Sample Business Continuity Plan 1. Company and business unit overview, location, and organizational information 2. Business Continuity Program history and objectives 3. Business Continuity Plan overview (see example below)
The plans are divided into stages, with information to support each stage identified in separate appendices. The stages include:
Stage 1 Stage 2 Stage 3 Stage 4 Stage 5 Stage 6
Immediate Response Steps Disaster Declaration Activities Functional Restoration “Day 2” Requirements Return to Normal Plan Distribution, Testing, and Maintenance
4. Risk analysis (see example on proceeding page)
Risk Analysis at this location is identified as:
Risk Type Event Probability of Occurrence
1=low 3=medium 5=high Natural Tornado Hurricane Earthquake Flooding Snow/Ice Temperature Extremes Labor Strike Supplier Failure Vandalism/ Theft Terrorism Inadequate Training Bomb Threat Arson Civil Disorder Hardware Failure Software or Application Failures Electrical Outage Telecom Outage Water or Plumbing Outage HVAC HAZMAT Toxic Contamination
Human
Technological
5. Controls in place to help mitigate risks. (for example, safety plans, public address systems, evacuation drills, backup generators, weather alert systems, onsite security, building blueprints stored offsite, relationship with city/county emergency management/police/fire departments, etc.)
Stage 1 - IMMEDIATE RESPONSE STEPS
____________________________________________________________________________________________________________
Immediate Response Steps include protection of life and property, determination of disaster declaration, and notification of key individuals.
See Appendix A for:
Initial Response to Incident (local safety plans, meeting place) Business Recovery Team Member Information Disaster Declaration Criteria Damage Assessment Command Center Location Corporate Communications Policy
Stage 2 – DISASTER DECLARATION ACTIVITIES
______________________________________________________________________
Disaster Declaration Activities includes employee notification and relocation to an alternate site with appropriate workspace.
See Appendix B for:
Emergency Notification Procedures (Calling trees) Alternate Site Information (include maps) Notification of Critical Employees Employee Contact Information Transportation & Relocation Plans Alternate Site Requirements (workspace, hardware, software) Notification of Critical Internal Contacts
Stage 3 - FUNCTIONAL RESTORATION
______________________________________________________________________
Functional Restoration is the point where all resources that support critical business operations are restored.
See Appendix C for:
Identification of Critical Business Processes Interim Operating Procedures Non-Critical Employee Notification Notification of External Vendors, Suppliers, and Customers
Stage 4 - “DAY 2” REQUIREMENTS
______________________________________________________________________
“Day 2” Requirements include the addition of processes to enable business units to resume some portion of their normal business operations.
See Appendix D for:
Identify “Day 2” Business Processes Identify “Day 2” Requirements
Stage 5 - RETURN TO NORMAL ____________________________________________________________ Return to Normal is the point where the damaged site has been repaired or a new location prepared and the business unit returned to their permanent location.
See Appendix E for: Determine Facilities Support for Repair / Rebuild / Relocation Identification of Procedures & Tasks Notification of Employees Notification of Internal Contacts Notification of External Vendors, Suppliers, and Customers
Stage 6 - PLAN DISTRIBUTION, TESTING & MAINTENANCE
_______________________________________________________________________________
Plan Distribution, Testing & Maintenance includes a plan distribution listing, information on plan testing and maintenance.
See Appendix F for:
Business Continuity Plan Distribution Business Continuity Plan Version Control Business Continuity Plan Testing Business Continuity Plan Maintenance Schedule
Internet Sites for Business Continuity References: (Including conferences and free subscriptions to newsletters/magazines)
www.continuitycentral.com www.drj.com www.contingencyplanning.com www.thebci.org www.survive.com www.continuityinsights.com www.continuityplanner.com www.disaster-resource.com
Networking Organizations: www.acp-international.com www.drj.com/groups lists various state/local organizations
Business Continuity Certification: www.drii.com US-based www.thebci.com UK-based BCI requires no recertification as long as the certified professional continues to work in business continuity. DRII requires a re-certification every two years, based on the accumulation of DRII-approved continuing education credits. The BCI has five applicable membership grades:
Student Affiliate of the Business Continuity Institute ABCI Associate of the Business Continuity Institute MBCI Member of the Business Continuity Institute FBCI Fellow of the Business Continuity Institute
DRII International has three membership grades:
ABCP Associate Business Continuity Planner CBCP Certified Business Continuity Planner MBCP Master Business Continuity Planner