Business Continuity Plan (template)



Business Continuity Plan (template)This document is intended for the management of major disruptive events that impact and reduce service delivery[Name of Business/Service/Organisation][Address]PRIORITIES In the event of a major disruptive event, staff must be directed to:Immediately inform key managers and staff (activation and notification)Take action to protect life and property, and minimise disruption to critical services (incident management)Maintain delivery of critical services (business continuity)Support a rapid return to ‘business as usual’ (recovery)CONTENTS: TOC \h \z \u \t "Heading 2,1,Heading 3,2,Heading 4,3" DOCUMENT CONTROL PAGEREF _Toc63663646 \h 3REVIEW AND AMENDMENTS PAGEREF _Toc63663647 \h 3PLAN STORAGE PAGEREF _Toc63663648 \h 3Section 1: PLAN PURPOSE AND SCOPE PAGEREF _Toc63663649 \h 4PLAN REMIT PAGEREF _Toc63663650 \h 4PLAN DISTRIBUTION AND STORAGE PAGEREF _Toc63663651 \h 4PLAN REVIEW AND TESTING POLICY PAGEREF _Toc63663652 \h 4Section 2: PLAN ACTIVATION PAGEREF _Toc63663653 \h 5CIRCUMSTANCES PAGEREF _Toc63663654 \h 5ACTIVATION PROCESS PAGEREF _Toc63663655 \h 5RESPONSIBILITY FOR ACTIVATION AND NOTIFICATION PAGEREF _Toc63663656 \h 5Section 3: INCIDENT MANAGEMENT/IMMEDIATE RESPONSE PAGEREF _Toc63663657 \h 6IMMEDIATE PRIORITIES: PAGEREF _Toc63663658 \h 6ACTIONS TO PROTECT THE SAFETY AND WELFARE OF STAFF, VISITORS AND THE PUBLIC PAGEREF _Toc63663659 \h 6COMMAND AND CONTROL PAGEREF _Toc63663660 \h 7Section 4: COMMUNICATION PLAN PAGEREF _Toc63663661 \h 8ALWAYS CONTACT PAGEREF _Toc63663662 \h 8CONTACTED DEPENDING ON INCIDENT PAGEREF _Toc63663663 \h 8COMMUNICATING WITH STAFF PAGEREF _Toc63663664 \h 9Section 5: BUSINESS CONTINUITY PAGEREF _Toc63663665 \h 10ACTIONS TO SUPPORT BUSINESS CONTINUITY PAGEREF _Toc63663666 \h 10CRITICAL/PRIORITY ACTIVITIES/SERVICES PAGEREF _Toc63663667 \h 11NON-CRITICAL ACTIVITIES PAGEREF _Toc63663668 \h 11BUSINESS CONTINUITY ACTIONS PAGEREF _Toc63663669 \h 11Section 6: BUSINESS RECOVERY PAGEREF _Toc63663670 \h 13RECOVERY AND RESUMPTION ACTIONS PAGEREF _Toc63663671 \h 13DOCUMENT CONTROLPlan owner: The plan owner is responsible plan maintenance, exercising/testing and updating according to the business/ organisational Business Continuity Strategy.REVIEW AND AMENDMENTSDateRevision/Amendment Details & ReasonAuthorNote any updates, revisions, amendments, exercising and testsPLAN STORAGEThis plan is stored for immediate access in the following locations:Digital file-path:(Save location as hyperlink)Physical copy (onsite)Physical copy (off-site)All physical copies should be updates on review and previous versions destroyedDisclaimer This template is provided as general information about Business Continuity Planning. It is not intended to replace detailed guidance, planning or insurances specific to you and your business/organisation. You should therefore consider whether you need to obtain professional business continuity support. Numid ltd accepts no liability arising from the use of this template either in part or full.Section 1: PLAN PURPOSE AND SCOPEThis Business Continuity Plan identifies actions in response to critical business disruption. This response document compliments actions to prevent, reduce and transfer significant internal and external risks identified through risk assessment that may cause significant disruption to critical functions and activities (Business Impact Analysis).PLAN REMITThe following sites and services are covered by this plan:Sites/BuildingsServicesAddressesDelivery function/service ADelivery function/service BDelivery function/service CFinancial servicesHuman ResourcesAddressesDelivery function/service ADelivery function/service BDelivery function/service CFinancial servicesHuman ResourcesPLAN DISTRIBUTION AND STORAGEThis plan contains sensitive data, including contact details for staff, and market sensitive data. This document must be kept secure as per GDPR guidelines and may only be shared with those that may be required to activate arrangements in the event of a disruptive event. The following officers are permitted access to this plan:NameRoleRecommend services managers/supervisors onlyPLAN REVIEW AND TESTING POLICYThis plan will be reviewed on the following basis: Quarterly for review of key personnel contacts and rolesAnnually for a full review of key services, processes and actions Annually following formal exercising (tabletop or live) of actions and proceduresPrior to known events that may cause disruption to servicesFollowing any disruptive event that causes the activation of this planA live test of plans must occur no less than every 2 yearsWhere significant changes are identified through review, other complimentary plans should be reviewed and amended to reflect changes in procedures (for example, ICT Disaster Recovery Plans).Section 2: PLAN ACTIVATIONCIRCUMSTANCESThis Plan will be activated in response to an incident causing significant service disruption, particularly the delivery of key/critical activities. Examples of incidents that may require activation of this plan include:Any significant events that impact the health, safety and wellbeing of residentsLoss of staff or skills above normal levels of absenteeism that leads to an inability to deliver critical servicesDisruption to critical systems (for example, ICT failure)Loss of key utilities (water, gas, electricity)Denial of access, or damage to, buildings and facilities (for example, resulting from flooding, fire or gas leaks)Loss of a key resource (for example, disruption to key deliveries, shortages)Specific plans for high risk disruptive events may exist, for example, infection control plans.center43688000ACTIVATION PROCESSRESPONSIBILITY FOR ACTIVATION AND NOTIFICATIONAny duty manager may activate this business continuity plan in the event of significant disruption to services that impact on the health, safety and wellbeing of residents. Section 3: INCIDENT MANAGEMENT/IMMEDIATE RESPONSEIMMEDIATE PRIORITIES:In the event of a major disruptive event, staff must be directed to:Immediately inform key managers and staff (activation and notification)Take action to protect life and property, and minimise disruption to critical services (incident management)Maintain delivery of critical services (business continuity)Support a rapid return to ‘business as usual’ (recovery)ACTIONS TO PROTECT THE SAFETY AND WELFARE OF STAFF, VISITORS AND THE PUBLICThe following actions will be taken to protect the immediate safety of staff, visitors and the public: ACTIONFUTHER INFO/DETAILSFollow normal Health and Safety and Fire Safety procedures For further information on H&S and Fire Safety arrangement see:Notify all key personnel See page 5 for list of key personnelStart a log of incident actions and communications. Maintain this throughout the incident management phaseUse a decision and action log (see final page of this plan for initial example)Record names and details of any staff, contractors or visitors who may have been hurt, killed, distressed or involved in the incidentAssess impact of the incident to agree response / next steps with managersLog details of key equipment lost or missingThis will be important for acquiring replacements as soon as possible for the resumption of servicesConsider whether the involvement of other teams, services or organisations are required to support the management of the incidentDepending on the incident the following may be approached to assist with incident management:PersonnelHealth and SafetyLegal HR[Insert teams/services/organisations that may provide additional support]COMMAND AND CONTROLTips for completing this section:It’s good practice to have a well-defined and practiced incident management structure that an organisation can turn to when facing disruption. Your managers and staff should know their roles and responsibilities immediately in an incident/disruption, and not have to be reminded. Where possible, the incident management structure should mirror the day-to-day management hierarchy of your organisation and should be instantly recognisable to the workforce. Radical managerial changes will create confusion and conflict.Your plan should identify:who will assume control immediately during an incident/disruption, the point that management should be escalated to the next tier and to whomwho should liaise with emergency services, council, utilities on siteindividuals to take responsibility for maintaining critical servicesBelow is a suggested roles and responsibilities that a business may want to consider in their incident management structure:355601422400Supports the response in organising, recording and delivering actions quickly and effectively 00Supports the response in organising, recording and delivering actions quickly and effectively 27406602851150Works with services and managers to make sure they get what’s needed to allow them to continue to deliver key services and activities. Will communicate and work with suppliers to make sure what’s needed is delivered.00Works with services and managers to make sure they get what’s needed to allow them to continue to deliver key services and activities. Will communicate and work with suppliers to make sure what’s needed is delivered.-590552841625Engages with customers to ensure their safety and security and making sure their needs are met. Communicates with customers, keeping them informed of the situation and actions.00Engages with customers to ensure their safety and security and making sure their needs are met. Communicates with customers, keeping them informed of the situation and actions.13595352851150Monitors and ensures the safety and security of staff. Communicates with staff onsite and off-site, ensuring they are aware of what is going on, what is expected of them and how they can support the response.00Monitors and ensures the safety and security of staff. Communicates with staff onsite and off-site, ensuring they are aware of what is going on, what is expected of them and how they can support the response.4045585536575In overall charge of the business in responding to and overcoming the disruption. Must have authority to make decisions that affect business operations and authorise expenditure.00In overall charge of the business in responding to and overcoming the disruption. Must have authority to make decisions that affect business operations and authorise expenditure.42932352851150Managers responsible for delivery of critical services and activities that your business must continue to deliver throughout the disruption. They will need the support of the whole management team and will likely be entirely focused on operational activities.00Managers responsible for delivery of critical services and activities that your business must continue to deliver throughout the disruption. They will need the support of the whole management team and will likely be entirely focused on operational activities.Section 4: COMMUNICATION PLANTips for completing this section:This section contains contact details for staff, stakeholders, suppliers and key partners so that they can be accessed quickly in a single document. You may wish to complete this section in its entirety including names and contact details for all.Alternatively, if you maintain a robust and resilient communications database that can be accessed from anywhere (for example, Google Contacts and WhatsApp groups containing employees and key managers) you may wish to detail this instead. This will avoid the need to continuously review and update this section, while reducing the amount of personal data will increase the flexibility you have in sharing this document without redacting entire sections.Where possible, use communications systems that your staff and customers are used to. Introducing a novel communications system, or using a system that is rarely practiced will create inevitable confusion and likely encounter technical problems.In the event this plan is activated, the following personnel must be notified at the earliest possible opportunity in the order prescribed:ALWAYS CONTACT Priority means of communication (unless detailed below):NameRoleContact DetailsLikely messageINSERTE.g. Senior ManagerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceRequest to escalate or supportINSERTE.g. Area ManagerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceRequest to escalate or supportINSERTE.g. Business Continuity LeadINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceRequest to escalate or supportINSERTE.g. Service ManagerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceRequest to escalate or supportINSERTE.g. Business OwnerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceCONTACTED DEPENDING ON INCIDENTPriority means of communication (unless detailed below):NameRoleContact DetailsLikely messageINSERTE.g. Service ManagerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceIndication of any press interestINSERTE.g. Comms OfficerINSERT(also include out of hours contact details i.e. mobile or email)Incident is taking placeAction being takenImpact on the serviceIndication of any press interestINSERTDigital servicesINSERTIncident is taking placeAction being takenImpact on the serviceIndication of any press interestAreas they can support service INSERTHR leadINSERTIncident is taking placeAction being takenImpact on the serviceWhere they need to report to/work fromSuppliersKey SuppliersINSERTIncident is taking placeAction being takenImpact on the serviceWhere they need to report to/work fromCustomersN/AConsider appropriate methods for communicating with customersIncident is taking placeAction being takenImpact on the serviceExpected duration of the disruptionLoLocal Authority Support/ Regulators/ information and adviceDirect numberCall centreIncident is taking placeAction being takenImpact on the serviceExpected duration of the disruptionLikely impactsPotential support requirementsCOMMUNICATING WITH STAFFTips for completing this section:It is highly likely that staff will need to be informed about a business disruption, or actions to maintain service continuity and what they should do. Management may also need to contact staff out of hours to advise them of any alterations to working conditions e.g. relocations and alternative working arrangements. Staff members contact details should be recorded for this purpose. It is important to develop a process that ensures contact details are maintained and updated.Priority means of communication (unless detailed below):NameRoleContact Details[Insert][Insert][Insert]Section 5: BUSINESS CONTINUITYTips for completing this section:The ‘Business Continuity’ phase of your response is concerned with maintaining a level of service delivery of your most critical activities, services and functions. Implementing contingency arrangements (such as relocation to back-up sites, identifying alternative working practises and suspending non critical activities) is a key feature of this phase.Not all services and activities will be critical in this phase. Some services can be suspended for short periods of time or deprioritised to support functions that must continue. A Business Impact Analysis can help to explore risks and opportunities your business has during disruption. This section must compliment other emergency plans, such as Health and Safety and Fire Safety/Evacuation plans; avoid duplication or conflict where possible.ACTIONS TO SUPPORT BUSINESS CONTINUITY ACTIONFUTHER INFO/DETAILSRecover/replace vital assets/equipment to enable delivery of critical activitiesThe essential services and essential equipment/resources required to deliver these services are listed:Assess the key priorities for the remainder of the working day and take relevant actionConsider sending staff home, to recovery site etcInform all staff what is required of themUse appropriate and existing means to communicate with staff, including for out of hours communications:For example: Call cascadeWhatsAppSMSEmailAnswerphone messagePublicise the interim arrangements for delivery of critical activitiesEnsure all stakeholders are kept informed of contingency arrangements as appropriate.[Insert how this will be done e.g. website/telephone etc. Consider who needs to know the interim arrangements e.g. key stakeholders, customers, suppliers etc]CRITICAL/PRIORITY ACTIVITIES/SERVICESServices that the business or organisation relies onA failure of these services may result in injury, death, or irreparable damage to the business or its reputationThese services must be maintained as a priority above all othersService/ActivityPurposeWhat key functions or activities does this service deliver?Recovery time How long can this service be disrupted or suspended before irreparable damage is caused?NON-CRITICAL ACTIVITIESNot recovering these activities until critical activities have been resumedSuspending these activities and diverting their resources to support the critical servicesThe non-critical activities for this team/service/organisation are:Service/ActivityPurposeWhat key functions does this service deliver?Recovery time How long can this service be suspended?[Insert] BUSINESS CONTINUITY ACTIONSACTIONFUTHER INFO/DETAILSIdentify any other staff required to be involved in the BC response Depending on the incident, the Business Continuity Team may need additional/specific input in order to drive the recovery of critical activitiesEvaluate the impact of the incident Use an incident impact assessment form to understand the impact of the incident on ‘business as usual’ working activities. Plan how critical activities will be maintained. Consider: Immediate prioritiesCommunication strategiesDeployment of resources FinanceMonitoring the situationReportingLog decisions and actions, including what you decide not to do and include rationaleUse a decision and action log to do thisLog all financial expenditure incurredUse a financial expenditure log to do thisAllocate specific roles as necessaryRoles allocated will depend on the incident and availability of staff Secure resources to enable critical activities to continue/be recoveredConsider requirements such as the staffing, premises, equipment. Refer to BIA for more detailed information on resource needs.Deliver appropriate communication actions as requiredEnsure methods of communication and key messages are developed as appropriate to the needs of your key stakeholders e.g. customers, suppliers, staff, Executive Boards, Shareholders etc.Section 6: BUSINESS RECOVERYGetting back to ‘business as usual’. E.g. reoccupation of the usual building, all staff returning to work, or going back to their ‘normal’ roles. RECOVERY AND RESUMPTION ACTIONSACTIONFUTHER INFO/DETAILSAgree and plan the actions required to enable recovery and resumption of normal working practisesAgreed actions will be detailed in an action plan and set against timescales with responsibility for completion clearly indicated.Continue to log all expenditure incurred as a result of the incident Use a financial expenditure log to do thisRespond to any long terms support needs of staffDepending on the nature of the incident, the Business Continuity Team may need to consider the use of Counselling Services e.g. internal Occupational Health involvement or appropriate External AgenciesCarry out a ‘debrief’ of the incident and complete an Incident Report to document opportunities for improvement and any lessons identifiedUse an Incident Report Form to do this. This should be reviewed by all members of the Business Continuity Team to ensure key actions resulting from the incident are implemented within designated timescalesReview this Continuity Plan in light of lessons learned from incident and the response to itImplement recommendations for improvement and update this Plan. Ensure a revised version of the Plan is read by all members of the Business Continuity Team Publicise that there is now ‘business as usual’[Insert how this will be done e.g. website/telephone etc. Consider who needs to know that normal working practises have been resumed e.g. customers, suppliers etc] ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download