How Safe are your Organisation’s Crown Jewels?

We all know business environments can be volatile; disruptions can arise from numerous sources – including economic shifts, technological advancements, security threats, and even unexpected global events.  That’s why, at Littlefish, we recommend conducting a ‘Crown Jewels Analysis’ with our customers. This is a potentially crucial tool to help identify risks and evaluate their possible consequences to people, operations, and finances – AKA your “crown jewels”.

In this article, I urge business leaders to ask themselves “what would my Crown Jewels Analysis reveal?”. To help reach this answer, we’ll explore the significance of conducting the analysis itself, some potential business disruptions and their effects, and how to use these insights to strengthen business continuity planning and authentication resilience (our Crown Jewels Analysis is part of an overall authentication assessment).

So, what exactly is a Crown Jewels Analysis?

A Crown Jewels Analysis is a systematic process that assesses the effects of unexpected disruptions on an organisation’s most important business functions. It identifies these critical functions, determines how long a company can operate without them, and quantifies the potential financial and reputational damage caused by downtime.

A well-executed Crown Jewels Analysis also highlights vulnerabilities and provides a foundation for an effective Business Continuity Plan (BCP). By conducting the analysis, therefore, businesses can prioritise resources, develop response strategies, and minimise disruption-related losses.

These days organisations face possibly more pressures than ever. Things like ongoing economic uncertainty, rising operational costs, and sophisticated cyber threats that continue to evolve. Conducting a Crown Jewels Analysis enables companies to anticipate these risks and prepare accordingly – as such, a Crown Jewels Analysis can be a crucial tool for enhancing resilience.

Other benefits of conducting a Crown Jewels Analysis include:

Risk awareness: It goes without saying that understanding potential threats allows businesses to take proactive measures, including implementing robust security protocols, conducting regular risk assessments, and investing in employee training, for example.

Regulatory compliance: Various industries must comply with regulations that require continuity planning. In the UK, these regulations often mandate that businesses have robust business continuity plans in place to ensure they can maintain operations during disruptions. For example, the Financial Conduct Authority (FCA) requires firms to have governance arrangements that include business continuity policies.

Financial protection:  Identifying key financial vulnerabilities helps in risk mitigation. By understanding where financial weaknesses lie, businesses can implement strategies such as diversifying revenue streams, maintaining adequate cash reserves, and securing appropriate insurance coverage.

Operational resilience: Of course, ensuring business functions can continue with minimal disruption is an imperative. This may involve conducting regular drills and simulations, or else investing in redundant systems and infrastructure as backup.

Customer confidence: Demonstrating preparedness reassures clients and stakeholders, helping to build trust and loyalty. Transparent communication about preparedness measures, regular updates on risk mitigation efforts, and visible commitment to maintaining service quality all enhance customer confidence, e.g.

Potential disruptions to business operations

So, what sort of things should your Crown Jewels Analysis cover? Of course, businesses can experience disruptions from various sources, each with different impacts on people, operations, and finances. For references sake, though, some common threats organisations should plan for include:

Cyber security breaches

With the rise of digital dependency, cyber-attacks such as ransomware, phishing, and data breaches pose significant risks. A Crown Jewels Analysis can help determine the impact of losing sensitive data or systems being compromised.

Supply chain disruptions

Global supply chains are complex and vulnerable to disruptions from influences like geopolitical tensions, transport strikes, or supplier failures. A Crown Jewels Analysis assesses the reliance on suppliers and potential delays in service delivery.

Natural disasters and extreme weather

Flooding, storms, and heatwaves can damage infrastructure, disrupt logistics, and impact workforce availability. With climate change increasing the frequency of such events, a Crown Jewels Analysis can help businesses plan for continuity in this instance.

Economic and market fluctuations

Recessions, inflation, and currency instability can create financial strain. A Crown Jewels Analysis identifies financial exposure and suggests measures to remain viable during economic downturns.

Employee-related disruptions

Labour shortages, industrial action, or key personnel departures can hinder operations. A Crown Jewels Analysis highlights which roles are crucial for continuity and proposes contingency staffing solutions.

Legal and regulatory changes

Brexit, GDPR, and sector-specific regulations can impose new or complex compliance requirements. A Crown Jewels Analysis helps businesses understand potential legal risks and prepare for any necessary adjustments.

Public health crises

Pandemics and localised outbreaks can force remote working, reduce workforce availability, and disrupt supply chains. I’m sure the COVID-19 pandemic requires no introduction, and neither does how this pandemic highlighted the need for robust continuity plans, making Crown Jewels Analyses even more essential.

Of course, the above business disruptions can all cause significant operational and financial challenges. In identifying these risks in advance, however, your Crown Jewels Analysis should help you take corrective action before problems such as the below, arise:

Revenue loss: Downtime or reduced productivity directly affects earnings.

Increased costs: Emergency responses, overtime payments, and alternative suppliers can raise costs.

Reputational damage: Failure to deliver services can erode customer trust.

Regulatory penalties: Non-compliance with legal obligations can result in fines.

Operational inefficiencies: Disruptions can slow workflows and increase bottlenecks.

How to conduct a Crown Jewels Analysis

Moving on to the nitty gritty, conducting a Crown Jewels Analysis involves several key steps and usually numerous stakeholders across the business will need to be involved. Of course, it’s always worth discussing your Crown Jewels Analysis with professionals to ensure it’s comprehensive and tailored to your specific business needs. Consulting with experts can provide valuable insights, help identify potential blind spots, and ensure that your analysis aligns with industry best practices and regulatory requirements.  The following steps briefly outline the process:

1. Identify critical business functions

Determine which processes are essential for operations and revenue generation. Examples include customer service, IT infrastructure, and supply chain management.

 

2. Assess the impact of disruptions

For each critical function, evaluate the potential effects of downtime, considering financial, operational, and reputational consequences.

 

3. Establish maximum tolerable outage (MTO)

Confirm the maximum time allowed for an outage before the business, essentially, becomes unviable. Knowing the MTO helps in setting realistic recovery objectives (see below) and keeps recovery time planning on track.

4. Establish recovery time objectives (RTOs)

Set targets for how quickly business functions should be restored after a disruption. This helps prioritise recovery efforts.

 

5. Evaluate resource dependencies

Identify key personnel, IT systems, suppliers, and equipment necessary for maintaining operations. Understanding dependencies allows for contingency planning.

 

6. Develop mitigation strategies

Once risks and impacts are assessed, develop strategies such as alternative supply chain options, data backups, or emergency staffing plans.

 

7. Document and update the analysis regularly

A Crown Jewels Analysis is not a one-time process. Regular reviews ensure that new threats and changes in operations are considered.

Usually, a Business Continuity Plan (BCP) will be the actionable output of a Crown Jewels Analysis. This will outline how your business will continue operating during and after a disruption. Key elements of a BCP include crisis response procedures, communication plans, alternative work arrangements and technology and data protection measures, including cyber security and data recovery solutions. Finally, the BCP will also outline regular testing and training, through simulations and employee learning to ensure readiness. By integrating the Crown Jewels Analysis findings into a BCP, businesses can ensure that their strategies for managing disruptions are both informed and comprehensive.

Final word

A Crown Jewels Analysis is a vital tool for businesses offering insights into potential threats and their potential consequences. By identifying critical functions, assessing risks, and developing mitigation strategies, organisations can enhance their resilience and ensure operational continuity during disruptions.

Remember, over 70% of UK businesses that implement similar analyses report a significant reduction in operational risks and companies with impact plans in place can recover from disruptions up to 50% faster compared to those without one.

Remember, conducting a thorough Crown Jewels Analysis and implementing a strong Business Continuity Plan can mean the difference between recovery and prolonged crisis and this is all part of an authentication resilience strategy we’ve been working on here at Littlefish (watch this space for more on that).

So … what would your Crown Jewels Analysis reveal?