Business Continuity Plan Template - Fordham … every business process will require a full business continuity plan. ... manager, who in turn will ... Business Continuity Plan Template

Business Continuity Plan Template

04 Fordham University BCP Requirements 110111 FINAL Page 1 of 14 Last Updated 11/01/11

Business Continuity Plan

The following is a list of possible items that you should consider placing in your Business Continuity Plan (BCP). Your BCP is not about format and it is not about how good it looks, it is about how well it will work for you and your department when you are standing outside of the yellow tape.

1. BUSINESS CONTINUITY PLAN INTRODUCTION ................................................................................................................ 2

2. BUSINESS PROCESS DESCRIPTION ................................................................................................................................... 2

3. EMERGENCY COMMUNICATION TEAM ........................................................................................................................... 3

4. EMERGENCY COMMUNICATION ESCALATION PROCEDURES .......................................................................................... 3

A. INTERNAL COMMUNICATIONS ..................................................................................................................................................... 3

B. EXTERNAL COMMUNICATIONS .................................................................................................................................................... 3

C. SENIOR MANAGEMENT COMMUNICATIONS ................................................................................................................................... 4

5. BUSINESS CONTINUITY TEAM ......................................................................................................................................... 4

6. ORGANIZATION CHARTS ................................................................................................................................................ 5

7. CRISIS COMMUNICATION CHART ................................................................................................................................... 5

8. EXTERNAL CRISIS CONTACT INFORMATION .................................................................................................................... 5

9. CONSTITUENTS BEING SERVED BY THE BUSINESS PROCESS ............................................................................................ 6

10. OFFICE INVOLVED IN THE BUSINESS PROCESS ............................................................................................................ 6

11. ALTERNATE WORK LOCATION .................................................................................................................................... 7

12. HUMAN RESOURCE’S DEPARTMENT NEW EMPLOYEE INTRODUCTION TO THE BCP ................................................... 7

13. MANUAL PROCEDURES .............................................................................................................................................. 7

14. CONTACT INFORMATION ........................................................................................................................................... 9

15. VENDOR INFORMATION ...........................................................................................................................................10

16. SCHEDULES ...............................................................................................................................................................11

17. DEPARTMENT STANDARD OPERATING PROCEDURES ...............................................................................................11

18. POLICIES AND PROCEDURES .....................................................................................................................................11

19. FORMS .....................................................................................................................................................................12

20. OFFICE REQUIREMENTS ............................................................................................................................................12

21. DEPENDENCIES .........................................................................................................................................................12

22. APPLICATION RECOVERY PROCEDURES .....................................................................................................................13

23. SALVAGE & RESTORATION ........................................................................................................................................13

24. TRAINING .................................................................................................................................................................13

25. TABLE TOP EXERCISE .................................................................................................................................................14

26. ADDITIONAL INFORMATION .....................................................................................................................................14



1. Business Continuity Plan Introduction Return

Not every business process will require a full business continuity plan. In some cases there may be a limited number of manual steps that can be put in place if the entire process is computerized. Without computer access, there may be no services that can be provided. If no services can be provided, how you will communicate this information to the recipients of the services must be documented. What will the people that would normally do the work do? How will you go back and pick up the backlog when the systems do come back online, etc. The BCP should be developed for every business process within each department and for every location that you serve. Services provided at your main office on the Rose Hill Campus may be different from the services you provide at the Lincoln Center Campus or other Fordham sites; therefore, your plan must reflect those differences. In some cases the people that are implementing the BCP are people that do not normally make ‘budget’ decisions. In other words, they may not make decisions that involve spending money unless pre-approval has been given. In a disaster situation, approval may be the last thing that someone may have an opportunity to acquire. So it is important that in your plan you put as many pre-determined decisions as possible as to how you would approach situations. For instances, is it ok to go out and purchase office supplies even though it may not be through a normal source? Is it ok to rent a conference room at a local hotel to have sufficient space to work for a short period of time, if access to the facility is deemed unsafe, if upper management approval is not available? Can you rent vehicles if you need to? Can you bring in outside assistance if you deem it necessary? Do you have limits on funds you could spend? These types of questions need to be discussed as you put your BCP together. It is impossible to know what all of the questions would be, in the same way it is impossible to understand absolutely every possible disaster that could occur. You must develop a BCP that is flexible to deal with any situation that could come up, while at the same time providing direction to staff as to what the expectations will be. The BCP provides guidance and information. The knowledge and experience of your staff when executing the BCP will provide for a successful conclusion.

2. Business Process Description Return Provide a description of the business processes that are being included in the BCP. You may want to list the business processes by rank. List Tier 1 applications first, Tier 2 second etc. If you have sub-processes within a main business process, you can identify them here as well. By definition, Tier 1 business processes will need to be addressed first. In many cases you may never get below a Tier 1 when responding to a disaster, since all of your manpower may be directed to this effort. In other cases, it may be lower tiered business processes that can actually be down, since they may not be as computer-dependent as high tier business processes. For this reason it is very important to document carefully how you will respond to each of the business processes in your department, including the sub-processes.



3. Emergency Communication Team Return Identify members of your Emergency Communication Team as one of the first steps in setting up your BCP. This team will be made up of people who will provide information to the senior department manager, who in turn will pass this information on to senior management. There needs to be at least two people (a primary and a backup) identified for each location where you have an office presence. It will be these people that will be relied on to provide information regarding the status of the situation. These people may not be the most senior people on site at these locations, and they may not be the most technically competent if it is a technical environment. But they are the people that are most likely to always be on site at the location. They would be the two people most likely to be on site if something were to happen, and therefore would be able to provide information to management as to what was going on. They don’t go to a lot of meetings, don’t go off site for lunch that often, are not off site at conference on a regular basis, etc. They are the people you rely on to always be there. They are the people that you will rely on to provide information if a disaster were to occur. They can inform you what the police or fire departments are saying or not saying by virtue of their actions. They can give you an onsite view of what is happening. The worst thing that occurs during disasters is the third or fourth hand stories about the situation. Inevitably these stories are wrong and in some cases tragically wrong. So as best you can, you want your Emergency Communication Team to be your onsite eyes and ears to what is going on.

4. Emergency Communication Escalation Procedures Return Within your BCP you must have three emergency communication escalation procedures.

a. Internal Communications Return The first is the internal communications that you conduct within the department. This first team is how your department will communicate internally and insure that everyone in the department understands that there is a problem, what the problem is, how it happened, when it happened, how long you think it will take to correct the problem, what groups outside the department are aware of the problem, whether it involves outside authorities, whether or not outside vendors are involved etc. This communication needs to be broken down into during office hours and outside of office hours. Special consideration should be given to long weekends and holidays such as Thanksgiving, Christmas, New Years, Good Friday / Easter, July 4th, Memorial Day and Labor Day, since these tend to be times when families plan to be away from home for extended periods of time. During these times, it may be more difficult to get in touch with staff members that have taken extend time off by adding vacation time to their long weekends.

b. External Communications Return The second is the external communications to your ‘customers’ that receive services from your department. It is important that you communicate to your constituency and inform them that you are



having problems and may not be able to meet your obligations to provide services. They may be aware of the problems due to the fact it is campus wide and they are also affected, or it may be a regional problem. Even if you think they are aware of the problem, you should still make a point of trying to reach out to them to inform them of what your BCP is doing to continue to provide services, even if on a limited basis. Let them know that you are aware of how important the service is to them and that you will do all that you can to meet their requirements. Let them know that you will work with their staff to make whatever manual arrangements can be made. Find out if your users have designated certain people that they want you to work with on the problem. Do not assume you know who you should be working with since people change and depending on the circumstances, some people may not be available. Verify your contacts as you go forward to provide even limited services.

c. Senior Management Communications Return The third communication is what you have in place for senior management communications. Make sure that you know how to get in touch with your boss and your boss’s boss so that the communications can go up the line to insure that the extent of the problem is communicated and the efforts to correct the problem are being clearly explained to senior management. Again you want to avoid third or fourth parties trying to assist you in providing information on your department’s behalf. Communication will make your business continuity plan go as smoothly as it can possibly go. Will it allow it to be perfect? Absolutely not! But without good communications, you can be assured it will go very badly.

5. Business Continuity Team Return All members of your department will be members of your BCP team. Each department member will have a role to play, even if it is a small role, in the continuity of services for your department. In addition, you may also want to include people from other departments in your team that can provide assistance to your team or that will be able to provide information from their team regarding the services they may be able to provide. It is possible to include people from companies outside the organization to participate as team members; however, this would only be in special cases where the vendor provided specific services that could not be provided inside the organization, or the services were provided by the vendor on an outsourced basis. As a result, there may be a need to have a number of vendor staff as part of the recovery team. In this case the vendor staff must not only agree, but must be contractually obligated to participate in the event of a disaster. Not all team members will have the same functions or roles to play on the team. The team makeup will vary from team to team; however, a typical team may look like the following;

BCP Team Manager Alternate BCP Team Manager BCP Team Members – from the department BCP Team Members – from outside the department BCP Team Members – from a vendor company



The roles of each participant on the team must be defined when the team is setup so that people are aware of what their roles are. These roles will become better defined as table top exercises (TTE) are conducted. During the TTE, you want all team members participating. TTEs will be further discussed later in this document. It is important on a semi-annual basis that you review the BCP with all members of your staff, your BCP team, so that they are aware of any changes to the plan and that new team members are made aware that they have a role to play in the BCP.

6. Organization Charts Return Organizational charts are always helpful, especially if you have people coming into the department to assist that are not used to the department. This could be vendors, or it could be people from other departments that have come over to assist in the manual efforts. They will benefit from seeing the organizational chart. It can show them who they will be working with; it can also assist in illustrating work flow throughout the department. You will want to keep the organizational chart updated at least quarterly, if not monthly, depending on how frequently changes occur in the department. You may also want to keep copies of all university organizational charts because, during an outage, these charts could prove invaluable in helping to determine whom to contact for information from other departments.

7. Crisis Communication Chart Return Any time a department experiences a disaster or any type of disruption in services it will cause problems. Any time you have problems; other people will want to know what is going on. Depending on the complexity of your department and the complexity of the services you provide, you may want to establish a crisis communication chart to follow depending on what is happening. The crisis communication chart will look like a typical decision chart: if this, then do that, if not this, then do that, etc. Determining how you will communicate and to whom prior to a disaster can be a big help, especially if key people are absent at the start of the emergency or disaster. Review this chart from time to time to determine if more should be added to it or if any parts of it should be modified or removed.

8. External Crisis Contact Information Return External contact information such as local emergency numbers for the police, fire etc. that are not the 911 numbers often times we think of for police and fire. They do have community information numbers. These are numbers that you can call and find out from them information regarding road closures, or other information that is not appropriate to get by dialing 911. These numbers can be found in the phone book and can be listed in your plan or at least have a reference for an Internet site you can go to for your local area.



Before you contact the local police or emergency services, clear it with your organization. Make sure it is ok to do; you don’t want multiple people conversing with the police or emergency services regarding the same matters.

9. Constituents Being Served by the Business Process Return In this section of your plan, you want to list the people that are being served by the various business processes that you have in your department. Not only will this be a list of the departments that you are serving, but it should also include ways to contact these people in the event of a disaster. If you can no longer perform these services in the same manner or in the same timeframe, you will be affecting not only the services you provide but the timeliness of these services. As a result, the recipients of the services may have to make alternate arrangements or change their schedules to accommodate the change in services or timing of services. You should also recognize that when a disaster occurs, it could be department specific and only impact your department and no other parts of the university. As a result, those departments that you support will still be expecting services. Communication is critical in an area-wide disaster, a campus-wide disaster or even a department-specific disaster. In this section, list the names of the people that you have the most contact with and what specific area or service that they are involved with. Document the ways to contact them: office phone, cell phone, e-mail, address, personal e-mail (if they will give it to you) and any other contact information they may be willing to share, such as spouses / significant others’ e-mail or cell phone, etc. Being able to communicate in an emergency is the most important thing you can do. The success of any recovery will be directly related to your ability to communicate to all of the necessary parties that can contribute to the recovery efforts. Your customers want to know what is going on. People will be far more tolerant of disruptions in services if they are being kept informed about what is going on, what steps are being taken, how close to a solution you may or may not be, etc. Communication is critical!

10. Office Involved in the Business Process Return Often more than one office is involved in providing support for this business process. In many cases the level of support will vary from office to office. It will be important when developing the BCP that you document the specific services that can be provided at each location. It may be that no services will be available at the secondary locations and only limited services are available at the main location. If that is the case, then you must be able to communicate that to the constituents that would normally receive services at the secondary locations. Part of your BCP should include communication plans by location. This should include posting signs, sending e-mails, if possible, to the people that would use your services: students, faculty, etc. Work with the universities communication staff to insure that information about your department is included in overall university communications, if necessary.



Be careful to monitor your communications as the outage or emergency is extended to insure the message is correct. Circumstances change and your message must reflect the changing circumstances. Your ability to serve your customers, even if on a limited basis, will be served best by clear communications. This will mean keeping the university communications group up to date with your circumstances and how you are moving forward so that they can change any information about your department within their message to insure consistency. Also insure during the entire time the emergency is taking place that you keep in touch with all personnel working at all of your offices to insure they are aware of their responsibilities during the outage.

11. Alternate Work Location Return If possible, establish an alternate work location prior to any outage. Make arrangements with your staff as to what they would do to move work to the alternate location in the event of an outage that caused their work location to close. Plans should be in place to accommodate short outages, possibly as short as a few hours, to outages that could exceed several days.

12. Human Resource’s Department New Employee Introduction to the BCP Return Establishing a BCP is an important task and one that is vital to the safety of everyone on the campus at the time of an emergency. Maintaining the plan is the responsibility of the BCP Manager within each department. It should be part of the HR orientation for new employees and part of the annual employee update of policies that a BCP exists in their departments and they must be familiar with it. HR can provide an overview of the BCP process within the organization and direct the employee to the BCP Manager within their department for an overview of the plan. All employees should participate in the Team Table Top Exercise as part of their review of the BCP processes for their department. This will assist them in understanding their role in the BCP.

13. Manual Procedures Return When told to set up manual procedures for a business process that is dependent on a computer and the application that drives the computer, the first response is to say it can’t be done. Many comments are made when asked to set up manual procedures. We are too dependent on the computer. All of our input comes from the computer. We depend on the system to look up information. All of these comments are true and many more could also be made; however, the person on the phone or standing across the counter does not want to hear that as an answer. They are more interested on how you are going to solve the problem. Even in today’s age of everyone having a Blackberry or a Droid or other devices, we still want to have solutions, even if we don’t know what we would do; we want the person we are talking to have a solution.



That is what the BCP will allow you to do, have a solution. It may not be the best solution. It may be a very mediocre solution and for many people an unacceptable solution, but if you can offer something it will, for the most part, be accepted as better than the alternative which is nothing or the doors closing. So as part of your BCP efforts, you and your staff must come up with manual procedures that will allow you to provide some level of service to your customer base. And the solutions and manual procedures may vary depending on the circumstances; however, they will provide at least some form of a solution to your customers that give them at least a sense that you are trying to work with them to solve their problem, which is to get them the service you formerly provided with relative ease. With no computers, or no network access, or no access to your normal office processes, how would you do this?

Have copies of the forms you would normally use, even if computer based, to fill in manually. This information can then be re-entered into the computer after the systems are back up. Remember to come up with a numbering system to track when the information comes in. You can use military time i.e. 05/12/11 at 15:27:15 would be May 12, 2011 at 3:27:15 p.m. Doing this insures that if timing is important, such as for registration for who came first or fifth or seventeenth, etc. then you would be able to determine it later.

If a timing system is required, it may be important to identify how you are going to do it. Document how you are going to do it and even have the legal department review your procedures. This can take away any concerns that could arise if you ever have to implement these procedures.

When you go into manual mode as a result of an emergency and need to have extra staff or existing staff working longer hours, you may need extra security. Make sure that you have made arrangements with Security for them to send in extra on-site security if your department has to implement your BCP. Any time you are not able to meet the expectations of your customers in a timely fashion, there is always a possibility of someone getting upset and then trouble can occur. A little extra security is always a good thing. Hopefully it will never be needed. Arranging for it to occur prior to an event makes it much easier to acquire than having to arrange for it on an emergency basis. It will also be more cost effective if it is planned.

Put documentation in place that can be handed to people explaining how things will be done when you are in your “continuity manual mode” so that it is clearly articulated, so that there are no questions. This can solve several problems and keep any disputes that may come up from starting in the first place.

Plan how many staff will be required to support the manual procedures. If you know it will take extra people, try to identify where they will come from. Having existing staff in other departments move to your department temporarily would work to your advantage. Use this knowledge to cross train these people so they are familiar with the area in which they would be working. At least semi-annually conduct a 1-hour review meeting with all staff, particularly those from outside the department; discuss how you would implement your BCP and what their roles will be. By doing this, you will find out if there are new employees that may not be aware of the BCP backup requirement and may not have received cross training. Based on this knowledge, you can take care of the cross training.

Where possible, set up Excel or Word documents on your PCs to support your manual efforts. Make sure they are available on local drives as network access may not be available. Make sure staff knows how to access this information if they need to start using them. If you are keeping this information on a USB drive (thumb drive), insure that the documents are up to date and people in the department know where to find the USB drive in the event of an emergency.



At least twice a year make sure that the staff reviews the manual procedure documentation to validate that it includes all current processes. Any changes that have been added over time need to be updated, and new staff needs to be aware of the process that will be activated, in the event of a disaster.

14. Contact Information Return Being able to communicate with your staff, your management, students, faculty and any other constituents during an emergency will the most important thing that you are able to do. Unfortunately it may the most difficult, if not the most impossible, thing to do. All of the normal channels of communications that we have available may not be working. E-mail may be down, telephones may be down, cell phones may not work, the ability to travel from building to building may be restricted, you may not be at the ‘office’ at the time of the emergency or disaster; therefore, not in close proximity to the people that you want to communicate with, etc. For all of the above reasons and additional ones that will become apparent at the time of an emergency, you must try to plan for as many options for communications as possible. When asking staff, management and others for contact information, request that they provide you with as many contact options as possible. This can include

Office phone number Home phone number Cell phone number Spouse / significant other office phone number Spouse / significant other cell phone number Parents / brothers / sisters / cousins / other family members contact information Out of state contacts – people you would contact in the event of a major disaster Work e-mail address Personal e-mail address Spouse / significant other work e-mail address Spouse / significant other personal e-mail address Family members e-mail addresses (people that would know where you might be or people you

would get in touch with) Neighbors / friends that might be able to check on you (in situations where person may not have

come in to work for an extended unexplained period of time) Addresses of where you might go if your own home address was not accessible e.g. parents, other

family, friends, in or out of state. As you can see there are numerous options for contact information. And with a little more thinking, other contact information options could be added to the list. You need to be aware that not everyone will be willing to give out a lot of personal contact information, nor can you legally compel them to do so. You can only tell them that you are asking them for this information only to be used in the event of a ‘true emergency’ and assure them it is the only time that you would use it. Since a majority of people now have Internet access, you can assume during an emergency people would do their best to get information via any means possible, including the Internet. If an individual will not give you a personal e-mail address you can always set up an e-mail address for them at Gmail, Hotmail, and Yahoo or a similar publically available e-mail provider.



Inform them you will send them information to that address in hopes of communicating to them during the emergency, as it may be the only way to get information to employees. At that point, it will be up to them to get the information. Communication has to be as clear and uncluttered as possible during any disaster, and it begins with the contact information being up to date and as complete as possible. Reviews of your contact information and having your staff review their contact information on a regular basis will insure it is up to date. Up to date will be the most important data in your BCP. Fordham University is in the process of acquiring CPOtracker which is software that will support your BCP efforts and will house your BCP information. From White Pages or Banner we will source basic contact and emergency information to feed CPOtracker; however, you can supplement this with other contact information, as listed above, if you feel it will help you in the event of an emergency. In an emergency your ability to communicate will be the most significant contributor to your success so any contact information will be valuable as you go through your recovery.

15. Vendor Information Return During any emergency you will rely on your vendors to assist you and to help get you back to normal. The only problem with relying on vendors will be if the disaster is more than a department-based disaster If a disaster includes more than your organization, then the demand on vendors will be far greater than normal and vendors will prioritize the customers to whom they provide services. In addition, the allocation of valuable replacement parts will also be allocated to high priority customers such as medical facilities and government groups. In some cases, depending on circumstances, the government may impose restrictions on vendors as to whom they provide services to. In addition, vendors will have the same problems that you will have: their people have families that will need to be taken care of, possibly moved to safe locations, etc. and vendors may have little control over the availability of their staff in the initial hours or days of the emergency. All of these factors will impact their ability to provide services to you. Regardless of the above, it still is incumbent on you to have all of the contact information that you can possibly have for your vendors. In the past few years, most vendors have gone to a centralized dispatch system where customers call 800#s or 888#s. Although it may not be possible to get personal contact information for the service people that provide support for your department, this dispatch system may assist in certain circumstance. Ask vendors to provide an outline of how they will provide support in the event of emergencies, including the policies and procedures that they follow. Knowing this information in advance can be of assistance as you respond to your emergency. Consider identifying and vetting other vendors that could provide support if your primary vendors are unable to provide support. Although the secondary vendors may not be as familiar with your environment and may charge additional for servicing your accounts, in an emergency this may be a reasonable expense when the alternative is continuing to be down and unable to provide services.



If you do use a secondary vendor, review what this may do to warranties with the primary vendor. If it were to void warranties, the costs in the long term may outweigh the short term gain. Discussing a response plan with your vendors and with purchasing should be done prior to a disaster so that all parties are aware of how the response will be undertaken and what response will provide the best long-term result.

16. Schedules Return All departments have schedules. After a disaster strikes, it is important to understand the schedules and insure that you have procedures in place to address the needs of the constituents as it relates to these schedules. Each department should look at their procedures on a daily, weekly, monthly, quarterly and annual basis to ensure that those things that they do are documented in this section of their plans. This will insure that if key personnel are not available, others following the BCP will be aware of upcoming scheduled items and be able to address them. Also consider what forms may have to be used to meet these schedule items and list where the forms can be found online, or put copies of the forms in the attachments section of the BCP.

17. Department Standard Operating Procedures Return Every department has standard operating procedures (SOPs). During a disaster or emergency situation, you may not remember all of the details of each SOP; therefore, it would be worthwhile to attach copies of your SOPs. These SOPs can be used as references for new staff that may come into the department to assist during the disaster situation. Consider that your normal access to information may be interrupted and normal points of reference may not be available, such as reference books and manuals, etc. Having copies of SOPs will assist in making determinations of what needs to be done or how you make judgments, especially when you're doing manual procedures. It will be up to each department to determine if they need to include SOPs as part of their BCP.

18. Policies and Procedures Return University policies and procedures may also be needed during an emergency or disaster situation. The policies and procedures could become more important during this disruption because it is not a normal situation and decisions will be made about time off, pay for overtime, etc. Many of these decisions may need to reference these policies and procedures. It is possible that policies and procedures set out by other departments could start to impact how your department functions during an emergency or disaster; having access to their policies and procedures may also assist your department. If you think other departments’ policies and procedures may impact your department, either ask for a copy of them or ask a representative of that department to include a copy in their BCP so it would be available during a disaster or emergency.



19. Forms Return For many departments, the use of forms has been made obsolete by the use of online systems. Employees, other staff members, faculty, students, and family members may all use online forms to provide information or request information many times during the year. If an outage occurs because of an application or network outage, where the applications are not available, paper forms may be the only way that you're going to be able to record information requests or keep track of the information that you are accumulating. You should have copies of all of forms, even if they are online, and keep these forms up to date. Make sure the updated or new versions are put into your BCP. Where necessary, request copies of forms from other departments if their forms could be used in your department to collect information that could then be passed on to them during the manual procedures that would be implemented during the outage. If you will be using a manual form and then passing it on to another department, work with that department to design that form to insure it will meet their needs and be as efficient as possible. That way, the form will produce as positive a result as possible. Insure that you set up a number system for the forms so that you can track when the information was created and who provided the information.

20. Office Requirements Return Basic office requirements should be outlined in your BCP. If you are not able to use your normal office environment because it has been damaged or is cordoned off for whatever reason, then you need to outline what your base needs would be. You may be temporarily set up in the cafeteria, in a conference room, a classroom or a hotel conference center, etc. What you should outline is a minimum requirement to allow you to function for the first twenty-four to forty-eight hours. As a result, it may be that your office requirements are three computers, one printer or lease access to a printer, and access to fax machine, even though right now you have eight staff members. Your staff would share the computing capabilities for the first several days, possibly in a shift arrangement, even sharing the equipment with another department. It could take weeks to get back to the new normal, so consider the minimal computing environment that your department would need when outlining your needs in this section. If your needs will grow over time as the recovery time extends beyond a certain number of days, then that should also be noted.

21. Dependencies Return Note the dependencies for your department. List the departments that you get information from. List the key people in those departments. List the departments that you provide information to. List the people that you are in contact with in those departments.



For all of the individuals that you work with in these departments, list their contact information so you can communicate with them. Try not to list just their office numbers but also try to get cell phone number, personal e-mail address, and home phone number so you can communicate with them outside of normal communication lines, because normal conditions may not be available. You may have to work with these people while you are all recovering from the disaster or emergency and having this information may be the difference between being able to recover and failure. Also provide them with contact information for yourself and key people in your department so that they have contact information in their BCPs.

22. Application Recovery Procedures Return As much as we don't want software applications to fail, it does happen and when it happens it is important to have application recovery procedures in this section of your BCP. You need to work with the application group and document how they will bring the application back up and make it available again to the organization as a whole. It is not reasonable to turn an application on and have all users start using it immediately. It must be validated the same as you would validate a brand-new application. Coming in and turning it on for the very first time after recovery, without it going through some form of quality control, could cause even greater harm in the longer term, than the initial failure may have done. If you are the designated application owner, it is critical for you to review the application once it is recovered and validate the database to insure that it has been recovered properly.

23. Salvage & Restoration Return On the chance that the office areas in which you work have been damaged by fire, smoke, water or some other things, it is important that you recover the information in that area. It's important to understand what was in the area; therefore, from time to time you should inventory your office environments and keep that inventory list as current as possible. You want to validate the list at least semi-annually. Where you have storage areas keeping old records, make sure that information is up-to-date and new items going into this storage area are added to the inventory list. If possible, all records should be moved to microfilm, microfiche or be digitally transposed, eliminating the need for paper. Anytime you have paper, you can lose it to water or fire damage; therefore, anything you can do to move it to an electronic media is a plus.

24. Training Return Each member of the team should be aware that there is a BCP.

They should be aware of what their role in it is. They should be aware of what their responsibilities are through the course of the year to maintain

the information that is in the plan.



All staff should be aware that in an emergency or disaster situation that the department might face, that it has a plan, they have a role to plan and they will get through it. Through training, reviews and keeping the contents of the plan up to date, the BCP will work for the department in an emergency situation. Any team members that see anything missing or that have questions about the BCP need to bring them up to the BCP manager so they can be addressed and, where necessary, make updates and corrections to the plan.

25. Table Top Exercise Return Table Top Exercises (TTE) set up scenarios for your team and all teams in the organization to work together to use their BCPs to determine if the contents of their plans have sufficient information to respond to the scenario. Through the TTEs, teams discover where the gaps are for missing information in their BCPS and they add information to their plans to make their BCPs better. It is also an opportunity for the teams to learn how to work together. The teams learn how they need to work with the other teams, and they also find out that they need to devise methods that in the event for the disaster will allow them to work across department lines. TTEs are repeated on a semiannual or annual basis to allow for continual improvement in the BCPs. This is necessary because business processes change, environments change, application technology changes etc., driving the need to keep the BCPs up to date in order for them to be able to have the correct information when a disaster or emergency does occur.

26. Additional Information Return

The above items are suggested items that should be included in your Business Continuity Plans. This does not mean that you can’t put in additional information; if fact additional information in your plan will only benefit you if and when it is needed. It is better when an emergency is over and you say we didn’t need these items rather than saying we wish we had those items. Add anything that you think could assist in an emergency or disaster. Better to have it than to be wishing you had it.

If you have any questions, please contact:

Mark Turnbull at 910-284-1224 or [email protected]

Documents

Business Continuity Plan Template - Fordham … every business process will require a full business continuity plan. ... manager, who in turn will ... Business Continuity Plan Template