The document outlines the key steps in developing a business continuity plan, including performing a business impact analysis, developing recovery strategies, creating the plan, and maintaining the plan through regular exercises. It discusses defining critical processes, employees, vendors, and locations and assigning roles and responsibilities to teams to ensure business functions can continue during a disruption. The six steps to building continuity plans are also presented.

1. Business Continuity Planning Presented by Robert Winkler December 15, 2008

2. Meeting Objectives Review the six steps in developing a Business Continuity Plan Review the results of the BIA & Questionnaire Discuss “workarounds” for Critical Applications Overview of the Business Continuity Process Next Steps – Building your plans. Preparing for a Pandemic

3. Definition of Terms Business continuity plan (BCP) The documentation of predetermined set of instructions or procedures that describe how an organization’s business functions will be sustained during and after a significant disruption. Disaster recovery plan (DRP) A written plan for processing critical applications in the event of a major hardware or software failure or destruction of facilities.

4. BCP Mission Statement Provide guidelines Maintain a central repository for all plans Monitor disaster recovery exercises Ensure that an exercise plan is developed that will test the functions and responsibilities of all plans and participants

5. Key Steps In Developing Business Continuity Plans

6. Risk Analysis There are two aspects to every risk to your business How likely is it to happen ? What effect will it have on your business ?

7. Develop Your Strategy What is your appetite for risk ? Does senior management agree with your analysis of the business risks, and which people and tasks are essential. This will give you a clear understanding of the “appetite for risk” within your business unit.

8. Develop Your Strategy Define your strategy Choose one of the following strategies : Accept the risks – change nothing Accept the risks, but make a mutual agreement with another business continuity supplier to ensure that you have help after an incident. Attempt to reduce the risks. Attempt to reduce the risks and make arrangements for help after an incident. Reduce all risks to the point where you should not need outside help.

9. Business Impact Analysis A BIA will identify the impact to this organization by measuring the operating, financial, legal and regulatory impact. This part of the process will identify the critical functions within the business.

10. Recovery Strategies The information that is gathered from the Business Impact Analysis & Questionnaire will be used to identify potential recovery options and their associated costs, present the options to management, and get agreement on the approach to be taken.

11. Develop Your Plan Visualize your plan Set-up Make it clear that you have consulted throughout the business. Use non-technical language that everyone can understand .

12. Develop Your Plan Visualize your plan Contents Make it clear who needs to do what and who takes responsibility for what. Create user checklists that readers can follow easily. Include clear, direct instructions for the crucial first hour after an incident. Include a list of things that do not need to be thought about until after the first hour.

13. Develop Your Plan Visualize your plan Contents (cont’d) Agree how often, when and how you will check your plan to make sure it is always a ‘living document’. Update your plan to reflect changes in your organization’s personnel and in the risks you might face. A good plan will be simple. Remember that people need to be able to react quickly in an emergency: stopping to read lots of detail may make that more difficult. Plan for worst-case scenarios. If your plan covers how to get back in business if a flood destroys your building, it will also work if one floor is flooded.

14. Develop Your Plan Include information from outside experts in planning for emergencies, or from other business people who face similar risks. Emergency Planning Officer (city) : Find out what your local authority would do in response to a major incident. Emergency Services : Ask your local fire house what they will want to know from you during a major incident ? How can you help the ambulance service to help you? Who will the police contact at an incident? Ask about access to your facility if your premises is cordoned off. Would your local fire station video tape the inside of your building?

15. Develop Your Plan Include information from outside your business (cont’d) Utility Companies : Find out from the Utility companies what they will need to know if your business is involved in a major incident. Suppliers & Customers : How will you contact your suppliers/customers to tell them you have been affected by an incident? Your insurance company : What information does your insurance company need from you? Do you need their permission to replace damaged critical equipment immediately?

16. Exercise & Maintenance Rehearse your plan Rehearsal helps you confirm that your plan will be connected and robust if you ever need it. Remember your BCP are “living documents” and you will need to rehearse whenever you update. Rehearsals are also good ways to train staff who have business continuity responsibilities. Rehearse your plans at least annually .

17. Exercise & Maintenance Maintaining your plans Review plans on a quarterly basis to ensure that they have been properly maintained and updated to reflect actual resumption and recovery needs. Include Business Continuity concepts into your change management process.

18. Awareness Business Continuity should become part of your new hire orientation. Business Continuity should become part of a managers performance review. Exercises provide the opportunity to train the staff on the procedures documented in the plans.

19. Business Continuity Planning There are six steps involved in building continuity plans : Step 1: Develop Continuity Planning Policies and Procedures Define your planning philosophies, policies and procedures in documents you will include with your printed plans. Step 2: Define Phases and Plan Structure Break down your planning effort into phases. Create plan names for each level within a phase. Hint: Your plan tree will mirror the physical structure of your organization.

20. Business Continuity Planning Sample BCP Plan Hierarchy Plan Name - Business Continuity Plan Company Name – Country – US Location – Chicago, IL Building – Scenario – Administration Agency Services Sale & Marketing Technical Solutions

21. Business Continuity Planning Step 3: Determine Plan Output Review the standard reports included in BCP determine the types of plan information you will want to see if a business interruption occurs. Step 4: Create a Table of Contents Set a table of contents for each of your BCP. Step 5: Collect Plan Information Responsibilities (Processes & Teams) People (Employees, Call Lists, Vendors, Customers) Materials (Software, Equipment, Supplies, Telecom, Assets, Vital Records) Miscellaneous (Documents, Workstations, Locations)

22. Business Continuity Planning Step 6: Print the Plan Print your plans for frequent testing and review as well as when needed to respond to a business disruption.

23. Phases and Plan Names To help you think about the plan structure, ask yourself a few questions. What kind of plans are you building? (Response/Resumption) Who are you building them for? (Organization) What are you planning for? Who will own the plan? How are the plans going to be maintained? (By whom and at what level – department? Process? Other?)

24. Build Plans – Assign Processes What are the critical functions in each department or business unit within my company ? Determining a critical rating and priority sequence for each process ensures that you will know right away the order in which your processes must be recovered during an incident.

25. Build Plans – Employee Summary Who are the critical employees in each of my departments ? Make sure you gather multiple contact methods for your key people. Build call lists to state who needs to be contacted during an actual incident in a specific order. You can also assign specialty attributes to each person so you can quickly locate people who have a particular skills/attributes.

26. Build Plans – Identify Vendors & Customers Who are the critical vendors and customers that each of my departments needs to contact? Who would you stay in communication with you during an actual incident? Not all of you customers and vendors work outside of your organization. You also need to consider those people and departments that you rely on, and those who rely on you.

27. Build Plans – Team Summary Who will be doing what at the time of an incident? How many teams will you need ? Teams should not exceed 20% of your staff. Be certain that each member of those teams will be able to perform their duties. Are they the primary care taker (child or elderly parent)? Would they be able to relocate if necessary? What positions will be on those teams? Who will be assigned to those positions? What order will those tasks be performed?

28. Build Plans – Materials Summary What equipment, software, supplies, telecom lines, vital records, and assets are needed in order for my department to recover? For each material: How many will you need? When will you need them?

29. Build Plans – Identify Locations Whether it is for response or resumption, you will need to document each physical location, its usage, and contact .

30. Build Plans – Assigning Documents Any pre-existing business continuity plans that are in MS Word, Excel, or Visio format can easily be included in your plans.

31. Plan Printing Whether you are printing a single plan, multiple plans, you will be able to print to a PDF file to keep electronically or send to a printer.

32. BCP – In Conclusion When developing you plans consider the company Record Retention Policy. The server that will house your plans is located at a remote facility where it is backed up daily. Keep a hard copy/compact disk of your plans close by. Be sure your plans include returning home after an incident.