How to Earn a Master's in Business Continuity: John Orlando, Norwich University
And at Norwich University, there now is a Master's of Science in Business Continuity program for mid-career professionals to hone their skills in this in-demand area.
In an exclusive interview, John Orlando, MSBC Program Director at Norwich University, talks about the school's Master's of Science in Business Continuity, discussing:
TOM FIELD: Hi, this is Tom Field, Editorial Director with Information Security Media Group. We're talking about education today. I'm privileged to be speaking with John Orlando, MSPC Program Director with Norwich University. John, thanks so much for joining me today.
JOHN ORLANDO: Thank you for having me, Tom.
FIELD: Now John, we talked in the past about programs you have at Norwich, and one that really fascinates me now is you're offering a Masters in Business Continuity. Now, I'd like to ask you about this. What is the market need that you've discovered here, and who are you serving with this program?
ORLANDO: Yeah, Business Continuity is an emerging field, and I actually like to say that it is similar to the -- where the information-insurance field was maybe 10-years ago. Right now, there are very, very few academic programs in Business Continuity. In fact, Norwich University's program is the only Masters degree that focuses solely on Business Continuity. There are similar programs that have a MBA focus - straight-forward MBA focus with finance, accounting and marketing, and then specialization at the end in Business Continuity. But we're the only program that focuses solely on Business Continuity. So the - the higher-education market is just starting to open, and the Business Continuity field is growing of course after 911, and we're just seeing, literally in the last year, maybe two years, a lot more attention being placed on Business Continuity. Especially after Katrina. There was a law passed last year - actually I should say a year-and-a-half ago now - implementing recommendations for the 911 act, which asks the Department of Homeland Security to develop a system for certifying U.S. companies in Business Continuity. At the same time, FEMA has been asked to develop what they call Continuity of Operations Training for the public sector, and this is just now emerging. And so right now, there's just much greater interest in Business Continuity, but there are very, very few academic programs. Right now, the education in the field is almost entirely through the professional associations, DRII, BCI, ICOR. I know this is sort of an alphabet soup of acronyms, but each has a different certification. Each has standards that they teach, and that basically there - the education is through the courses that prepare people for those verifications.
What we find is - and what we found actually I should say, in attending conferences in Business Continuity. I personally went to the major Business Continuity conferences, and I got myself a booth, and I waved a survey around and asked people walking by to fill out the survey, and asked them what they felt the market needed, and would they be interested in a degree, and a surprisingly large number said they would, because they felt that they needed a more well-rounded education than a certification training could provide. Normally, certifications training is a one-week intensive course that ends with an exam. Maybe a 200-question, multiple-choice exam, and they were looking for something that's more in-depth, because in - you're trying to cover an entire field in one week. You're only spending maybe an hour or two on different topics. So, they wanted to be able to spend a week or two on important topics at least. Also something with greater breath, and finding, and I think most importantly, something that isn't just focused on one particular certification, or one particular standard, or one particular way of looking at Business Continuity, because each of these different standards approach it in a different way, and you - if you get a certification from one professional organization, you're really kind of immersed in that particular way of doing Business Continuity.
So, we found that the market wanted something that would maybe teach people about the various ways of approaching Business Continuity, and that's what we do in our degree program. We talk about the different approaches and the different certifications, but wouldn't be wedded to one particular way that would provide a more comprehensive view of what the field is. Partly because the field is still evolving, and many of those certifications may be replaced in the next year or two.
FIELD: Well, you make a good point. John, what are the requirements for students entering the program?
ORLANDO: Well, because it's a Masters degree, they do have to have an undergrad degree from an accredited university. The second thing is that Norwich University uses a case-study program, and this is actually something that comes from Norwich University's roots as an institution that was founded on the belief that theory has to be applied to practice for real education to occur, and that's something I talked about in an earlier podcast, by the way, concerning the MSIA program. What we do is we require our students to use their own organization as a case study, so when they cover a particular topic -- let's imagine what's called the Business-Impact Analysis -- they don't just learn what a business-impact analysis is or how to do it, they actually do it on their own organization. They perform a business-impact analysis. They develop recommendations, and eventually they produce a report that's actually given to their own business, and it's a kind of consulting report that tells their own business what are the weaknesses. What are what they call the gap, a kind of gap analysis, and what should they do to improve their situation. And this is modeled after very, very successful program that we've used in the Information Assurance degree, where they also do a case study, and in that degree, we found that students were being promoted even before graduating because of the benefits that they were giving their own organization, and the fact that they were demonstrating their proficiency to their organization. So students need to make sure that they can do a Business Continuity plan or analyze their own organization in terms of business continuity principles, so they have to get their organization behind them. If for some reason they can't, and occasionally they can't because they are, say, consultants, then they do what is called an Industry-specific case study, where they take a particular industry, like finance, or utilities, and they research that particular industry, and they make recommendations concerning that industry, and those are recommendations that may be eventually published in a journal or something like that.
FIELD: Well, this is great just knowing that so many organizations either have got outdated business continuity plans, or they haven't tested them recently. They're really getting a good service for having students come into this program.
ORLANDO: Yeah, exactly, and we think that, and I think it's pretty clear, that within a year or two, there will be regulations coming down from the federal government requiring business continuity programs at companies. They're literally working on those standards and those regulations as we speak, and companies are going to have to do this to meet those regulations. They're going to have to do it to meet insurance requirements, and what we're doing is we're not only creating the people who can develop the business-continuity programs, but those people are actually developing the programs as they're learning the trade itself, so it's really a win-win situation.
FIELD: Now, I know you serve both the public and the private sectors. I'd ask you sort of a two-part question. I want to know where the students are coming from, both in terms of where they're coming from, the private sector or the public, but where are they coming from in their careers as well?
ORLANDO: Yeah, well first off, these are people who are normally at least in their 30's, maybe 40's, because they've been out in the work force for 5-10-15 even 20 years. They're mid career. They've already started working in a business in whatever capacity, so they have some experience. They're not just these 22-year-olds just out of college that are just starting their first jobs, they have family lives. They have work lives. They have to work everything around that, so they're working professionals. They have a certain amount of experience in the profession, and we draw on that experience by making sure that our courses are heavily discussion oriented. So each week, they're required to respond to various discussion questions on what we call an asynchronous-discussion board, and that allows them to actually examine these topics, and again, apply them to their own situations. For instance, we may after studying business impact analysis in one or two weeks, ask the discussion question `Well, we've studied the IT-business-impact analysis, but in reality what works in theory doesn't work in practice. You just don't have the data to do a real business-impact analysis. It's all guess work. Do you agree or disagree?` And at the point, the students can draw on their own experience, and they can actually talk about what they've now done as a business analysis. They can say `You know, there's some truth to that. People don't know how often the servers have crashed. You can't know what the likelihood of these things will be, so really it's guesswork,` and someone else may reply, `I agree with you, Mark or Betty, however, there's certain statistics you can use and make reasonable judgments.' See, and else what they're doing, they're applying what they're learning to their own workforce. They're bringing their own experience into it, and they're kind of pushing the common orthodox. They're not just accepting what's being taught to them as the way it's done in the field, but they're even asking whether the way it's done makes sense, and whether it should be modified, and these are adults -- because they have that experience of working in the field, these adults can - can do that - can kind of examine different topics and really discuss them, and really push the field forward. And the other thing, the second point you made about public and private, yes, we have people from both the public and the private realm, and I - I - we felt when we developed the program, that despite it being called a business continuity degree, that we'd probably get a few people from the public sector, and what surprised me, is we're getting more people from the public sector than I anticipated. I'd have to say at this point, we're getting at least 25-30% from the public sector, and that's because the public sector is also pushing very hard for what they call continuity of operations, which is really just a public sector term for business continuity. This again, is a law. There was a law passed in the last year that requires all federal agencies to have continuity of operations programs. So, public organizations are realizing the need for continuity of operations programs, and they're implementing these. We're getting the law students from there. We're even getting students from the military that plan to go into Business Continuity or Continuity of Operations after they're done with the service. So it's a big, much broader group than I had originally anticipated, and they're coming from a lot of different fields. I think we're heavy right now in areas like healthcare, in finance and utilities, but it's still a fairly broad sampling of businesses, because really any business will need to develop a business-continuity plan.
FIELD: Now obviously, a program like this doesn't evolve without partnerships. So I'd like to hear about some of those strategic partnerships you have with businesses and government to make this go.
ORLANDO: Yeah, we've been actively pursuing partnerships. One interesting one is with FEMA. Now, as I mentioned, the federal government is under a directive - a Presidential Directive for all agencies to develop continuity of operations programs, and FEMA is what they call the Continuity of Operations Directorate, is in charge of that, and we have been talking with them, and they're now in the process of developing courses that will prepare people at not only the federal level, but at the state and local level to develop continuity of operations programs at their own agency, and this will support a couple certifications that FEMA is developing related to Continuity of Operations. So we're developing a continuity of operations track within the Master's degree in Business Continuity. What that means is that if an individual from a public-sector organization wants to get the coursework they need to develop a continuity of operations program and get the FEMA certification, they can take a sequence of courses for that, but then when they're done, if they want to, they can continue to an entire Master's degree, because this track will be part of the Master's degree. Or, they may begin with an intention of just getting a Master's degree in a kind of continuity of operations area, or with a continuity of operations focus rather than a business-continuity focus. So that's one of our major areas that we're partnering. Another thing we're doing is we are working with different professional organizations in the field to develop other types of education modules for people both within our program, but also for field in general. For instance, we're starting to do webinars now with professional organizations on topics of interest to the field, and we're also working with some professional organizations on some research - actually having our students and faculty do research, because it's such a new field, there's still great amount of research that needs to be done, and we're looking to work with these organizations to identify the areas where research needs to be done, and collaborate a little bit and produce the kind of white papers or scholarly papers that are needed to sort of take the field forward and help legitimize it in the face of the business community.
FIELD: That makes sense. Now John, I know this is a relatively young program, how do you see it evolving?
ORLANDO: Well, as I mentioned before, we are implementing the continuity of operations track, so that it will cover both public sector continuity of operation side and the private sector business continuity side that people can choose the one that's appropriate to them. The other thing is that there are certain fields where there are specific business-continuity requirements. For instance, Healthcare. There are a number of requirements. Some are related to HIPAA and other regulations. There's also in the finance field business continuity requirements. There are in the utility field requirements, and at the very least, very often, there are specific policies or procedures relating to these fields. So, we're going to start developing electives in specific areas. If someone is in the utility Industry, they can look at business continuity in terms of utilities, and you can certainly see how a utility -- let's imagine a utility that supplies electricity -- continuity is critical to what you're doing, because the expectation is you're running 24-7. As soon as it stops - as soon as you stop running, you immediately start causing problems for customers, and we have an aging utility infrastructure, and there's a lot of talk now in the stimulus package about smart grids and upgrading that. So there - it looks like the utility industry itself is going to become a greater focus in the areas of business continuity. So, what I see is as this field develops, it will also develop the specialized knowledge in areas in sub-areas of the field, and we need to - we need to continue - we need to recognize that and give the students the opportunity to pursue that specialized knowledge.
Finally, the field is also evolving it's standards as well as best practices, and there is currently a variety of standards out there, and as we speak, there are is actually a kind of competition between them as the United States and other countries and different organizations talk about these standards and start developing new standards, and that means that the standards in the field are going to change in the next year or two. In fact, I think eventually there will be one - more or less one standard that will be adopted around the world, and that means that once there's some agreement on the best way to approach business continuity and the best practices in general, then we need to make sure that our curriculum follows that, rather than a sampling of the various standards that are now. Once there is a single standard, we have to make sure that that get's integrate into our curriculum. So, I see that also happening in the next few years.
FIELD: John, one last question for you. For people that want to know more about this Master's in Business-Continuity Program, where can they go?
ORLANDO: Well, they can simply start at the Norwich University web site, www, norwich.edu, and that's the web site for the entire university both the Residential Undergraduates and the Graduate College. Once you land on this site, look for what's called the School of Graduate Studies, and we have 10 Masters degrees that are all delivered online, and this program is part of those Masters degrees, and we actually sequestered all the Masters Degrees into a single school of Graduate studies, because we know that working adults have certain needs as far as their education that have to be served. It's different from that of a residential Undergraduate student. So wanted to make sure to develop the apparatus that can support the specialized needs of the working adult. So all of our Masters degrees are all put into this School of Graduate studies. So there you'll find us as well as the other Masters degrees, at Norwich University.
FIELD: Very good, John. Thank you so much for your time and your insights in telling us about this Masters program in Business Continuity.
ORLANDO: My pleasure. Thank you very much, Tom.
FIELD: We've been talking with John Orlando of Norwich University. For information Security Media Group, I'm Tom Field. Thank you very much.