business continuity plan template for sme's (1)

8/13/2019 Business Continuity Plan Template for SME's (1)

1/22

Business Continuity PlanTemplate to support Small to Medium

Size Enterprises

Date ofPublication

VersionNumber1

Plan Owner: Business Name: Page 1 of 22


2/22

IntroductionCardiff Council is firmly committed to helping Businesses across Cardiff andas such has developed this simple guidance document and BusinessContinuity Plan template to assist small to medium sized businesses !he aimis to help businesses to develop a business continuity management response"hich "ill help their businesses prepare for# and manage# incidents that couldimpact on their businesses

Business continuity management sets out a frame"or$ and a process toenable you to plan the delivery of your business during events or incidents!his process "ill help you to identify and manage ris$s and ensure you gatherinformation "hich "ill help to build a simple Business Continuity Plan "hich"ill protect your business during a business disruption

Risk%t is important to consider ris$s that could impact on your business and "hat

measures that could be implemented to help reduce or manage the identifiedris$s !he cost of putting in place measures that reduce the ris$ may be costlyfor your business# but balance that against the potential cost of the threatbecoming a reality &ou may decide to accept the ris$ and plan to managethe impacts of the ris$s should the threat of the ris$ occurring become areality 'ccepting or managing ris$ is part of your businesses your decision itis often referred to as your ris$ appetite#

FloodingConsider "here your business is# is it "ithin a flood ris$ area( &ou can chec$this by accessing the information on the )nvironment 'gency "ebsite :

http:**"""environment+agencygovu$*homeandleisure*floods*,1-./asp0

&ou can also sign up to receive flood "arnings from the same "ebsite "hich"ill help you react to protect your business "hen flooding is possible

)ffective flood defence items can be purchased to help you protect yourpremises# protecting your premises could mean the difference bet"een yourbusiness surviving a flood incident or not

Interruption to Energy supply

%s your business particularly vulnerable to the possibility of the po"er supplybeing interrupted# if so "hat could the cost of this occurrence be on yourbusiness(&ou may not be very vulnerable to energy interruption !he impact could beminimal# on the other hand you could find that the impact could be significantand very costly

Loss of e!site or "irus attack on key IT systemso" big a ris$ "ould this be to your business and "hat "ould be the impacton you if this occurred Consider ho" safe the information is that you hold andho" sensitive it is Consider getting professional advice and support to ma$esure your %! and information is secure and protected

Date ofPublication

VersionNumber1

Plan Owner: Business Name: Page 2 of 22

http://www.environment-agency.gov.uk/homeandleisure/floods/31650.aspxhttp://www.environment-agency.gov.uk/homeandleisure/floods/31650.aspx


3/22

Se#ere eat$er% snoConsider the impact on staff and customers accessing your businesspremises hat measures can you ta$e to ma$e access easier( hathappens if your suppliers have difficulty delivering to you or pic$ing up goods(o" can you help staff prepare for travel into and from "or$(

Fire RiskConsider if your business premises is at ris$ of fire

Consider:

• 're highly flammable materials*goods stored "ithin the premises# are

they correctly stored(

• 're there tools or e3uipment on site that could cause fire# if so are they

"ell maintained(

• hat about neighbouring business and properties could they cause an

increased ris$ of fire(

• 're your evacuation plans and fire detection e3uipment appropriateand "ell maintained(

• 're all your staff trained in "hat to do in a fire and ensure customers

and visitors are evacuated safely in case of a fire(

!he above bullet points details some of the threats to your business# you arebest placed to understand the specific ris$s to your business and the potentialimpact that they "ould have should they occur

Risk Treatment 'fter revie"ing the ris$s to your business and considered ho" li$ely they areto occur and the potential impact on your business you can e0plore possibletreatments 4imple treatments for e0ample may be if to consider buying andfitting simple effective flood barriers "hich can be fitted at short notice %f yourrefitting your premises carry out "or$ to limit the impact of possible flooding

' ris$ treatment for sno" disruption may be having sno" shovels and gritspreaders and grit *salt on site Chec$ that your suppliers are prepared todeliver in sno" conditions and help your staff consider alternative "ays ofgetting into "or$ and returning safely home# effective communication "ithstaff and customers is vitally important

!he above are 5ust a fe" simple e0amples of some "ays you can helpmanage the ris$ of sno" disrupting your business &ou must decide "hat isappropriate and "hat is cost effective based on the potential impact to yourbusiness

Insurance&ou can6t stop all threats from becoming a reality but you can loo$ at insuringyourself as a business to cover the costs so you can get your business up andrunning normally as 3uic$ly as possible %t may even be possible to insure forpartial loss of business income due to the business disruption but you "ould

need to discuss "ith your insurer o"ever being able to sho" your insurer

Date ofPublication

VersionNumber1

Plan Owner: Business Name: Page , of 22


4/22

you are manageing and reducing ris$s may benefit you "hen discussingpremiums so consider this "hen you are loo$ing at the cost and benefit of ris$treatment methods 7emember to store copies of $ey insurance documents#contracts and business credit*debit cards etc safely and securely off site incase your premises are damaged or you lose access to them

Looking at continuity optionsaving put in your ris$ treatment measures and appropriate insurance youno" need to focus on suitable continuity options !he purpose of your chosenoptions is to manage the impacts of incidents and events that could disruptyour business !he business continuity plan template "hich is in thisdocument helps you outline options for managing impacts to the follo"ingscenarios:

• &ork Space disruption# eg fire# flood# sno"

• 'on a#aila!ility of Staff eg sic$ness# travel disruption

• Loss of IT 8 eg phone lines etc

• Loss of ot$er resources+ eg vehicles# fuel

(d#ice on Filling in t$e plan template!he template is 5ust a simple plan outline to help you protect your business%t is designed to help you capture important processes and actions that you oryour staff "ould need to underta$e should there be a business disruption !heplan should be stored securely off site and be accessible by those that "ouldneed to implement it !he te0t in blue is there to illustrate some e0amples ofthe sot of actions that you may "ant to consider "hen you fill out your plan#you can build from this and ma$e it specific to your business 7emember that$ey documents li$e insurance document# client information or contracts andsupplier details should be stored securely off site %t is also a good idea tohave a business debit or Credit card a"ay from your business premesis so ifyou lose access you are able to start implementing actions to help yourbusiness survive

)seful e!sites and links

Cardiff Council % &it$ links to all council ser#ices* including inter

eat$er ad#ice * Emergency management* Business Continuity and!usiness ser#ice+$ttp+,,-cardiff-go#-uk,content-asp.parent/directory/id01234

E"(C Cardiff 5 is a multi%agency commitment to de#eloping acoordinated response to a ma6or incident in Cardiff-$ttp+,,-cardiff-go#-uk,content-asp.na#01278*9:;:*4:49


5/22

Met >ffice % &eat$er arnings and eat$er updates$ttp+,,-metoffice-go#-uk,

Traffic &ales 5 Transport disruptions to road netork$ttp+,,-traffic%ales-com,

Sout$ &ales Police$ttp+,,-sout$%ales-police-uk,

Sout$ &ales Fire and Rescue ser#ice$ttp+,,-sout$ales%fire-go#-uk,Englis$,?ome,Pages,default-asp=

&ales Resilience$ttp+,,alesresilience-go#-uk,.skip0:


6/22


7/22

Contents

:- Introduction

11 'im12 b5ectives

1, 4cope f !he Plan

1- Reco#ery >!6ecti#es

9- Plan (cti#ation Procedures < Process

9-: Plan (cti#ation Process9-1 (cti#ation of Plan9-9 &orkspace

9-; IT Systems , "oice netorks , Aey data9-4 Aey Staff 9-3 >t$er Aey Resources

;- Supporting Information

;-: Staff &elfare;-1 Communicating &it$ Staff ;-9 Media , Pu!lic Information

4- Plan Maintenance Procedures

.1 Plan validation

(ppendices

( Staff Contact ListB >t$er )seful 'um!ersC Summary of Reco#ery Resources

@istri!ution List


8/22

'ame o! Title Email address-

88:Business Continuity Officer Business

Continuity Officer

//2 Name of Manager Manager

//, Name of Deputy Deputy Manager

//9//.

//-

//;

//<

//=

/1/

Plan )pdates

%t is essential that the Plan is $ept up to date and it is version controlled "ith a cleardate on front page of the plan

%f you have any suggested changes to this plan# please notify the author of theplan# "ho6s name is on the front of the plan

!his person is also responsible for updating and issuing plans 8 e suggestcontact lists are revie"ed every - months and plan annually or follo"ing anysignificant change to the organisation or service

%f any changes to the service or personnel occur the plan should be updated andissued to the copy holders

!his plan must be e0ercised annually or follo"ing any significant change to thebusiness and the e0ercise recorded and any improvements built bac$ into the plan

:- Introduction

!his plan is to be used to assist in the recovery of the (insert business name> in theevent of a ma5or disruption to the business ' ma5or disruption is defined as asignificant incident "hich threatens personnel# buildings or the operational


9/22

structure of the business and re3uires special measures to be ta$en to restorethings bac$ to normal

:-: (im

!he aim of the Plan is to set out the roles# responsibilities and actions to be ta$enby the business staff to re+instate the business follo"ing a ma5or disruption

:-1 >!6ecti#es

!he ob5ectives of the plan are to

l !o provide for continuity of the activities essential to the businessl !o reduce the disruption of clients# customers# employees# and services to

an acceptable level

:-9 Scope of t$e @ocument

!his plan sets out details of the recovery measures to be ta$en in the event of ama5or disruption to the business

1- Reco#ery >!6ecti#es

Business activity restoration priorities have been identified against the follo"ing

categories# consider the various activities your business underta$es and "hich are

the most time sensitive needing to be restored first# this "ill help you plan to

recover your activities :+


10/22

PRI>RITD Ser#ices @EFI'ITI>'

Red

Time Critical ser#ice

needing to !e restored

it$in

8%: $our

(m!er

Important ser#ice needing

to !e restored it$in

:%1; $ours

reen

( ser#ice needing to !e

restored it$in

4 orking days

Black

( ser#ice $ic$ can !e

restored progressi#ely after

4 orking days


11/22

9- Plan (cti#ation Procedures

9-: Plan (cti#ation Process


12/22

&$at is 'ature oft$e @isruption.

(nd $at impact ist$is $a#ing on t$e!usiness- C$eck

t$e impact

sections $ic$apply

&orkspace

(ssess CurrentSituation

IT Systems ,

"oice 'etorks,key @ata >nly

Aey Staff>nly

>t$er AeyResources

>nly

Return to 'ormal

DES 9-9

DES 9-;

DES 9-4

@isruption>#er

In#oke Plan

Monitor Situation*is t$ere a need toimplement Plan

'>

Start Log and inform Manager , >ner

Detailed 'ctions 'reProvided in4ection 9 of

the Plan

DES 9-3

'>

'>

'>

DES


13/22


14/22

9-9 &orkspace

>!6ecti#e (ctions , Considerations

:- Esta!lis$ t$ecurrent situation at

t$e affected site ,orkspace

? hat has happened(? hen did it occur(

? 're the )mergency 4ervices informed * on+site(? %s there access to the site(? 're the %! systems and services still running(? ho else has been informed(? o" potentially serious is it(? 're there any casualties( %f so# details(

1- @ecide $et$ert$e BusinessContinuityManagement Plans$ould !e in#oked.T$e decision ill !e!ased upon t$einformationpro#idedconsiderations$ould !e gi#en to+

• o" 3uic$ly the business "ill be able to re+enter theaffected "or$space

• Prevailing "eather conditions• hether the area is currently responding to an e0ternalincident

• %f the decision is to relocate $ey staff to the agreedalternative accommodation alert the site 8 @contact detailsin table belo">

• %f the decision is made not to invo$e the plan# continue tomonitor the situation until such time as normal access isgranted to the disrupted location

9- Communicateit$ staff

• IF EVACUATION I NEEDED ! Fo""o# site e$acuation p"anta%ing into account staff& customer an' $isitor safety

• )eep staff informe' at Assemb"y *oints unti" a 'ecision +asbeen ma'e about #+et+er t+e bui"'ing is "i%e"y to becomea$ai"ab"e again soon If t+e bui"'ing #i"" not be a$ai"ab"e&

re"ocate i'entifie' %ey staff to t+e agree' a"ternati$e#or%space an' consi'er sen'ing ot+er staff +ome an' te""t+em to a#ait instructions ,emin' t+em to c+ec% t+e in #it+t+e manager at an agree' time

• Out of -ours If t+e 'isruption occurs outsi'e office +ours& staffcommunication #i"" be co.or'inate' by t+e manager or t+eir'esignate' staff member

• Ta%e t+e Emergency /rab bag #it+ you

Ser#ice , (cti#ity Staff to !e Relocated

(lternati#e(ccommodationLocation+

Contact 'ame atLocation+

Contact 'um!er+


15/22

9-; IT Systems , "oice netorks , Aey data

>!6ecti#e (ctions , Considerations

:- Confirm t$e nature

of t$e disruption

? hat has happened(

? hen did it occur(? hich systems and*or services are affected? o" potentially serious is it(? hat is the estimated duration of the problem(? ho else has been informed @media officer#comms# sta$eholder>(

1- @ecide $et$er t$eBusiness ContinuityManagement Plans$ould !e in#oked-T$e decision ill !e!ased upon t$einformation pro#idedconsideration s$ould!e gi#en to+

• o" long systems "ill be unavailable• hether the systems affected are re3uired tosupport the !ime Critical * %mportant Business 'ctivities• hether the 'rea is currently responding toe0ternal incident

? %nform staff that the Business ContinuityAanagement Plan is being invo$ed or put staffon standby or invo$e agreed manual systems toensure that the service can continue to operate

? %f the decision is made not to invo$e the plan#continue to monitor the situation until such time asnormal service is resumed

9- Enter Specific

actions orconsiderations if t$edisruption is due tonon a#aila!ility of ITsystems , "oicenetorks , key data

4ome )0amples of BCA solutions * strategies•

Instigate manua" #or% aroun' systems• ,erouting of ca""s• Accessing an' ma%ing a$ai"ab"ecritica" 'ata to %ey staff #+ic+ +as been protecte'• 0or%ing from a secon'ary "ocationunaffecte' by t+e IT issue

• If t+e main "an'"ine(s1 are "ost re$ertto mobi"e p+ones an' gi$e number to %ey staffan' sta%e+o"'ers

• If IT systems are "ost instigate

Disaster reco$ery p"an


16/22

9-4 Aey Staff

9-3 >t$er Aey Resources

>!6ecti#es (ctions , Considerations

:- Confirm t$e nature oft$e disruption

? hat has happened(? hen did it occur(•ho and ho" many are affected(

? hich systems and*or services are affected? o" potentially serious is it(? hat is the estimated duration of the problem(? ho else has been informed @Aedia fficer#Comms# sta$eholders>(

1- @ecide $et$er t$e

Business ContinuityManagement Plans$ould !e in#oked-T$e decision ill !e!ased upon t$einformation pro#idedconsideration s$ould !egi#en to+

• o" long staff "ill be unavailable• hether the staff are re3uired to support theCritical * %mportant Business 'ctivities

• hether the 'rea is currently responding toe0ternal incident

? %nform staff that the business ContinuityAanagement Plan is being invo$ed or put staff onstandby or invo$e agreed manual systems toensure that the service can continue to operate

? %f the decision is made not to invo$e the plan#continue to monitor the situation until such time as

normal service is resumed

9- Enter Specificactions orconsiderations if t$edisruption is due to nona#aila!ility of Aey Staff

• C+ange of 2ob functions for some staff(to support t+e critica" business acti$ities1

• Emp"oy agency staff • Offer o$ertime 3 Toi" • uspen' "ess time critica" parts of t+ebusiness

• Consi'er out sourcing some ser$ices if

possib"e unti" you are rea'y to restore t+em


17/22

;- Supporting Information

;-: Staff &elfare

>!6ecti#es (ctions , Considerations

:- Confirm t$e nature oft$e disruption

? hat has happened(? hen did it occur(? hich systems and*or services are affected? o" potentially serious is it(? hat is the estimated duration of the problem(? ho else has been informed(

1- @ecide $et$er t$eBusiness ContinuityManagement Plans$ould !e in#oked-T$e decision ill !e!ased upon t$einformation pro#idedconsideration s$ould !egi#en to+

•

o" long resources "ill be unavailable• hether the resources affected are re3uired tosupport the Critical * %mportant Business 'ctivities• hether the 'rea is currently responding toe0ternal incident

? %nform staff that the business ContinuityAanagement Plan is being invo$ed or put staff onstandby or invo$e agreed manual systems toensure that the service can continue to operate

? %f the decision is made not to invo$e the plan#

continue to monitor the situation until such time asnormal service is resumed

9- Enter Specific actionsor considerations if t$edisruption is due to nona#aila!ility of keyresources

• Arrangements3contracts to +ire 3 borro# 3 purc+ase rep"acement resources fromsupp"iers

• *rotecti$e measures for resources egnot +a$ing a"" resources at one site3s+op3office


18/22

%t must be recognised that a business interruption may also cause additionalpressures for staff 4taff members need to be given clear direction about "hat thepriorities of the business# "hich can be achieved by having "ell thought out andimplemented continuity strategies in place Aanagers must ensure that theymonitor staff more closely to ensure that their "elfare is maintained @eg regularbrea$s due to increased intensity or pressure of "or$>

4taff should be a"are of "hat their role is "hen a ma5or disruption occurs Clearand concise communication "ith staff is pivotal to having an organised response4taff must be made a"are of "hat communication methods are going to be usedso they can find out the latest information# if they are going to be "or$ing fromhome or a different location than normal %f staff are to be "or$ing from a differentlocation ensure that they $no" "here the location is @provide a map and ordirections if necessary> and they are able to get there and get access

;-1 Communicating it$ Staff

During ffice ours%f the disruption occurs during office hours then staff can be communicated "ith viabriefings from managers and electronically by the intranet and email

ut of office hours

!he manager for the business or the designated staff member "ill $eep staff up todate by the follo"ing methods:

• !elephoning staff and passing on essential information

• Aobile phone !e0t cascade of information if appropriate

• )mail to staff that have access to e0ternal email as a appropriate

• ace to face as appropriate

%nformation may be available via the follo"ing depending on the reason fordisruption

Business name +ttp433business#ebsite

Or $ia t+e business T#itter account +ttp433businessname

4taff should given the opportunity to feedbac$ any comments they may have afterthe response phase and the service has returned to normal !his may be in theform of a structured debrief or more informally

Aanagers "ho suspect that staff members have suffered undue stress or eventrauma from the business disruption must consider providing assistance for thosestaff "ho have been affected

;-9 Media , Pu!lic Information

%n the event of a ma5or disruption to the business the business Communicationsfficer must be contacted to inform them of "hat has happened and the estimatedlength of the disruption and possible impacts of the disruption


19/22

4- Plan Maintenance Procedures

!he author of the plan is responsible for revie"ing contact lists every - months andplan must be revie"ed annually ltimately the plan o"ner is responsible forensuring the plan is up to date and e0ercised and all audit re3uirements have been

met

4-: Plan #alidation e=ercises , Training Sc$edule

'"areness training for staff to ma$e sure they all $no" "hat to do and "ho "ill beinvolved Be sensitive ho" you communicate your plan 8 phrasing Eessential staff6or Evital services6 suggests that some of your staff aren6t as important as others

(ppendi= (

ST(FF Contact 'ames < 'um!ers

To !e updated 3 mont$ly and stored securely-

A list of staff contact details (Out of hours) is to be completed and

maintained by (the responsible person named in this plan)

http://business/


20/22


21/22

>rganisation Contact 'ame o! Title>ffice ?ours

ContactMo!ile Contact

upp"ier

(ppendi= C

Resource ReGuirements for resumption deli#ery of RE@ and (MBER ser#ices , acti#ities-

Ser#ices or acti#ities+

Staff+

(greed(ccommodation

Location+Contact 'ameContact 'um!er

Systems IT < IS+

?ard @ata+

>t$er Resources+


22/22

business continuity plan template for sme's (1)

Documents