Business Continuity Plan Template to support Small to Medium Size Enterprises

Date of Publication

Version Number1

Plan Owner:

Business Name:

Page 1 of 22

Introduction Cardiff Council is firmly committed to helping Businesses across Cardiff and as such has developed this simple guidance document and Business Continuity Plan template to assist small to medium sized businesses !he aim is to help businesses to develop a business continuity management response "hich "ill help their businesses prepare for# and manage# incidents that could impact on their businesses Business continuity management sets out a frame"or$ and a process to enable you to plan the delivery of your business during events or incidents !his process "ill help you to identify and manage ris$s and ensure you gather information "hich "ill help to build a simple Business Continuity Plan "hich "ill protect your business during a business disruption Risk %t is important to consider ris$s that could impact on your business and "hat measures that could be implemented to help reduce or manage the identified ris$s !he cost of putting in place measures that reduce the ris$ may be costly for your business# but balance that against the potential cost of the threat becoming a reality &ou may decide to accept the ris$ and plan to manage the impacts of the ris$s should the threat of the ris$ occurring become a reality 'ccepting or managing ris$ is part of your businesses your decision it is often referred to as your ris$ appetite# Flooding Consider "here your business is# is it "ithin a flood ris$ area( &ou can chec$ this by accessing the information on the )nvironment 'gency "ebsite : http:**""" environment+agency gov u$*homeandleisure*floods*,1-./ asp0 &ou can also sign up to receive flood "arnings from the same "ebsite "hich "ill help you react to protect your business "hen flooding is possible )ffective flood defence items can be purchased to help you protect your premises# protecting your premises could mean the difference bet"een your business surviving a flood incident or not Interruption to Energy supply %s your business particularly vulnerable to the possibility of the po"er supply being interrupted# if so "hat could the cost of this occurrence be on your business( &ou may not be very vulnerable to energy interruption !he impact could be minimal# on the other hand you could find that the impact could be significant and very costly Loss of e!site or "irus attack on key IT systems 1o" big a ris$ "ould this be to your business and "hat "ould be the impact on you if this occurred Consider ho" safe the information is that you hold and ho" sensitive it is Consider getting professional advice and support to ma$e sure your %! and information is secure and protected
Date of Publication Version Number1 Plan Owner: Business Name: Page 2 of 22

Se#ere eat$er% sno Consider the impact on staff and customers accessing your business premises 2hat measures can you ta$e to ma$e access easier( 2hat happens if your suppliers have difficulty delivering to you or pic$ing up goods( 1o" can you help staff prepare for travel into and from "or$( Fire Risk Consider if your business premises is at ris$ of fire Consider: 're highly flammable materials*goods stored "ithin the premises# are they correctly stored( 're there tools or e3uipment on site that could cause fire# if so are they "ell maintained( 2hat about neighbouring business and properties could they cause an increased ris$ of fire( 're your evacuation plans and fire detection e3uipment appropriate and "ell maintained( 're all your staff trained in "hat to do in a fire and ensure customers and visitors are evacuated safely in case of a fire( !he above bullet points details some of the threats to your business# you are best placed to understand the specific ris$s to your business and the potential impact that they "ould have should they occur Risk Treatment 'fter revie"ing the ris$s to your business and considered ho" li$ely they are to occur and the potential impact on your business you can e0plore possible treatments 4imple treatments for e0ample may be if to consider buying and fitting simple effective flood barriers "hich can be fitted at short notice %f your refitting your premises carry out "or$ to limit the impact of possible flooding ' ris$ treatment for sno" disruption may be having sno" shovels and grit spreaders and grit *salt on site Chec$ that your suppliers are prepared to deliver in sno" conditions and help your staff consider alternative "ays of getting into "or$ and returning safely home# effective communication "ith staff and customers is vitally important !he above are 5ust a fe" simple e0amples of some "ays you can help manage the ris$ of sno" disrupting your business &ou must decide "hat is appropriate and "hat is cost effective based on the potential impact to your business Insurance &ou can6t stop all threats from becoming a reality but you can loo$ at insuring yourself as a business to cover the costs so you can get your business up and running normally as 3uic$ly as possible %t may even be possible to insure for partial loss of business income due to the business disruption but you "ould need to discuss "ith your insurer 1o"ever being able to sho" your insurer
Date of Publication Version Number1 Plan Owner: Business Name: Page , of 22

you are manageing and reducing ris$s may benefit you "hen discussing premiums so consider this "hen you are loo$ing at the cost and benefit of ris$ treatment methods 7emember to store copies of $ey insurance documents# contracts and business credit*debit cards etc safely and securely off site in case your premises are damaged or you lose access to them Looking at continuity options 1aving put in your ris$ treatment measures and appropriate insurance you no" need to focus on suitable continuity options !he purpose of your chosen options is to manage the impacts of incidents and events that could disrupt your business !he business continuity plan template "hich is in this document helps you outline options for managing impacts to the follo"ing scenarios: &ork Space disruption# e g fire# flood# sno" 'on a#aila!ility of Staff e g sic$ness# travel disruption Loss of IT 8 e g phone lines etc Loss of ot$er resources+ e g vehicles# fuel

(d#ice on Filling in t$e plan template !he template is 5ust a simple plan outline to help you protect your business %t is designed to help you capture important processes and actions that you or your staff "ould need to underta$e should there be a business disruption !he plan should be stored securely off site and be accessible by those that "ould need to implement it !he te0t in blue is there to illustrate some e0amples of the sot of actions that you may "ant to consider "hen you fill out your plan# you can build from this and ma$e it specific to your business 7emember that $ey documents li$e insurance document# client information or contracts and supplier details should be stored securely off site %t is also a good idea to have a business debit or Credit card a"ay from your business premesis so if you lose access you are able to start implementing actions to help your business survive )seful e!sites and links

Cardiff Council % &it$ links to all council ser#ices* including inter eat$er ad#ice * Emergency management* Business Continuity and !usiness ser#ice+ $ttp+,, -cardiff-go#-uk,content-asp.parent/directory/id01234 E"(C Cardiff 5 is a multi%agency commitment to de#eloping a coordinated response to a ma6or incident in Cardiff$ttp+,, -cardiff-go#-uk,content-asp. na#01278*9:;:*4:49<parent/directory/id01234 En#ironment (gency % (d#ice on flooding $ttp+,, -en#ironment% gency-go#-uk,$omeandleisure,floods,default-asp=
Date of Publication Version Number1 Plan Owner: Business Name: Page 9 of 22

Met >ffice % &eat$er arnings and $ttp+,, -metoffice-go#-uk,

eat$er updates

Traffic &ales 5 Transport disruptions to road net ork $ttp+,, -traffic% ales-com, Sout$ &ales Police $ttp+,, -sout$% ales-police-uk, Sout$ &ales Fire and Rescue ser#ice $ttp+,, -sout$ ales%fire-go#-uk,Englis$,?ome,Pages,default-asp= &ales Resilience $ttp+,, alesresilience-go#-uk,.skip0:<lang0en Business Continuity Institute $ttp+,, -t$e!ci

Date of Publication

Version Number1

Plan Owner:

Business Name:

Page . of 22

Business Continuity Management Plan (Name of Business)

"ersion+ Plan > ner+ @ate pu!lis$ed+

Date of Publication

Version Number1

Plan Owner:

Business Name:

Page - of 22

Contents
:Introduction
11 12 1, 'im :b5ectives 4cope :f !he Plan

19-

Reco#ery >!6ecti#es Plan (cti#ation Procedures < Process

9-: 9-1 9-9 9-; 9-4 9-3 Plan (cti#ation Process (cti#ation of Plan &orkspace IT Systems , "oice net orks , Aey data Aey Staff >t$er Aey Resources

;-

Supporting Information
;-: ;-1 ;-9 Staff &elfare Communicating &it$ Staff Media , Pu!lic Information

4-

Plan Maintenance Procedures

.1 Plan validation

(ppendices
(B BB CB Staff Contact List >t$er )seful 'um!ers Summary of Reco#ery Resources

@istri!ution List

'ame 88: //2 //, //9 //. ////; //< //= /1/ Business Continuity Officer Name of Manager Name of Deputy

Co! Title Business Continuity Officer Manager Deputy Manager

Email address-

Plan )pdates %t is essential that the Plan is $ept up to date and it is version controlled "ith a clear date on front page of the plan %f you have any suggested changes to this plan# please notify the author of the plan# "ho6s name is on the front of the plan !his person is also responsible for updating and issuing plans 8 2e suggest contact lists are revie"ed every - months and plan annually or follo"ing any significant change to the organisation or service %f any changes to the service or personnel occur the plan should be updated and issued to the copy holders !his plan must be e0ercised annually or follo"ing any significant change to the business and the e0ercise recorded and any improvements built bac$ into the plan

:- Introduction
!his plan is to be used to assist in the recovery of the (insert business name > in the event of a ma5or disruption to the business ' ma5or disruption is defined as a significant incident "hich threatens personnel# buildings or the operational

structure of the business and re3uires special measures to be ta$en to restore things bac$ to normal :-: (im !he aim of the Plan is to set out the roles# responsibilities and actions to be ta$en by the business staff to re+instate the business follo"ing a ma5or disruption :-1 >!6ecti#es

!he ob5ectives of the plan are to

l l

!o provide for continuity of the activities essential to the business !o reduce the disruption of clients# customers# employees# and services to an acceptable level Scope of t$e @ocument

:-9

!his plan sets out details of the recovery measures to be ta$en in the event of a ma5or disruption to the business

1-

Reco#ery >!6ecti#es

Business activity restoration priorities have been identified against the follo"ing categories# consider the various activities your business underta$es and "hich are the most time sensitive needing to be restored first# this "ill help you plan to recover your activities :+

PRI>RITD Ser#ices

@EFI'ITI>'
Time Critical to !e ser#ice restored needing it$in

Red

8%: $our
Important ser#ice needing

(m!er
Ereen Black

to !e restored

it$in

:%1; $ours
( ser#ice needing to !e restored it$in $ic$ can !e

orking days

( ser#ice

restored progressi#ely after

orking days

9- Plan (cti#ation Procedures

9-: Plan (cti#ation Process

&$at is 'ature of t$e @isruption. (nd $at impact is t$is $a#ing on t$e !usiness- C$eck t$e impact sections $ic$ apply

DES F9-9B &orkspace '>

IT Systems , "oice 'et orks, key @ata >nly

DES F9-;B

'>
Aey Staff >nly

DES F9-4B

'>
>t$er Aey Resources >nly (ssess Current Situation

Detailed 'ctions 're Provided in 4ection 9 of the Plan

DES F9-3B

DES
Return to 'ormal @isruption >#er Monitor Situation* is t$ere a need to implement Plan

In#oke Plan

'>

Start Log and inform Manager , > ner

9-9 &orkspace
>!6ecti#e :- Esta!lis$ t$e current situation at t$e affected site , orkspace (ctions , Considerations ? 2hat has happened( ? 2hen did it occur( ? 're the )mergency 4ervices informed * on+site( ? %s there access to the site( ? 're the %! systems and services still running( ? 2ho else has been informed( ? 1o" potentially serious is it( ? 're there any casualties( %f so# details( 1o" 3uic$ly the business "ill be able to re+enter the affected "or$space Prevailing "eather conditions 2hether the area is currently responding to an e0ternal incident %f the decision is to relocate $ey staff to the agreed alternative accommodation alert the site 8 @contact details in table belo"> %f the decision is made not to invo$e the plan# continue to monitor the situation until such time as normal access is granted to the disrupted location

1- @ecide $et$er t$e Business Continuity Management Plan s$ould !e in#oked. T$e decision ill !e !ased upon t$e information pro#ided consideration s$ould !e gi#en to+ 9- Communicate it$ staff

IF EVACUATION I NEEDED ! Fo""o# site e$acuation p"an ta%ing into account staff& customer an' $isitor safety( )eep staff informe' at Assemb"y *oints unti" a 'ecision +as been ma'e about #+et+er t+e bui"'ing is "i%e"y to become a$ai"ab"e again soon( If t+e bui"'ing #i"" not be a$ai"ab"e& re"ocate i'entifie' %ey staff to t+e agree' a"ternati$e #or%space an' consi'er sen'ing ot+er staff +ome an' te"" t+em to a#ait instructions( ,emin' t+em to c+ec% t+e in #it+ t+e manager at an agree' time( Out of -ours If t+e 'isruption occurs outsi'e office +ours& staff communication #i"" be co.or'inate' by t+e manager or t+eir 'esignate' staff member( Ta%e t+e Emergency /rab bag #it+ you(

Ser#ice , (cti#ity
(lternati#e (ccommodation Location+ Contact 'ame at Location+ Contact 'um!er+

Staff to !e Relocated

9-; IT Systems , "oice net orks , Aey data

>!6ecti#e :- Confirm t$e nature of t$e disruption (ctions , Considerations ? 2hat has happened( ? 2hen did it occur( ? 2hich systems and*or services are affected ? 1o" potentially serious is it( ? 2hat is the estimated duration of the problem( ? 2ho else has been informed @media officer# comms# sta$eholder>( 1o" long systems "ill be unavailable 2hether the systems affected are re3uired to support the !ime Critical * %mportant Business 'ctivities 2hether the 'rea is currently responding to e0ternal incident ? %nform staff that the Business Continuity Aanagement Plan is being invo$ed or put staff on standby or invo$e agreed manual systems to ensure that the service can continue to operate ? %f the decision is made not to invo$e the plan# continue to monitor the situation until such time as normal service is resumed 4ome )0amples of BCA solutions * strategies Instigate manua" #or% aroun' systems ,erouting of ca""s Accessing an' ma%ing a$ai"ab"e critica" 'ata to %ey staff #+ic+ +as been protecte'( 0or%ing from a secon'ary "ocation unaffecte' by t+e IT issue( If t+e main "an'"ine(s1 are "ost re$ert to mobi"e p+ones an' gi$e number to %ey staff an' sta%e+o"'ers( If IT systems are "ost instigate Disaster reco$ery p"an

1- @ecide $et$er t$e Business Continuity Management Plan s$ould !e in#okedT$e decision ill !e !ased upon t$e information pro#ided consideration s$ould !e gi#en to+

9- Enter Specific actions or considerations if t$e disruption is due to non a#aila!ility of IT systems , "oice net orks , key data

9-4 Aey Staff

>!6ecti#es (ctions , Considerations :- Confirm t$e nature of ? 2hat has happened( t$e disruption ? 2hen did it occur( 2ho and ho" many are affected( ? 2hich systems and*or services are affected ? 1o" potentially serious is it( ? 2hat is the estimated duration of the problem( ? 2ho else has been informed @Aedia :fficer# Comms# sta$eholders>( 1- @ecide $et$er t$e 1o" long staff "ill be unavailable Business Continuity 2hether the staff are re3uired to support the Management Plan Critical * %mportant Business 'ctivities s$ould !e in#oked 2hether the 'rea is currently responding to T$e decision ill !e e0ternal incident !ased upon t$e ? %nform staff that the business Continuity information pro#ided Aanagement Plan is being invo$ed or put staff on consideration s$ould !e standby or invo$e agreed manual systems to gi#en to+ ensure that the service can continue to operate ? %f the decision is made not to invo$e the plan# continue to monitor the situation until such time as normal service is resumed

9Enter Specific actions or considerations if t$e disruption is due to non a#aila!ility of Aey Staff

C+ange of 2ob functions for some staff (to support t+e critica" business acti$ities1 Emp"oy agency staff Offer o$ertime 3 Toi" uspen' "ess time critica" parts of t+e business Consi'er out sourcing some ser$ices if possib"e unti" you are rea'y to restore t+em(

9-3 >t$er Aey Resources

>!6ecti#es :- Confirm t$e nature of t$e disruption

(ctions , Considerations ? 2hat has happened( ? 2hen did it occur( ? 2hich systems and*or services are affected ? 1o" potentially serious is it( ? 2hat is the estimated duration of the problem( ? 2ho else has been informed( 1o" long resources "ill be unavailable 2hether the resources affected are re3uired to support the Critical * %mportant Business 'ctivities 2hether the 'rea is currently responding to e0ternal incident ? %nform staff that the business Continuity Aanagement Plan is being invo$ed or put staff on standby or invo$e agreed manual systems to ensure that the service can continue to operate ? %f the decision is made not to invo$e the plan# continue to monitor the situation until such time as normal service is resumed

1- @ecide $et$er t$e Business Continuity Management Plan s$ould !e in#okedT$e decision ill !e !ased upon t$e information pro#ided consideration s$ould !e gi#en to+

9- Enter Specific actions or considerations if t$e disruption is due to non a#aila!ility of key resources

Arrangements3contracts to +ire 3 borro# 3 purc+ase rep"acement resources from supp"iers ( *rotecti$e measures for resources e(g( not +a$ing a"" resources at one site3s+op3office(

;- Supporting Information ;-: Staff &elfare

%t must be recognised that a business interruption may also cause additional pressures for staff 4taff members need to be given clear direction about "hat the priorities of the business# "hich can be achieved by having "ell thought out and implemented continuity strategies in place Aanagers must ensure that they monitor staff more closely to ensure that their "elfare is maintained @e g regular brea$s due to increased intensity or pressure of "or$> 4taff should be a"are of "hat their role is "hen a ma5or disruption occurs Clear and concise communication "ith staff is pivotal to having an organised response 4taff must be made a"are of "hat communication methods are going to be used so they can find out the latest information# if they are going to be "or$ing from home or a different location than normal %f staff are to be "or$ing from a different location ensure that they $no" "here the location is @provide a map and or directions if necessary> and they are able to get there and get access

;-1

Communicating

it$ Staff

During :ffice 1ours %f the disruption occurs during office hours then staff can be communicated "ith via briefings from managers and electronically by the intranet and email :ut of office hours !he manager for the business or the designated staff member "ill $eep staff up to date by the follo"ing methods: !elephoning staff and passing on essential information Aobile phone !e0t cascade of information if appropriate )mail to staff that have access to e0ternal email as a appropriate Bace to face as appropriate

%nformation may be available via the follo"ing depending on the reason for disruptionC

Business name(

+ttp433business#ebsite +ttp433businessname

Or $ia t+e business T#itter account(

4taff should given the opportunity to feedbac$ any comments they may have after the response phase and the service has returned to normal !his may be in the form of a structured debrief or more informally Aanagers "ho suspect that staff members have suffered undue stress or even trauma from the business disruption must consider providing assistance for those staff "ho have been affected

;-9

Media , Pu!lic Information

%n the event of a ma5or disruption to the business the business Communications :fficer must be contacted to inform them of "hat has happened and the estimated length of the disruption and possible impacts of the disruption

4-

Plan Maintenance Procedures

!he author of the plan is responsible for revie"ing contact lists every - months and plan must be revie"ed annually Dltimately the plan o"ner is responsible for ensuring the plan is up to date and e0ercised and all audit re3uirements have been met

4-: Plan #alidation Fe=ercisesB , Training Sc$edule

'"areness training for staff to ma$e sure they all $no" "hat to do and "ho "ill be involved Be sensitive ho" you communicate your plan 8 phrasing Eessential staff6 or Evital services6 suggests that some of your staff aren6t as important as others

(ppendi= (

ST(FF Contact 'ames < 'um!ers

To !e updated 3 mont$ly and stored securelyA list of staff contact details (Out of hours) is to be completed and maintained by (the responsible person named in this plan)

(Ser#ice 'ameB Contact Details !emplate 'ame

Staff name 1

Co! Title
Manager

>ffice Contact
029200000

Mo!ile Contact
077777777

?ome Contact
02920000000

(ppendi= B

S)PPLIER Contact 'ames < 'um!ers < ot$er key contact detailsContractors* suppliers < useful num!ers Contact @etails A "ist of contact 'etai"s (Out of +ours1 is to be comp"ete' an' maintaine' by (t+e responsib"e person name' in t+is p"an1

>rganisation upp"ier

Contact 'ame

Co! Title

>ffice ?ours Contact

Mo!ile Contact

Ser#ices or acti#ities+ Staff+

(greed (ccommodation

Location+ Contact 'ame Contact 'um!er

Systems FIT < ISB+ ?ard @ata+ >t$er Resources+

(ppendi= C
Resource ReGuirements for resumption deli#ery of RE@ and (MBER ser#ices , acti#ities-