Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide


  1. 1. STRATEGY DOCUMENT Nottinghamshire County Council Business Continuity Management Prepared by Nottinghamshire County Council Emergency Planning Team
  2. 2. Nottinghamshire County Council Business Continuity Management CONTENTS SECTION CONTENT SECTION 1 Foreword SECTION 2 Purpose of the Strategy Document SECTION 3 Aims and Objectives SECTION 4 Context SECTION 5 Environment and Culture SECTION 6 Management Structure SECTION 7 Implementation of Business Continuity Management SECTION 8 Roles and Responsibilities Appendix A Implementation Plan 2007 – 2008 Appendix B Reference Material May 2007 Page 2 Strategy Document
  3. 3. Nottinghamshire County Council Business Continuity Management Foreword 1.1. The Civil Contingencies Act 2004 places a duty on the local authority to ensure that it has prepared, as far as is reasonably practicable, to continue to provide critical functions during any disruptive challenge. 1.2. Business Continuity Management is a process to deal with the effects of interruptions to service delivery. This document outlines the strategy being adopted within Nottinghamshire County Council to implement Business Continuity Management. 1.3. The Council has strategies and plans in place to ensure the delivery of services to the public. There are statutory duties placed upon the Council as well as permissive powers that the Council chooses to exercise. The public also has an expectation of what they believe the Council will provide. 1.4. There is an assumption that an environment will always exist in which services can be delivered. It is however difficult to identify and manage the interdependencies that can expose services to interruptions. Therefore it is necessary to ensure that all service functions have a forum in which these issues can be identified. 1.5. When considering incidents that may cause an interruption to the delivery of service it becomes apparent that the effects are broadly similar. These are loss of personnel, buildings, resources or infrastructure. Therefore the need to identify every possible scenario is removed. 1.6. It is necessary to consider the identifiable risks to the Council in order to mitigate against them. In doing this it is important to retain a credible view of the risks and by adopting this approach the authority should be equipped to deal with the less likely and difficult to predict events of a more serious nature. 1.7. This strategy outlined in this document will provide improved resilience in Nottinghamshire County Council and will also provide an effective and efficient response to any interruption in the service it delivers. 2. Purpose of the Strategy Document May 2007 Page 3 Strategy Document
  4. 4. Nottinghamshire County Council Business Continuity Management 2.1. The purpose of this document is to outline the framework of Business Continuity Management within Nottinghamshire County Council. The strategy will provide: 2.1.1 The management structure 2.1.2 The implementation of Business Continuity Management in terms of Resources Organisational competence The process of delivering the strategy 3. Aims and Objectives 3.1 The aim of Business Continuity Management is to: Ensure that the organisation is resilient to business or service interruptions by providing a Business Continuity Management process. 3.2 The objectives to achieve this aim are to: 3.2.1 Develop an organisational framework in which Business Continuity Management will operate. 3.2.2 Develop the culture to support Business Continuity Management. 3.2.3 Develop training and education of Business Continuity Management. 3.2.4 Provide support for Departmental Business Continuity Management. 3.2.5 Identify and manage Business Continuity vulnerabilities. 3.2.6 Develop organisational skills to respond to business or service interruptions. 3.2.7 Create understanding of how business interruptions can impact upon the Authority in areas at the point of delivery but also those not at the point of delivery. 4 Context May 2007 Page 4 Strategy Document
  5. 5. Nottinghamshire County Council Business Continuity Management 4.1 Any Business Continuity incident may be impacted by events outside of the County Council. This leads to three possible contexts in which a Business Continuity incident may be managed. 4.1.1 Incident arising solely within and contained within the Authority. – Response therefore solely Nottinghamshire County Council business continuity. 4.1.2 Civil emergency requiring a response from Emergency Planning that requires Nottinghamshire County Council to divert resources and thereby impacting on the ability of the Council to continue providing services. – Response therefore one where Business Continuity enables the Council to continue its normal functions while facilitating the civil response of Emergency Planning. 4.1.3 A civil emergency where the Council is directly affected requiring it to provide its own response. – Response therefore being both of the above plus a need to provide its own response, recovery and rehabilitation. 5 Environment and Culture 5.1 The success of Business Continuity Management is largely determined by the environment in which it operates and the culture of the organisation. The environment can be judged by where in the organisation places the Business Continuity function. As a strategic tool it requires that it needs to have input from a senior level. 5.2 With Business Continuity Management placed in the correct environment then the issue of culture needs to be addressed and understood. For Business Continuity Management culture is important as it will have an impact on the organisational culture and also be affected by existing County Council cultures. 5.3 For any organisation dealing with a Business Continuity incident there are common issues. The dynamics in which working relationships operate are likely to change. This is normally due to the problems being dealt with will be outside the normal work experience of those responding. Different skills and resources may be required and it may not be evident from whom or where they can be obtained. While people are addressing these issues they will also be under pressure to make decisions in an environment where time is short and information on which to base decisions is limited, not available or unreliable. 5.4 These pressures can lead to a change of management style and leadership that may itself lead to an impairment of the response. This can arise where the normal span of control for an individual is too wide for an incident. The narrowing of the span of control can lead to people becoming less aware of the overall picture. This can in turn lead to a more command focused style of May 2007 Page 5 Strategy Document
  6. 6. Nottinghamshire County Council Business Continuity Management management. At this point there is a danger that the style of management clashes with the existing management culture. 5.5 The core to ensuring the resilience of the Council to business continuity incidents is to ensure that those people likely to be involved in a business continuity incident can work as a team and have the specific skills that are required by the nature of a Business Continuity response. Therefore Business Continuity Management becomes essential. 6 Management Structure 6.1 Appropriate management is essential to ensure the complexities of Business Continuity Management for an organisation which has varied areas of services. In some cases departments deliver direct to the public whilst with others they provide support to these departments in order that they can function effectively. A visual representation of the management structure for Business Continuity Management is provided in Figure 1.1. Management is represented at strategic, tactical and operational level which reflects the recent business restructure. 6.2 The need for Business Continuity Management is firstly acceptable to the Strategic Management Board which allows the culture to filter throughout the organisation from the top most level. 6.3 Business Continuity Management will however will be managed and monitored by the Risk and Emergency Management Group on behalf of the Strategic Management Board who also oversees the County Council’s preparedness for managing emergencies along with their partners. 6.4 Day to day management will be accomplished through the Business Continuity Forum, which works as a sub-group of the Risk and Emergency Management Group. 6.5 As Business Continuity planning should be provided at the point of service delivery each Department and Division Business Continuity Group will carry out the work required to achieve the strategy. 6.6 The role of the Emergency Planning Manager on Business Continuity Management is to act as a project manager, facilitator and consultant on Business Continuity Management issues. 6.7 Also, each department will have the support of an Emergency Planning Officer to advise on methods and consistency throughout. Strategic Management Board May 2007 Page 6 Strategy Document
  7. 7. Nottinghamshire County Council Business Continuity Management Risk & Emergency Management Group Chair - Asst Dir (Community Protection) - Communities Department. Head of Emergency Management - Communities Department Communications Manager Management structure Fig 1.1 - Chief Executive Dept. Assistant Director (Resources) - Adult Social Care & Health Deputy Director - Environment Department Head of Development - Children & Young People County Treasurer - Resources STRATEGIC Risk Manager - Resources Ad hoc members for Business Continuity issues Richard ……. – Property Steve ……. - IT Jack ……. – Human Resources John ……. - Emergency Planning County Business Continuity Forum Chair – Richard …….. Director Corporate Property Julie …… – Communities Tony ……… – IT Sue …… – Communities Steve …….. – IT Jayne …. – Adult Social Care Bev ………. – Human Resources TACTICAL John …… – Children & Young Keith ……. – Property People Julie …… – Chief Executives David … – Resources John ……. – Communities Richard … – Resources Robin … – Chief Executives Alan ……. – Property Children & Resources Adult Social Young People Care & Health BCM Group OPERATIONAL BCM Group BCM Group Chief Exec Communities BCM Group BCM Group 7. Implementation of Business Continuity Management May 2007 Page 7 Strategy Document Contents
  8. 8. Nottinghamshire County Council Business Continuity Management 7.1 The implementation of Business Continuity Management will require cultural and organisational change in order to embed it within the Authority. 7.2 Business Planning must consider Business Continuity and the business planning process must include Business Continuity Management. The performance evaluation of relevant personnel must also be considered therefore it is necessary that Business Continuity Management is also incorporated into job descriptions. 7.3 The result will be that Business Continuity Management will be given the framework in which resources can be identified, training provided and organisational competence achieved. 7.4 The resources required are those normally associated with any project; personnel, staff time and budget. These should be identified and indicated in the project plan. 7.5 During the Business Continuity Management process information will be gathered which will require effective management using IT. 7.6 All information will be published on the authorities intranet pages in “Quickplace” and include: 7.6.1 Minutes and Agendas for all meetings 7.6.2 Departments and Divisions Business Impact Analyses 7.6.3 Departments and Divisions Business Continuity Plans 7.6.4 Corporate Risk Register. 7.7 Details of the Implementation Plan are provided in Appendix A May 2007 Page 8 Strategy Document
  9. 9. Nottinghamshire County Council Business Continuity Management 8. Roles and Responsibilities 8.1 Strategic Management Board The Strategic Management Board will: 8.1.1 Provide the overall strategic direction of Business Continuity across the County Council 18.1.2 Ensure that the Business Continuity Management Strategy and delivery Plan is implemented and resourced 08.1.3 Liaise with the Risk & Emergency Management Group during a corporate emergency 18.1.4 Provide and participate where necessary in training and exercising arrangements. 8.2 Elected Members Elected members will: 18.2.1 Approve future Council strategies and policies relating to the Business Continuity Management Programme 28.2.2 As portfolio holders monitor the Councils implementation and progress of Business Continuity Management as it relates to the Civil Contingencies Act, 2004. 8.3 Risk & Emergency Management Group The Risk & Emergency Management Group will provide leadership and sponsorship of the Business Continuity Management Strategy and be responsible for: 8.3.1 Providing leadership and support to the Emergency Planning and Business Continuity Working Groups. 8.3.2 Make decisions regarding assessments and recommendations provided by the Emergency Planning and Business Continuity Working Groups. 8.4 Business Continuity Forum The Business Continuity Forum will monitor, support and contribute to The Business Continuity Management Framework and in doing so will: 8.4.1 Provide a forum to discuss relevant business continuity issues that could affect the Council. 8.4.2 Determine the corporate critical functions during the business impact analyses. 8.4.3 Each member will provide a lead within their own departments on Business Continuity Management and report progress to the Forum May 2007 Page 9 Strategy Document
  10. 10. Nottinghamshire County Council Business Continuity Management 8.4.4 Will provide assistance and support to the Emergency Planning Manager responsible for Business Continuity Management with regard to corporate and service planning initiatives. 8.4.5 Provide business continuity recommendations and assessments to the Risk & Emergency Management Group. 8.4.6 Report on the progress being made on Business Continuity Management to the Risk & Emergency Management Group. 8.5 Departmental Business Continuity Groups Each group will be supported by an emergency Planning Officer who will assist in implementing the council strategy. The group will provide: 8.5.1 Support to the Council in delivering the Business Continuity Strategy 8.5.2 A representative to attend the Business Continuity Forum 8.5.3 Support, assistance and guidance to divisions in the completion of business impact analysis, identifying risk treatments and producing plans on business continuity. 8.6 Divisional Business Continuity Groups Each Division will provide a service representative to attend the Departmental Business Continuity Group. 18.6.1 Support the Council to implement Business Continuity Strategy 28.6.2 Carry out a Business Impact Analysis in their own service area. 08.6.3 Identifying risk treatments and producing divisional plans on business continuity. 18.6.4 Support the Business Continuity Strategy by attending training and exercising arrangements. 3 8.8 Risk Services The County Council Risk Manager will support the Council Strategy by: 8.8.1 Identifying, controlling and treatment of risks that could affect the Council’s resilience 18.8.2 Provide advice and support at strategic, tactical and operational level as required. May 2007 Page 10 Strategy Document
  11. 11. 18.9 Emergency Planning Department The Emergency Planning Department has the lead responsibility for providing assistance and advice to the organisation on business continuity. The Emergency Planning Department will: 18.9.1 Work in partnership with Corporate and Service representatives on Business Continuity Management and attend group meetings. 28.9.2 Maintain the availability of Business Continuity expertise, guidance and assistance to Corporate and Service level planning initiatives within The Business Continuity Management Framework 38.9.2 Oversee and provide templates for the development of Corporate level Business Continuity Plans 48.9.7 Manage and support at every level on the progress being made on The Business Continuity Management framework 58.9.11 Monitor Business Continuity Plans at corporate and service level to ensure accuracy and consistency. 68.9.5 Develop Business Continuity Management documentation to include project plan, BIA and planning templates. 78.9.2 Arrange training and exercises in support of Departments and Divisions. 88.9.9 Manage the Intranet and publish all documents including plans on Business Continuity. 08.9.10 Liaise continually with service areas and support in Business Impact Analysis where necessary. 98.9.8 Promote Business Continuity to partners, businesses and voluntary agencies by providing advice and expertise.
  12. 12. Appendix A 10Business Continuity Management 11Implementation Plan 2007 - 2008 April 07 June 07 August 07 April 08 September 07 October 07 December 07 January 08 February 08 May 07 July 07 November 07 March 08 N Task Remarks o 1 Convene Business Continuity Business Continuity Forum Forum and provide Terms of X meetings convened on a reference quarterly basis 2 Assign Emergency Planning Planning meetings convened Staff to Departments, on a quarterly basis. convene planning meetings X Report progress to the and provide Terms of Business Continuity Forum reference for each 3 Determine training needs of Emergency Planning and BC planning groups and arrange X Officer to arrange workshops appropriate workshops 4 Report progress to Risk & Report to 2nd and 4th meeting Emergency Management X of the year Group 5 Produce a project plan for Validate Project Plans with each Department and each the BC Officer Division for delivery of BIAs X and BCPs 8 Incorporate elements of the Involve the Risk Manager Corporate Risk register into X X BIAs where appropriate
  13. 13. April 07 June 07 August 07 April 08 September 07 October 07 December 07 January 08 February 08 May 07 July 07 November 07 March 08 N Task Remarks o 7 Identify Corporate critical Ongoing support provided by functions and conduct X X the Emergency planning corporate BIA liaison officer 6 Conduct Business Impacts Ongoing support provided by Analyses for Departments X X the Emergency planning and Divisions liaison officer 9 Produce Service specific Template provided by the BCPs X X Emergency Planning to be used 10 Produce Corporate BCP to Template provided by the include loss of County Hall X X Emergency Planning to be used 11 Arrange training for key staff Training arrangements to be on the implementation of the X provided by the Emergency BCPs and conduct exercise planning team 12 Review progress and carry Use the audit process to issues forward to the X determine BCPs are fit for following year purpose. 13 Publish BCPs following X Review on a yearly basis consultation 14 Promote Business Continuity On going in support of X X X X X X X X X X X X X Districts and Boroughs Completed In progress Not started
  14. 14. Appendix B Appendix B Reference Material The following publications were referenced during the publication of this document: No. Publication Author The Business 1 Good Practise Guide 2007 Continuity Institute 2 Business Continuity Management British Standards BS 25999-1 Institute Part 1: Code of Practice 3 Civil Contingencies Act 2004 Civil Contingencies Guidance on Part 1 Secretariat Risk Assessment (Business Impact Analysis) Section 6.14-6.16 Plan Production of generic and specific plans Section 6.17-6.19 Plan Invocation Section 6.20 Exercising of Business Continuity Plans Section 6.21-6.23 Training of key staff (to undertake Business Continuity roles) Section 6.24-6.25 Review and Maintain Business Continuity Plans Section 6.26-6.28 Publication of Business Continuity Plans Section 6.29-6.31 Business Continuity Promotion Section 8.9-8.17