Business Continuity Action Plan
Posted on May 25, 2018
It is essential that every business has a Business Continuity Plan (BCP). It means when disaster hits, your organisation can continue operating and have the resilience to recover quickly.
What makes a good Business Continuity Plan (BCP)?
Also known as a Business Continuity Action Plan or Business Continuity Management Plan, this approach sets out specific steps to manage and respond to emergencies. Your BCP should contain all the details of the essential functions of your business, identifying all strategic systems and processes which must be maintained in order to continue operations.
A good plan does not have to be overly complex or long. Often, one or two pages may suffice, as long as it contains detailed information about the minimum resources required for business continuance.
As well as its ease of use, a good BCP is a living, dynamic document. Once completed, it shouldn’t just be filed away and brought out when a disaster befalls the business. A huge part of your organisation’s resilience is going to depend on whether the BCP is current and accurate. Regular testing and updates, evaluation, and maintenance can be the difference between recovery and disaster.
Why a plan is important
When creating a plan, there are three major steps to be undertaken: information gathering and risk assessment, plan development and finally, plan testing and updating.
1. Information gathering and risk assessment
Risk to the successful operations of your business come in many different shapes and sizes. Cyber attacks represent a very real and growing threat to business, but the risk of human error or natural disasters should be taken into account also.
Assessing the likelihood of each possible event occurring and the potential damage they could cause, will decrease the possibilities of a costly disruption to workflow and integral processes.
2. Plan development
Senior IT administrators will often create the outline of a company’s plan. However, input from others—in particular from management and executive staff—will ensure the plan is more complete and captures risk from all areas of the company.
Don’t forget to involve your service providers. Being aware of how to escalate issues to accelerate restoration of services can be the difference between getting back in business, or shutting it down permanently.
3. Plan testing and updating
After a plan is developed, elements must be tested to ensure its accuracy and effectiveness. These can be planned outages or spontaneous. Issues that arise from testing should be incorporated and/or the plan modified as a result.
Regular review and update times should be scheduled or even built in as part of the plan and staff should be trained to understand how to access it and when.
When times of crisis hit, it is imperative to know you have anticipated the risks and tested outcomes, through step-by-step procedures and responses outlined in your BCP.
The elements that make up a good BCP
Your Business Continuity Plan is primarily a set of procedural steps. It should be simple, easy to use and should also include:
- Contact information located at the beginning of the plan, as well as policy details
- Purpose of the document, its scope and when this plan should be initiated
- Emergency response and management
- Step-by-step procedures
- Relevant checklists and/or flow diagrams
- Schedule for reviewing, testing and updating the plan
Getting Started on your BCP
To develop a useful Business Continuity Plan, you’ll need to explore some worst-case scenarios in your business, then set out the steps your organisation would need to take to work around or overcome that disaster.
You can start by asking some of the following questions:
- How would the business function if all network functionality and communications were unavailable? What if the outage lasted for a day, or a week, or longer?
- Does this organisation have any critical outsourced relationships and what would happen if they suddenly disappeared?
- What is the minimum amount of staff needed and what functions do they need to conduct to continue basic operations? Who are they and what are their contact details?
- What are the key skills, knowledge and expertise needed to recover?
With business systems being so critical to operations, discuss your needs with your carrier in detail. This will ensure you can factor in response times, upgrades to technology and communication channels clearly in your response planning.
Disasters can never be fully avoided. But you can build resilience into your company with a thorough, current and accurate Business Continuity Plan.