Docstoc

Departmental Business Continuity Plan Template

Document Sample
Departmental Business Continuity Plan Template Powered By Docstoc
					Departmental
  Business
 Continuity
  Planning




    Page 1 of 18
       Business Continuity Planning Components


 Getting Started                                         Section 1
 1. Assign departmental business continuity responsibilities.
 2. Department mission and business functions/processes.
 3. Identification and evaluation of scenarios, risks, events and
    threats.


 Developing the Plan                                     Section 2
 4. Document recovery plans to recover critical functions for each
    scenario.
 5. Determine details to complete tasks.
 6. List contact information.
 7. List necessary resources and reference materials.


 Maintaining the Plan                                    Section 3
 8. Train personnel on the plan.
 9. Test (validate) the plan.
10. Maintain the plan.




                                Page 2 of 18
Getting Started

   Section 1




     Page 3 of 18
1. Assign departmental business continuity responsibilities.
Departmental Business Continuity Coordinator

{Include Business Continuity Coordinator responsibilities here.}
The purpose for selecting a Business Continuity Coordinator is to designate a single person with appropriate backup to serve in a coordination
capacity for the department. Responsibilities of the Business Continuity Coordinator can include liaison with emergency operations center,
coordinate department efforts during plan development and recovery, and have delegated authority to execute recovery procedures.

                                    Name              Telephone Number         Alternate Number               Other                   E-mail
Business Continuity
Coordinator
1st Alternate

2nd Alternate


Departmental Business Continuity Committee

{Include Departmental Continuity Committee responsibilities here.}
The purpose for assembling a Committee should be to ensure that various interests (faculty, staff, IT, research, and budget) within the department
are represented within the continuity planning process with focus on ensuring that developed plans promote a successful recovery effort.

                             Name                                           Title or Areas represented




                                                                    Page 4 of 18
2. Department mission and business functions/processes.
Departmental Mission

Our department mission is the following




Department Critical Functions/Processes
We have identified and prioritized the following as critical functions or processes.

           Departmental Business       Maximum allowable                 Impact 3           Dependencies (internal        Will other business
             Function/Process1              outage2                                            and external)4            processes cease with
                                                                                                                          out your business
                                                                                                                         processes operating?
                                                                                                                               If so, list.
                                                                                            Internal
                                                                                            Vital records, IT,
                                                                                            personnel with
                                                                                            specialized skills, etc.

                                                                                            External
                                                                                            Vendors, IT, etc.


1
    Critical Function/Process – Core services to the department’s mission or have been designated as an essential service for the University.
2
    Maximum Allowable Outage – The amount of time caused by disruption in operation before significant impact is incurred.
3
    Impact – Include a brief description of the impact of discontinued operations past the maximum allowable outage. Impact should take into
            consideration in both non-monetary and monetary outcomes. Impacts can be measured with respect to faculty, student and staff safety or



                                                                       Page 5 of 18
            morale, institutional reputation, compliance, loss of critical services, property loss, fines, cash flow, legal, etc. Impacts should also take
            into account timing of events.
4
    Dependencies – Internal or external resources or inputs necessary for a departmental business function/process to operate


Other Departmental Functions/Processes
The department also has the following functions/processes. While important, the delay of these services would not cause significant impact with
respect to the department in achieving its mission.

                              Functions/Processes                   Allowable outage                            Impact




                                                                         Page 6 of 18
3. Identification and evaluation of scenarios, risks, events and threats.
The following scenarios were evaluated for impact on critical functions/processes. Consideration was given to the sufficiency of existing mitigating
activities/strategies. Additional activities/strategies were identified and reviewed based on cost/benefit and likely hood of event.

   Scenario, risk or           Description           Impact on Mission             Mitigating               Additional          General Strategy      Does
         threat             (Specific details of          Critical            Activities/Strategies    Activities/ Strategies     Options for       scenario
     (Likely events,             event.)            Functions/Processes       (Impact on resources      To Be Considered           Recovery         warrant
    both internal and                               (Impact on resources     necessary for a process                                                business
  external, that could                             necessary for a process        to function.)                                                    continuity
   disrupt operations                                   to function.)                                                                                plan?
  of our department.)                                                                                                                               (Yes/No)
  Fire leading to a        Isolated building       Examples include:            Back up tapes            Vital records       Relocate IT
  loss of building and     loss. Utilities and      Information                 stores offsite            stored               services to
  contents                 University supported       technology                                           electronically/off   Department
                           network services are      o Data loss                                           -site                ___.
                           intact at other           o Servers not                                        Implement a         Exercise
                           campus locations.             recoverable                                       process to           emergency
                                                    20% reduction in                                      perform a backup     rental
                                                      service (due to                                      restoration          agreement for
                                                      multiple service                                                          server and
                                                      locations)                                                                workstation
                                                    Halt of all                                                                recovery to
                                                      operations (all                                                           restore
                                                      services provided                                                         departmental
                                                      within same area)                                                         operating
                                                                                                                                capacity to
                                                                                                                                20%.
  Other examples                                                                Back up                  Maintain
  may include                                                                    generators                documentation of
  flooding, and                                                                 Manual work               backup generator
  storms that lead to                                                            around procedures         testing centrally
  the loss of utilities,
  loss of network,
  etc.




                                                                             Page 7 of 18
Developing the Plan

     Section 2




       Page 8 of 18
                Business Continuity
                       Plan
                                       Business Unit




                                       Scope and Objective

Describe the scope of the plan. Describe the scenario and the functions to be included within the plan.




Business Continuity Coordinator:
BCC Contact information:                Telephone –
                                        Cell Phone –
                                        e-mail –
Date plan updated:
Plan Updated by:
Filename:



                                            Page 9 of 18
                                   Recovery Summary
4. Document recovery plans to recover critical functions for each
   scenario.
General Recovery Strategy
This is a high level statement of the solutions determined to recover a department’s business function to a
predetermined operating capacity.

      Relocate to identified alternate facility and restore operations to 20% capacity within 2 days.


Recovery Tasks
The following tasks will need to be performed to accomplish our strategy:

Provide a simple list of tasks such as:
    Notification
    Contact backup site
    Contact printer for emergency supply of preprinted forms
    Arrange for delivery of laptops

            Recovery                      Day     Days Days         Day
             Tasks                         1       2-3  4-7          8      Criticality      Responsible Person
                                                                                             Business Continuity
           Notification                    X                                      1
                                                                                                Coordinator



Detail for each Recovery task is included in a Detailed Process Task located at _______.

Assumptions
List assumptions made regarding scenario and the related planning. Examples include:
 Workspace and required resources are available.
 All team members or personnel with equivalent skills are available.
 Backup of critical computer systems

      Assumption 1
      Assumption 2
      Assumption 3




                                                 Page 10 of 18
                              Detailed Process Task
5. Determine details to complete tasks.
For each task listed within the Recovery Summary, list the details and applicable information necessary
to carry out that task. Each task should be provided on a separate page.

Task Name
The name should be the same name listed within the Recovery Summary.

Team Lead
Insert name of team lead.

Task Summary
Provide a brief description of major steps involved within the task and the desired results
when the task is completed.

Skills
Required Skill Set             Description
Provide general knowledge      Include detailed knowledge and access requirements.
requirements for completion
of the task in the event
backup personnel are
required.

Dependencies
           Internal Dependencies                                  External Dependencies



Recovery Tasks
The following steps will need to be performed to accomplish our task:
                   Recovery                        Day Days Days Day                   Team Member
                     Steps                           1    2-3     4-7 8                 Responsible



Resource Matrix (Optional)
Include summary of resources that may be needed depending on the level of recovery.
 Workload     People      Workspace Computer(s) Printer(s) Phone(s)                 Other
20%
40%
60%
80%
100%




                                            Page 11 of 18
                                Contact Information
6. List contact information.
Employees
 Team Leaders
  Contacted                 Recovery                                    Home    Office
    Y/N            Name       Role     Cellular     Pager    e-mail     Phone   Phone      Address   Skills   Notes




XXXXXXX calls Alternate Team Leaders
  Contacted                 Recovery                                    Home    Office
    Y/N            Name       Role     Cellular     Pager    e-mail     Phone   Phone      Address   Skills   Notes




XXXXXXX calls Team Members
  Contacted                 Recovery                                    Home    Office
    Y/N            Name       Role     Cellular     Pager    e-mail     Phone   Phone      Address   Skills   Notes




XXXXXXX calls Staff
  Contacted                 Recovery                                    Home    Office
    Y/N            Name       Role     Cellular     Pager    e-mail     Phone   Phone      Address   Skills   Notes




University Services
                                                                                            Comments
              Representative/                               Alternate                    (account number,
Service          Contact         Address          Phone     Phone’s        e-mail              etc)




Vendors
                                                                                            Comments
Vendor        Representative/                               Alternate                    (account number,
 Name            Contact         Address          Phone     Phone’s        e-mail              etc)


                                             Page 12 of 18
Customers
Vendor   Representative/   Address    Phone      Alternate   e-mail      Comments
 Name       Contact                              Phone’s              (account number,
                                                                            etc)




                                     Page 13 of 18
                                               Resource Appendices
7. List necessary resources and reference materials.
Facility Requirements
   Infrastructure requirements                            Number-descriptions
Phone lines
Network connections
Seat/workstations                  Provide square footage required for each seat or workstation
Fax
Electrical requirements            Number of outlets, special voltage requirements



Alternate locations
    Address/ Building Name        Phone Number           Alternate Phone             Contact Person
                                                             Number




Equipment Requirements
List workstations, phones, phones, copiers, and requirements for set up.
   Qty                           Description                             Comment (vendor name,        Day needed
                                                                            purpose, etc.)
2         Printer
2         USB/Printer cords


Software/System Application Requirements
          Qty                    Description                  Version                     Comment          Day needed




                                                             Page 14 of 18
Supplies-
  Qty                            Description                                     Comment                         Day needed




Forms
Form Description      Revision    Minimum       Current    Storage      Contact       Printer                   Day needed
  #                    Date        Needed      Inventory   location   information   information
                                  Comment




Offsite Storage Materials
  Qty              Description (box number, location, etc)                       Comment                         Day needed




Vital Records
     Description         Storage Site     Media        Record Type       Storage Frequency           Comment
                                           (disc,       (original,       (D, W, M, Q, S, Y)
                                        fiche, etc)     duplicate)




Procedures
Insert or attach existing procedures for daily procedures and procedures or checklist for process that will be unique to the recovery
process.




                                                             Page 15 of 18
Maintaining the Plan

     Section 3




       Page 16 of 18
8. Train personnel on the plan.
Include information about how the components of this plan will be communicated to the staff (meetings, access
to electronic copy on department network, etc.). Include timeframes needed to train staff.




9. Test (validate) the plan.
Departmental Business Continuity Test Log

               Type of        Portion of plan
   Date                                                                   Comments
               exercise           tested




                                                Page 17 of 18
10. Maintain the plan.


                                      Annual Certification

The (Department Name) business continuity plan has been reviewed and tested. The procedures
provided in this plan meet the department’s expectations for business continuity under the assumptions
which have outlined in this plan.


___________________________                     ________________________
Department Head                                           Date



___________________________                     ________________________
Business Continuity Coordinator                           Date




                                             Page 18 of 18

				
DOCUMENT INFO