Business continuity plan template: 5 things to look for
What every business continuity plan template should include
A business continuity plan template should be straightforward to use - not a colossal, clumsy word document but something that helps you to structure your work and which guides and supports you through the process
A well-structured business continuity plan template will help you to break down the process of business continuity plan development into bite size chunks and ideally should provide you with the right tools to effectively and efficiently complete each stage of business continuity plan development
1. Understand your organisation’s priorities
-
Identify
Consider the important operational functions, or priorities, of your organisation and then identify what the effects would be if these were affected by, for example, a loss of IT systems, loss of workplace, or loss of staff availability. Then consider how quickly the systems need to be recovered from the interruption.
To do this the business continuity plan developersneed to answer some straightforward questions: “What is it we get paid for?”. For non-profit organisations this could be, “How do we support our beneficiaries?” For public sector bodies it is “how do we make sure we maintain services to the public?”.
The key here is to understand what goes on in the organisation that generates revenue or creates satisfied customers. It is important to concentrate on products, services and customer “touch points”, and then look to mitigate any risks of these being compromised.
-
Analyse
Now that the operational priorities are established it is time to understand what the consequences would be to the company if they were disrupted. These could be, for example:
-
Loss of revenue.
-
The loss of customer goodwill – how long will your customers tolerate unavailability?
-
Contractual commitments – Are there contractual SLAs in place and are there any associated penalties?
-
Legal and Regulatory – would a disruption to service or delivery expose you to litigation or regulatory action?
Once this is accomplished then you have achieved the first milestone of setting the scope and objectives of a BCP. It is then time to engage with other areas of the business and assess their business continuity capabilities.
Undertaking this exercise ensures that the detailed planning activities are aligned with the overall operational priorities of the business. It is important that this information is available in a format that can be easily shared within the organisation during future stages of the BCP development, for example, a well-designed spreadsheet will probably suffice. The following diagram provides an example of a completed priority and tolerance assessment (the first stage of any BIA)
2. Confirming Current Capabilities & Core Resources
During the first step of Business Continuity Plan development, the organisation’s priorities and thresholds for disruption were established – based on considerations such as customer goodwill, revenue and contractual commitments. The next stage of development ensures that there is a foundation of intrinsic capabilities to meet those priorities, and mitigate the exposures related to a failure to meet them.
3. Response & Recovery Plans
Response and Recovery Plans Template relate to the priority functions identified earlier, and specific actions to be taken to recover priority activities.
Evidence, and more importantly experience, clearly demonstrate that most employees cannot easily use an unfamiliar and complicated plan at time of disaster and use it for an effective and efficient response. This part of the business continuity plan template needs to provide a structure to create an easy guide to developing actionable plans
The structure of a recovery plan template should contain just a few pages, be designed for ease of use in a tabular rather than narrative format and should accommodate the following information:
-
Leadership team members, their roles and contact details.
-
Specify the communications facilities available to the team, and how to access and utilise them.
-
Details of key contacts. which may be internal or external to the company.
-
Specific consideration of actions taken under different incident scenarios
- Loss of workplace.
- IT systems failure.
- Loss of staff mobility and /or mobility.
4. Communications Framework
The communications framework, best developed in tabular format, defines how the whole organisation will communicate during the response and recovery stages of an incident. Communications are often the “make or break” part of incident management and recovery, being the “glue” that holds internal activities together and how the organisation’s handling of an incident is perceived and judged by external parties such as mainstream media, social media and regulators. The Communications Framework defines how the organisation will communicate with interested and involved parties, what channels will be used for communications and who will operate or “own” those channels.
5. Business Continuity Management Framework
This part of a business continuity plan template defines a management structure and responsibilities for ensuring the ongoing relevance and integrity of an organisations business continuity arrangements and for performing the scheduled assurance activities. These activities will include:
-
Periodically re-confirming the understanding of business priorities and tolerances.
-
Ensuring capabilities and available resources remain in line with recovery needs. This may include IT Failover tests to ensure that IT systems can be recovered within the required timeframes and to gain assurance that these capabilities are still working correctly and remote working “stress” tests to ensure that the remote access capabilities can support a large number of users.
-
Confirming that functional and departmental plans remain relevant and fit for purpose