BUSINESS CONTINUITY PLAN TEMPLATE Front Cover Ensure the date of issue, version number, author and owner of the plan are clearly indicated. Contact List Include the primary staff members involved with Business Continuity Management and the Business Continuity Plan plus contact details of their deputies, in the event of their absence. Contents Section 1 – Overview Include an introduction, the aim and scope of the plan, background information and methodology. To include a response checklist (please see the Response Checklist available in ‘what to do during an incident’).and information on plan invocation (i.e. how and when it will be invoked) and incident management procedures. Staff involved in the response to an incident should also be listed together with their contact numbers. A list of essential products / services undertaken by your organisation should be provided. Ideally these products / services should be prioritised to indicate which products / services need to be: maintained regardless of an incident resumed first after an incident. An explanation of the criteria used to determine whether an activity is essential should be included. In addition the methodology used to prioritise the essential products / services should also be included. Data from your business impact analysis (BIAs) should be included here including the Recovery Time Objectives and Maximum Tolerable Outage Time for each of your listed essential products / services. Section 4 – Resources required Identify key people (including specialist staff), files, IT systems, premises, other equipment etc required to ensure your essential products / services can be delivered. This should also include a list or flowchart of suppliers used on which you are dependent to deliver your essential product / services. This should also include the location and contents of battleboxes (a Battlebox should contain essential equipment and information necessary to support response and recovery following an incident). Section 5 – Key People Include contacts within each appropriate section / department of your business and ensure specialist team representatives are also included. Contacts for both office
Section 2 - What to do in an incident
Section 3 – Essential Products / Services
hours and out of office hours should be noted. Include key external contacts (e.g. customers, suppliers etc) Section 6 - Cross-organisation key functions Ensure you have identified any cross-organisational functions. These may include: HR Legal Statutory / regulatory H&S Communications – media, suppliers, customers, staff, Emergency Services etc. Insurance IT provision Catering and cleaning Utilities Identify the key contacts for each, the contingency arrangements they have in place to ensure the service is not disrupted and any single points of failure which may prove problematic during an incident, e.g. an IT system which is required to deliver one of your essential products / services, for which you have no IT support should it fail. Section 7 - Plan Management, Monitoring and Review Identify how often this will be done and who is responsible for it and any management information system for business continuity. Identify who will receive copies of the plan, whether they will be electronic or paper copies, and confirm storage requirements (i.e. if sensitive information is contained within your plan such as personal contact details for key staff, copies of the plan should be stored securely and the storage location identified). For example, a Decisions Log, Initial Assessment Checklists etc.
Section 8 - Plan Distribution
Section 9 - Useful Logs and Checklists