In this, the third of five articles giving a detailed view into each step of the “5 Key Stages to Business Continuity Planning” we are now focusing on the Response and Recovery Plans of a BCP. These relate to the priority functions, and the specific steps needed to recover each of the individual activities. Evidence, and more importantly experience, clearly demonstrate that most employees cannot easily use an unfamiliar and complicated plan at time of disaster and use it for an effective and efficient response. Therefore, the plans should be written in a way to easily guide a person through each of the key activities to aid recovery.
For most organisations detailed plans are only required for the most critical of functions, and these are mainly written for highlighted people who will have specific roles and responsibilities during incident or recovery management. These individuals will be expected to review their allocated plans on a regular basis to ensure that they are familiar with them.
So, what does the structure of a recovery plan look like? Below is an example of a brief but comprehensive plan for a specific department or activity. It would normally will consist of only a couple of pages.
Example, Page – 1:
For ease of reference, we have divided the first page of the plan into three sections.
- Part 1 – defines the Leadership Team, their roles and contact details.
- Part 2 – details the communications facilities available to the team, and how to access and utilise them.
- Part 3 – contains key contacts. These may be internal or external to the company.
Next, the second page of the plan defines what happens at key milestones of the recovery process, and who is responsible for performing them.
This part of the plan is organised by scenario, and in this example shown below, we have identified three:
- Loss of workplace
- IT systems failure
- Loss of staff mobility and /or mobility
Example, Page – 2:
The roles identified in the Leadership Team, in Page-1, are now allocated to their specific duties should there be an invocation of the BCP. There is also the space to describe the actions that need to be undertaken to assist recovery.
Some examples of the actions that could be invoked are:
- To advise specific colleagues to go to a Workarea Recovery location, or to commence remote working.
- Ensuring data integrity and completeness, and checking the restoration of IT systems.
- Operating support lines for customers who may be impacted by the incident.
Plans formatted like the one shown here are designed for conciseness and ease of reference. They need to be thought of as a series of prompts that should be used at certain stages, and during particular scenarios. Bear in mind though, that the success is wholly reliant on having other core capabilities in place, such as alternative workplace provision, relocation logistics, and a proven IT recovery capability.
That concludes Stage 3 of the BCP development. ADAM Continuity can help provide these core capabilities and provide you the services and assurances to be able to recover from an unexpected incident. If you have any questions concerning this, or any or business continuity solution, please contact us.
In the next article, we shall be reviewing the penultimate step, Stage 4 – Build the Business Continuity Organisation.