Business Continuity Planning

  1. Introduction

All businesses need to produce and maintain a Business Continuity Plan. This document is a template and should be read in conjunction with the notes.

Amend the content so that it fits in with your businesses requirements and

Enter details where text is shown in blue.

  1. Business ContinuityPlan

Plan content – insert a contents page

Title –Company name Business Continuity Plan

Add a picture / company logo as required

Distribution list – list names below of those who have a copy of the plan

Copy Number / Name / Location / Responsibility
001
002
003
004
005
Expand this list as required

Insert version number plan sign off date

Introduction - aims and objectives

Eg The overall aim of the Business Continuity Plan (the Plan) is to enable the business to recover its normal operations to an agreed level in the event that it suffers a severe disruption.

This is achieved by documenting plans for response, recovery, resumption, after major incident where an incident is defined as the occurrence of any event that causes a significant disruption to normal operating capabilities.

The central theme of the Plan is to minimise the effect a disruptive incident would have upon on-going operations. The Plan will be distributed to all key personnel and reviewed annually.

The general approach is to make the Plan as threat independent as possible. This means that it should be functional regardless of what type of incident occurs.

Assumptions of the company’s Business Continuity Plan

Eg – add or remove as required

Recovery for anything less than complete ‘destruction’ should be achievable by using the Plan.

Some staff members may be rendered unavailable by a particular incident or its aftermath or may be otherwise unable to participate in the recovery.

Procedures are sufficiently detailed in the Plan so that someone, other than a member of the Business Continuity team that wrote the plan, can follow them.

Services may have to operate at lower than optimum levels, with limited support and some degradation of service until full recovery is made.

Criteria for invoking the Business Continuity Plan

As soon as a situation occurs that could result in a severe disruption to service, the on-site personnel should assess the impact of the incident on their business

  • contact the appropriate emergency authorities (if required)
  • take the necessary steps to minimise property damage and injury to people in the vicinity
  • Notify the following people: insert in table below as appropriate for your organisation

Defined roles and responsibilities for those involved in managing the incident

Business Continuity Management Team / Responsible for / Contact details / Contact details / Contact details
Business continuity manager name / Enter details for BC Manager / Mobile number / Work / Home
BC team member name / Deputise for BC manager / Mobile number / Work / Home
BC team member name / Enter details eg IT / Mobile number / Work / Home
BC team member name / Enter details eg HR / Mobile number / Work / Home
BC team member name / Enter details eg Finance / Mobile number / Work / Home
BC team member name / Enter details eg Ops Manager / Mobile number / Work / Home
Expand as required

Initial actions by the Business Continuity Management Team – general plan

The Business Continuity Management Team should visit the site and make an initial assessment of the extent of the damage. Based on their assessment all, or part, of the Business Continuity Plan should be invoked.

The Business Continuity planning team members (or their deputies where any members are unavailable) should meet as soon as practical to ensure the plan is put into effect.

The team leader (or their deputy) has the primary responsibility for implementing and chairing the initial ‘emergency’ meeting, normally on site. Consider several scales of impact.

Identification of impact of incident on business activities - Critical Service Priority List.

Enter those services in the order in which they should be re-started.

Priority / CriticalService
1 / Service 1
2 / Service2
3 / Service3
4 / Service4
5 / Service5
6 / Add extra lines as required

This list should be used during an incident to assist you in deciding which services needs to be reinstated first.

Details of how a recovery would be organised / phased to ensure urgent priority activities are recovered first:

  1. If normal operations can be continued at the site and repairs started as soon as possible

Minor damage – processing can be re-started in a short time

Anticipated down-time is less than one day

Damage could be to buses, hardware, software, mechanical equipment, electrical equipment or the premises

  1. If normal operations can be continued or re-started with the assistance of the Continuity Team

Major damage – selected members of the Management/Supervisor Team will be called to arrange restoration of normal operations using appropriate personnel

Major damage to hardware/software: Operations Manager

Major damage to engineering facility/premises: Engineering Manager

Involvement at each stage: Managing Director

  1. If limited operations may be continued, plans should commence to repair or replace unusable equipment
  2. If the garage, bus park or head office are destroyed to the extent that alternate facilities must be sought eg.

Restoration will take upwards of one week

Computer/server room could be completely destroyed

All departmental heads will be called to begin a total implementation of the contingency plan

  1. The extent that the Business Continuity Plan must be initiated
  2. The Business Continuity Team/Management Team will decide on a plan of action and notify all Directors
  3. If the action plan requires the assistance of outside companies/agencies, those companies/agencies will be notified by the Operations Managers, Engineering Manager, Company Directors or Supervisor.

Process for activating the response

When do you invoke your plan?

Who is going to call who?

  • Identify your call cascade(s)
  • Identify deputies in case lead manager unavailable

Who will decide the message to be given?

What will be the message to be sent?

How will you tell staff (phone, text, …)?

Communication plan for employees and their relatives, key parties and emergency contacts

Staff emergency contact information (Position, Name and Contact Numbers)

Comprehensive team cascade list structure

  • BC team to department managers
  • Department managers to team members

Telephone/Mobile numbers and email addresses for different parts/ departments/ branches of the company

Details of media response

Comms strategy

Templates for media messages

Nominated spokesperson

Nominated control centre

Where are you going to manage the incident from?

Address, how to get there, contact details for site, any special access issues

Resource requirements (people, work area office space, equipment, IT, telecommunications)

  • Staff to perform specialist roles
  • Specialist equipment
  • IT systems used
  • Telecoms requirements (eg mobile phones)

Time / No. of staff / Relocationrequired? / Resources required / Data required
First 24 hours
24 – 48 hours
Up to 1 week
Up to 2 weeks
Up to 1 month

Telephone divert arrangements

  • Where is your main phone line to be diverted to
  • How will it be diverted
  • Who will make sure it happens
  • What message will be used as a standard

Emergency contact number for employees to obtain the latest information

  • What is the phone number to use
  • Who will update it
  • How often will it be updated

Details of recovery resources available

  • Spare ticket machines
  • Emergency tickets

List of key customers, suppliers, third parties and their contact details

  • Enter details here

Contacts for internal and external agencies to support the recovery efforts

  • Enter details here

Address of the recovery site(s)

  • Enter details here

Offsite battlebox / disaster pack details

  • contents
  • storage location
  • access method

Details of the vital records’ store containing backup computer data and any critical paper records held off-site

  • What does it hold
  • Where is it
  • How do you get in to use it
  • What security keys are there to access the store

Create specific action plans for dealing with any potential threats that you have identified.

Trigger / Action / Who / How / With what
Eg. Telephony Down /
  • Contact Telephony provider
  • Request divert to new number
  • Inform reception staff of which number diverted to
/
  • Operations Manager
/
  • Contact helpline centre on 01453 310 345
/
  • Mobile

Trigger 1 /
  • action 1
  • action 2
  • etc
/
  • Person carrying out the action
/ what do they have to do / What resources are required to complete action

Each action plan to cover identified threats eg.

  • fire
  • flood
  • vandalism
  • electricity failure
  • IT system failure
  • phone system failure
  • other

Network diagrams and other technical IT information

And finally ….Stand-down procedure once the incident is resolved and the business is back to normal – or a new normal if the incident has been so severe that it has changed the way that you deliver your business.

  1. Emergency Procedures

Ensure your company has basic emergency procedures in place

Make sure your employees really know what to do if a fire breaks out

Make certain your employees understand the evacuation procedures

Ensure your employees know what to do if a colleague is injured

Ensure your employees know what to do if any sort of disruption occurs

The key to a sound emergency procedure is clear process, roles and responsibility and employee awareness

  • team members from each department should be given responsibility for ensuring a smooth and orderly process

All employees should receive training on your emergency procedures, with regular updates and refresher courses on it

It is important that your workforce know where to access a ‘guidelines and procedures’ document to ensure that they are always fully aware of what is expected of them

Response Checklist for use during an incident

•Start a log of all actions taken:………………………………..

•Liaise with Emergency Services:……………………………..

•Identify any damage:…………………………………………..

•Identifyservices disrupted:…………………………………..

•Convene your Response / Recovery Team:………………..

•Provide information to staff:…………………………………..

•Decide on course of action:…………………………………..

•Communicate decisions to staff and business partners:…………………………………………………

•Provide public information to maintain reputation and business:……………………………………………………..

BC Plan content template, March 2015, page 1 of 7