Use of ICT for Risk Management and Business Continuity Management and R&D Initiatives

1.1 Risks

When the new influenza of 2009 (Swine Flu) broke out, measures such as prohibiting international and domestic business travel and increasing the use of conference calls and videoconferencing were instituted across most organizations and these measures affected business operations. When the recent missile launch from North Korea occurred, issues such as emergency notification to residents and local governments were also raised as concerns by Japanese citizens. Japan also faces the threat of natural disasters, such as the Iwate-Miyagi Nairiku earthquake in June 2008 and the heavy rain in the Chugoku and Northern Kyushu regions in July 2009 [1]. Thus, Japan is surrounded by various risks and, in 2009 in particular, there was a real sense and awareness of this down to the personal, individual level.

1.2 Market trends in risk management and business continuity management

The Japanese government is continuously promoting the sharing of disaster prevention information across organizations, spanning all the way down to cooperation with local governments to help build a better assessment of the extent of damage in times of disaster and to promote cooperation among rescue agencies [2]. It is also promoting initiatives such as the J-ALERT national warning system, which can transmit emergency warnings to residents instantly, the use of an emergency earthquake alert system, and the enrichment of other information provided to residents, such as weather reports, water-level data, and flooding information [3].

Local governments are also making progress in completing a wired and wireless, dual-mode communications system for conveying prompt and accurate emergency information to residents. However, due to severe regional financial conditions in recent years, there is demand for highly cost-effective systems and services that can use existing resources (communications infrastructure etc.) and be used in normal conditions as well as in emergency conditions. A system that can provide enhanced evacuation-support and better information-transmission for people requiring assistance during a disaster is also being established [4].

In national and local governments, agencies have received the “Central Government Business Continuity Guidelines, Edition 1” (Cabinet Office, June 2007) and they are creating and publishing their own business continuity plans (BCPs). The Ministry of Internal Affairs and Communications has also created guidelines for the information and communications technology (ICT) departments in local administrations in case of a major earthquake [5], which should help accelerate concrete initiatives.

In industry, a 2008 survey of the state of BCP development found that about 80% of enterprises (mainly listed companies) had either completed or were in the process of creating a BCP (compared with 50% in 2006) [6]. The new influenza pandemic (Swine Flu) in 2009 is one factor that makes it even more important to improve BCP measures. However, a shortage of personnel for business continuity management (BCM) initiatives and budget shortages for countermeasures are being recognized as hindrances [6] to BCM promotion, so ICT solutions that improve efficiency and reduce costs are desirable.

2.1 Overview

With the market trends described above, ICT has already permeated our society and become an essential part of life and business, so analysis in the area of how to apply ICT for BCM and risk management is very important. There are two perspectives for using ICT during emergency and normal times to minimize the degree of damage and increase the ability to recover business activities after an incident occurs.

The requirements for deciding an organizational BCP and building a BCM system are increasing, not only from the viewpoint of the menace of natural disasters, but also from that of the requirements of stakeholders such as trading partners and compliance with BCP decision-making guidelines. ICT use areas in the BCM cycle as well as examples of solutions in these areas provided by the NTT Group are shown in Fig. 1.

Fig. 1. BCM cycle and examples of NTT Group solutions.

When an incident occurs, risk management information such as the state of damage is gathered, and after this information has been shared with and analyzed by relevant key persons, decisions are made regarding proposed responses and communicated to residents, employees, and staff. ICT can be a useful tool for supporting this chain of events ((2) in Fig. 1). It is also necessary to build a communications infrastructure capable of supporting this cycle in all cases and to ensure that this environment is always available and robust against faults ((1) in Fig. 1).

On the other hand, in addition to ICT system countermeasures, human system countermeasures for executing business processes are also essential for comprehensive BCM. In the NTT Group, we are also providing consulting services covering management strategies and business process environments for our customers from the viewpoint of our awareness of the importance of reflecting these issues in efficient ICT strategies and practical countermeasures (harmonization of human and ICT systems).

2.2 Example of ICT use during a pandemic

An example of using ICT to improve business continuity in the case of a pandemic such as a new influenza virus is shown in Fig. 2. In a pandemic, the focus of damage is on people, so countermeasures to prevent direct contact between people are taken to control the spread of the infection. ICT can play a major role in promoting remote communication and collaboration (mainly the communication/collaboration infrastructure in Fig. 1). Teleworking, using technologies such as thin clients, is effective at reducing contact at the office, while remote communication such as videoconferencing and web-based meetings can help reduce the need for business trips. A secure network environment is essential for implementing these measures. Considering that absence from the office could be high, cloud-computing services (such as software as a service (SaaS)) can also be effective at enabling human and physical resources to be accessed from outside an organization.

Fig. 2. Example of ICT use during a pandemic.

On the other hand, when implementing measures like teleworking, there may be concern regarding weaker information security and governance, questions about cost effectiveness, and feelings of alienation or cultural barriers due to insufficient face-to-face communication among employees or between employees and customers. Thus, it is vital that managers introduce the teleworking system for use in normal times and not just during emergencies to help establish it and improve cost effectiveness with the latest ICT solutions taking into consideration aspects such as enriching the work-life balance and reducing the environmental impact.

3.1 Disaster prevention information transmission control system

Thus far, government radio broadcasts have been used to distribute disaster prevention and rescue information from local governments to residents. However, improvements such as changing from analog radio to digital formats and integrating the emergency broadcast systems of municipalities that have merged require a huge amount of investment for local governments. Because of this, NTT has developed a disaster-prevention information-transmission control system as a means of complementing or replacing these government broadcast systems [7].

This system can distribute disaster-prevention information from local governments to residents via a variety of networks, including existing assets such as local governments’ own fiber-optic networks, the Internet, and mobile phone networks, and a variety of terminals such as outdoor loudspeakers, mobile phones, and touch-panel-operation terminals (Fig. 3). In this way, the cost of facilities for local governments can be controlled, while the likelihood of getting the required information to citizens is increased. The system supports the delivery of the same information to various different terminals via a single operation, which improves the speed and certainty of information transmission and strengthens its governance. The system does not require all of the networks and terminals shown in Fig. 3 to be used, so they can be introduced gradually, and the system can be expanded taking into consideration local government plans for disaster prevention, computerization, financing, and investment.

Fig. 3. Disaster prevention information transmission control system able to distribute information from local governments to residents quickly and reliably.

At NTT, we have performed demonstrations to verify the system’s effectiveness on a real network in cooperation with NTT EAST and Iwamizawa City in Hokkaido. In FY2008, we tested the distribution of disaster information linked with the digital terrestrial television broadcasting system, including One-Seg (one-segment) mobile TV. We have also linked with products from various NTT Group companies (e.g., NTT DOCOMO’s early warning service Area Mail [8]) to secure a variety of transmission methods, which has significantly improved synergy within the NTT Group.

3.2 Lightning strike prediction technology and disaster-information distribution & sharing through SaaS

If it is possible to predict a disaster ahead of time, countermeasures can be taken beforehand, enabling real reductions in the amount of damage. Weather forecasting has long been representative of this type of disaster forecasting. At NTT Laboratories, we have developed an online lightning-prediction technology based on image processing and statistical analysis of radar imaging and other information published by the Meteorological Agency (Fig. 4). Damage due to lightning strikes, such as injury to personnel, power outages, and damage to electrical equipment from power surges, can have a bad effect on business continuity. Electrical companies have services that provide recent past data after lightning strikes, but our technology makes it possible to take preventative measures before a lightning strike by providing users with lightning hazard data in combination with lightning prediction and location data. For example, industries that use outdoor equipment can adjust work plans and personnel assignments for outdoor work, which will help to reduce damage and improve business continuity.

Fig. 4. SaaS mash-up service providing lightning prediction technology and disaster-prevention information.

We are also studying a SaaS service that combines the above lightning prediction information together with other free and paid-for disaster-prevention information and provides it to users in a mash-up with a mapping application (Fig. 4). In doing so, we are hoping to verify the effectiveness of geographic information systems (GISs) for disaster countermeasures and recovery efforts [9]. By offering GIS functions with the electronic map and disaster prevention information through networks, we hope to free users from system management tasks such as map updates and provide a low-cost service through the benefits of scale.