Business Continuity Plan Development: Step-by-Step

Business Continuity Plan templates shown in the Business Continuity Plan Video

A good way to visualise a business continuity plan is to think of it as a framework, rather than a huge document that describes a detailed process to be followed. Believe, me no-one uses these gargantuan documents during a crisis, they need information that they can access and understand quickly.  That's why effective business continuity plan development generates several different types of document, some which help later stages of development and some which are used for reference purposes and others - the really important ones that can be used when disaster strikes.  So here's a list and examples of the most important templates that you'll see in our business continuity plan development video:

 

Priorities Assessment. This is the initial stage of business continuity plan development. Some call it a Business Impact Assessment (or "BIA"), others may refer to it as a risk assessment.  What we decide to call it is less important than what this step actually does which is the process of identifying the most important activities that would want to keep running to keep your customers comfortable and assure the survival of your organisation. Once you have identified what is important you can then start to consider what your overall capabilities are to meet these priorities, especially  in terms of people, premises, IT and other resources. Our plan template for this is based on an excel spreadsheet, this helps you capture the information you need and identify and analyse this information

Core capabilities. It's your core capabilities for recovering IT systems, providing alternative workplace arrangements and acquiring alternative equipment that will determine whether or not your organisation has the intrinsic ability to restore your organisation to an acceptable operational level. This stage draws in colleagues from the areas of the organisation that deliver these core capabilities and captures their feedback on what they can currently provide and whether this is sufficient to meet the organisations business continuity priorities.

Departmental Plans. This is where we get down into the "nitty gritty" of how the organisations activities are restored after certain types of disaster. Having established what can be done in terms of IT systems, alternative working arrangements and equipment, we get to the stage of defining actions plans for specific activities, deciding who does what where and when and who they need to communicate and collaborate with.  These "plans" are working documents that describe key actions, team members, roles and relationships

Communications Framework. This part is the glue that holds together departmental action plans and the core capabilities recovery activities.  Also factored in are communications needs external to the organisation such as suppliers and customers.  The communications framework helps to define who will be responsible for communicating with particular groups and how that communication will be effected.

If you are ever asked the question "Why is a business continuity plan important?"

During the course of developing your business continuity plan you may run into some scepticism and some might this question.  The purpose of a business continuity plan is to keep employees safe and preserve customer and stakeholder relationships during a crisis. Organisations of all sizes have experienced significant operational disruptions and had some unwelcome publicity into the bargain. so if you need a little proof that "accidents happen" our business continuity incidents log (which we update frequently) will help you to demonstrate that business continuity planning is more than just an academic exercise or something you do to keep auditor happy.  The business continuity incidents log is also a useful tool for business continuity plan development because you have the opportunity to look at real-life cases and ask the question "how would we deal that, what would we do in this situation?". This is really helpful when you are in stages two and three of module one as it gives some tangible issues to consider when developing recovery plans.

Cyber%20Exchange_Member%20Badge_Full.png

RiskCentric | Cambridge, United Kingdom | enquiries@riskcentric.co.uk | Tel: +44 (0)1353 667374