TABLE OF CONTENTS - Epic Collaborative Advisors



264781782557COMPANY NAMEStreet AddressCity, State and Version 0.0.000/00/000000COMPANY NAMEStreet AddressCity, State and Version 0.0.000/00/0000-8845734200 VERSION HISTORYVERSIONAPPROVED BYREVISION DATEDESCRIPTION OF CHANGEAUTHORPREPARED BYTITLEDATEAPPROVED BYTITLEDATETABLE OF CONTENTS TOC \o "1-3" \h \z \u 1.BUSINESS FUNCTION RECOVERY PRIORITIES PAGEREF _Toc528656443 \h 32.RELOCATION STRATEGY PAGEREF _Toc528656444 \h 33.ALTERNATE BUSINESS SITE PAGEREF _Toc528656445 \h 34.RECOVERY PLAN PAGEREF _Toc528656446 \h 45.RECOVERY PHASES PAGEREF _Toc528656447 \h 4A.DISASTER OCCURRENCE PAGEREF _Toc528656448 \h 4B.PLAN ACTIVATION PAGEREF _Toc528656449 \h 4C.ALTERNATE SITE OPERATION PAGEREF _Toc528656450 \h 4D.TRANSITION TO PRIMARY SITE PAGEREF _Toc528656451 \h 46.RECORDS BACKUP PAGEREF _Toc528656452 \h 57.RESTORATION PLAN PAGEREF _Toc528656453 \h 58.RECOVERY TEAMS PAGEREF _Toc528656454 \h 5A.TEAM ROLES PAGEREF _Toc528656455 \h 5B.TEAM CONTACTS PAGEREF _Toc528656456 \h 5C.TEAM RESPONSIBILITIES PAGEREF _Toc528656457 \h 6D.DEPARTMENTAL RECOVERY TEAMS PAGEREF _Toc528656458 \h 69.RECOVERY PROCEDURES PAGEREF _Toc528656459 \h 6A.POTENTIAL RECOVERY PROCEDURE PAGEREF _Toc528656460 \h 610.APPENDICES PAGEREF _Toc528656461 \h 6A.Employee Contact List PAGEREF _Toc528656462 \h 6B.Recovery Priorities PAGEREF _Toc528656463 \h 6C.Alternate Site Resources PAGEREF _Toc528656464 \h 6D.Emergency Operations Center (EOC) Locations PAGEREF _Toc528656465 \h 6E.Vital Records PAGEREF _Toc528656466 \h 6F.Vendor Lists PAGEREF _Toc528656467 \h 6G.IT System Reports and Resources PAGEREF _Toc528656468 \h 6H.Alternate Site Transportation Information PAGEREF _Toc528656469 \h 6I.Impact and Risk Assessments PAGEREF _Toc528656470 \h 6J.Business Impact Analysis PAGEREF _Toc528656471 \h 6K.Recovery Task Lists PAGEREF _Toc528656472 \h 6L.Office Recovery Plan PAGEREF _Toc528656473 \h 6This RESILIENCY AND RECOVERY Plan template provides a framework, guidance, and concept of operations to support businesses to continue and/or rapidly restore their critical business functions in the event of a disruption to normal operations. This template includes an overview of continuity operations, outlines the approach for supporting an organization’s critical business functions, and defines the roles and responsibilities of staff. It also outlines the orders of succession, notification procedures and communication methods, plan activation and deactivation protocols, provisions for alternate work locations, and the plan for maintaining and restoring access to vital records. This document establishes procedures and processes to maintain operational continuity for businesses based on three types of disruptions that could occur individually or in any combination: Loss of access to parts of or the entire facility (e.g., following a fire, sudden storm, or flooding);Loss of services due to a reduction in the workforce (e.g., during pandemic influenza, civil disturbance, or strike); Loss of services due to equipment or systems failure (e.g., information technology (IT) systems failure, electrical grid failure).This document serves as a template at all times and is intended to be customized at each step to fit the needs of the business owner or designee. Adjustments and additions to the framework laid forth in this document are welcomed. The more functional the document is for an organization, the greater success they will have navigating an emergency event. BUSINESS FUNCTION RECOVERY PRIORITIESDisaster recovery teams use this strategy to recover essential business operations at an alternate location site. The information system and IT teams restore IT functions based on critical business functions.RELOCATION STRATEGYALTERNATE BUSINESS SITEAn organization uses the alternate business site and relocation strategy in the event of a disaster or disruption that inhibits the continuation of the business processes at the original business site. This strategy should include both short-term and long-term relocation sites in the case of both types of disruptions.RECOVERY PLANRECOVERY PHASESThese are the activities most needed for the business to continue, and the recovery plan should target these essential business functions. The recovery plan should proceed as follows:DISASTER OCCURRENCEThe company declares a disaster and makes the decision to activate the rest of the recovery plan.PLAN ACTIVATIONDuring this phase, the company puts the business continuity plan into effect. This phase continues until the company secures the alternate business site and relocates the business operations.Plan Activation During Normal Business HoursIf it is determined that the facility cannot be re-inhabited, the Business Owner or Designee will inform personnel on next steps. Employees may be instructed to go home to await further instructions or to activate the Resiliency and Recovery Plan, which may trigger activation of an alternate site or activation of a telework plan. Plan Activation Outside Normal Business Hours If an event occurs outside normal business hours that renders a facility uninhabitable, the Business Owner or designee will activate the Plan.Actions upon ActivationUpon activation of the Plan, the Business Owner or designee will be responsible for notifying the alternate site, if appropriate, of their impending arrival.ALTERNATE SITE OPERATIONThis phase continues until the business can restore the primary facility.TRANSITION TO PRIMARY SITEThis phase continues until the company can appropriately move business operations back to the original business site. RECORDS BACKUPRESTORATION PLANDisaster recovery/It teams maintain, control, and periodically check on all the records that are vital to the continuation of business operations and that would be affected by facility disruptions or disasters. The teams periodically back up and store the most critical files at an offsite location.RECOVERY teamsThe company establishes recovery teams and divides the participants into appropriate groups based on job role and title. The organization designates a team leader for each team. It assigns a specific role or duty to each remaining member of the team.TEAM ROLESTeam Leader, Backup Team Leader, Team MemberTEAM CONTACTSStored in the Contact List AppendixTEAM RESPONSIBILITIESIncident Commander, HR/PR Officer, Information Technology, Finance/Admin, Legal/ContactsDEPARTMENTAL RECOVERY TEAMSBusiness Continuity Coordinator, Communications Team, Human Resources Team, Administration Team, Emergency Response Team, Information Technology Recovery TeamRECOVERY PROCEDURESThe company details the specific activities or tasks needed to recover normal and critical business operations. It describes each strategy by enumerating the specific set of activities and tasks needed to recover appropriately.POTENTIAL RECOVERY PROCEDUREDisaster OccurrenceNotification of ManagementPreliminary Damage AssessmentDeclaration of DisasterPlan ActivationRelocation to Alternate SiteImplementation of Temporary ProcedureEstablishment of CommunicationRestoration of Data Process and Communication with Backup LocationCommencement of Alternate Site OperationsManagement of Work Transition Back to Primary OperationsCessation of Alternate Site ProceduresRelocation of Resources Back to Primary SiteAPPENDICESThis section lists all the appendices needed to carry out a BCP. These appendices include the following:Employee Contact ListEmployee NameTitle / Responsibility Home / Cell NumberPersonal Email AddressRecovery PrioritiesAlternate Site ResourcesAn alternate continuity facility provides a fallback location for a business to safely transfer operations should the main facility become inoperable due to loss of access to parts of the facility or the entire facility. The use of alternate facilities and telework options, when available, enhances organizational resilience during incidents that render primary facilities unavailable.Alternate Facility SelectionWhen determining appropriate alternate facilities, an organization must ensure that they provide the means and capabilities needed to perform critical business functions. Considerations for alternate facilities may include but are not limited to the following elements:Sufficient distance from the primary facility as not to be impacted by cascading events. Access to critical equipment and supplies or can be prepared to operate essential equipment and supplies within 12 hours of Business Continuity Plan activation.Current Memorandums of Understanding/Agreement.Sufficient levels of physical and information technology security.Telework as an Alternate SiteTeleworking is an arrangement between an employee and the employee’s supervisor that allows the employee to work at home or other non-traditional location. Telework is not always an option for all business types, though it should be utilized when available. The organization’s telework policy should be inserted here and adapted, as needed, to support continuity operations. For example, provisions should be included that authorize telework of employees who may not otherwise be eligible. Emergency Operations Center LocationsVital RecordsVital Records are those records a business needs to sustain the mission of the organization and comply with legal requirements. Vital records must be stored in multiple places in multiple formats. The identification, protection, and ready availability of vital records needed to support essential functions are critical components of a successful Plan. They must be protected against damage and loss and must be kept current and complete. By protecting and storing vital records in redundant fail-safe formats, such as hard copies, alternate database locations, virtually, on external hard drives, etc. staff can access vital records that contribute to the business’s rapid resumption of critical business functions. Examples of documents that should be considered vital records are as follows, but not limited to:Policies and procedures, contracts, Memorandums of Agreement/Understanding, insurance information, and payroll data. An electronic and hard copy list of staff members and their contact information.Necessary keys, access codes, or passwords.Continuity facility location and directions.Over time, records can become outdated, and insufficient representation of current plans, procedures, records, etc., is possible. It is essential that records are updated appropriately following a predetermined schedule. If vital records are not updated and thusly destroyed, incomplete or inaccurate information may be relied upon during emergencies, and outdated information and records can slow the continuation and reconstitution of essential functions. Vendor ListsVendorResource/ServiceContact InformationIT System Reports and ResourcesAlternate Site Transportation InformationImpact and Risk Assessments Maximum Allowed DowntimeIdentify the amount of time your business could afford for the function to be down before it could cause the business irreparable harm. Consider using the following units:Less than 24 hours1 day to 1 week1 to 2 weeks2 to 4 weeks30 days or greater CriticalityEnter High, Medium, or Low, depending on how critical the function is to the operations of your business. Following are some considerations to use when determining criticality:What business objective/goal does this function support? How often does this function occur? How many business units (departments) perform this function? Does the successful completion of this function depend on any other functions? Are other functions dependent on this function for its successful completion? Is there a potential for revenue loss if this function is not completed? Is there a potential for fines, litigation, additional downtime, or other punishment for noncompliance due to a regulatory requirement? Does this function directly impact the business’ image or market share? What priority ranking would you give this function as compared to other functions? Required ResourcesPeople: Identify the number of employees required for this function. Also, identify if a staggered resumption of employees is an option.Equipment: Identify the type of equipment and how many would be required in order to get this function back in operation.Supplies: Identify any unique supplies required for this function (do not list items that could be easily purchased from an office supply store). This would include any paper forms or documents rmation Technology: Identify software (e.g., Microsoft Office, QuickBooks, Point of Sale system), systems, applications, and electronic documentation needed to complete the function.Interdependencies: List other business functions this function relies on in order to be operational.Business Impact AnalysisThe following blank table should be used to conceptualize your organization’s critical business functions. Generally, organizations should identify 3-5 critical business functions. The following tables are customizable and have no limit to how much information should be included. The table can be easily copy/pasted so that each critical business function has its own table. Language in italics is intended as a sample. [Company Name] Company Critical Business FunctionCritical Business Function 1: Business Process to Complete: Supporting Elements Supporting Activities(describe)Lead POCVendors and External ContactsVital RecordsMax Allowed Down Time AlternateCriticalityActivityPosition TitleBrief list of vendors or external contacts to know for business purposesBrief list of the vital records that support this activityTime/Days Position TitleHigh/Med/LowActivityPosition TitleBrief list of vendors or external contacts to know for business purposesBrief list of the vital records that support this activityTime/Days Position TitleHigh/Med/LowActivityPosition TitleBrief list of vendors or external contacts to know for business purposesBrief list of the vital records that support this activityTime/Days Position TitleHigh/Med/LowImplications If Not Conducted: Interruption and/or loss of this function would interrupt…. Furthermore, it would result in a delay of the capability to… Calendar Dependence: e.g., this function is always occurring; this function only occurs in summer months; this function is active during inclement winter weather, etc.Required Resources: Staff, equipment, supplies, information technology, and other resources. Facilities: Standard office space that can accommodate up to XX people at any time. Traditional office equipment and space for phones, computers, scanners, printers, etc., with network access to Internet, radio, and other telecommunications services.Supporting Partners: List private sector or public sector supporting partners. Vital Records: List relevant vital records and their location, if appropriate. Recovery Task ListsOffice Recovery PlanPlan deactivation is the process of demobilizing the alternate facility and restoring critical business functions to the primary facility or a new facility that will permanently replace the damaged facility. Plan deactivation may not consist of an exact replacement of lost facilities, equipment, or processes. The goal of plan deactivation is to reestablish the organization’s capabilities in the most efficient manner. In some continuity incidents, extensive coordination may be necessary to backfill staff, procure a new operating facility, and re-establish IT infrastructure and vital records. When it is determined the activation of the Business Continuity Plan is no longer needed all personnel should be informed of new locations, policies, and procedures. Criteria For Plan DeactivationThe business owner or designee will determine, based on input from first responders, staff responsible, and other entities, when it is safe and when the organization is prepared to restore or transfer critical business functions to the original facility or to an alternate facility for long-term usage.Critical business functions must be restored in priority sequence based upon the classification and criticality of the function. The following elements are typically completed prior to plan deactivation:Purchase and acquire equipment, supplies, and make travel arrangements needed for the resumption effort.Temporarily suspend non-critical functions, as necessary, to support the resumption efforts.As applicable, utilize personnel from other sites to support the resumption efforts.REsumption ProceduresProvide information as to how each function outlined in the following table will be resumed and which staff members need to be active participants in this process. How To Complete The Plan Deactivation TableBusiness Function Resumption/Plan Deactivation Process#FunctionSuppliesRequired Resources 12345Family Emergency PlanEmployees must also prepare in advance for what to do in an emergency and should develop a Family Support Plan to increase personal and family preparedness. 11.1 Basic Disaster Supplies KitTo assemble your kit, store items in airtight plastic bags and put your entire disaster supplies kit in one or two easy-to-carry containers such as plastic bins or a duffel bag.A basic emergency supply kit could include the following recommended items:Water?-?one gallon of water per person per day for at least three days, for drinking and sanitationFood?- at least a three-day supply of non-perishable foodBattery-powered or hand crank radio and a NOAA Weather Radio with tone alertFlashlightFirst aid kitExtra batteriesWhistle to signal for helpDust mask to help filter contaminated air and plastic sheeting and duct tape to?shelter-in-placeMoist towelettes, garbage bags and plastic ties for personal sanitationWrench or pliers to?turn off utilitiesManual can opener for foodLocal mapsCell phone with chargers and a backup battery11.2 Additional Emergency SuppliesConsider adding the following items to your emergency supply kit based on your individual needs:Prescription medicationsNon-prescription medications such as pain relievers, anti-diarrhea medication, antacids or laxativesGlasses and contact lens solutionInfant formula, bottles, diapers, wipes, diaper rash creamPet food and extra water for your petCash or traveler's checksImportant family documents such as copies of insurance policies, identification and bank account records saved electronically or in a waterproof, portable containerSleeping bag or warm blanket for each personComplete change of clothing appropriate for your climate and sturdy shoesHousehold chlorine bleach and medicine dropper to disinfect waterFire extinguisherMatches in a waterproof containerFeminine supplies and personal hygiene itemsMess kits, paper cups, plates, paper towels and plastic utensilsPaper and pencilBooks, games, puzzles or other activities for childrenStaff AccountabilityOnce employees, customers, and guests have evacuated from the impacted facility personnel should remain at the primary assembly point and await further instructions. Once at the assembly point accountability must be performed: Initiate headcount and make note of missing and/or injured employees, customers, and guests; and Report missing and/or injured employees, customers, and guests to the Business Owner or designee. This information should be shared with emergency first responders on scene. The Business Owner or designee should determine the best methods for disseminating communications to staff and socialize these policies with staff prior to an incident occurring. Employee Communication Methods1Staff work email, list located at XXXX location2Staff work mobile phones, list located at XXXX location3Staff personal email and mobile phones, list located at XXXX location-119134506COVID-19 Back-to-Work ChecklistReturning employees to the workplace during and after the COVID-19 pandemic won’t be as simple as announcing a reopening or return-to-the-workplace date and carrying on business as usual. Not only will many workplaces be altered initially, some changes may be long term, even beyond the imagined “finish line” of a widely available vaccine or treatment. The details of each employer’s plan to return will look different, but there are 10 key issues most will need to understand and start preparing for now.1. Workplace safety. Employers have to ensure their workplaces are as safe as they can be. Employees and customers alike may have fears of returning to business as usual; preparing for and communicating how safety is a top priority will allay fears and increase brand loyalty.Safety measures might include:Implementing employee health screening procedures.Developing an exposure-response plan that addresses:Isolation, containment and contact tracking procedures.Stay-at-home requirements.Exposure communications to affected staff.Providing personal protective equipment (PPE) such as:Masks, gloves, face shields, etc.Personal hand sanitizer.Detailing cleaning procedures and procuring ongoing supplies.Establishing physical distancing measures within the workplace:Staggered shifts and lunch/rest breaks.Rotating weeks in the office and working remotely.Moving workstations to increase separation distance.Implementing one-way traffic patterns throughout workplace.Restricting business travel: Start with essential travel only and define what that is.Follow government guidance to ease restrictions over time.Defining customer and/or visitor contact protocols such as:Directing customer traffic through workplace.Limiting the number of customers in any area at one time.No handshake greetings; remain 3-6 ft. apart.Using video or telephone conferencing instead of in-person client meetings.Providing contactless pickup and delivery of products.Understanding and complying with Occupational Safety and Health Administration (OSHA) record-keeping and reporting obligations:Identify positions, if any, with the potential for occupational exposure to the coronavirus.Review OSHA regulation 29 CFR § 1904 to determine work-relatedness of illnesses.2. Recall procedures. Plan for how and when employees will return to work or to the worksite to create an organized and controlled approach. All employees returning on the same day at the same time could be overwhelming and possibly unsafe. Things to consider include:Phasing-in employees returning to work:Use seniority or other non-discriminatory factors for selection.Consider adopting a work share program if bringing employees back on a reduced schedule.Determine schedule changes to provide the greatest protection to workers.Creating a plan for employees in high-risk categories for infection to return to work:Consider allowing them to work from home or remain on leave until they feel comfortable to return.Determine increased measures to protect them when working onsite, including isolated workstations, additional PPE as requested, fewer days in the office, etc.Notifying the state unemployment agency of employees recalled to work. This is a state requirement and will help save on unemployment taxes for those who choose not to return to work.Determining how to handle employees who are unable or unwilling to return to work.Employees who are fearful of returning to work.Employees who have family obligations that interfere with the ability to return to work.Employees who remain under quarantine due to exposure to COVID-19. 3. Employee benefits. Whether employees remained on the employer’s benefits plans or not, certain notices or actions may be required to stay compliant. Communicating these changes to employees should be done as soon as possible.Review such issues as:Group health insuranceEligibility—redetermine waiting-period issues due to leave or reinstatement; review any revised eligibility requirements during the layoff or furlough and determine if those changes will be revoked and when.Ensure coverage changes, such as adding telehealth benefits, and services now not subject to deductibles have been incorporated into the plan.If employee premiums were paid during leave, determine how or if the employer will recover those costs from employees.Flexible spending accountsReview Dependent Care Assistance Program election changes with employees to ensure their new or revised elections are correct.Over-the-counter medical products are now allowed under flexible medical accounts on a permanent basis and should be included in plan documents and communications.Address new flexible spending account elections and allowable changes with employees. 401(k) or other pension plansReview eligibility issues due to layoff or furlough.Consider any break in service issues or counting years of service concerns.Review any in-service loans employees may have or will want to take, including eligibility and pay back procedures.Paid leaveReview required leave under the Families First Coronavirus Response Act (FFCRA), ensure employees understand the eligibility requirements and provide them with a policy. Create a way to track time used and collect supporting documentation for tax credit purposes. Determine if there will be company PTO policy changes, including increasing or decreasing paid leave benefits, or additional restrictions in using paid leave.Understand the coordination of leave benefits and communicate these to employees as needed.4. Compensation. Many employers may have made compensation changes during the crisis thus far, and others may need to make them in order to reopen. How the disruption has affected compensation policies going forward will also need reviewing and communicating to affected staff.Things to address include:How the employer will handle any missed annual pay increases and if those will be applied retroactively.Will any pay cuts be made or revoked? Understand how to reduce salaries for exempt employees if necessary.Determine if employee status changes—exempt to non-exempt or full- to part-time status—are needed to reopen or if those already made will continue.How will bonuses be affected, including eligibility for or continuation of, etc.Will hazard pay be offered or revoked?It may be a good time to consider a pay equity audit as workers return, as pay may have been reduced or frozen and may have impacted women differently.5. Remote work. Telecommuting may have proven to work well during the pandemic for some employers and employees. Using it not only as a short-term emergency tool to survive the next year but also as a permanent work/life balance and cost-saving measure should be considered.Actions to consider include:Continuing to allow remote work where possible to keep employees safe.Staggering weeks in office and at home among team members, or part-time remote work on alternate weekdays.Responding to employee requests to continue to work from home, including long-term arrangements.Updating technology to support virtual workers.Consider the long-term cost savings or impact of offering permanent remote work.6. Communications. Establishing a clear communication plan will allow employees and customers to understand how the organization plans to reopen or reestablish business processes. Topics to cover may include:How staying home if sick and physical distancing policies are being used to protect workers and customers.Detail what training on new workplace safety and disinfection protocols have been implemented.Have exposure-response communications ready to go to any affected employees and customers.Have media communications ready to release on topics such as return-to-work timetables, safety protections in place, and how else the company is supporting workers and customers. Prepare to respond to the media for workplace exposures. 7. New-hire paperwork. Employees returning to work who remained on the payroll would generally not need to complete new paperwork. However, for those separated from employment, such as laid-off workers, it may be best to follow normal hiring procedures.Determine employment application and benefits enrollment requirements for rehired workers.Decide whether full or adjusted orientation procedures will be utilized.Submit new-hire reports for new and rehired workers.Notify state unemployment agencies of recalled workers, whether rehired or not.Address I-9 issuesIf completed remotely, complete in person upon return to the workplace.Update any expired work authorization documents or make note of which need updating as soon as new documents are received by the employee.Determine if you will have employees complete Section 3 of their original I-9 or complete a new I-9 form. 8. Policy changes. It is no longer business as usual, and employers will likely need to update or create policies to reflect the new normal. Some examples include:Paid-leave policies adjusted to reflect regulatory requirements and actual business needs.Attendance policies relaxed to encourage sick employees to stay home.Time-off request procedures clarified to indicate when time off can be required by the employer, should sick employees need to be sent home. Flexible scheduling options implemented allowing for compressed workweeks and flexible start and stop times. Meal and rest break policies adjusted to stagger times and processes implemented to encourage physical distancing.Travel policies updated to reflect essential versus nonessential travel and the impact of domestic or global travel restrictions. Telecommuting policies detailed to reflect the type of work that is able to be done remotely and the procedures for requesting telework. Information technology policies revised to reflect remote work hardware, software and support. 9. Business continuity plans. Employers will have learned valuable lessons regarding their business continuity plans, or lack thereof, during the past months. Now is the time to review and revise the plan to prepare for future emergencies.Implement a business continuity plan, including infectious disease control, if a plan did not exist prior to the COVID-19 crisis.Amend existing plans to include the latest emergency information, such as updates on epidemics and workplace considerations or changes in protocols for responding to global disasters. Update plan resources and contact information to ensure accuracy.Establish a pandemic task force to continuously monitor external and internal data and implement appropriate protocols. Recognize the possibility of additional closings during this current pandemic as COVID-19 infections may rise and fall again, triggering more stay-at-home orders and supply chain disruptions. Perform testing and exercises to practice the new or revised emergency plans to make sure employees know what to do and to find any missing parts that need to be addressed before another emergency situation occurs.10. Unions. Employers with unionized workforces may have additional considerations, including:Determining obligations to bargain when implementing changes to mandatory bargaining subjects such as wages and benefits.Identifying the need to add a force majeure clause into a collective bargaining agreement to protect the employer from contractual obligations during an event that is beyond the employer’s control. Reviewing existing no-strike clauses to ensure continued work during future infectious disease outbreaks. Determining obligations for hazard pay under Section 502 of the National Labor Relations Act (NLRA) during “abnormally dangerous conditions.”Source: ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download