"Compliance" may be a word that makes some IT executives cringe, but the management at Virgin Mobile didn’t shy away when it came time for them to demonstrate that they could ensure business continuity for their customers, shareholders and other constituents.
Virgin Mobile is one of the most dynamic companies in the UK and one of the most energetic mobile communications providers in the world. Launched in 1999, it has swiftly grown to 1,400 employees serving more than four million customers. But what would happen to those customers and the company in the event of a disaster? It was clear the company needed a business continuity and crisis management solution that would proactively mitigate risk to enable compliance with UK corporate governance guidelines. "We wanted to be certain that we were adhering to best practice business continuity management," says Andrew Ralston, customer relationship director, Virgin Mobile. "We recognized there were several single points of failure that we needed to address. We had a strong opinion of what the risks were that we faced, but we required a more formal set of guidelines to make certain the company was adhering to its insurance, legal, and regulatory requirements."
Symantec Consulting Services worked with Virgin Mobile to prepare a business continuity management (BCM) plan that would comply with the British Standards Institute PAS56 standards for business continuity management. To accomplish this goal a business continuity coordinator (BCC) for each of the company's functional areas was appointed. Time was allotted for each BCC to attend trainings and workshops provided by the Symantec Business Continuity Practitioner to help them prepare their division/functional plans.
The first stage of the plan development involved a Business Impact Analysis and Risk Assessment. The BCCs compiled information about what they would need to do to ensure business continuity in the event of a large or small disruption. Crisis Management was an intrinsic part of the process. "A valuable amount of time was devoted to identifying potential crises, such as Avian Flu, terrorism, natural disasters, and other lower-level types of denial of access to buildings," Ralston says. "Together with the Symantec Consultants, we identified a crisis team from each function who would take responsibility in a situation."
The need to establish alternative working facilities in case the current location became unavailable was also a key element of the plan. With Symantec's help, the BCCs assessed work area recovery requirements for Virgin Mobile's business critical activities.
"One of the key issues was finding an alternative site for our Customer Centre and headquarters at Trowbridge," Ralston says. "Together, we identified the minimum operational requirements for the site and the number of people required to staff it." Once it was clear which functions needed to operate no matter what the scenario, Symantec initiated a Request for Proposals (RFP) and prepared the selection criteria for the alternative site.
As a virtual mobile network operator, the company outsources most of its key work to other companies, such as Symantec partner Atos, which supplies its technology, and T-Mobile, which supplies its network. The final step of the process was a review of Virgin Mobile's contracts with its outsourcers. Again, working closely with Symantec Consulting, Ralston and his team conferred with internal business owners to review contract clauses on disaster recovery and business continuity. Five key contracts were adjusted to ensure Virgin Mobile will be able to keep functioning in an emergency.
The BCM program was completed to schedule in six months, having met all its original objectives. Virgin Mobile has a unified BCM plan, consistent across all divisions, to reduce the likelihood of an incident and its potential impact. The company is now equipped to protect its assets, brand, and reputation while minimizing the impact of events on its customers and supply chain.
Moreover, Virgin Mobile can demonstrate that it is meeting insurance, contractual and regulatory requirements "Symantec Consulting identified and mitigated the risk faced by Virgin Mobile. The company now is in a significantly stronger position to understand the potential issues it faces and how to manage them," Ralston says.
For more on how Symantec helped Virgin Mobile ensure business continuity and compliance, read the customer success story