A simple Business Continuity Framework

BUSINESS CONTINUITY FRAMEWORK
Business Continuity Management (BCM) is a holistic management process that identifies potential impacts that threaten key business resources and provides a framework for building resilience and the capability to support these essential key business resources and activities during a disruption.

An Office’s strategies and decisions are based on an assumption of the business continuing. An event that violates this assumption is a significant occurrence, impinging directly on its ability to fulfil its objectives.

BCM therefore, forms an integral part of our risk management strategy, and establishes cost-effective treatments should an outage occur. Depending on its nature, a disruption/outage will have a greater or lesser chance of occurrence (likelihood) and a greater or lesser office impact (co-sequence)

OBJECTIVE
This BCM framework is aimed at everybody within an Office, as it is about maintaining key essential business resources and activities during a disruption.

The objective is to ensure the uninterrupted availability of key business resources and activities required to support essential business services. BCM differs from disaster recovery in that it is about continuity of all key processes, resources and activities, extending beyond just IT systems.

OUTPUT
The primary output of this BCM framework will be a simple but effective business continuity plan (BCP). The BCP will comprise the key elements when collectively, define an Office’s approach to dealing with a break in business continuity. It will also describe the steps an Office will take to maintain operations in contingency mode until full recovery of lost functions occurs.

CRITERIA FOR INVOKING BCP
The plan will be invoked when one of the following events occurs:

1. A key system has failed
2. Access to the office building is restricted or denied
3. A key resource or an employee is no longer available
4. Upon instruction from Senior Management

EXPECTED LIFE OF THE PLAN
The plan will be implemented immediately any of the above criteria are met and will remain in operation until it is agreed by senior management that normal operations can be resumed.

ROLES, RESPONSIBILITIES AND AUTHORITY
The Senior Manageemnt will authorise the implementation of the plan.

All business unit Managers’s are responsible for:

1. Ensuring all business unit staff are aware of the BCP (Business Continuity Plan)
2. Identifying key resources & ensuring alternatives are available
3. Identifying key processes and services and identifying a suitable degraded mode
4. Ensuring the necessary training and resources are available for staff to operate in the degraded mode
5. Delegating to key staff the authority and responsibility to implement the plan.

HOW TO PREPARE A BUSINESS CONTINUITY PLAN (BCP) BASED ON BCM
In order to keep our BCP simple and effective, this plan will only address maintaining essential business resources and activities in ‘contingency’ mode during a disruption.
The treatments to overcome identified disruptions need to address three key stages necessary to complete recovery.

Each phase is defined as follows:
Response - The time from disruption/disaster declaration until critical activities and resources have been re-established.

Interim Processing - The period an Office relies on alternate processes and resources.

Restoration - The period when an Office returns from using alternate processes and resources back to business as usual.


The contingency mode of operation will be broken down into three classifications:

1. Access to the Office is denied however all systems are operational
2. Access to the Office is denied, and all systems are not operating
3. Key staff and resources are not available

Phase 1 - Form working party comprising appropriate staff from each business unit

Phase 2 - Each business unit delegate is to develop a Business Unit Essential Activities and Resources List, in conjunction with business unit leaders, for the three classifications of contingency mode.

Phase 3 - Proposed Business Unit plan submitted to Senior Management for endorsement.

Phase 4 - Establish annual review/audit process of identified essential activities and resources to ensure currency and applicability.