Attachment 1: BCP Development Checklist DRAFT
Business Continuity Plan Development Checklist Organisation Address: User Note: This template is generic and does not therefore use terminology that is restricted to business continuity planning for financial management purposes.Attachment 1: BCP Development Checklist DRAFT BCP Development Guidance Page 2 1 BCP Development Checklist Public Sector Agencies should select tasks according to their size, complexity and likely business continuity requirements. Task Task Requirement Responsibility Sign-Off 1 BCP Scope Definition & Awareness Definition of objectives and scope is important to the success of the BCP activities. Timelines, assumptions, resource allocation and milestones are to be set at this phase. 1.1 Identify key stakeholders and co-ordinate attendance at a BCP briefing session. Ensure the staff involved in documenting the BCP have the appropriate: • skills • knowledge of the organisation and functional areas. Note: A formal briefing session may not be necessary for very small agencies. 1.2 Assign responsibilities for plan ownership and administration, including plan testing and maintenance activities 1.3 Assign responsibilities for collaborative plan development with process/activity owners 1.4 Develop and document project objectives 1.5 Develop draft BCP assumptions (may need to revisit as plan develops) 1.6 Define in-scope and out-of-scope activities 1.7 Obtain current copy of the organisation chart Attachment 1: BCP Development Checklist DRAFT BCP Development Guidance Page 3 Task Task Requirement Responsibility Sign-Off 1.8 Review existing BCP documentation (where available) and assess the relevance/opportunity for integration with existing arrangements, responsibilities and recovery strategies 1.9 Define timelines and milestones and assign adequate resources for the BCP activities 2 Business Impact Analysis (BIA) During this phase, critical business processes and activities will be identified, an analysis will be carried out to evaluate impact and probabilities of failures and critical business processes will be prioritised. 1 2.1 Identify key business processes and activities 2.2 For each business process and activity, identify dependencies, such as Information Technology (IT), resources, other activities, locations, other 2.3 For each business process and activity, identify critical time periods, i.e. daily, end of week, month-end, quarter-end, year-end, other 2.4 For each business process and activity, identify potential failure events or disaster scenarios, i.e. describe how the activity is able to fail 2.5 For each business process and activity, rate the impact of not having the business process and activity available 2.6 For each business process and activity, identify controls to prevent an event from occurring 2.7 For each business process and activity, identify the remaining impact and maximum tolerable outage2 to be addressed 1 The BIA may be undertaken using the BIA Development Checklist & Template (Attachments 5 and 6). It is more likely that this tool will be useful for larger agencies. 2 Maximum Tolerable Outage -the maximum period of time that critical business processes can operate before the loss of critical resources affects their operations Attachment 1: BCP Development Checklist DRAFT BCP Development Guidance Page 4 Task Task Requirement Responsibility Sign-Off 3 Strategy Selection and Evaluation Based on the results of the Business Impact Analysis, appropriate strategies will be selected for continuity planning. The strategies provide clear options to deal with impacts of business interruption efficiently. 3.1 Identify recovery strategies, including approach, escalation plan process and decision points 3.2 Ensure the recovery strategies are cost effective and meet agreed maximum acceptable outage requirements 3.3 Implement proposed response strategies and solutions 4 Plan Documentation This phase results in the documentation of continuity plans. 4.1 Document the BCP3. 5 Implementation and Testing This phase will implement process to ensure that the people in the organisation are familiar with their individual roles and responsibilities. Testing will validate the usability of contingency and recovery plans and help to identify changes that need to be made to keep these plans current. 5.1 Determine testing approach to be followed (approaches documented within BCP) 5.2 Hold testing briefing with all participants 5.3 Test developed plans following to adopted approach 5.4 Undertake a testing debrief4. This process will identify gaps /additional needs in the current plans 3 The BCP Template (Attachment 2) may be used to do this 4 The Business Continuity Plan Test Report may be used to document this (within the BCP Template – Attachment 2) Attachment 1: BCP Development Checklist DRAFT BCP Development Guidance Page 5 Task Task Requirement Responsibility Sign-Off 5.5 Incorporate necessary changes into BCP 5.6 Publish and distribute final copies of BCP to Responsible Parties 6 Maintenance and Update BCP’s must be updated on a regular basis to ensure that the contingency and recovery measures remain current and accurate. 6.1 During the updates, at a minimum, the following details must be checked: • business processes • criticality of assessed processes and elements • third-party interfaces • organisation structure • responsible persons assigned to carry out tasks • deadlines • appendices, including contact lists Attachment 1: BCP Development Checklist DRAFT BCP Development Guidance Page 6 2 Glossary of Terms Term or Acronym Meaning BCP Business Continuity Plan A BCP is a document that describes the methods and procedures required to recover business operations from particular disaster scenario’s or events. BIA Business Impact Analysis A management level analysis, which identifies the impacts of losing Public Sector Agency resources. The BIA measures the effect of resource loss and provides senior management with reliable data upon which to base decisions on risk mitigation and continuity planning. Business Process and Activities Key business processes and activities are those processes and activities essential to delivery of outputs and achievement of business objectives. DRP Disaster Recovery Plan The DRP focuses on recovery of IT systems infrastructure to support the recovery of the business. The DRP is referred to by the BCP in order to completely recover the site business. These are separate recovery procedures defined by the IT team for the technical recovery of IT systems or components to support the business operations. MTO Maximum Tolerable Outage The maximum period of time that critical business processes can operate before the loss of critical resources affects their operations. Recovery Strategy A pre-defined, pre-tested, management approved course of action to be employed in response to a business disruption, interruption or disaster.