uk delivery business continuity plan prepared: recovery

47

Upload: others

Post on 28-Dec-2021

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery
Page 2: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 2 of 7 BCP-Issue 7

1. INTRODUCTION ........................................................................................................3

2. SCOPE .......................................................................................................................3

3. ROLES AND RESPONSIBILITIES; ...........................................................................4

3.1 ORGANISATIONAL RESPONSIBILTY OF THE RECOVERY COMMITTEE ..........4 3.2.1 Primary Responsibility ................................................................................................................ 4 3.2.2 Responsibilities of the Recovery Committee ................................................................................. 4 3.2.3 Updating the Plan ....................................................................................................................... 4 3.2.4 Distribution of Business Continuity Plan ..................................................................................... 4

4. BUSINESS IMPACT ANALYSIS ................................................................................5

4.1 IDENTIFICATION OF BUSINESS IMPACTS ................................................................7

5. APPENDICES ............................................................................................................7

Page 3: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 3 of 7 BCP-Issue 7

1. INTRODUCTION

This instruction details the process for the Business Continuity Plan that is designed to provide an effective preparation/planning tool that outlines the arrangements and defines the responsibilities necessary to recover from partial or total business interruption to QuEST Global Engineering Limited, at the following addresses

QuEST Global Engineering Limited,

Derwent House,

RTC Business Park,

London Road,

Derby, DE24 8UP

QuEST Global Engineering Limited

Brabazon Business park,

Golf Course Lane,

Filton,

Bristol BS34 7PZ

QuEST Global Engineering Limited

Red Hill House,

Hope Street,

Saltney,

Chester CH4 8BU

QuEST Global Engineering Limited

South Barn Building,

Broughton Hall Business Park,

Broughton,

Skipton BD23 3AE

2. SCOPE

These requirements relate to the Business Impact Analysis at all the above sites and are detailed in Appendix 1.

In Appendix 1 the Company has identified six scenarios and their associated causes and has further determined the significance of their impact, the probability, the control measures and the contingency plans that would affect business continuity;

1) Loss of Facility

2) System Failure (IT)

3) Loss of Link

4) Loss or Disruption of Essential Services

5) Personnel

6) Environment

Page 4: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 4 of 7 BCP-Issue 7

3. ROLES AND RESPONSIBILITIES;

A Recovery Committee was formed consisting of Senior Management and defined key personnel (details of personnel in Appendix 2h)

3.1 ORGANISATIONAL RESPONSIBILTY OF THE RECOVERY COMMITTEE

3.2.1 Primary Responsibility

The primary responsibility for co-ordinating the response to a major incident will, until the arrival of the Head of UK Delivery who will assume control, rest with:-

Those representatives of the Recovery Committee present on site

The Head of Human Resources will call the Recovery Committee together in an appropriate place dependent on the type of incident. An alternate location will provide premises at short notice should these be required immediately.

3.2.2 Responsibilities of the Recovery Committee

In the event of a significant incident that impacts the business at any site, the Recovery Committee will provide co-ordination and assistance in establishing and maintaining a continued programme to recover the situation that will include:-

a) Implementing a plan of action to be followed during interruptions that will provide for:-

i. Safety of personnel

ii. Minimisation of business interruption

iii. Protection of property/equipment.

b) Co-ordination of efforts in the event of an incident

c) Maintain and review an effective Business Continuity Plan.

3.2.3 Updating the Plan

The representatives of the Recovery Committee will maintain the Business Continuity Plan.

The Business Continuity Plan will be reviewed by the Recovery Committee on an annual basis, or when significant changes in the system have occurred. The review and the monitoring of the frequency will be the responsibility of the Head of UK Delivery.

3.2.4 Distribution of Business Continuity Plan

The Business Continuity Plan is a controlled document available within the QuEST QMS and hard copies will be held with Recovery Committee representatives at each site.

Page 5: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 5 of 7 BCP-Issue 7

4. BUSINESS IMPACT ANALYSIS

In Appendix 1 the Recovery Committee have identified Business Continuity procedures to cover the most likely causes of potential incidents.

These incidents have then been broken down into their associated causes and the Recovery Committee has further determined the significance of their impact, the probability, the control measures and the contingency plans that would affect business continuity.

LOSS OF FACILITY

Total loss or destruction of building by:

Fire

Aeroplane Crash

Natural disaster

Subversive action

Explosion

Vandalism

Partial loss of building (not Server Room)

Inability to access site

SYSTEM FAILURE (IT)

Unauthorised access to customer and company data

Loss of servers

Viral attack

Malicious damage

Failure of maintenance provider

Loss of backup (and archive) data

Page 6: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 6 of 7 BCP-Issue 7

LOSS OF LINK

Site to site WAN Links

Customer Managed Links

Telco Failure

LOSS or DISRUPTION OF ESSENTIAL SERVICES

Business interruption through damage to the building, industrial action, significant system failure (internal or external) or failure to settle accounts resulting in:

Total Loss of Electricity

Loss of Water

Loss of Gas

PERSONNEL

Pandemic

Industrial action

Espionage

ENVIRONMENT

Flooding/Water Ingress

Page 7: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Recovery Committee

Approved: Shashi Rao

20 Feb 2020 Page 7 of 7 BCP-Issue 7

4.1 IDENTIFICATION OF BUSINESS IMPACTS

An inventory of impacts that would affect business continuity was compiled forming the foundation for the initial Appendix 1 document and subsequent reviews.

The Recovery Committee identified the risks to the business. Each risk was analysed for the probability of occurrence and its overall effect on the business. This process is reviewed as a minimum on an annual basis.

Through this process the framework provides a Business Continuity Plan for the organisation to ensure ongoing business processes. It details the actions to be taken to ensure that the business continues to function at an effective level in the event of an incident. It ensures that there is an embedded culture of review, maintenance and testing of the plan and its contents.

In addition it provides an aide-memoire for the management of the incident, a detailed guidance on the recovery of normal operations and catalogues the contact particulars for emergency services, key personnel and local third party agencies who might usefully be called upon.

The Business Continuity Plan is designed to outline in sufficient detail the steps that must be followed during recovery from a potential incident in order to minimise business interruption.

In the event of an incident, the Recovery Committee, following the guidance in this plan, will provide co-ordination, assistance and positive action for the restoration of the damaged function in an expeditious manner.

5. APPENDICES

Appendix Issue Title

Appendix 1 3 Business Impact Analysis

Appendix 2a 6 Incident Log

Appendix 2b 6 Managing the Incident

Appendix 2c 6 Press Office – Dealing with the Media

Appendix 2d 7 Human Resources

Appendix 2e 6 IT

Appendix 2f 7 Facilites Management

Appendix 2g 6 Legal

Appendix 2h 8 Useful Contact Details

Appendix 2i 5 Pandemic Planning

Appendix 2j 5 Environment

Appendix 2k 1 Testing to Simulate Disaster Recovery in QuEST UK

Environment

Page 8: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

Business Continuity Plan Appendix 1Business Impact Analysis

Heading Sub-Heading Risk Description/Impact Control Description/Mitigation Contingency Probability ActionsSystem Failure Information

Technology Unauthorised access to customer and company data 1. External access to data is through multiple levels of firewall

2. All data transferred across the internet is encrypted3. Some Critical data is mirrored to remote sites4. Computer access control via Quality process

1. Logging on servers and workstations2. Site Security personnel - mobile patrols andsecurity gates

Low 1.Fully compliant.

Loss of server(s) 1. System designed to survive, duplicate power supplies etc2. Vmware installed on multiple servers with V-Motion and DR modules3. Cold-Spares held on-site

1. Third Party Hardware Maintenance2. Cold spares held at other sites3. Hardware standardisation across all sitesallowing for systems to be restored at anotherlocation in an emergency

Medium 1. New DC built in Derby to host all criticalservers2. New Server hosts allow full redundancy andcontingency in the event of hardware failure

Virus Attack 1. Data transferred across internet is encrypted2. High end firewalls are in use3. Incoming mail is "swept" for threats prior to being allowed through4. All workstations and Servers are virus protected5. Novell & UNIX Operating systems utilised (Industry accepted low risk environments)

1. Anti-Virus contracts are maintained, allowingfor rapid fix2. Comprehensive backup schedule in place3. Virus alerts are emailed to IT Team4. Dual anti-virus now on Internet and e-mailserver

Medium 1. Sophos AV currently deployed all across allUK business. Looking at replacing Sophos AVwith global stanard in 2020.

Malicious Damage 1. Strong passwords are mandated on systems2. No shared user accounts are permitted3. Site is protected by electronic entry systems4. Server-room protected by electronic and physical combination locks

1. Logging on servers and workstations2. Site Security personnel - mobile patrols andsecurity gates

Low 1. Fully compliiant

Failure of maintenance provider 1. Would expect gradual degradation therefore an alternative would be sourced Low 1. Consider alternative maintenance providerlist

Loss or failure of backup systems(Would require failure of primary servers and loss of back up data as a coincidingevent for data-loss to be a problem)

1. All tapes stored in recognised fire proof safes2. Backup process is "2-Stage" with backups being staged to separate disks before beingcopied to tape media

1. Backup process logs are reviewed daily2. Backup alerts are emailed to IT Team

Low 1. Arrange for secondary back-up tapes to bestored offsite2. Identify alternative off site location forstorage of backup tapes on site

Loss of Link Site to Site WANLinks

Reduction in efficiencyInability to carry out multi site activities

1. Software deployed to local/alternate sites2. Distributed server network is in place with local servers supplying local applications3. CAD licences are distributed across multiple servers with at least one at each site4. Where available from service provider, dual links with diverse paths are in place

1. All licences are on maintenance contracts with3rd party suppliers. In the event of a significantoutage a request to have the licences moved toan alternative server would be made.

Medium 1. We currently utlize DFS to copy and have areplica of sofware shares deployed to allQuEST UK sites.2. We currnetly have local ZenWorks serversat every UK site (ZenWorks) that allows localdistribution of applications to users.3. The current license sever model is that allCAD machines point to one server in Derby. Ifall major MPLS links were down then no usercould continue to function, regarlsess of CADlicensing.

Customer Managedlinks

Inability to satisfy contractual obligations 1. Where customer has deemed cost effective, dual links are in place with diverse paths intosites

1. Alternative delivery methods by CD, DVD,Other electronic devices or paper copies wouldbe utilised and delivered by courier or by hand

Medium 1. Dual network links are not in present on thecurrent UK MPLS links to all branhc offics aswell as India.

Businessinterruption as aresult of a pandemic

Personnel unable to attend workplace due to illness or prohibited from attending theworkplace;Unavailability of key skilled personnel

1. Regular Health Surveillance Checks/Occupational Health Support2. General Infection Control Practices3. Pandemic Check List

1. Temporary Labour2. Remote working

Low 1. Maintain good relationship with approvedagencies2. Review Pandemic Checklist (Appendix 3h)3. Establish limitations of Home working andRemote Access

Businessinterruption due toindustrial action

Union members withdraw labour 1. Regular liaison with Office Committee 1. Temporary Labour Low 1. Maintain relationship with provider(s) ofresource

Businessinterruptionthrough espionage

Long term or complete loss of a group of personnel (eg project team) 1. Monthly review of leavers through exit interview process.2. Annual salary and grade reviews for all employees.3. Open management culture that encourages employees to express dis-satisfaction whereit exists

1. Access controls to software applications Low

Environment Flooding/WaterIngress

Major flooding that damages building so severely it cannot stay open 1. Routine valley gutter clearances2. Regular inspection of flat roofs3. Registered to Flood Line

1. Provision of Sand bags Low 1. Source Supplier for the provision of sandbags etc and detail within Appendix 2h

Personnel

17 Dec 2019 1 of 1 BCP_Appx1 Issue 3

Page 9: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

29th January 2020 Page 1 of 1 Appendix 2a Issue 6

Incident Log

Date: Time Alert Received:

Time Head of UK Delivery Notified:

Names of Recovery Committee Present:

TYPE OF INCIDENT:

Location:

Number of ill or injured:

Time the Incident occurred:

Any Hazards (Biological / Chemical / Radiation / Other):

Other details:

Your Name: ………………………… Signature: ………………………………

Page 10: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 1 of 6 Appendix 2b: Issue 6

1. MANAGING THE INCIDENT CHECKLIST

FOLLOW ORDERS GIVEN BY THE EMERGENCY SERVICES AND INSTRUCT STAFF CONSIDERING AND TAKING ACTION AS APPROPRIATE

Tick box

Note time/date/action taken if appropriate

1. Have all danger areas been evacuated?

2. Is everyone accounted for? (Employees, maintenance/ service contractors and visitors?)

3. Is the Recovery Committee managing the incident?

3.1 Who is liaising with the emergency services?

Name:

3.2 Are the emergency services receiving all necessary assistance?

3.3 Who is liaising with the Regulatory Agencies? Name:

3.4 Who is liaising with the utilities companies and Landlord? Name:

3.5 Who is listening to the local radio or watching local TV for advice? Name:

4. Are site plans available?

5. Is the responsible staff on site readily identifiable (i.e. clothing or device)?

5.1 Have all necessary staff been asked to remain on site to provide emergency cover?

5.2 If appropriate, has non critical staff been advised to go home / stay?

6. Have Marketing and Communications been notified?

7. Who is liaising with relatives and hospitals? Name:

8. Who is liaising with the media? Name:

9. Is it necessary to appoint a liaison officer to support Marketing and Communications? Name:

10. Has an appointed spokesman made a statement?

Page 11: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 2 of 6 Appendix 2b: Issue 6

FOLLOW ORDERS GIVEN BY THE EMERGENCY SERVICES AND INSTRUCT STAFF CONSIDERING AND TAKING ACTION AS APPROPRIATE

Tick box

Note time/date/action taken if appropriate

11. Has a 24-hour switchboard been set up?

12. Has a staff information hotline been established?

13. Is appropriate ancillary support (admin/clerical/secretarial etc.) in place?

14. Can the business be continued on site?

14.1 If not, where and how?

15. Have the Insurers been contacted regarding liability?

16. Have the Senior Vice President Human Resources and Senior Vice President Global Delivery been notified?

17. Have vital company property and documents been safeguarded?

18. Should representatives of the Local Authority or community be informed?

Page 12: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 3 of 6 Appendix 2b: Issue 6

2. MANAGING THE INCIDENT - CONTINGENCY PLANNING CHECKLIST IMMEDIATELY FOLLOWING AN INCIDENT (IF EVACUATION IS NOT NEEDED):

FOLLOW ORDERS GIVEN BY EMERGENCY SERVICES AND INSTRUCT STAFF THEN CONSIDER AND TAKE ACTIONS AS NECESSARY

Tick box

Note time/date/action taken if appropriate

1. Is everyone accounted for? (Employees, maintenance/service contractors and visitors?)

2. Is the Recovery Committee managing the incident?

2.1 Have personnel been informed of the incident?

2.2 Have personnel been informed of how the incident is being handled?

2.3 Are personnel aware of whether or not they can leave the building?

2.4 Who is liaising with service providers, media, utilities companies and the emergency services (if relevant)? Name:

2.5 Who is listening to the local radio or watching local TV for advice (if relevant)? Name:

3. Have all personnel who are responsible for the business continuity plan been informed?

4. Have Insurers been contacted regarding liability?

5. Have the Senior Vice President Human Resources and Senior Vice President Global Delivery been notified?

6. Can the business be continued on site?

6.1 If not, where and how?

7. Have vital company property and documents been safeguarded?

8. Should representatives of the Local Authority or community be informed?

Page 13: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 4 of 6 Appendix 2b: Issue 6

3. MANAGING THE INCIDENT - CONTINGENCY PLANNING CHECKLIST FOLLOWING AN INCIDENT (IF RELOCATION TO AN ALTERNATIVE SITE IS TAKING PLACE)

FOLLOW ORDERS GIVEN BY EMERGENCY SERVICES AND INSTRUCT STAFF THEN CONSIDER AND TAKE ACTIONS AS NECESSARY

Tick box

Note time/date/action taken if appropriate

1. Has the alternative site/site supplier been contacted?

2. Have alternative arrangements for work and technology requirements been made?

3. Have arrangements for resource requirements: office equipment, hardware and software, furniture, machinery been made?

4. Do we have all our contacts and important documents?

5. Is the phone system working remotely from the old site?

6. Is the phone system working on the new site?

7. Have other utilities at the new site been tested to see if they are working?

8. Have dangerous utilities at the old site been switched off, if applicable to the situation? (If not possible, contact utility supplier)

9. Has an inventory been carried out (if possible)?

10. Has the insurance company been contacted?

11. Has the Landlord been contacted (if needed)?

12. Have all Key Personnel been contacted?

13. Has a Personnel Advice Line been set up?

14. Have customers/suppliers that have appointments in the short term been contacted?

Page 14: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 5 of 6 Appendix 2b: Issue 6

4. INCIDENT CENTRE

Control of any serious incident will be exercised through an Incident Centre, to be set up at a location as near to the incident as safely possible. See also Paragraph 5.

4.1 INCIDENT CENTRE – ACTIONS

Following the initial alert to a disaster, the Human Resources Manager will contact the Recovery Committee and direct them to the newly set up Incident Centre (IC).

Incident Centre Staffing: The Head of UK Delivery

IT Manager

FTA Head - EU

Human Resources Manager

Engineering Management

Administration Support

See Appendix 2h - Useful Contact Details for the current contact numbers of the Recovery Committee members.

The IC will be under the command of the Head of UK Delivery or, in his/her absence, the most senior person present.

4.2 SEQUENCE OF ACTION

The Head of UK Delivery or, in his/her absence, the most senior person present must complete the Incident Log (see Appendix 2a).

The Incident Centre leader is to consult with the Emergency Services to assess the situation.

Depending on the severity of the damage, priorities for action are to be determined.

Contact:

The Senior Vice President Human Resources and Senior Vice President Global Delivery

Advise them of the incident

Inform them that they will receive details of emergency arrangements as soon as possible

Advise them of the appropriate contact details to use

Page 15: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

17th February 2020 Page 6 of 6 Appendix 2b: Issue 6

5. LOCATION OF INCIDENT CENTRE

5.1 TOTAL DESTRUCTION OF BUILDING

Establish temporary accommodation as near to the incident as safety permits. Where possible relocate personnel to other QuEST premises and if required implement shift working. Alternative office accommodation would be sought by the FTA team and Engineering Management. Mobile phones would be used for communication.

5.2 PARTIAL DESTRUCTION OF THE BUILDING

Following clearance from the emergency services, use an existing, undamaged office on site with a Direct Exchange Line or mobile phone in an undamaged part of the building.

Use a local business premise.

6. INCIDENT CENTRE – ESSENTIAL EQUIPMENT

Telephones – Direct Exchange Line or mobile phone

Business Continuity Plan

Lighting

Table and chairs

Heating

Laptop or mobile phone

Paper and stationery

Torches (or Torch App on mobile phone)

First Aid kit

Postal franking machine/ stamps

Multi-Functional Device

Whiteboard

Flip Chart

Radio (or Radio App on mobile phone)

Refreshments

Page 16: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Melanie Horner

Approved: Shashi Rao

01 December 2019 Page 1 of 1 Appendix 2c: Issue 6

PRESS OFFICE – DEALING WITH THE MEDIA

Marketing and Communications have to be alerted and briefed as a priority. If a significant incident involved the emergency services, the local and then the national media would know within minutes.

Nominated spokespeople are:

UK Head of Delivery

Human Resources Manager

The above personnel are aware of their potential roles in the event of an incident.

Unless the circumstances are exceptional it is likely that a single person would handle media enquiries. This is the preferred option as it is easier to provide a consistent message.

For family, colleagues and friends of those involved in a serious incident the media – local radio and TV, etc. – are often their primary source of information. The media can also very quickly colour the perception of an event and its causes. It goes without saying, therefore, that the person dealing with media enquiries has to be kept fully informed in real time of new information and developments.

Some spokesperson guidelines:

1. The default approach is to allow no media on site, hold no press conference and give no face-to-face interviews with radio or TV – those are situations where it is easy to lose control. Handle all enquiries via telephone conversations with nominated company’s spokespersons/Marketing and Communications.

2. QuEST representatives should always appear open and available even if there is very little to say.

3. Never release personal information on individuals until next of kin/ families have been informed and then only in terms of their name and position within the Company. No private addresses are to be shared – the emergency services are the source for that information.

4. Keep everything factual. Express regret/ sorrow in very measured terms in case of an external interpretation of the Company’s culpability. Do not speculate - ever. Stick to what you know.

Page 17: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Melanie Horner

Approved: Shashi Rao

01 December 2019 Page 1 of 1 Appendix 2d: Issue 7

HUMAN RESOURCES

RISK SCENARIOS AND PLANNED CORRECTIVE ACTION

1. Total loss of facility

1.1. The Human Resources Manager or most senior HR member available will be part of the Recovery Committee and will be responsible for the following:

1.1.1. Liaison with staff – Provision of employee contact details. Access to HRIS can be gained from off site.

1.1.2. Liaison with relatives – Provision of next of kin details. Access to HRIS can be gained from off site.

1.1.3. Liaison with hospitals/emergency services – Refer to Appendix 2h – Useful Contact Details

1.1.4. Liaison with Marketing and Communications. Refer to Appendix 2c - Dealing with the Media and to Appendix 2h – Useful Contact Details.

2. Business interruption as a result of a pandemic

Personnel unable to attend workplace due to illness or prohibited from attending the workplace. Unavailability of key skills.

2.1. Refer to Appendix 2i - Pandemic Planning checklist

2.2. Liaise with Line Manager to review staffing levels

2.3. Liaise with Talent Acquisition Team to discuss staffing levels and identify recruitment

agency support requirements. Approved agency list with contact details is maintained on G:/Resourcing

3. Business interruption Union members withdraw labour

3.1. Liaise with union committee to find resolution

3.2. Liaise with Line Manager to review staffing level concerns

3.3. Liaise with Talent Acquisition Team as required. Approved agency list with contact details is maintained on G:/Resourcing

4. Personnel Following the death or incapacity of one or more senior management:

4.1. The most senior manager present continues the business of QuEST Global Engineering Ltd until relieved by a higher authority.

Page 18: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 1 of 8 Appendix 2e_Issue 6

IT/IS

RISK SCENARIOS AND PLANNED CORRECTIVE ACTION

1. Unauthorised Access to Customer and Company Data

Corrective action:

1.1. Establish extent of information compromised by reference to firewall and server logs

1.2. Shutdown user account(s) or firewall access to areas affected

1.3. Establish whether this is a system failure or a rogue user incident and take corrective action as appropriate

1.4. Prepare a written report for QuEST senior management, detailing the incident and the extent to which information was compromised

2. Loss of Server

Loss of a Single Server - Corrective action:

2.1. Establish extent of loss

2.2. If server hardware is recoverable and covered for the loss, log a call with the 3rd party maintenance provider. If not covered for the loss then identify cold spare location and retrieve hardware

2.3. Identify server importance to the business and decide whether to recover to a cold spare or whether to wait for a 3rd party hardware repair

2.4. Identify latest backup image and recover to staging area

2.5. Recover server and restore data as appropriate dependent on severity of failure and repair solution

2.6. If server restore required use of cold spare then order replacement hardware to maintain stock

Loss of Multiple Servers - Corrective action:

2.1. As above steps for single server, but refer to Appendix A, B and C for list of servers and suggested order of recovery

2.2. If insufficient, cold spare capacity then contact supplier(s) and arrange for a priority replacement of critical equipment.

2.3. Liaise with senior management and Recovery Committee for alternative location for servers and any deviation in the pre-defined priority list

Page 19: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 2 of 8 Appendix 2e_Issue 6

3. Virus Attack

Corrective action:

3.1. Establish extent and source of Virus attack

3.2. Shutdown systems or external connections as appropriate

3.3. Contact virus software vendor and request solution and removal instructions

3.4. Deploy new virus protection update to internal systems and internet facing systems

3.5. Clean-up infected systems and check for data loss, recover lost data from backup as appropriate

3.6. Investigate systems to determine cause of infection and review systems to see if any improvement of systems of procedures is required

3.7. Inform senior management of cause and solution

4. Malicious Damage

Corrective action:

4.1. Establish the extent of the damage/loss

4.2. If damage is to software or data then reinstall/restore as appropriate

4.3. If damage is to hardware then repair/replace as appropriate

4.4. Prepare a written report for QuEST senior management, detailing the incident and the extent of the damage and the cost

5. Failure of Maintenance Provider

Corrective action:

5.1. Establish the extent of the systems covered by the supplier and the contracts in place

5.2. Cancel any pending contract renewals with the failed supplier

5.3. Find other vendors by searching the internet and using professional contacts

5.4. Seek quotations from potential replacement suppliers

5.5. Purchase cover from new suppliers as appropriate

5.6. Pass contract details of failed supplier to Purchasing so that refund action can be looked into

Page 20: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 3 of 8 Appendix 2e_Issue 6

6. Loss or Failure of Backup Systems

Corrective action:

6.1. Establish the nature of the failure and determine whether the failure is Software or Hardware related and the extent of the systems that failed to back-up

6.2. Log a call with 3rd party maintainer

6.3. Establish whether there is an alternative method of backing up or duplicating the at risk data. If there is, then take appropriate action to protect the data until the system can be repaired

6.4. Once backup system is repaired, ensure that a full backup is performed at the earliest opportunity.

7. Loss of Site-to-Site WAN Link

Corrective action:

7.1. Establish the extent of the failure and which sites are affected

7.2. Contact the link provider to log the failure

7.3. Contact the affected site so that they are aware of any work around(s) that need(s) to be used during the outage

7.4. If outage is likely to be prolonged then liaise with site with a view to arranging for personnel to work from alternative sites.

8. Loss of Customer Managed Link

Corrective action:

8.1. Establish the extent of the failure, which Customer link is affected

8.2. Contact the customer so that they can arrange for their 3rd party provider to investigate the failure

8.3. Asses which services will be affected and what the work around(s) will be

8.4. Communicate the work around to the engineering teams.

Page 21: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 4 of 8 Appendix 2e_Issue 6

9. Telecommunications

9.1. The IT Server Room & Cisco Voice hardware (Cube) is located at QuEST UK HQ (Derby) building. An assessment will be made taking account of the circumstances as to the immediate priority for damage sustained to be rectified.

All voice and telephony is now managed via India voice team.

9.2. Requirements would be as follows:

9.2.1. Purchase new, commandeer or reallocate any mobile telephones for use by controller of the incident

9.2.2. Enable manual failover to second Cisco Cube, which is a cold spare, and advice India voice support to change routing of voip calls over MPLS.

9.2.3. Advise India Voice Team to redirect incoming telephone calls to an alternative QuEST-UK office (dependent on scale of incident)

9.2.4. Repair or purchase new firewall to enable external comms links.

10. Direct Exchange Lines

10.1. Purchase new, commandeer or reallocate any usable facsimile.

Page 22: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 5 of 8 Appendix 2e_Issue 6

Recovery Notes

Hardware Failure

1. All critical QuEST Hardware is covered by maintenance or warranty agreements giving a maximum of four hour response times. Where appropriate these would be used to rectify any faults with IT hardware.

2. QuEST holds a number of “cold spares” at other QuEST sites.

Software Failure

1. All critical QuEST Software is covered by maintenance or warranty agreements. Where appropriate these would be used to rectify any failures or to assist with the restoration of systems after any failure.

2. Software is stored online on the system across multiple sites and where appropriate is also stored in CDROM or DVDROM format at other QuEST sites.

Method of Restoration

1. Technical notes have been produced by the IT Team and contain all the technical information about the build and configuration of each major service.

2. Members of the IT department also hold the technical notes as well as being on the Network Drives in electronic form so that they are available regardless of the scenario faced.

Page 23: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 6 of 8 Appendix 2e_Issue 6

APPENDIX A – WSM CRITICAL PHYSICAL SERVERS

Note: With greater reliance on Virtual Server technology, the most important servers we have today are the VMWare Physical Servers. At least one server would need to be provisioned before any guest servers from Appendix-B could be restored.

QuEST Server Name Function Model Location Operating System

VMWare Physical Svr-1 VMH01WSM)

VMWare Services R720 Main Server Room

VMWare

VMWare Physical Svr-2 (VMH02WSM)

VMWare Services R720 Main Server Room

VMWare

VMWare Physical Svr-3 (VMH03WSM)

VMWare Services R720 Main Server Room

VMWare

BAK01WSM NetBackup Server R720XD Main Server Room

Linux

V240-01 Licence Server (Catia, MSC, Theorem, ICAD) NIS, Nastran, File/Print

Sun V240 Main Server Room

Solaris 10

LIC02WSM Physical Licence Server R710 Main Server Room

Win2008r2

Page 24: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 7 of 8 Appendix 2e_Issue 6

APPENDIX B – WSM VIRTUAL SERVERS

Note-1: The servers in this list are “guest” servers on our VMWare cluster, to begin restoring these servers you would need at least one physical server to have been provisioned.

Note-2: Because of the high level of change in the servers deployed, only those servers with a key role are identified in this table as a quick reference guide. A complete list of active servers is maintained as a working document at the following location - Q:\SYSTEMS\Tech_Notes\PC\Servers\QuEST_Server_Details. This document will form part of the electronic holding of the company BCP that is distributed to key personnel.

QuEST Server Name Function Model Location Operating System

VCS01WSM Virtual Centre Server VM Guest WSM VM Cluster Win2008r2

DC02WSM Domain Controller VM Guest WSM VM Cluster Win2008r2

PAY01WSM Pay Roll VM Guest WSM VM Cluster Win2012 R2

FS01WSM File/Print Server VM Guest WSM VM Cluster Win2012 R2

FS03WSM File/Print Server VM Guest WSM VM Cluster Win2012 R2

SQL01WSM SQL Server VM Guest WSM VM Cluster Win2012 R2

exch02wsm Email – Exchange CAS VM Guest WSM VM Cluster Win2008r2

exch03wsm Email – Exchange dB VM Guest WSM VM Cluster Win2008r2

Page 25: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Chris Parker

Approved: Shashi Rao

20 Feb 20 Page 8 of 8 Appendix 2e_Issue 6

APPENDIX C – WSM NON-CRITICAL SERVERS

Note: The following servers are physical servers and would be replaced after those in Appendix A as circumstances permit.

QuEST Server Name Function Model Location Operating System

APP02WSM Nastran Server R720 Main Server Room

Win2008r2

WHL-Server01 Leonardo Work IBM Main Server Room

AIX

WHL-Server02 Leonardo Work IBM Main Server Room

AIX

Page 26: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

14th February 2020 Page 1 of 2 Appendix 2f: Issue 7

FACILITIES MANAGEMENT

The role of the FTA team during an incident is to liaise with the Emergency Services and ensure that their orders are carried out, ensuring access to the facility as required.

If what appears to be a minor incident suddenly escalates, then the FTA team should not hesitate to call for security assistance or the Emergency Services if required.

A checklist for the FTA team is shown below:

1 Liaise with Emergency Services, Regulatory Advisers and Landlords

2 Secure (make safe) the facility or part of the building

3 Take stock (what is working; heating/lighting, etc.)

4 Inform the Recovery Committee

5 Isolate services if required

6 If necessary re-locate staff to alternate premises

RISK SCENARIOS AND PLANNED CORRECTIVE ACTION

Loss or Disruption of Essential Services

1. Postal Services

1.1. Contact Postal/ Courier Services to give new location

1.2. Deliver by car and/ or courier or re-post to alternative location

1.3. Purchase stamps

1.4. Purchase new franking machine and scales, if applicable

2. Catering

2.1. Food/ beverages could be prepared off site or purchased locally and brought in as required

3. Total Loss of Electricity

Page 27: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

14th February 2020 Page 2 of 2 Appendix 2f: Issue 7

Loss or Disruption of Essential Services

3.1. In the event of a total loss of electricity outside the scope of the existing UPS (and generator at Derby; NB: At Derby generator only powers IT office and Server Room in the event of power failure):

3.1.1. Inform the Landlord/Facilities and the accredited electrician. Appendix 2h – Useful Contact Details

3.1.2. Inform the specialist contractor of long term outage and arrangements so that provision of fuel can be made (Derby only) Appendix 2h – Useful Contact Details

3.1.3. Contact the specialist contractor, Landlord or Facilities to hire additional generator(s) and confirm delivery to site. Appendix 2h – Useful Contact Details

3.1.4. Liaise with the Landlord/Facilities and ensure the accredited electrician disconnects the existing supply and connects the site to a temporary generator of suitable capacity

3.1.5. If appropriate the Recovery Committee will ensure that the emergency procedure for shutting down power at Derby referred to in the Appendix 2f - Facilities Management is adopted (NB: Landlord responsibility at other sites)

4. Loss of Gas

4.1. In the event that there was a long-term loss of gas at Derby that occurred within the winter months:

4.1.1. Inform the Landlord and the accredited gas engineer. Appendix 2h – Useful Contact Details

4.1.2. Inform the Landlord/Facilities and the specialist contractor of long term outage and ensure arrangements are made for the provision of portable heater hire

4.1.3. If appropriate the Recovery Committee will ensure that the accredited gas engineer would isolate the mains gas supply at Derby only by following the emergency procedure referred to in Appendix 2f – Facilities Management (NB: Landlord responsibility; if applicable, at other sites)

5. Loss of Water

5.1. In the event that there was a long-term loss of water supply:

5.1.1. Inform the Landlord

5.1.2. Inform Facilities/specialist contractor of long term loss and ensure arrangements are made for the provision of no-mains portable toilet hire with hot hand washing heater hire and an alternative water supply. Appendix 2h – Useful Contact Details

5.1.3. If appropriate the Recovery Committee will ensure that the mains water supply is isolated at Derby only by following the emergency procedure referred to in Appendix 2f – Facilities Management

Page 28: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Wayne Harvey

Approved: Shashi Rao

01 Dec 19 Page 1 of 1 Appendix 2g: Issue 6

LEGAL

During major business interruption it is essential that business continuity is instantly recognised as a critical legal issue requiring immediate action. Contracts we enter into ordinarily have performance/schedule adherence obligations and penalties that in most instances carry dispensations where excusable delay has occurred and is demonstrable.

For the business to seek such protection under these areas of a contract it is essential to consider declaring a ‘force majeure’ event as quickly as possible upon business interruption becoming a clear probability.

A secondary reason is to engage our customers in recovery options and plans which may involve retrenching workshare back into their organisation with QuEST seconded resource, agreeing an offshore solution or 2nd Tier involvement.

Accordingly, guidance should be taken from the UK leadership and Legal as to who will fulfil this customer notification role that may necessitate, in certain circumstances, the formal issue of a ‘Notice’ under the appropriate contract condition.

A contact list of Customers and 2nd Tier suppliers is maintained in Appendix 2h – Useful Contact Numbers.

Copies of key strategic commercial contracts are stored electronically and held centrally by Legal at their Bangalore office.

Page 29: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 1 of 11 Appendix 2h: Issue 8

USEFUL CONTACT DETAILS

Appendix I Local HospitalsAppendix II Useful Telephone NumbersAppendix III First AidersAppendix IV Health & Safety Zone Representatives/ Fire MarshalsAppendix V ContractorsAppendix VI Key QuEST PersonnelAppendix VII Customer Base & Support

Page 30: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 2 of 11 Appendix 2h: Issue 8

APPENDIX I - LOCAL HOSPITALS

Name Address Telephone Number

Southmead Hospital Bristol Southmead RoadWestbury-on-TrymBristolBS10 5NB

0117 9505050

Countess of Chester Hospital Countess Of Chester HealthParkLiverpool RoadChesterCH2 1UL

01244 365000

Cygnet Hospital Derby City GateLondon RoadDerbyDerbyshireDE24 8WZ

01332 365434

Page 31: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 3 of 11 Appendix 2h: Issue 8

APPENDIX II – USEFUL TELEPHONE NUMBERS

Contact Details Telephone No.

Accommodation Premier Inn, BristolPremier Inn, ChesterPremier Inn, Derby

0871 527 81640871 527 82300871 527 8292

Conference Facilities Chester Grosvenor Hotel & SpaDerby Conference CentreHoliday Inn Express North Bristol

01244 32402401332 8618420871 902 1604

Landlord/Agent Bristol – Richard James Morfoot &PAL Trustees LtdDerby – Sanderson Weatherall RTCDerby – Geoff Todd (FM Manager)Saltney – Brymau EstatesSaltney – Out of Hours

07900 9841940117 908253801132 26485007850 57608201244 681220845 337 0545

Police Emergency/Terrorist ActivityNon-emergency

999101

Serviced Offices Rombourne, BristolRegus, ChesterDerby Conference Rooms

0845 6010 27001244 89310001332 224251

REGULATORY AUTHORITIES Telephone No.

Council Cheshire West and Chester CouncilDerby City CouncilSouth Gloucestershire Council

0300 123 812301332 29311101454 868009

Environmental Health The Environment Agency (IncidentHotline)

0800 807060

Fire Emergency Only 999 or 112

Flooding Environment Agency Flood line 0345 988 1188

Health and Safety The Health and Safety Executive(HSE)

029 2026 3000

NB: Contractor numbers are included separately in Appendix V

Page 32: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 4 of 11 Appendix 2h: Issue 8

APPENDIX III – FIRST AIDERS

Company First Aiders:

First Aiders Site

Sam Baker (responsible person) Bristol

Terri Barron Derby

Judy Smith Derby

Sarah Townsend (responsible person) Saltney

Page 33: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 5 of 11 Appendix 2h: Issue 8

APPENDIX IV – HEALTH & SAFETY ZONE REPRESENTATIVES/ FIRE MARSHALS

Health and Safety zone representatives/ Fire Marshals:

Health and Safety zone representatives/ Fire Marshals help to evacuate the building and report ifthey are aware of any missing person(s).

Health & Safety Representative Zone

Judy Smith Derby

Terri Barron – Ground floor Derby

Alberto Di Rito Derby

Sarah Townsend Saltney

Sam Baker Filton

Page 34: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 6 of 11 Appendix 2h: Issue 8

APPENDIX V – CONTRACTORS

Service Description Name Contact Details

Air Conditioning Richard Morfoot (Filton)Sanderson Weatherall(Derby)

07900 98419401332 264850

Building Supplies (Bricks in respectof flood prevention)

Jewson 0117 941 1641 (Filton)01332 363525 (Derby)01244 342171 (Saltney)

Catering Grubs Up (Filton)Gather and Gather(Derby)

0330 123 344707900 704244 (NathanKearney)

Cleaning Fairway SupportServices (Filton)Sanderson Weatherall(Derby)

01179594301

01332 264850

Computers Dell 01344 8604560844 4444712

Electrical R & B ElectricalInstallations (Filton)(Darren Redmond)

01453 827235

Fire Alarms APE Fire and Security(Filton)

0870 345 6227

Fire Alarm Monitoring APE Fire and Security(Filton)

APE Fire and Security(Filton)Passcode: 1854

Fire Extinguishers Rhino Fire Control 01278 422705

Fire Suppression (server room) Tyco Fire & Security 0161 455 4400

Flood Protection (sandbags) Jewson 0117 941 1641 (Filton)01332 363525 (Derby)01244 342171 (Saltney)

Furniture Blueprint Interiors Ltd 01530 223111

Intruder Alarms APE Fire and Security(Filton)

0870 345 6227

Page 35: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 7 of 11 Appendix 2h: Issue 8

Service Description Name Contact Details

Multi-Functional Devices DellSDS

01344 86045601278 723784

Plumbing Richard Morfoot (Filton)Sanderson Weatherall(Derby)

07900 98419401332 264850

Postal Services Royal Mail 01179 470124 (Filton)0845 722 3344 (Derby)01244 679545 (Saltney)

Siteguard Access Control ADT 0870 600 600501454 843539

Spill Containment & Collectionspecialists

Safety-Kleen UK 01332 290345 (Derby)01179 575011 (Bristol)01244 660184 (Saltney)

Toilets (Portable Toilet Hire) Chew Valley Hire LtdDove LoosCestrian Loos

01761 221105 (Filton)01335 361058 (Derby)01829 261312 (Saltney)

Servers (Sun, IBM PC) IT DepartmentChris ParkerAlberto Di-RitoRob Southcombe

07787 26155707469 02009207740 322673

Water (Alternative Water Supply;emergency water and emergencybottled water)

Water Direct 0345 345 1725

Page 36: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 8 of 11 Appendix 2h: Issue 8

APPENDIX VI – PERSONNEL CONTACTS LISTKEY PERSONNEL UK

Name Job Title Mobile Number

Shashi Rao Head of UK Delivery 07557 950827

Vinay Paliya Centre Manager - RR 07876208778

Santiago Mendez Centre Manager – NewBusiness

07557578863

Chris Parker IT 07787 261557

Melanie Horner Human Resources Manager 07740 322720

Sarah Townsend Delivery Manager -Broughton

07825710131

Satheesh BN Engineering Manager –Concessions, Broughton

07827 882639

Andrew Ullathorne Centre Manager -Aerostructures

07990139456

Jayne Gosney Executive Assistant toAndrew Lewis and LawtonGreen

07824886807

Judy Smith Office Admin - Derby 07880400687

KEY QUEST GLOBAL PERSONNEL

Name Job Title Contact Number

Andrew Lewis Vice President - Head ofEuropean Delivery

(M) 07785 715918

Vijayshyam Acharya Associate Vice President -Legal

(T) +91 80 6709 000(X) 1302

Robert Harvey President of StrategicAccounts

(T) +01 860 290 1145(X) 8200(M) +1 860 573 5950

Shrikanth Naik Senior Vice President ofGlobal Delivery

(T) +91 80 6709 0000X: 1908(M) +91 9845 346505

Page 37: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 9 of 11 Appendix 2h: Issue 8

Shankar Narayanan K V Associate Vice President -FTA Global

(T) +91 80 4119 0900(X) 3355(M) +91 9845 674780

Niketh Sundar Senior VP Human Resources (T) +91 80 6709 0000(X) 1888(M) +91-9611 103646(M) +91 9008 317749

Page 38: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 10 of 11 Appendix 2h: Issue 8

APPENDIX VII – CUSTOMER BASE & SUPPORT

Contact Name Contact Details

Rolls-Royce Plc Simon BurrEngineering and Technology Director(Civil Aerospace)Mike WhiteheadDirector of Engineering andTechnology, Civil AerospaceOperationsDean FellHead of Group Categorymanagement, Global IndirectPurchasingRebecca KiddGlobal Commodity Manager – GBSProcurement – Category Management& SourcingAngela KinseyBuyer, Engineering Services andResearch & Technology

+44 (0)1332 24964007825 974722

+44 (0)1332 244810

+44 (0)1332 33372407973 486162

+44 (0)7973 485724

+44 (0)7581 622015

Airbus OperationsLimited

James BuckOutsourcing and Offshoring

Danny Shallish-MooreHO Change and Performance

(M) 07793 905211(T) 0117 936 3434(T) 01244 524926(M) 07979506365

Leonardo Helicopters Terry ButlerProcurement Manager

Jim HawkBusiness Planning Manager(Engineering)

(T) 01935 703738(M) 07980 864049

(T) 01935 702219

UTAS ActuationSystems,Wolverhampton

Simon HardimanHead of Operational Excellence,Wolverhampton Site – Actuation &Propeller Systems

(T) 01902 624782(M) 07990 540158

Page 39: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Mel HornerApproved: Shashi Rao

10 Feb 20 Page 11 of 11 Appendix 2h: Issue 8

Contact Name Contact Details

Collins Aerospace,Wolverhampton

John EnglandGeneral manager, WolverhamptonSite – Actuation & Propeller Systems

(T) 01902 624574(M) 07970 653182

BombardierTransportation

Kathryn WoodcockHead of Partnering – UK, PartneringTeam, Global EngineeringRichard SlaneyHead of Procurement & Supply Chain– Derby, Bombardier TransportationHead of Procurement

(M) 07736 101817

(T): +44 (0)1332 266059(M): +44 (0) 7824 087 954

Leonardo Aerospaceand Defence

Steve CousinsProcurement Manager – New MarketsLeonardo Airborne & Space Systems

(M): +44 (0) 131 343 5046

Page 40: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

18th February 2020 Page 1 of 5 Appendix 2i: Issue 5

BUSINESS PANDEMIC PLANNING CHECKLIST

1.1 Plan for the impact of a pandemic on our business:

Tasks Not Started In Progress Complete

Identify a pandemic coordinator and/or team with defined roles and responsibilities for preparedness and response planning

Identify key personnel and other critical inputs (e.g. suppliers, sub-contractor services/products and logistics) required to maintain business operations by location and function during a pandemic

Train and prepare ancillary workforce (e.g. contractors, employees in other job titles/descriptions, retirees)

Determine potential impact of a pandemic on company business financials using multiple possible scenarios that affect different product lines and/or sites

Determine potential impact of a pandemic on business-related domestic and international travel (e.g. quarantines, border closures, etc.)

Find up-to-date, reliable pandemic information from community public health, emergency management, and other sources and establish sustainable links

Establish an emergency communications plan and revise periodically. This plan includes identification of key personnel (with back-ups), chain of communications (including suppliers and customers), and processes for tracking and communicating business and employee status

Implement an exercise/drill to test your plan, and revise periodically

Page 41: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

18th February 2020 Page 2 of 5 Appendix 2i: Issue 5

1.2 Plan for the impact of a pandemic on our employees and customers:

Tasks Not Started In Progress Complete

Forecast and allow for employee absences during a pandemic due to factors such as personal illness, family member illness, community containment measures and quarantines, school and/or business closures, and public transportation closures

Implement guidelines to modify the frequency and type of face-to-face contact (e.g. hand-shaking, seating in meetings, office layout, shared workstations) among employees and between employees and customers

Encourage and track annual influenza vaccination for employees

Evaluate employee access to and availability of healthcare services during a pandemic, and improve services as needed

Evaluate employee access to and availability of mental health and social services during a pandemic, including corporate, community, and faith-based resources, and improve services as needed

Identify employees and key customers with special needs, and incorporate the requirements of such persons into your preparedness plan

Page 42: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

18th February 2020 Page 3 of 5 Appendix 2i: Issue 5

1.3 Establish policies to be implemented during a pandemic:

Tasks Not Started In Progress Complete

Establish policies for employee compensation and sick-leave absences unique to a pandemic (e.g. non-punitive, liberal leave), including policies on when a previously ill person is no longer infectious and can return to work after illness

Establish policies for flexible worksite (e.g. telecommuting) and flexible work hours (e.g. staggered shifts)

Establish policies for preventing pandemic spread at the worksite (e.g. promoting respiratory hygiene/cough etiquette, and prompt exclusion of people with influenza symptoms)

Establish policies for employees who have been exposed to pandemic influenza, are suspected to be ill, or become ill at the worksite (e.g. infection control response, immediate mandatory sick leave)

Establish policies for restricting travel to affected geographic areas (consider both domestic and international sites), evacuating employees working in or near an affected area when an outbreak begins, and guidance for employees returning from affected areas (refer to Foreign Office travel recommendations)

Set up authorities, triggers, and procedures for activating and terminating the company's response plan, altering business operations (e.g. shutting down operations in affected areas), and transferring business knowledge to key employees

Page 43: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

18th February 2020 Page 4 of 5 Appendix 2i: Issue 5

1.4 Allocate resources to protect our employees and customers during a pandemic:

Tasks Not Started In Progress Complete

Provide sufficient and accessible infection control supplies (e.g. hand-hygiene products, tissues and receptacles for their disposal) in all business locations

Enhance communications and information technology infrastructures as needed to support employee telecommuting and remote customer access

Ensure availability of medical consultation and advice for emergency response

1.5 Communicate to and educate our employees:

Tasks Not Started In Progress Complete

Develop and disseminate programs and materials covering pandemic fundamentals (e.g. signs and symptoms of influenza, modes of transmission), personal and family protection and response strategies (e.g. hand hygiene, coughing/sneezing etiquette, contingency plans)

Anticipate employee fear and anxiety, rumours and misinformation and plan communications accordingly

Ensure that communications are culturally and linguistically appropriate

Disseminate information to employees about our pandemic preparedness and response plan.

Page 44: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

18th February 2020 Page 5 of 5 Appendix 2i: Issue 5

Tasks Not Started In Progress Complete

Provide information for the at-home care of ill employees and family members

Develop platforms (e.g. hotlines, dedicated websites) for communicating pandemic status and actions to employees, vendors, suppliers, and customers inside and outside the worksite in a consistent and timely way, including redundancies in the emergency contact system

Identify community sources for timely and accurate pandemic information (domestic and international) and resources for obtaining counter-measures (e.g. vaccines and anti-virals)

1.6 Coordinate with external organisations and help our community:

Tasks Not Started In Progress Complete

Collaborate with insurers, health plans, and major local healthcare facilities to share our pandemic plans and understand their capabilities and plans

Collaborate with local public health agencies and/or emergency responders to participate in their planning processes, share our pandemic plans, and understand their capabilities and plans

Communicate with local and/or public health agencies and/or emergency responders about the assets and/or services our business could contribute to the community

Share best practices with other businesses in your communities, chambers of commerce, and associations to improve community response efforts

Page 45: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

02 January 2020 Page 1 of 2 Appendix 2j: Issue 5

ENVIRONMENT

FLOODING

In the event that flooding is broadcast at Derwent House, RTC Business Park, flood prevention bags, bricks and wood will be supplied by the maintenance team from Sanderson Wetherall to reduce the damage of floodwater to the business. (NB: This is the Landlord’s responsibility at other UK sites)

RISK SCENARIOS AND PLANNED CORRECTIVE ACTION

1. Flooding

1.1. Minimising floodwater entry and damage

1.1.1. Placing of sandbags and wood outside of doors, window frames and vents will be done by the maintenance team from Sanderson Wetherall to reduce the amount of water entering the property

1.1.2. Do not permanently seal any vents, in particular on the boiler house as permanently blocking is hazardous

1.1.3. Store hazardous materials at high level. Chemicals such as cleaning products, paint may spill or leak into floodwater causing additional environmental problems

1.2. Essential Services

1.2.1. Turn off gas, electricity and water at the mains - see Appendix2f – Facilities Management

1.3. Furniture and Equipment

1.3.1. Unplug all electrical appliances in particular IT equipment and store at least at desk height

1.3.2. Empty contents of large appliances and raise above floor level using bricks or blocks (this may be particularly helpful for fridge freezers)

1.3.3. Move furniture away from walls as this will help with drying the property later

1.3.4. If items of furniture cannot be moved, weigh them down with a heavy object or stack them together to prevent furniture floating should the flood become severe.

1.4. Outside the business

1.4.1. Move vehicles to higher ground if possible

1.4.2. Move anything kept outside and not fixed to the ground to a safer location, e.g. waste containers, car oil, etc.

1.5. Some post flood MANDATORY requirements

1.5.1. Dry out all appliances affected by floodwater and get a qualified electrician, GAS SAFE registered gas engineer or plumber to inspect before use

Page 46: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

UK DELIVERY

BUSINESS CONTINUITY PLAN

Prepared: Judy Smith

Approved: Shashi Rao

02 January 2020 Page 2 of 2 Appendix 2j: Issue 5

1.5.2. After flooding do not reconnect gas, electricity and water supplies until checked by an accredited engineer.

Be prepared for flooding

In recent years the UK has witnessed several major flood events and scientists predict that climate change could lead to more frequent flooding in the future so it is important that we are all aware and prepared.

Stay safe in a flood

Switch off water, gas and electricity supplies at the first sign of flooding to property

Floods can kill. Don’t try to walk or drive through floodwater – six inches of fast flowing water can knock a person over and two feet of water will float a car

Manhole covers may have come off and there may be other hazards that cannot be seen

Never try to swim through fast flowing water – you may be swept away or be struck by an object in the water

Don’t walk on sea defences, riverbanks or cross river bridges – they may collapse in extreme conditions

Avoid contact with floodwater – it may be contaminated with sewage

Page 47: UK DELIVERY BUSINESS CONTINUITY PLAN Prepared: Recovery

5 February 2020Appendix 2kIssue 1

UK DELIVERYBUSINESS CONTINUITY PLAN

Prepared: Chris ParkerApproved: Shashi Rao

Total Number of Tests:0

Pass 0OK 0Fail 0 Test Plan Results Version No: v1.0

Not Tested 0 Tested By:Start Date: 18-Jun-20

Finish Date: 22-Jun-20

Comments:

Test No: Function To Be Tested: Pre-requisites:How to be Tested

(Including Sample Criteria /Data Input):

Expected Result (Action /Output): Tested By: Result (Action/Output): Pass\Fail

Action Taken if Failed: e.g."Logged Test Database -

Allocated to XX"1 Core Services - Domain

Services, Exchange, File Data,Currrent and most recent incremetanl and full backuptapes. Once the system has been failed over and DNSentries have been updated, proceed to system tests

Restore LTO tapes to baremetal hardware required by3rd party vendor

CP As expected

23456789

101112

Testing to Simulate Disaster Recovery in the QuEST UK Environment