Business Continuity Planning - A guide to developing the plan
Tuesday September 16, 2014"As a business owner it is important to plan for the worst. Using a business continuity plan can help keep you on the right track" Wendy Light | firstname.lastname@example.org PLAN COMPONENTS The following is guidance for developing your Business Continuity Plan. It includes the basic components of a Plan and outlines the steps in developing and implementing the Plan. Executive Summary The executive summary gives management a brief overview of: the purpose of the plan; the facility's emergency management policy; authorities and responsibilities of key personnel; the types of emergencies that could occur; and where response operations will be managed. Emergency Management Elements This section of the plan briefly describes your approach to the core elements of emergency management, which are: Direction and control Communications Life safety Property protection Community outreach Recovery and restoration Administration and logistics These elements are the foundation for the emergency procedures that your facility will follow to protect personnel and equipment, and resume operations. Emergency Response Procedures The procedures spell out how the facility will respond to emergencies. Whenever possible, develop them as a series of checklists that can be quickly accessed by senior management, department heads, response personnel and employees. Determine what actions would be necessary to: Assess the situation; Protect employees, customers, visitors, equipment, vital records and other assets, particularly during the first three days; and Get the business back up and running. Specific procedures might be needed for any number of situations such as bomb threats or tornadoes, and for such functions as: Warning employees and customers Communicating with personnel and community responders Conducting an evacuation and accounting for all persons in the facility Managing response activities Activating and operating an emergency operations center Fighting fires Shutting down operations Protecting vital records Restoring operations Support Documents - Documents that could be needed in an emergency include: Emergency call lists — lists (wallet size if possible) of all persons on and off site who would be involved in responding to an emergency, their responsibilities and their 24-hour telephone numbers Building and site maps that indicate: Utility shutoffs Water hydrants Water main valves Water lines Gas main valves Gas lines Electrical cutoffs Electrical substations Storm drains Sewer lines Location of each building (include name of building, street name and number) Floor plans Alarm and enunciators Fire extinguishers Fire suppression systems Exits Stairways Designated escape routes Restricted areas Hazardous materials (including cleaning supplies and chemicals) High-value items Resource lists — Lists of major resources (equipment, supplies, services) that could be needed in an emergency; mutual aid agreements with other companies and government agencies. THE DEVELOPMENT PROCESS Identify challenges and prioritize activities - Determine specific goals and milestones. Make a list of tasks to be performed, by whom and when. Determine how you will address problem areas and resource shortfalls. Write the Plan - Assign each member of the planning group a section to write. Determine the most appropriate format for each section. Establish an aggressive timeline with specific goals - Provide enough time for completion of work, but not so much as to allow assignments to linger. Establish a schedule for: First draft Review Second draft Conduct tabletop exercise (see step 7) Final draft Printing Distribution Establish a training schedule - Have one person or department responsible for developing a training schedule for your facility. Coordinate with outside organizations - Meet periodically with local government agencies and community organizations. Inform appropriate government agencies that you are creating an emergency management plan. While their official approval may not be required, they will likely have valuable insights and information to offer. Determine State and local requirements for reporting emergencies, and incorporate them into your procedures. Determine protocols for turning control of a response over to outside agencies. Some details that may need to be worked out are: Which gate or entrance will responding units use? Where and to whom will they report? How will they be identified? How will facility personnel communicate with outside responders? Who will be in charge of response activities? Determine what kind of identification authorities will require to allow your key personnel into your facility during an emergency. Maintain contact with other corporate offices - Communicate with other offices and divisions in your company to learn: Their emergency notification requirements The conditions where mutual assistance would be necessary How offices will support each other in an emergency Names, telephone numbers and pager numbers of key personnel Incorporate this information into your procedures. Review, conduct training and revise - Distribute the first draft to group members for review. Revise as needed. For a second review, conduct a tabletop exercise with management and personnel who have a key emergency management responsibility. In a conference room setting, describe an emergency scenario and have participants discuss their responsibilities and how they would react to the situation. Based on this discussion, identify areas of confusion and overlap, and modify the plan accordingly. Seek final approval- Arrange a briefing for the chief executive officer and senior management and obtain written approval. Distribute the Plan - Place the final plan in three-ring binders and number all copies and pages. Each individual who receives a copy should be required to sign for it and be responsible for posting subsequent changes. Determine which sections of the plan would be appropriate to show to government agencies (some sections may refer to corporate secrets or include private listings of names, telephone numbers or radio frequencies). Distribute the final plan to: Chief executive and senior managers Key members of the company's emergency response organization Company headquarters Community emergency response agencies (appropriate sections) Have key personnel keep a copy of the plan in their homes. Inform employees about the plan and training schedule.