SharePoint 2010.

Strengths

Avalution's BCM consulting practice is recognized as strong in the market. The vendor'sconsulting lead is the U.S. representative to the International Organization for Standardization(ISO) for ISO 22301:2012 standard development.

Customer references report a very strong customer service capability, ease of implementationand total cost of ownership.

Avalution was the only vendor that reported that its BCM operations located in a SAS 70 TypeII data center are BS 25999-certified. All development work is subject to a formal qualityassurance and testing process, including product beta testing with the customer. TPP operationsrecovery is tested on a quarterly basis. Customer support is through a toll-free help line with atwo-hour response time 24/7 for emergency issues.

In terms of specific product features, TPP has average capability for workflow management,strong ease of reporting, very good ease of use experience and average customizationcapability. The offering has a risk register and a preloaded set of risks against which a risk

vertical applications thatwill result in significantlyincreased revenue orcost savings for anenterprise

Moderate Provides incremental,but significant,improvements toestablished processesthat will result inincreased revenue orcost savings for anenterprise

Low Slightly improvesprocesses (for example,improved userexperience) that will bedifficult to translate intoincreased revenue orcost savings


EVALUATION CRITERIA DEFINITIONS

Ability to ExecuteProduct/Service: Core goods and services offered bythe vendor for the defined market. This includescurrent product/service capabilities, quality, featuresets, skills and so on, whether offered natively orthrough OEM agreements/partnerships as defined inthe market definition and detailed in the subcriteria.

Overall Viability: Viability includes an assessment ofthe overall organization's financial health, the financialand practical success of the business unit, and thelikelihood that the individual business unit will continueinvesting in the product, will continue offering theproduct and will advance the state of the art within theorganization's portfolio of products.

Sales Execution/Pricing: The vendor's capabilities inall presales activities and the structure that supportsthem. This includes deal management, pricing andnegotiation, presales support, and the overalleffectiveness of the sales channel.

Market Responsiveness/Record: Ability to respond,change direction, be flexible and achieve competitivesuccess as opportunities develop, competitors act,customer needs evolve and market dynamics change.This criterion also considers the vendor's history ofresponsiveness.

Marketing Execution: The clarity, quality, creativityand efficacy of programs designed to deliver theorganization's message to influence the market,promote the brand and business, increase awarenessof the products, and establish a positive identificationwith the product/brand and organization in the mindsof buyers. This "mind share" can be driven by acombination of publicity, promotional initiatives,thought leadership, word of mouth and sales activities.

Customer Experience: Relationships, products andservices/programs that enable clients to be successfulwith the products evaluated. Specifically, this includesthe ways customers receive technical support oraccount support. This can also include ancillary tools,customer support programs (and the quality thereof),availability of user groups, service-level agreementsand so on.

Operations: The ability of the organization to meet itsgoals and commitments. Factors include the quality ofthe organizational structure, including skills,experiences, programs, systems and other vehiclesthat enable the organization to operate effectively andefficiently on an ongoing basis.

Completeness of VisionMarket Understanding: Ability of the vendor tounderstand buyers' wants and needs and to translatethose into products and services. Vendors that showthe highest degree of vision listen to and understandbuyers' wants and needs, and can shape or enhancethose with their added vision.

Marketing Strategy: A clear, differentiated set ofmessages consistently communicated throughout theorganization and externalized through the website,advertising, customer programs and positioningstatements.

Sales Strategy: The strategy for selling products thatuses the appropriate network of direct and indirectsales, marketing, service, and communication affiliatesthat extend the scope and depth of market reach,skills, expertise, technologies, services and thecustomer base.

Offering (Product) Strategy: The vendor's approachto product development and delivery that emphasizes

assessment can be performed. TPP shows the last approved version of a document versus thecurrent document being worked on. AES-256 is used to encrypt data at rest in the database anduses TLS 1.0 for data encryption during transit. C/IM is a built-in component of TPP. TPP has amobile Web application that enables users to access their recovery plans and the live C/IM portalon TPP via their iOS, Android or BlackBerry device. Recovery plans can be printed in more thanPDF format. Single sign-on is supported.

TPP offers the best price comparison coming in at less than half of the median pricingexample. Its pricing model is based on the number of plans and BIAs; Avalution offers amultiyear discount and a small or midsize business (SMB) pricing option.

Cautions

All internal staff for sales, customer call centers and support engineers is U.S.-based only.

Production availability service levels are managed only to a 99.99% service guarantee level witha recovery time objective (RTO) of four hours and a recovery point objective of four hours. Datacenters are in the U.S. only in Virginia and Illinois.

Partnerships with other BCM vendors, professional services, resellers/value-added resellers(VARs) are limited, compared with other BCM product vendors, thereby limiting Avalution'smarket penetration and sales performance.

Drag-and-drop support for customization is not provided. The BIA capability does notautomatically calculate RTOs. Suppliers/vendors are considered a resource managed as all otherresources. The vendor's internally provided EMNS capability is limited to phone, email and SMSendpoint support. The user interface supports English only.

Return to Top

BOLDplanningBOLDplanning is headquartered in Nashville, Tennessee. It is a privately held company with 21employees dedicated to BCMP. The BCMP product version evaluated for this Magic Quadrant wasBCplanner.com v.6.8; the current version is 10.4. With a BCMP offering in place since 2004, thereported number of BCMP product customers for this evaluation period is 170. The key marketssupported are state, local and municipal government agencies (including municipal airports); highereducation institutions; courts and healthcare. The product is offered only in a vendor-hosted deliverymodel. The product architecture is based on Windows 2003 Server, Internet Information Services 6.0,Adobe ColdFusion v.7 and Microsoft SQL Server 2005.

Strengths

BOLDplanning has a very strong focus on government, including continuity of operations(COOP), Department of Homeland Security's (DHS's)/Federal Emergency Management Agency's(FEMA's) National Incident Management System (NIMS)/Incident Command System (ICS), theU.S. National Response Framework, and Federal Continuity Directives 1 and 2. BCplanner.com isthe best product for government organizations.

Customer references report that the product is cost-competitive for the functionality and thatBOLDplanning has very good customer service. Customer references also report that the productis easy to use.

The vendor has very strong partnerships with emergency management consultancies,strengthening its market penetration and sales performance.

In terms of specific product features, the user interface makes the product more easily usableby a broader community. The product has strong reporting capability, strong customization withdrag-and-drop support, very good workflow capability and very good risk assessment capabilitywith a preloaded set of risk content. It also has a comprehensive help facility. BCplanner.comhas an excellent built-in C/IM module. The online chat room feature is a nice addition for a BCMPproduct something usually only found in EMNS products. BCplanner.com has the best set ofplan templates both in terms of breadth and depth, including COOP, continuity of government(COG) planning and emergency operations planning (EOP). BOLDplanning provides templatetext preloaded into the templates a unique feature that the other vendors in this MagicQuadrant do not support due to a perceived liability risk if a customer uses a vendor-populatedrecovery plan and fails in the process. AES-256 encryption is used for data encryption at rest forboth database and file storage. BOLDplanning uses 256-bit SSL for encryption in transit,although they allow users to downgrade their encryption in transit security in support ofgovernment agency customers. BOLDplanning has separate product versions for governmentversus the private sector. Recovery plans can be printed in more than PDF format. The userinterface supports English and Spanish only.

For the BCMP vendor-hosted/software as a service (SaaS) delivery model, BOLDplanning offers a99.999% service-level guarantee. The vendor's server infrastructure was upgraded in mid-2012to utilize multiple servers in Virginia and Oregon with automatic failover. Data center operationsfailover times are on the order of a few minutes and do not result in the loss of customer data.The vendor's data center operations are audit-tested by a third party on a quarterly basis. Uponrequest from existing customers, complete and full audit reports are provided.

Pricing is based on organization head count. Comparison pricing was on target with the medianpricing example. BOLDplanning offers a "try before you buy" option, as well as a multiyeardiscount.

Cautions

All internal staff for sales and customer call centers, as well as support engineers, are U.S.-based only.

Currently, the product has very limited multilanguage support. The vital record data object canbe used to represent too many different resources, such as business processes, applications anddata; instead, it should break out resources (IT, form, report, facility, etc.) as discrete boxeswith a comment field to help manage and report impact data in a more structured way. Thevendor's BIA capability does not automatically calculate RTOs and it should break out the

differentiation, functionality, methodology and featuresets as they map to current and future requirements.

Business Model: The soundness and logic of thevendor's underlying business proposition.

Vertical/Industry Strategy: The vendor's strategyto direct resources, skills and offerings to meet thespecific needs of individual market segments, includingvertical markets.

Innovation: Direct, related, complementary andsynergistic layouts of resources, expertise or capital forinvestment, consolidation, defensive or pre-emptivepurposes.

Geographic Strategy: The vendor's strategy to directresources, skills and offerings to meet the specificneeds of geographies outside the "home" or nativegeography, either directly or through partners,channels and subsidiaries as appropriate for thatgeography and market.

business impacts into separate data entry fields. In addition, peak time frames are notsupported, impact time frames are predetermined by BOLDplanning and adding questions to BIAsurveys is not always possible by the customer the customer may need BOLDplanningintervention to accomplish this task. The vendor's internally provided EMNS capability is limitedin endpoint support. Suppliers/vendors are considered a resource managed as all otherresources. There is no single sign-on support.

Training fees apply.

Return to Top

Business ProtectorBusiness Protector, a Metric One Company, is headquartered in Irvine, California. It is a privately heldcompany with a total employee head count of 17. The BCMP product version evaluated for this MagicQuadrant was Business Protector version 5.0; the current version is 6.0. With a BCMP offering inplace since 1986, the reported number of BCMP product customers for this evaluation period was212. The key markets supported are financial services, including insurance; discrete manufacturing;and energy firms. The product is offered using SaaS and on-premises delivery models. The productarchitecture is based on Microsoft Windows Server (up to 2008 R2), IIS (up to 7.5) and SQL Server(up to 2008 R2). Version 6.0 of Business Protector was released in May 2013 and supports SQL 2012.Note: The vendor did not provide revenue numbers, but did provide the percent revenue change yearover year.

Strengths

The acquisition by Metric One offers Business Protector a stronger data center operationsenvironment one based on cloud computing. It also offers a larger professional services armthat can take the Business Protector product to a larger and broader set of customers.

Customer references report that a key reason for choosing this product is the vendor's flexibilityin customizing the product to meet its BCM need as well as the cost competitiveness of theproduct.

For the BCMP vendor-hosted/SaaS delivery model, the vendor offers a 99.999% service-levelguarantee. Data center operations are split across two continents: California in the U.S. andLondon in the U.K., significantly reducing the impact on the customer if Business Protector incursa disruptive event. Security and recovery audits are conducted on an annual basis. In addition,strong customer data protection controls are in place and are evolved as needed.

Partnerships for sales execution are very good, with an interesting one for organized labor riskmanagement assessments for events such as strikes and workplace violence.

In terms of specific product features, there is very good ease of reporting capability, very goodease of use, and good ease of customization, with drag-and-drop support. EMNS partnershipsare through top-tier EMNS vendors. Suppliers/vendors are considered a resource managed as allother resources. The product supports good workflow capability, very good risk assessmentcapability and very good BIA capability. SAML single sign-on support is available. Customer datais encrypted at rest using SQL 2010 encryption support. Data is encrypted in transit using 256-bit encryption. The user interface supports multiple languages through Unicode support.Industry-specific versions of the product are available.

Comparison pricing is very good lower than the median pricing example. The vendor's pricingmodel is based on both concurrent and named users those requiring a user ID and password.The vendor offers a multiyear discount as well as SMB and nonprofit pricing options.

Cautions

Currently, there are limited customer networking and information sharing forums outside ofspecial forums at the national BCM conferences in the U.S.

Major product releases do not occur as frequently as releases from competitors.

There is no native mobile device app for plan access. The BIA capability does not automaticallycalculate RTOs.

The vendor charges a setup fee for product implementation.

Return to Top

Continuity LogicContinuity Logic is headquartered in Fairfield, New Jersey. A privately held company, it has anemployee head count of 29 dedicated to its BCMP product. The evaluated BCMP product version wasFront Line Live 4.6; the current version is 4.9. The reported number of BCMP product customers forthis evaluation period was 50. The key markets supported are consumer services, financial services,healthcare, insurance and healthcare. The product is offered using SaaS and on-premises deliverymodels. Its architecture is based on Microsoft SharePoint 2007, IIS 7.0 (or greater) and SQL Server2008 R2.

Strengths

Continuity Logic is one of the newest vendors to the BCMP market, with a long-term focus ongovernance, risk and compliance.

Customer service and support engineers are split between the U.S. and the Asia/Pacific region.

Customer references report that a key reason for choosing this product is its cost versus thecompetition.

Data center operations are globally decentralized (New Jersey, Dallas, Texas and India),facilitating a high degree of flexibility for supporting international customers. Operations can befailed over between data centers. A performance management system is in place that supportsnear-real-time alerting of the operations team when predefined packet latency thresholds areexceeded. Quality assurance (QA) environments that mirror the intended productionenvironment are internally maintained. Users are provided with access to the QA environment

for testing purposes prior to formal production turnover. A dedicated QA team is in place forquality testing and customer support.

In terms of specific product features, the vendor's risk assessment capability is good, with theadditional capability of populating the risk register via a third-party offering, such as the UnifiedCompliance Framework (UCF). The product has very good reporting capability and very goodease of use. Its ease of customization is strong, with drag-and-drop support. EMNS is good(partnerships could improve with top-tier EMNS vendors). The vendor's C/IM and third-partymanagement capabilities are two of the strongest for a BCMP product. Workflow capability isvery good. Through the Compliance Manager module, Continuity Logic has a very goodstandards compliance capability, supporting the most (30) BCM standards/frameworks of all thevendors in this Magic Quadrant. Secure File Transfer Protocol (SFTP) is used to encrypt data intransit. Recovery plans can be printed in more than PDF format.

Comparison pricing was on target with the median pricing example. Base pricing complexity isgood (based on the number of plan administrators and product administrators). The vendor hasan excellent multiyear pricing option.

Cautions

From the customer reference point of view, the areas that Continuity Logic can improve in arecustomer service and training.

Production availability service levels are managed only to a 99.996% service guarantee level.

Partnerships with a few large consulting firms help to scale the business and expand salesperformance, but Continuity Logic needs to add more partners for this benefit to be realized.

There is no native mobile device app available for plan access for the evaluated version;however, the vendor reports that the current version of the product supports native apps for theApple iPad and Android devices. The product has limited capability to customize the look and feelto align with the customer's branding. There is no single sign-on support, and no encryption fordata at rest. The user interface supports English only.


Return to Top

Coop SystemsCoop Systems is headquartered in Herndon, Virginia. A privately held firm founded in 2002, it has anemployee head count of 25 dedicated to the BCMP product. The BCMP product version evaluated forthis Magic Quadrant was version 6.11; the current version is 6.14. myCOOP has been a productoffering since 2005. The reported number of BCMP product customers for this evaluation period wasmore than 150. The key markets supported are higher education, financial services, state/localgovernment, insurance and professional services (not including IT). The product is offeredhosted/SaaS and on-premises delivery models. The product architecture is based on SQL Server,SharePoint, Visual Studio and Microsoft .NET.

Strengths

The vendor supports both a user group and an advisory group.

Partnerships for sales execution include large technology and consulting firms in the U.S. andJapan.

Data centers are located in the U.S. (Atlanta) and Canada (Toronto, with failover to Vancouver).Operations service-level guarantees include 99.9% for service availability. SaaS operations aremanaged in Tier 4 data center facilities. Active-active operations are supported with recoverytimes on the order of minutes.

In terms of specific product features, the reporting capability is very good and the user interfacecan be tailored to align with ISO 22301 and other BCM standards/frameworks. myCOOP has avery good built-in C/IM capability. Coop Systems' hosted services use only SHA-1 hashingfunctions to encrypt all sensitive information, including passwords. As an option, data at rest canbe encrypted using AES-256. All sensitive data encrypted for transit over the Internet uses SSLv.3. myCOOP's native mobile device app delivery approach is unique the vendor worksthrough a third-party vendor that ports the app to all devices. Supplier/vendor management is aseparate module. The vendor's BIA capability is very good. Dependency mapping supports agraphical representation. The user interface supports English, Japanese and Thai. Importing datafrom organizational sources of record to the added-on myCOOP database has been resolved withthe introduction of its data synch feature. Recovery plans can be printed in more than PDFformat. Coop Systems has built automated capability to import recovery plans and data fromother BCMP products.

The pricing model is based on named users those requiring a user ID and password. Thevendor offers a strong multiyear pricing option.

Cautions

All internal staff for sales and customer call centers, as well as support engineers, are U.S.-based only. In some overseas markets, partners provide local support.

Some customer references report a concern over the vendor's customer support services.Customer references also report that there have been some challenges in balancing theupgrades and keeping up with customer desires/demands.

myCOOP requires more vendor intervention for aligning the product to customer requirements,especially those of larger clients.

In terms of specific product features, myCOOP could see expanded sales if it had partnershipswith more than one top-tier EMNS vendor (currently, MIR3). There is no support for single sign-on. The basic workflow capability has some limitations; the purchase of Advanced Workflow isrequired to perform an unlimited number of steps in a defined workflow process.

Comparison pricing was slightly higher than the median pricing example. The vendor charges asetup fee for product implementation.

Return to Top

eBRP SolutionseBRP Solutions is headquartered in Toronto, Canada. An employee-owned firm, it has an employeehead count of 40 dedicated to the BCMP product. The BCMP product evaluated for this MagicQuadrant was the eBRP Suite version 4.1.04; the current BCMP product version is 4.1.08. With aBCMP offering in place since 2002, the reported number of BCMP product customers for thisevaluation period was more than 120. The key markets supported are the broadest of all vendorsanalyzed in this research, with a focus on financial services, energy (oil and gas), discretemanufacturing, and utilities. The product is offered using hosted/SaaS and on-premises deliverymodels. The product architecture is based on Microsoft Windows Server 2008 (or newer), MicrosoftIIS and SQL Server 2008.

Strengths

During the past five years, eBRP has focused on developing an operational risk managementproduct, including BCM and third-party management.

There is strong global staff distribution between the U.S., Canada, Europe, India and Australia.

Operations data centers (Tier 3/Tier 4) are distributed across six separate geographicallocations: the U.S. (Washington, D.C. and Santa Clara, CA), Canada (Toronto, Ontario andVancouver, British Columbia) and the U.K. (London and Slough). For the BCMP vendor-hosted/SaaS delivery model, eBRP Solutions offers a 99.995% service-level guarantee.Operations failover is tested once every two weeks. The maximum amount of time in whichcustomer data could be lost is 15 minutes.

In terms of specific product features, the third-party management and dependency mappingcapabilities are the best among all the vendors in this Magic Quadrant. EMNS support is providedthrough top-tier vendors. The built-in exercise management and C/IM capability is very good.There is an integrated GIS capability (allowing all facility, employee and vendor locations to bemapped). Mobile device capability for plan access is through the C/IM capability. Workflowcapability is very good. Support for Gantt charts to visually display recovery procedures is a keyproduct differentiator. Encryption for data in transit is very good, with support for PGP, SSL v.3and SFTP. Encryption for data at rest is available upon request by the customer. Single sign-on issupported. The user interface supports multiple languages. The product has not been developedto align with any specific BCM standard, but BCM standards self-assessment compliance trackingsupport is available through configuration. Strong password controls and role-based accesscontrol. The product has strong training capabilities. eBRP has built automated capability toimport recovery plans and data from other BCMP products.

Comparison pricing is competitive, coming in slightly under the median pricing example. Thevendor has an unlimited user pricing model. The vendor offers a multiyear discount.

Cautions

eBRP has specific and long-held beliefs about how risk assessments, BIAs and recovery plansare to be developed. For example, the product does not show risk impact over a range of timeframes; this is a professional decision made by eBRP founders about how to conduct a riskassessment assessing risk impact is not much more than a guess and providing suchcapability only takes bad data and compounds it.

Although eBRP has updated the look and feel of the product, it is still limited by the .NETinfrastructure on which the product is developed. Some report data is not accessible through anonline feature, such as a URL link; eBRP considers this to be a security concern and will notprovide the capability. This last point means that there is more work to be done to completesome steps for example, you can look up people on a team, but you have to go back into theproduct's administrative interface to make changes to that person, rather than clicking on theperson's name in the generated report. Tool administration could be easier to perform and moreintuitive; you usually have to go back to the administrative interface, and go through the assetinfrastructure model to do most actions.


Return to Top

EMC (RSA)RSA, The Security Division of EMC, is headquartered in Bedford, Massachusetts. A public company,RSA acquired Archer Technologies in 2010. Archer has a BCMP solution available within its eGRCSuite. The BCMP product version evaluated for this Magic Quadrant was Archer Business ContinuityManagement v.4.5.2; the current BCMP product version is 5.2. With a BCMP offering in place sinceSeptember 2008, roughly 25% of RSA Archer customers have deployed the BCM module. The keymarkets supported are financial services; insurance; government (federal, national and provincial);business/consumer services; and professional, scientific and technical services (not including IT). Theproduct is offered in hosted/SaaS and on-premises delivery models. The product architecture is basedon .NET, Windows Server 2003/2008 Microsoft SQL Server for its RDBMS and IIS 7.0 for its Webserver. Note: RSA did not provide answers to survey questions regarding revenue by year or region,nor for staff head count. We used Gartner's internal vendor rating process to provide an overallfinancial viability score for RSA.

Strengths

BCMP capability is integrated with the vendor's enterprise and IT GRC management platform forbroader integration into the operational/enterprise risk management process. RSA has a betterand more well-established delivery ecosystem than the other GRC products included in thisresearch.

Customer support staff are in the U.S. and the U.K. Support engineers are in the U.S., U.K. andthe Asia/Pacific region.

The vendor has a well-developed network of reseller and professional services partners,

including its own EMC Consulting practice.

There is a very strong user group process, including the number and size of user forums thatfacilitate peer networking, information sharing and product requirements capture across all itsproduct modules.

In terms of specific product features, ease of reporting is very good. Ease of use and the userinterface are excellent, with strong graphical support. Ease of configuration is excellent withdrag-and-drop capability. There is an excellent use of graphics. The product leverages a third-party partner for loading risk statistics into the product. Data at rest is encrypted using AES-256. Data in transit is protected using SSL 256-bit encryption. The vendor offers one of the bestnative mobile device apps for the iPhone and iPad. EMNS support is through one top-tier EMNSvendor. Exercise management is good, as is C/IM capability. Supplier/vendor management isavailable. There is a strong BCM standards self-assessment compliance tracking capability,including alignment to key BCM standards/frameworks. Recovery plans can be printed in morethan PDF format. Single sign-on is supported. The user interface supports English, French,Spanish, German and Japanese.

Comparison pricing is on target with the median pricing example. The vendor's pricing model isbased on employee head count and the number of modules needed to be purchased. An SMBpricing option is offered.

Cautions

Availability service-level guarantees are 99.9%, lower than many of RSA's competitors. Only onedata center supports production BCMP service operations in Phoenix, with a "warm spare"; thebackup site is in Marlborough, Massachusetts. IT service operations failover is not automated. ITservice recovery testing results are not currently audited by independent third parties. Thevendor has indicated that this is due to the newness of the vendor-hosted offering and that suchauditing is planned for the near term.

Generation and distribution of a recovery plan to a designated plan owner is a bit complicated;the plan is generated through the use of Microsoft Word templates, mail merge and notifications.Also, the only file format supported as an attachment that can be printed along with the plan isWord. Other file formats will be forthcoming.

RSA is the only vendor to not offer a multiyear pricing discount. It charges a setup fee forproduct implementation. Training fees apply.

Return to Top

FactonomyFactonomy is headquartered in Edinburgh, Scotland, and New York City. Factonomy is a privately heldcompany that is venture-capital-backed. The vendor's head count is approximately 50. The BCMPproduct version evaluated for this Magic Quadrant was Factonomy ResilienceXT v.3.0; the currentversion is 3.21. Factonomy has 14 customers using its technology for BCMP purposes all havingimplemented the product within their own data centers. The key markets supported are financialservices, manufacturing and professional services. The product is offered via on-premises andSaaS/hosted delivery models. The product architecture is based on Windows 2008 Server R2 (64-bit)Microsoft .NET (v.3.5 or above), Microsoft IIS Application Server and SQL Server (either 2005 or2008).

Strengths

One of the newest entrants to the BCMP market, the FactonomyXT application engine is basedon a declarative XML application engine.

Customer references report that Factonomy is intuitive and easy to manage, and that the lookand feel is clean, streamlined, not cumbersome, and can be customized even more.

Staff for customer call center and sales, as well as support engineers, are in the U.S., U.K. andIndia.

Separate development, user acceptance testing (UAT) and production environments areestablished for each client. Additionally, internal test platforms are used for early-stageconfiguration. Operations failover to a separate physical server and to another physical locationis supported, consistent with the client's data storage policy. Factonomy supports Amazon WebServices (AWS) GovCloud (US) and is able to offer U.S. federal government customers theability to host its services on AWS GovCloud, which is compliant with the FISMA Act and theFedRAMP initiative.

In terms of specific product features, Factonomy has converted its declarative XML applicationengine from one that required extensive vendor-based configuration to one in which customerscan do much of the customization themselves. This makes the product accessible toorganizations of all sizes, not just the large, multinational organizations that Factonomy hadbeen pursuing. The user interface is very modern and easy to use. Business rules for plandevelopment and management can be unique to a business unit, region, etc. The vendor has ascenario modeler feature that takes BIA results to produce scenarios that rank the impact to thebusiness from different and varied interruptions. Due to the product operating in the MicrosoftAzure cloud environment, 2048-bit SSL is used to encrypt data in transit. There is very strongease of reporting. EMNS support is through one top-tier EMNS vendor. Role-based access controlis very strong. Single sign-on is supported.

The pricing model is based on employee head count.

Cautions

Partnerships for sales execution are few, although those that Factonomy has IBM and Deloitte are strong partners.

The vendor currently does not support a formal user group.

The SaaS/hosted offering has highly resilient and scalable operations run in Microsoft's Azurecloud computing infrastructure, although no customer has implemented the product in thisdelivery model as of the evaluation time frame. Factonomy offers Microsoft Azure services as a

managed service.

For its vendor-hosted/SaaS delivery model, Factonomy offers a 99.95% service-level guaranteeonly. The vendor's recovery plans are not tested on a regular basis. Little to no regular vendortesting of system performance.

No encryption support currently exists for data at rest. The product does not come with built-insupport for any BCM standard/framework. There is no native mobile device app support, and noC/IM capability. The user interface supports multiple languages through the use of the translatefeature. English, German, Russian and simplified Chinese are the standard options offered, butany language can be supported. In all cases, the client is responsible for making andmaintaining the translation.

Comparison pricing is noncompetitive to the median pricing example. Most implementations arefixed-price.

Return to Top

Fusion Risk ManagementFusion Risk Management is headquartered in Rolling Meadows, Illinois. It is a privately held companywith investors that include Fusion's founders and selected angel investors. The head count of thecompany is approximately 15. The BCMP product version evaluated for this Magic Quadrant was theFusion Framework Risk Management & Contingency Planning System v.1.4; the current version is 1.5.The Fusion Framework System runs on the cloud-based Force.com application platform and hostingenvironment provided by salesforce.com. As an independent software vendor (ISV) applicationpartner of salesforce.com, Fusion provides the Fusion Framework System and underlying Force.comembedded OEM licenses as a single integrated solution to its enterprise customers. Fusion RiskManagement currently has more than 30 customers. The key markets supported are manufacturing,financial services, telecommunications, energy, services, retail and distribution. Because it is alayered service within the salesforce.com cloud, the only delivery model supported by Fusion Risk isSaaS.

Strengths

The newest and fastest-growing BCMP vendor, Fusion has some of the strongest BCMprofessional experience in its management team.

Fusion Risk Management is the only BCMP vendor that utilizes cloud-based platform as a service(PaaS), specifically through salesforce.com.

Customer reference feedback indicates ease of use and expanse of customization capability.

Fusion Risk Management offers a 99.9% service-level guarantee. The product platform(Force.com) supports several million concurrent users. Client-specific QA is performed tovalidate user access models, workflows and navigation. Service availability and performance ismeasured and continuously reported on the public-facing portal. Salesforce.com has a veryrobust IT disaster recovery management (DRM) capability with ongoing component testing,failover testing and multiple layers of backup. Full recovery test data is provided to clients aspart of the BITS Shared Assessment reports and SSAE 16, among other assessments. Thevendor also regularly tests its internal BCM plans via a mandatory work-from-home strategyevery six weeks.

In terms of specific product features, Fusion Risk Management has some of the best reporting,ease of use and configuration capabilities. It provides mobile device support for plan access,incident response, reports and dashboards, and comprehensive enterprise collaboration via theintegrated salesforce.com Chatter application included with the Fusion Framework System.Chatter Mobile is supported on iOS, Android and BlackBerry, and Chatter runs within the FusionFramework System and as a stand-alone desktop application. Encryption of data in transit isdone through standard HTTPS/TLS 128-bit encryption using RC4-128, with SHA1 for messageauthentication and RSA as the key exchange mechanism. Encryption of data at rest is optionalusing the industry standard AES algorithm and 128-bit master keys. Very good C/IM is built intothe product. Workflow capability is very good, with integrated workflows across all plans andfeatures of the product. BCM standard compliance self-assessment tracking is available throughconfiguration to follow many BCM standards. There are very good role management and accesscontrol capabilities. Single sign-on is supported via SAML 2.0 and 1.1. Recovery plans can beprinted in more than PDF format. The user interface can support more than 25 languages.

The pricing model is based on named users those requiring a user ID and password. Thevendor offers a multiyear discount and has an SMB pricing option called Fusion Essentials.

Cautions

All internal staff for customer call centers and support engineers are U.S.-based only. There is asmall sales presence in Canada.

Because it is a new vendor in the BCMP market, partnerships are currently very limited. The useof Tier 2 partners is planned for expansion purposes into EMEA, Latin America and theAsia/Pacific region.

All data centers are in the U.S. in Northern and Southern California, Illinois, and Virginia. Torun the Fusion Framework System application in a non-U.S. salesforce.com data center, Fusionmust make an application to salesforce.com for its review and acceptance.

The BIA capability does not automatically calculate RTOs as an out-of-the-box feature, but theproduct can be configured to do so.

Comparison pricing is noncompetitive to the median pricing example. Training fees apply.

Return to Top

MetricStreamMetricStream is headquartered in Palo Alto, California. A privately held company, it has an employeehead count of 1,100 of which 35 to 40 are dedicated to the BCMP product. The evaluated BCMPproduct version was MetricStream 6; the current version is 6.1. With a BCMP offering in place since

2010, the reported number of BCMP product customers for this evaluation period was 15. Key verticalmarkets supported are energy, financial services (including Insurance), government (federal, nationaland provincial), life sciences, discrete and process manufacturing, and utilities. The product is offeredusing SaaS/hosted and on-premises delivery models. The product architecture is based on open-standard Java Platform, Enterprise Edition (Java EE) and XML. Note: Revenue numbers were notprovided by the vendor.

Strengths

BCMP capability is integrated with the vendor's enterprise and IT GRC management platform forbroader integration into the operational/enterprise risk management process. In addition, theBCMP module is packaged and sold separately from MetricStream's GRC offerings.

Staff for customer call centers and sales are on every continent, and support engineers are inthe U.S., Europe and Asia.

For the BCMP vendor-hosted/SaaS delivery model, MetricStream offers a 99.999% service-levelguarantee. Data center operations are located on three separate continents: the U.S., India andEMEA.

In terms of specific product features, the customization capability is the strongest of all vendorsin this research. Ease of reporting is very good, and ease of use is above average. A very goodand flexible workflow capability is supported by the Process Flow Designer product a Visio-likeinterface. A strong track record is in place for both IT operations control management andregulatory compliance, with the second-highest number (22) of BCM standards/frameworkssupported. Data at rest is encrypted using 256-bit PGP, and 256-bit HTTPS is used to encryptdata in transit. A native mobile device app is available for plan access in offline mode.MetricStream has one of the best third-party management capabilities of all the vendorsincluded in this research, although it is a separately purchased module. Role management andaccess control capabilities are also the best among all vendors in this Magic Quadrant. Singlesign-on is supported. The vendor has added a few interesting features to its offering, such asvirtualization risk management and live situational awareness tracking. The user interfacesupports multiple languages through Unicode support.

MetricStream offers a multiyear pricing discount.

Cautions

Strong partnerships with business and technology firms are in place for sales execution, but theyare not focused on BCM, which means that they are not recognized in the marketplace as astrong BCMP vendor.

For the product version analyzed for this Magic Quadrant, service operations recovery plantesting frequency was unclear, and application performance and scalability testing was onlyperformed in response to a customer request. According to the vendor, it has since changedthese cautions as follows: service operations recovery plan, application performance andscalability are now tested annually and with every new release.

The BIA capability does not automatically calculate RTOs, nor does it show business interruptionimpact over a range of time frames. The internally provided EMNS capability has limitedendpoints. There is no C/IM capability; the vendor has indicated that this module is currentlyunder development.

Comparison pricing is noncompetitive to the median pricing example. The pricing model is basedon the number of users and their type: heavy (e.g., product administrators), medium (e.g., planadministrators) and light (everyone else, including read-only users). There is a setup feecharged for product implementation.

Return to Top

ModuloModulo is headquartered in Atlanta. It is a privately held company with a total employee head countof 400, including 70 employees focused on the development of the Modulo Risk Manager product and15 employees dedicated to the BCMP module. The evaluated BCMP product version was the BCMmodule of the Modulo Risk Manager software v.8.1; the current version is 8.2. With a BCMP offeringin place since 2006, the reported number of BCMP product customers for this evaluation period wasapproximately 50 (all internally hosted in customer data centers). The key vertical markets supportedinclude energy, financial services, federal and state government agencies, transportation, and utilities.The product is offered via SaaS/hosted and on-premises delivery models. The product architecture isbased on Microsoft Windows Server 2008, Microsoft .NET Framework 64 and Microsoft SQL Server2008.

Strengths

The BCMP capability is integrated with the vendor's enterprise and IT GRC management platformfor broader integration into the operational/enterprise risk management process.

Customer references report that a key reason for choosing this product is its cost versus thecompetition, as well as vendor certifications in ISO 20000 and ISO 27000.

Customer service, sales and support engineers are located in the U.S., U.K., Brazil and India.Modulo has a highly experienced consulting and professional services team.

The vendor has a strong reseller network with over 70 companies reselling the Risk Manager andBCMP modules.

For the BCMP vendor-hosted/SaaS delivery model, Modulo offers a 99.9999% service-levelguarantee with data centers located in the U.S. (production and recovery) as well as Brazil. Astrong track record is in place for both IT operations control management. A large test and QAmanagement team (of 20) is in place.

In terms of specific product features, there is a very flexible user interface, although it has themost technical feel of all the BCMP products. There is a very good ease of reporting capability,including an SQL query to create any dashboard report. There is strong standards/frameworkscompliance tracking support with alignment to key BCM standards/frameworks. Google Maps is

used to view the impact of natural events (such as weather) on asset availability. There is goodworkflow and risk assessment capability. Graphics support is excellent throughout the product,including graphical plan dependency mapping support. Data at rest is encrypted using AES-256.Data in transit is encrypted using IIS-level certified HTTPS, which supports SSL v.3.0. There arevery good role management and access control capabilities. Single sign-on is supported. Theuser interface supports English, Portuguese and Spanish.

Comparison pricing is competitive, coming in slightly under the median pricing example. Thevendor offers a multiyear pricing discount.

Cautions

The areas in which Modulo can improve, from a customer reference point of view, arefeatures/functions and maintenance/upgrades.

The SaaS-based delivery model was a new offering at the time of this evaluation; therefore,customers who have implemented the BCMP capability in SaaS were not included.

Ease of customization needs improvement, as customers are not able to change terminology totheir terms and there is limited ability to change the look and feel of the product to meet thecustomers' branding requirements. Plan components are fixed and are not easily modifiable bycustomers. There are limited built-in EMNS and C/IM capabilities. Exercise managementcapability is available, but only through configuration through workflow. BIA capability does notautomatically calculate RTOs, nor does it easily support modifications to facilitate time-basedimpact assessments; instead, a separate BIA must be initiated and populated. There is no nativemobile device app for plan access.

Because Modulo's focus is GRC, pricing is based on the number of IT assets being managed bythe Risk Manager module, which is a nonintuitive approach for BCM professionals. The BCMmodule is not sold separately from the Risk Manager module and is 20% of the base RiskManager cost. The vendor charges a setup fee for product implementation.

Return to Top

PhoenixPhoenix is headquartered in Northampton, U.K., and is listed in the FTSE. The employee head countdedicated to the BCMP product is 102. The evaluated BCMP product version was 4.2; the currentversion is 4.2.4. With a BCMP offering in place since 2003, the reported number of BCMP productcustomers for this evaluation period was 75. Phoenix does not manage its business by industryvertical; rather, it does so by region and, therefore, we have no key industry verticals to list for thevendor. The product is offered using the vendor-hosted delivery model. The product architecture isbased on the CentOS, vSphere infrastructure, JBoss Middleware, MySQL database and theJasperReports engine; client access is via a Web browser (PC, Mac or tablet) or mobile app(BlackBerry/RIM platform). Note: Phoenix did not provide information regarding its typicaldeployments.

Strengths

Phoenix has a high-quality professional services delivery capability.

For the BCMP vendor-hosted/SaaS delivery model, the vendor offers a 99.997% service-levelguarantee. A staffed 24/7 operations center continuously monitors applications and systemsalarms. Operations data centers are distributed across four separate geographical locations: theU.K. Aston (production), the U.K. Farnborough (recovery) Phoenix (the majority ofShadow-Planner clients are hosted in Phoenix's own U.K. data centers), and, for clients who wishto host their data outside the UK, Switzerland Geneva (production and recovery) and theU.S. New York City. Recovery tests are conducted on a daily basis.

In terms of specific product features, the opening screen is a dashboard of BCM programmanagement. The user interface is very clean. The product has very strong ease ofconfiguration, with drag-and-drop capability on most administrative features. Ease of reportingis very good. EMNS support is through top-tier EMNS vendors. Supplier/vendor management,workforce scheduling over time and recovery seat planning capability is available. Workflow canbe built using multiple steps and can automatically populate the calendar of tasks to complete inthe workflow process. Out-of-the-box BCM standards/frameworks alignment is to BS 25999Parts 1 and 2. There is good risk assessment capability, and very good role management andaccess control capabilities. Single sign-on is supported. AES-256-bit encryption is used forencrypting data in transit. The user interface supports English, French, German, Spanish, Italianand Japanese.

Comparison pricing was on target with the median pricing example. The pricing model is basedon employee head count. The vendor offers a multiyear discount, as well as nonprofit and SMBpricing.

Cautions

Customer call centers, support engineers and sales are in the U.K. only.

The area in which Phoenix can improve, from a customer reference point of view, is in the timeand effort it takes to bring the product into production.

Partnerships for sales execution are nonexistent. Phoenix needs to pick up a large businessconsulting firm to make inroads into the larger enterprise risk management area.

Specific product features: native mobile device app available only on the BlackBerry. There is noexercise management, C/IM or compliance management support. BCM standard compliance self-assessment tracking is not available as an "out-of-the-box" feature. Data at rest is notencrypted.


Return to Top

Quantivate

Quantivate is headquartered in Woodinville, Washington. It is currently a privately held company. Theevaluated BCMP product version was Quantivate Business Continuity December/2012. Quantivatedoes not publish version numbers because product updates are continuously made and rolled out toall customers. The product is offered via the SaaS/hosted delivery model only. The productarchitecture is based on Linux, Apache HTTP Server, open-source MySQL and PHP. Note: Quantivatedid not provide answers to a number of questions in the vendor survey, including staffing size anddistribution, revenue numbers by year, region and industry (however, it did provide the percentchange in revenue year over year), the number of customers, pricing, and the number of newcontract signings. The exclusions are the primary reason for its Niche Player placement in the MagicQuadrant.

Strengths

Quantivate provides an integrated platform for BCM, information security, enterprise riskmanagement, audit management and third-party management.

Customer references report that the key reasons for choosing this product are its intuitive userinterface, experience with other products from this vendor, and Quantivate's "loss based"approach to BCM that matched the customer's internal approach.

Operations are managed in Tier 4 private cloud infrastructure data center facilities located inChicago and Dallas. Users can get a whole QA environment setup with their cloned data. Thevendor has high-quality customer service support with a very repeatable service implementationand management process.

In terms of specific product features, the native mobile device app for plan access is very good,with support for iOS and the Droid with synchronization to the phone for offline usage. The easeof use and user interface and the ease of reporting are very good. The ease of configuration isgood, with drag-and-drop capability. EMNS capabilities are limited and C/IM capability is built-in.Quantivate's third-party management capability is excellent, although it is a separatelypurchased module. The BIA capability can report on RTO gaps in a very graphical and intuitiveway. The product provides conversion support for a wide variety of different plan formats. Thereis custom help text online for every field. There is very good graphics support (e.g., heat mapson risk assessment) and a graphical view of plan procedures. Data at rest is encrypted using256-bit AES. Data in transit is encrypted using multiple SSL and TLS versions. Quantivate hasbuilt an automated capability to import recovery plans and data from other BCMP products.Recovery plans can be printed in more than PDF format.

The vendor offers a multiyear pricing discount.

Cautions

All internal staff for sales, customer call centers and support engineers are U.S.-based only.

The areas in which Quantivate can improve, from a customer reference point of view, aretraining and maintenance and upgrades.

Reseller and system integration partnerships are very limited, which impacts the vendor'smarket presence and sales performance.

Quantivate supports a 99.9% IT service-level guarantee lower than most vendors in thisMagic Quadrant. IT service operations recovery plans are only tested once per year. IT serviceincident management procedures are not well-defined. Operations failover is managed manually.

There is limited support for modifying the look and feel of the product to align with customers'branding requirements. There is a minimal BCM standards/frameworks self-assessmentcompliance tracking capability. Workflow is limited to two steps based on date. Roles and accessmanagement is not as robust as the other vendors in this research, and single sign-on is notsupported. The user interface supports English only.

Comparison pricing was not able to be calculated because Quantivate provided no pricinginformation. Pricing is not typically based on the number of users. Rather, the vendor uses apricing model based on the industry of the customer. For example, banks and credit unions arecharged by asset size, mortgage companies by outstanding loans, insurance companies byassets under management, and for some other industries, by the number of plans they want toproduce.

Return to Top

RecoveryPlannerRecoveryPlanner is headquartered in Trumbull, Connecticut. It is a privately held company with anemployee head count of 28 that is dedicated to the BCMP product. The BCMP product versionevaluated for this Magic Quadrant is RPX Enterprise, RPX Bank and RPX Credit Union Editions r.21.91;the current version is r.22.95. With a BCMP offering in place since 2001, the reported number ofBCMP product customers for this evaluation period was 200. The key vertical markets supported fortheir BCMP offerings are financial services, insurance, higher education, and professional, scientificand technical services (not including IT). The product is offered using the following delivery models:SaaS/vendor-hosted, customer-hosted or a hybrid of these. The product architecture is based onLinux and Java.

Strengths

Customer call center staff are in the U.S., U.K., Brazil, the Dominican Republic and Bulgaria.Sales staff are in the U.S., U.K. and Brazil. Support engineers are in the U.S., U.K., Brazil andArgentina.

A strong reseller partner program provides RecoveryPlanner with global, enterprisewide BCMPdeployments.

IT service availability is 99.99%. Data center operations are separately located in two countries(the U.S. and Canada) and spread between two data centers in each country two in the U.S.(Chicago and Denver) and two in Canada (Toronto and Vancouver), and support automaticcutover. Failover processes have been audited and certified by several large clients. Customerscan do their own testing and QA with their own production data optionally synchronized to the

staging area prior to production release. Portions of the IT operations recovery plan are testedon a quarterly basis. Penetration testing is conducted daily by a third party. The vendor hasstrong customer service.

In terms of specific product features, there is very good ease of reporting and ease of use/userinterface. The product has built-in support for C/IM. Support for Gantt charts to visually displayrecovery procedures is a key product differentiator. Sensitive data at rest (plan data, personneldata, revision history data and customer custom fields), as well as in transit, is encrypted usingAES-256. RecoveryPlanner has specific versions for commercial banks and credit unions. EMNScapability is supported through partnerships with top-tier EMNS vendors, as well as built-inemail and SMS alerts. Exercise management and third-party management capabilities areavailable. The user interface supports English, Spanish, Portuguese and French. RPX has a verygood BCM standard self-assessment compliance tracking capability. Recovery plans can beprinted in multiple formats. Single sign-on support is through SAML2. RecoveryPlanner has builtan automated capability to import recovery plans and data from other BCMP products.

Comparison pricing is competitive, coming in at approximately 25% less than the median pricingexample. Pricing complexity is medium to low, with the pricing model based on head count orasset size or BCM program complexity with a determination of the expected use levels of theproduct. The vendor offers a multiyear discount as well as nonprofit and SMB pricing options.

Cautions

Security audit testing of IT service operations by a third party is performed once per year.

Native mobile device support for plan access is not available. Workflow capability could beimproved it needs to be standardized across all BCMP product functions. The risk assessmentcapability does not show risk impacts over a range of time frames, but the customer canconfigure and report on risk impact in the risk survey.

A setup fee is charged for product implementation, and includes training and assistance withdata migration.

Return to Top

Rentsys Recovery Services-EverGreenRentsys Recovery Services-EverGreen is headquartered in College Station, Texas. At the time ofevaluation, EverGreen Data Continuity was a privately held company, with an employee head count of13 dedicated to the BCMP product. On 16 July 2013, Rentsys announced the acquisition of EverGreen.The BCMP product version evaluated for this Magic Quadrant was Mitigator 9.0.0; the current versionis 9.0.1. With a BCMP offering in place since 2003, the reported number of BCMP product customersfor this evaluation period was 259. The key markets supported are financial services, includinginsurance; K-12; higher education, healthcare and federal government agencies. The product isoffered using the following delivery models: SaaS/hosted, on-premises and hybrid. The productarchitecture is based on Microsoft .NET and SQL Server (either 2005 or 2008).

Strengths

Rentsys-EverGreen has a strong focus on product quality and offers a guarantee to fix recoveryplans if the customer fails an audit after using the product a unique offering in the market.

Support engineers are in the U.S. and EMEA.

Customer references report that the key reasons for choosing this product are its cost versus thecompetition, ease of use, and the ease of managing and maintaining it.

Partnerships are very good and international, but the vendor needs to pick up a large businessconsulting firm to make inroads into the larger enterprise risk management area.

For the BCMP vendor-hosted/SaaS delivery model, Rentsys-EverGreen offers a 99.9999%service-level guarantee, with data centers in the U.S. and Canada. The vendor quotes aguaranteed product operations one-hour maximum recovery time. Well-defined operationsfailover procedures are defined between service provider facilities. QA and preproductionturnover test processes are well-defined and rigorously managed.

In terms of specific product features, the product comes with preloaded content for riskassessments through recovery planning tasks. There is strong, integrated IT DRM support.Exercise management is supported. The product has a very broad and complete set of trainingservices available to customers, such as online user guides and tutorial videos. The C/IMcapability is very good. There is a strong workflow capability. BCM standards self-assessmentcompliance tracking support is through reports called survey summaries, which track percentcompliance to industry best practices. There is above-average risk assessment and BIAcapabilities are based on National Institute of Standards and Technology (NIST) best practices.There is a solid financial analysis capability, although it is rarely used by customers because thedata needed to perform such an analysis is often not readily available to the customer. Theproduct has good graphical capabilities. Standard 256-bit HTTPS is used to encrypt data intransit. Single sign-on support for Shibboleth and LDAP is available. The user interface supportsonly English and Italian.

Comparison pricing is very competitive, coming in at approximately half of the median pricingexample. The pricing model is based on employee head count. The vendor offers a multiyeardiscount, as well as SMB and nonprofit pricing options.

Cautions

Customer support personnel are in the U.S. only.

There is limited mobile device capability for plan access. Ease of reporting and customization arethe most limited of all the vendors in this research; customers cannot change any report oreasily customize the product, and must go back to the vendor to do so, or export the data toExcel for report manipulation. Data is not encrypted at rest. The user interface should bemodified for a more modern look. Customers cannot construct their own business impact timeframes, although the vendor notes that it provides the most standard ones. The product doesnot support the concept of third parties they are considered contacts only. The role and

access controls provided by the product cannot be modified by the customer.


Return to Top

Strategic BCPStrategic BCP is headquartered in Plymouth Meeting, Pennsylvania. A privately held company, it hasan employee head count of 15 dedicated to the BCMP product. The BCMP product version evaluatedfor this Magic Quadrant was ResilienceONE v.6.0; the current version is 6.1. With a BCMP offering inplace since February 2004, the reported number of BCMP product customers for this evaluation periodwas 137. The key vertical markets supported for the vendor's BCMP offering are financial services,including insurance; higher education and healthcare. The product is offered using the followingdelivery models: hosted/SaaS, on-premises and hybrid. The product uses an n-tier architecture and iswritten in .NET (C#). Note: Revenue numbers were not provided, but percent change year over yearwas provided.

Strengths

Strategic BCP is known for its BCP Genome offering, a built-in component of ResilienceONE thatensures a strong compliance tracking capability to over 20 BCM-related standards andframeworks, and allows customers to map their BCM program and BCMP components to them.The vendor also uses a business process modeling method when developing recovery plans aunique approach.

Customer references report that a key reason for choosing this product is its cost versus thecompetition.

Strong partnerships with top consulting firms provide higher market presence and salesperformance.

An IT service availability level of 99.999% is supported. With Tier 4 data centers in Dallas(production) and Virginia (recovery), IT service operations can be automatically failed over fromthe primary to the secondary site. A separate user acceptance test URL is configured to enablecustomers to test any new code prior to going into production. Strategic BCP has strongcustomer service, with an online enhancement submission product that customers can use tosubmit product enhancement suggestions. Clients have the option to audit internal BCMPoperations as part of the operations SLA.

In terms of specific product features, the offering has the best ease of reporting capability every field in the database has been mapped to the vendor's internal reporting product, and canbe dragged and dropped to build custom reports on the fly. There is very good ease of use and agood user interface. There is a strong customization capability, with drag-and-drop support.EMNS capability is provided through top-tier EMNS vendors. There is a very good built-in C/IMcapability included in the base price. Exercise management is provided through the C/IMmodule. There is good third-party management capability and good workflow capability. The riskassessment capability is also good. There is very good BIA capability, including the automaticcalculation of RTOs. Role and access control management are very good. Data at rest isencrypted with either 3DES (an obsolete algorithm) or AES 256 (preferred). Single sign-on issupported. Recovery plans can be printed in more than PDF format.

Comparison pricing is competitive coming in at approximately 25% less than the medianpricing example. The vendor offers nonprofit and SMB pricing options.

Cautions


There is no native mobile device app support. Data in transit is encrypted using a weakalgorithm (128-bit SSL). The user interface is in English only.

Return to Top

SunGard Availability ServicesSunGard Availability Services is headquartered in Wayne, Pennsylvania, with its ContinuityManagement Solution (CMS) division headquartered in King of Prussia, Pennsylvania. A privately heldcompany, it has an overall employee head count of over 3,000, with approximately 200 dedicated tothe CMS software. The BCMP product version evaluated for this Magic Quadrant was LDRPS v.10.8,BIA Professional v.10.8, Risk Assessment v.10.8 and modules of CMS. The current BCMP productversion is 10.8. With a BCMP offering in place since 1988, the reported number of BCMP productcustomers for this evaluation period was 2,051. The key markets supported are business/consumerservices, energy, financial services, government (state, local and regional), healthcare, and insurance.The product is offered in hosted/SaaS and on-premises delivery models. The product architecture isbased on Microsoft .NET. Note: Revenue numbers were not provided. Also, SunGard is activelyaddressing customer complaints about LDRPS (including v.10, which some customers have had a hardtime migrating to) and the expanded CMS software suite by completely redesigning the product(called Assurance) from the ground up, including the core platform, database, user interface andother components, under the direction of a new product design team. The new solution, not evaluatedfor this Magic Quadrant, was announced in March 2013 and was made generally available on 31 May2013.

Strengths

LDRPS has the largest product installed base and strong brand recognition, with very well-established customer/user forums. Because of its data center hosting business, SunGard hasextensive experience in managing complex data center operations.

Customer call centers are located in the U.S., U.K. and India, with support engineers availablefor global customer support 24/7. Call center, support engineers and other support personnelare required to have BCM professional certification.

Customer references report that a key reason for choosing this product is the functionalityprovided.

The product is hosted in five geographically separate locations in Tier 4 data centers:Philadelphia, Atlanta, and Aurora, Colorado, in the U.S., and two data centers in the U.K. forcustomers wanting to host outside of the U.S. IT service operations recovery plans are internallytested once per quarter. A fully hosted UAT environment for testing and training is provided.Maintaining a database in a separate software staging environment enables customers toperform internal training or testing without impacting their production databases. SSAE 16 TypeII certification for IT service operations has been obtained.

In terms of specific product features, the new CMS framework has made the product more user-friendly and allows enhanced security features, such as single sign-on using the SAML standard.Built-in EMNS is provided through the vendor's NotiFind product (powered by Varolii).Supplier/vendor management is available through a separate module. C/IM capability isavailable through the built-in Incident Manager product (powered by WebEOC). AES-256 is usedto encrypt data at rest. SSL v.3 is used to encrypt data in transit. SunGard has product versionsfor credit unions and healthcare organizations. Recovery plans can be printed in more than PDFformat. The user interface supports Portuguese, French, English, Japanese, Spanish and Polish.

Comparison pricing was on target with the median pricing example. The pricing model is basedon the number of concurrent users. The vendor offers multiyear pricing discounts, as well asnonprofit and SMB pricing options.

Cautions

Some customer references report that the product is too expensive, too complex, not easy touse and too modular (not integrated as an entire BCMP product deliverable). The areas in whichSunGard can improve, from a customer reference point of view, are pricing, installation andsetup, and maintenance and upgrades. Note: SunGard had the lowest customer referenceoverall score of all the vendors in this Magic Quadrant. The vendor often has difficulty winningcurrent competitive bids because of its prospects' assessment of complexity and pricecompetitiveness for LDRPS. The perceived lock-in of the LDRPS BCM methodology and lack offlexible workflow is a recurring customer concern. Currently, all deviations require customization(through configuration) of the product, which further locks users into the product.

For the BCMP vendor-hosted/SaaS delivery model, SunGard offers 99.9% (hosted) and 99.5%(SaaS) service-level guarantees, which are low compared with the other vendors in thisresearch. Recovery plans are not made available in their entirety to customers; portions of theseplans are considered confidential and, therefore, are not released.

No native mobile device app is available for plan access. The ease of use and user interface arerepeatedly mentioned by customers as being lacking, requiring strong IT knowledge toadminister the product and being nonintuitive for end users. Ease of customization is the secondlowest of all vendors included in this Magic Quadrant; drag-and-drop capability is not supported.Exercise management is provided through a separate module, not through the C/IM module.BCM standard self-assessment compliance tracking is not available as an out-of-the-box feature,but the product can be configured to align with many BCM standards. CMS does not have aninternal reporting engine; it requires the use of SAP Crystal Reports. To use the survey capabilityfor BIAs, users must buy the BIA Professional module (what SunGard calls BIA Lite is included inthe core LDRPS product). There is no risk register, but risk views can be created via reporting.

Return to Top

VirtualVirtual is headquartered in Budd Lake, New Jersey. A privately held company, it has an employeehead count of 28 dedicated to the BCMP product. The BCMP product version evaluated for this MagicQuadrant was Sustainable Planner v.2.6; the current version is 2.8. The vendor reports that version3.0 is scheduled for 3Q13 release. With a BCMP offering in place since April 2005, the reportednumber of BCMP product customers for this evaluation period was 35. The key markets supported arehealthcare, insurance, government and financial services. The product is offered using the followingdelivery models: hosted/SaaS, on-premises and hybrid. The product architecture is based onMicrosoft ASP.NET and Visual Basic .NET, and an SQL Server or Oracle Database. Note: Virtual usesthe term "templates" to refer to configuring Sustainable Planner for specific purposes (e.g., incidentmanagement, IT DRM, business recovery and other operational risk management capabilities), ratherthan just a form or report template.

Strengths

Virtual is very strong in understanding the BCM requirements of its key target industry sectorsof healthcare, insurance and financial services, as well as in its overall BCM consulting practice.The vendor is also making headway into government, retail, research and academic BCMprograms. In addition, Virtual is the creator of the Business Continuity Maturity Model (BCMM).

Customer references report that a key reason for choosing this product is Virtual's Completenessof Vision and ease of configuration.

Sales partnerships are many and across multiple geographies, with stronger support in LatinAmerica.

For the BCMP vendor-hosted/SaaS delivery model, the vendor offers a 99.999% service-levelguarantee. Operations failover is fully automated. Recovery test results are audited by a thirdparty.

In terms of specific product features, ease of customization is high, with templates created tosupport unique requirements, such as alternate work site resource reservation andmanagement. There is good BIA capability. Data in transit is encrypted using SSL v.3. EMNScapability is through top-tier EMNS vendors. The user interface supports French, Spanish,Portuguese, Italian and German. The multiple templates provided in Sustainable Planner alignwith NFPA 1600 2013 Edition, ASIS SPC.1-2009 and ISO 22301. The Sustainable Plannerproduct includes two BCMM assessment templates supporting BCMP program metrics, includingstandards compliance.

Comparison pricing is on target with the median pricing example. The vendor's pricing model isbased on the number of named users those requiring a user ID and password. Virtual offers amultiyear pricing discount, as well as SMB and nonprofit pricing options.

Cautions


The user interface is old looking; the vendor reports that version 3.0 has a new look and feel.The product does not support drag and drop. The product does not have an internal reportingengine; it requires the use of Crystal Reports. Data at rest is not encrypted. There is no nativemobile device app for plan access. There is a very limited BCM standard self-assessmentcompliance tracking capability. A few of the navigation elements (e.g., Previous Page and NextPage) of the user interface are hard-coded and cannot be changed into local language.

Reports are only in PDF format, although data can be exported to Excel, Word and RTF files formanipulation. Workflow needs improvement and automatic notifications for user action-taking.

Return to Top

Vendors Added and DroppedWe review and adjust our inclusion criteria for Magic Quadrants and MarketScopes as marketschange. As a result of these adjustments, the mix of vendors in any Magic Quadrant or MarketScopemay change over time. A vendor appearing in a Magic Quadrant or MarketScope one year and not thenext does not necessarily indicate that we have changed our opinion of that vendor. This may be areflection of a change in the market and, therefore, changed evaluation criteria, or a change of focusby a vendor.

Return to Top

AddedNot applicable this is the first Magic Quadrant for this market.

Return to Top

DroppedNot applicable this is the first Magic Quadrant for this market.

Return to Top

Inclusion and Exclusion CriteriaInclusion in the 2013 BCMP Magic Quadrant was based on the following criteria:

The product met the Gartner definition of a BCMP product (see "Hype Cycle for BusinessContinuity Management and Disaster Recovery Management, 2012").

Products must have been generally available as of 31 December 2012.

Products must be deployed in at least 10 customer production environments (preferably onefrom North America, one from EMEA and one from the Asia/Pacific region)

Each vendor had to supply at least five references available to contact.

Value-added resellers and product distributors are not included.

Exclusion was based on the following criterion:

The vendor's BCMP product was developed and used primarily for small businesses.

Return to Top

Evaluation CriteriaAbility to ExecuteAbility to Execute is ranked according to a vendor's ability to provide a BCMP product to the marketthat meets customer feature/function capability requirements, as well as the vendor's ability todeliver and service the product with a high level of service guarantee and customer support.

Product/Service compares the completeness and appropriateness of core BCMP technologycapability as well as service delivery operations, except those noted in the Offering/Product Strategyevaluation criterion category. We weighted this category High.

Overall Viability considers the vendors' demonstrated commitment in the market regarding staffingchanges except for sales, company ownership and revenue growth between 2010 and 2012, ascompared with the rest of the market using a median three-year revenue growth percentage of17.5%.

Sales Execution/Pricing compares the depth, breadth and strength of a vendor's sales channels,including direct and indirect geographic distribution channels, the change in sales and marketingstaffing, current sales comparison for the percentage of prospects evaluating its BCMP product, thetypical size of its customers, new contract signings, the deep and breadth of its sales channels, thelargest and most complex customer implementation, the average revenue percentage for verticalindustry coverage, and pricing, including the percent change in the vendor's deal size, its overallpricing complexity and a product pricing comparison.

Customer Experience is a combined rating of service-level agreement guarantees, the vendor'ssupport and service process, the preparedness and completeness of the vendor in delivering theMagic Quadrant demo to Gartner analysts (a vendor's execution with Gartner is a direct reflection ofits execution with customers), and customer reference feedback directly from the vendor and Gartnercustomers.

Table 1. Ability to Execute EvaluationCriteria

Criteria Weighting

Product/Service High

Overall Viability Standard

Sales Execution/Pricing Standard

Market Responsiveness/Record No Rating

Marketing Execution No Rating

Customer Experience Standard

Operations No Rating


Return to Top

Completeness of VisionCompleteness of Vision is ranked according to a vendor's ability to show a commitment to BCMPtechnology developments in anticipation of user wants and needs that turn out to be on target withthe market, as well as the ability to show integration into the broader BCM, EMNS and C/IM markets.

Market Understanding is ranked through observation of the degree to which a vendor's products,road maps and missions anticipate leading-edge thinking about buyers' wants and needs. Included inthis criterion are how the vendor supports specific industry verticals, how buyers' wants and needsare assessed and then brought to market in a production ready offering, and the vendor's competitiveassessment of its own product in the market.

Sales

Documents

Magic Quadrant for Business Continuity Management Planning Software