PP5 Implementation Flashcards
Key requirements for implementation of an effective
BC plan are:
- Ability to recognise and assess existing and potential
threats when they occur and to determine an appropriate response. - Response structure in place for the activation, escalation, and control of organization’s response.
- Personnel with the authority and competency to implement agreed solutions and measures.
- Ability to communicate effectively between internal and external interested parties.
- Access to sufficient resources to support the agreed
continuity solutions
The purpose of establishing a response structure is
To ensure that the organization has a clearly documented and well understood mechanism for responding to an incident, regardless of its cause. The
response structure establishes command, control, and communication systems to help the organization manage the incident and minimise the impact of the disruption.
Response structure identifies
- Individuals and teams responsible for response activities.
- The roles and responsibilities of the individuals and teams.
- The relationships between the individuals and teams.
- The documented procedures to support the individuals and teams.
Incident defined as
A situation that might be, or could lead to, a disruption, loss, emergency or crisis.” (Source: ISO 22300:2012)
Crisis defined as
A situation with a high level of uncertainty that disrupts the core activities and/or credibility of an organization and requires urgent action.” (Source: ISO 22300:2012)
key requirements for an effective response structure are
- Ability to recognise and assess threats when they occur.
- Clear procedures for escalation when a disruption has occurred or may soon occur.
- Individuals and teams with the authority and capability to develop and select an appropriate response to an incident.
- Clearly understood procedures in place for the activation and control of the response to an incident or crisis.
- Responsible personnel with the authority and capability to implement the agreed business continuity solutions as defined within the organization’s plans.
- Ability to communicate effectively with internal and external interested parties.
- Access to sufficient resources to support the implementation of the continuity solution.
- Ability to recognise when key external suppliers should be notified and included in the implementation of the continuity solution.
- An agreed budget for supporting the response structure.
Strategic team
Focuses on strategic issues that impact the organization’s core objectives, and products and
services and is usually led by top management.
Tactical teams
Manage and coordinate the continuity of the processes required to deliver the impacted products and services, and ensure that the resources are allocated appropriately.
Operational teams
Focus on continuity of the activities that contribute to the process or processes that deliver the prioritised products and services.
The key steps when establishing a response structure
are as follows:
- Identify, understand, and work within organization’s existing management and leadership structure.
- Identify responsible individuals and roles in any existing response teams or plans.
- Understand requirements and scope of BC
programme. - Consider continuity solutions agreed in the Design
stage of BC management lifecycle. - Develop a draft response structure.
- Present response structure to top management
and seek feedback. - Update response structure based on top
management feedback. - Obtain top management approval for updated response structure.
- Document and publish approved response
structure. - Implement approved response structure in any
existing BC plans. - Rehearse response structure as part of BC
exercising
Responsibilities of individuals and teams identified in
response structure should be documented and include:
- Team mobilisation
- Procedure escalation.
- Plan activation.
- Command and control.
- Resource allocation.
- Cost management.
- Personnel welfare.
- Interested party communication.
- Incident monitoring and assessment.
- Changing priorities as the situation evolves.
Small, single site organization
In a small, single site organization, all levels of response may be implemented by one response team within a single plan, covering all aspects
of the organization’s response
Medium sized organization
Might be implemented as:
Strategic: Crisis management plan with a response
team consisting of top management.
Tactical: Single plan covering continuity of all of organization’s operations, with a response team consisting of the functional leaders or heads of departments.
Operational: Usually covered by tactical plan, except
for ICT which, because of the technical detail required, has its own ICT service continuity plan with technical ICT recovery team.
Large organization
Might be implemented as:
Strategic: Crisis management plan with response
team consisting of top management.
Tactical: Several plans, each one covering division,
product, service, or location, each with its own response team consisting of either the division head, or product or service heads responsible for the areas covered by
plan.
Operational: Usually covered by individual tactical
plans. Exceptions are main support functions of human resources, ICT, fnance, and sites or facilities. Each of these has its own specialist response team.
Large multinational organization
Might be implemented as:
Strategic: Global crisis management plan, with a response team consisting of top management with global responsibilities, and an incident management plan for each territory, with a response team consisting of top management from those territories. Multinational organizations may also have another level of strategic plan focused on regions.
Tactical: Each region or country could have several plans, each covering a major division, product, or service, with its own response team consisting of the
functional leaders or divisions, or product or service heads responsible for the areas covered by the plan.
Operational: Each department or location covered
by the business continuity plan may have its own detailed operational plan, with its own response team consisting of the operational managers of the
department or location.
Response structure should define:
• The required number and type of individuals or teams.
- Relationships between the individuals and teams.
- Roles and responsibilities of the individuals and teams.
- Documented plans required to support the response.
BC plan’ is defined as
Documented procedures that guide organizations to respond, recover, resume, and restore to a predefined level of operation following disruption.”
(Source: ISO 22301:2012)
To make the plan focused, specific and easy to use, it should be
- Direct; providing clear, action orientated and time-based direction. It should provide quick access to vital information.
- Adaptable; enabling the organization to respond to a wide range of incidents, including those that the organization may not have anticipated.
- Concise; containing only guidance, information and tools that are likely to be used by the team in an incident. Anything else is unnecessary.
- Relevant; providing information that is current and useful to the team using the plan
Plans at all levels should contain the following:
- Purpose and scope.
- Objectives and assumptions.
- Response structure which is specific to organization
- Plan activation criteria, procedures, and authorisation, including implementation procedures:
- Invocation of continuity solutions.
- Team mobilisation instructions. - Response team roles and responsibilities (with alternates as appropriate).
- Individual responsibilities and authorities of team members.
- Prompts for immediate action and any specific decisions the team(s) may need to make, for example, whether to activate an alternate site.
- Communication requirements and procedures concerning relevant interested parties, for example, personnel, suppliers, customers, and the media.
- Internal and external interdependencies and interactions, including contact details (usually held as appendices).
- Summary information (at a level of detail appropriate to the plan) of the organization’s prioritised activities and resource requirements as identifed in the Analysis stage of the business continuity management lifecycle, with reference to the continuity time frames
within which they are required. - Assumptions defning the limitations of the plan relating to extent,
duration, or impact of the incident. - Decision support checklists.
- Details of meeting locations.
- Information flow and documentation processes.
- Procedures for standing down the team and organization once the incident has been resolved.
- Appendices with relevant information capture templates, for example, an action log.
- Plan approval and distribution information.
The key steps when developing and managing a plan
should include the following:
- Appoint an owner or sponsor of the plan.
- Define the objectives and scope of the plan.
- Create a plan development process and budget,
and obtain approval. - Create a planning team (if appropriate).
- Agree the responsibilities of the response team and their relationship with other plans and response teams
(at a strategic, tactical and operational level if
appropriate). - Establish the response team with the relevant
authorities and competencies - Defne the structure, format, components, and
contents of the plan. - Gather information to populate the plan
- Draft the plan
- Circulate the draft plan for consultation and
review - Gather feedback from the consultation and
review stage - Amend the plan as appropriate, based on
feedback - Agree and formally approve the plan.
- Develop, implement, and plan the exercise programme to regularly rehearse team response capabilities and validate the plan content.
- Agree a maintenance schedule for the plan to ensure
it remains current and response team information remains up to date.
Specifc team roles, each with nominated responsibilities, should include:
- The team leader who ensures that the response team is activated, briefed, and properly staffed. They can nominate team members if necessary.
- People and welfare.
- Internal communication to establish and maintain contact with personnel and other response teams.
- External communication to establish and maintain contact with interested parties outside the organization, which may include the media.
- Operations, including fnance.
- Technical support for example, ICT and facilities.
- Administrative support, including a record keeper to maintain a log of incoming information, decisions made and actions carried out throughout the incident
During an incident, and where relevant, one or more team members should be assigned responsibility for
- Verifying the results of site evacuation.
- Accounting for the organization’s personnel and visitors.
- Communicating with personnel and others on site.
- Communicating with emergency services.
- Setting up communications systems, for example, a help line or intranet pages.
- Contacting next of kin.
- Arranging transport assistance.
Specific responsibilities of the strategic level team that should be captured in the plan include:
- Establishing the strategic objectives of the crisis or incident response.
- Devising short, medium, and long-term strategies, depending on the type of crisis or incident.
- Managing communications with all involved interested parties, including the media.
- Approving external statements before they are issued and monitoring and adjusting the communications strategy, as necessary.
- Monitoring the overall response to the crisis or incident.
- Resolving implementation issues or resource conflicts during the response.
- Ensuring the response and recovery is in line with the long term objectives of the organization and meets the organization’s legal and regulatory requirements.
- Identifying and maximising opportunities or advantages arising from the crisis or incident.
- Approving significant expenditure.
- Monitoring the financial health of the organization.
- Identifying and declaring when the incident or crisis is over, directing the individuals and teams to stand down, and clearly communicating the end of the incident or crisis to all interested parties.
Outcomes of developing the strategic level business
continuity plan include:
- A plan that can support top management during an incident or crisis.
- A plan for managing interested parties and media
communications during an incident or crisis. - Documented evidence of the organization’s preparedness which is available to interested parties.
- A plan that complies with legal and regulatory requirements.
