How to Write a Business Continuity Plan

Disaster Recovery Redux

Why create and use a Business Continuity and Disaster Recovery Plan (BCDRP)?

For the same reason you have a health plan, a car insurance plan, or a home owner’s policy...to prepare for, respond to, and successfully overcome a disaster.  If you experience a major disaster, and man-made and natural disasters happen daily, having a BCDRP may make the difference between your business surviving or going out of business.  

As importantly, having one may mean the difference between who lives and who dies. Think of it as life insurance YOU write that helps ensure that you, your loved ones, your employees, and your business go on.

What follows are some of the major parts of any BCDRP. It is only a guide. 

Every BCDRP must be custom written and tested to your unique needs and circumstances. Use this for ideas of how to create your plan, but make sure you create a plan that reflects your needs.

Disaster Management Plan Purpose

The purpose of the BCDRP is to ensure that a clearly define BCDRP structure and accountable and responsible Disaster Management Team is in place to quickly, efficiently and effectively recognized and respond to any business disruption to:

•         Ensure the safety of our employees and the security of our property

•          Coordinate continuity of high quality service to customers

•          Coordinate communication (both external and internal)

•           Prioritize recovery efforts

•          Activate  the BCDRP

•          Invoke emergency authorization to procure and allocate resources and support

What is a Disaster

•    ·       Anything that causes harm to people or significant damage to property

•          Anything that adversely affects the value or financial survival of the company

•         Anything that disrupts routine business operations or wastes significant management time or financial resources

BCDRP Guiding Principles

Any good BCDRP includes the following tested and proven principles:

•         Describe the business impact

•         Identify impacted stakeholders

•         Identify who does what and when

•         Do not use overly technical information

•         Provide an escalation point for issues and concerns

•         Test the plan and incorporate lessons learned for future plans

In addition, here are some fundamentals your basic plan should cover:

•         Develop and practice a contingency plan that includes a succession plan for your leadership.

•         Train backup employees to perform emergency tasks. The employees you count on to lead in an emergency will not always be available.

•         Determine off site disaster meeting places and disaster communication plans for all your employees.

•         Practice disaster communication with employees, customers, suppliers and the outside world.

•         Invest in an alternate means of communication in case the phone networks go down.

•         Make sure that all employees are involved in the exercises so that they get practice in responding to an emergency.

•         Make business continuity exercises realistic enough to tap into employees' emotions so that you can see how they'll react when the situation gets stressful.

•         Form partnerships with local emergency response groups (firefighters, police and EMTs) to establish a good working relationship. Let them become familiar with your company and site.

•         ·Evaluate your company's performance during each test, and work toward constant improvement.

•          Conduct continuity and disaster recovery exercises to reveal any changes and weaknesses. Technology, personnel and facilities are in a constant state of flux at any company.

BCDR Plan Outline

The most important fact about the BCDRP is that those who need the information can get it quickly, efficiently, and easily. 

One way to accomplish that goal is to separate the plan into two major sections: the plan itself and the material that supports the plan that goes into the appendix. 

Here is a suggested outline that has worked well for many companies.

Disaster recovery planning is the process of creating a document that details how your business will recover from a catastrophic event. These steps include:

•        Create a List of Jobs: Know all the office jobs that would have to be relocated to an alternate location.

•        Create an Inventory Necessary Office Equipment:  For each employee, list only the essential office equipment and furniture that they need to perform their jobs. Remember, in the event of a disaster, space, time and money will be at a premium.

•         Create a Catalog of Supporting Software and Computer Equipment: Create a catalog of the essential office computer software and equipment you use.

•         Identify an Alternate Office Space:  Now that you have a list of people, furniture and computer software, networks and equipment, you will need a physical place to put them. Find several alternative places to relocate your office.

•        Create an Insurance and Budget Document:  After you decide where to put people, you will need to start buying them the stuff they need to do their jobs. Estimate how much each piece will cost to buy or lease. The time spent up front on this task will shave days off of the recovery process because you will be able to provide a list to your insurance agent of what you need.

•        Share It and Store the Plan Off-site: Share your plan with several people and keep it in several places.

• See the table below for a suggested table of contents that should be included in any BCDRP.

Recommended BCDRP Table of Contents

What

Description

Business Continuity Contact List

Name, phone, email, home address, home numbers. Placing it upfront makes it easier to find in an emergency.

Disaster Recovery Contact List

Name, phone, email, home address, home numbers. Placing it upfront makes it easier to find in an emergency.

Disaster Recovery Escalation Process

Clearly identify who is to be notified and who has the title and responsibility for declaring an event and activating the plan.

If Disaster Recovery Plan is Activated

Concise immediate steps that must be taken once a disaster is declared. Goal is to preserve life, prevent injury, and protect property and to lay the foundation for restoring normal business operations.

Disaster Recovery Plan Major Steps

Clearly identified major steps that must be taken to resume routine business operations

Disaster Recovery Facilities Location

Location of the alternative recovery location along with instructions for whom to contact and what to do when there. It can be held in readiness for use during the disaster to recover technical assets and for recovery of business processes. For small- and medium-sized businesses, this can mean employees working from home using their laptops.

Resuming Daily Business Operations

Establish the goals, milestones and metrics that will indicate that the disaster recovery has succeeded and routine business operations have resumed.

See the table below for what material belongs in the appendix to the BCDRP. By organizing your document in this way it is easier to write, organize, and update.

Recommended BCDRP Appendix Sections

What

Description

Appendix A: Disaster Management Team Activation Guide

Rules for the activation and the Incident Commander, Coordinator and the rest of the Disaster Management Team.

Appendix B: Emergency Evacuation Procedure and Safe Assembly Areas

Instructions for when and how to evacuate and where to gather once out of the building.

Appendix C: Exit, Fire Extinguisher, Fire Alarm and Hose Locations

Description of how to exit the floor and building, and the location of the emergency equipment.

Appendix E: Shelter-in-Place Instructions

Instructions for when and how to shelter in place if necessary

Appendix F:  Reporting Disasters

Instructions for how and to whom to concisely and accurately report disaster.

Appendix G: Floor Plan

Drawing of each floor with employee name, phone, and email on the drawing, along with clearly identified exits.

Additional Appendixes

Add any sections that are necessary to your plan.

Additional Tips

•        Make a list of all your software you may need to replace.

•        Back up all your files.

•         Put your essential files of a thumb drive. You may need them to get restarted.

Using Social Media to Respond to a Disaster

Increasing, using social media correctly to respond to a disaster is one of the most critical parts of your BCDRP. To ensure your social media presence is ready for a disaster, make sure that you:

•        Have a media plan with the tools, skills and resources to promptly execute your media

•        Have accounts with the right social media outlets (Facebook, Twitter, Instagram, etc.) before the disaster

•         Monitor social media before, during and after the disaster

•        Designate one employee to speak for the company through social media outlets because social media is driven by trust in people, not an organization

•         The audience has the tools to investigate, record, and publish, so content accuracy is critical

•        A good response should include negative perceptions and address causes and facts

•        With your posts, tweets, photos etc. a link with more information will always help support your message

Disaster Management Team Roles and Responsibilities

When the Incident Commander convenes the Disaster Management Team (DMT), he or she also authorizes the BCDRP and declares an emergency. Each member of that team has specific responsibilities that are listed below.

Core DMT Roles and Responsibilities

Role

Responsibilities

Incident Commander

Leads the CMT. Provides guidance to the team and is the final decision maker in the case of conflict or lack of consensus.

CMT Coordinator

Assembles the team at the request of the Incident Commander. Schedules meetings, assists with meeting facilities and general support, and completes additional tasks requested by the Incident Commander. Informs other levels for the Incident Commander.

CMT Member

Participate in discussion and take ownership of actions to ensure resolution of issues within their area of expertise.

Note Taker

Documents all CMT meetings to capture discussion points, actions, owners and deadlines.

Social Media Liaison

Social media expert who has preexisting accounts on social media platforms who professionally and accurately communicate with external and internal customers.

Trusted Advisor

Provides detailed specialized knowledge to provide additional capacity.

Tabletop Exercise

Every BCDRP requires a test to prove that it works and to identify areas that need improvement, also known as a tabletop exercise. Each participant undertakes the actions and tasks as they would during a real disaster. 

After the exercise, the team members identify the plan strategies that worked and did not work. Then they identify and implement actions that improve the plan, including adding them to the plan.

For the best tools of the trade, see North American Rescue.

North American Rescue for Disaster and Medical Products

When it comes to bleeding control, North American Rescue has the best products. T

hey are a company founded by special forces guys and are experts at preventing bleeding out. 

Business Continuity Disaster Response Plan Terms 

 Like any field, BCDRP has its own terms used by those who work with it to communicate. To help you better understand some of those terms. The table below lists and describes a number of those terms.

BCDRP Glossary

Term

Description

Awareness

To create understanding of basic BCDRP issues and limitations. This will enable staff to recognize threats and respond accordingly. Examples of creating such awareness include: distribution of posters and flyers targeted at company-wide audience or conducting specific business continuity briefings for executive management.

Backup

A process by which data, electronic or paper based is copied in some form so as to be available and used if the data from which it originated is lost, destroyed or corrupted.

Backup Generator

An independent source of power, usually fueled by diesel or natural gas.

Business Continuity

Capability of the organization to continue delivery of products or services at acceptable predefined levels following disruptive event

Business Continuity Plan

Documentation that contains all alternative activities to recover and continue disrupted business activities on an acceptable minimum level, including the transition back to normal operations.

Business Recovery

Recovery steps taken to resume the business within an acceptable time frame following a disruption.

Call Tree

A structured cascade process that enables a list of persons, roles or organizations to be contacted as a part of information exchange or plan invocation procedure. Includes a document that graphically depicts the calling responsibilities and the calling order used to contact management, employees, customers, vendors, and other key.

Communications Recovery

The restoration or rerouting of an organization’s telecommunication network so that it continues to work with few or no interruptions.

Desktop Exercise

Technique for training emergency teams in which participants review and discuss the actions they would take according to their plans, but do not perform any of these actions; can be conducted with a single team, or multiple teams, typically under the guidance of exercise facilitators. You can conduct them at your office, off-site, or in th e back of a truck. During a disaster, you don't always get to choose the best setting.

Disaster Management

Involves the management of an event appropriate to the severity and the impact of the event. It consists of the communication that occurs within the response phase of the continuity event management scenarios.

Disaster Recovery Plan

This refers to the management approved document that defines the resources, actions, tasks and data required to manage the technology recovery effort. It is the result of the Disaster Recovery Planning effort. Documentation that defines the resources, actions, tasks and data required to manage the technology recovery effort. Usually refers to the technology recovery effort.

Emergency Evacuation

The immediate and rapid movement of people to a place of safety away from an area that is subject to a potential imminent major disruption such as natural disasters or terrorist attack.

Emergency Management

Refers to the actions taken in response to an event that has occurred, or is anticipated, and the planning that precedes those actions. This primarily includes safety of employees and security of facilities. Medical alert teams, Floor Warden programs and regular fire drills would all be considered part of Emergency Management.

Emergency Response

The response of an organization to a disaster or other significant event that may significantly impact the organization, its people, or its ability to function productively. Emergency response may include evacuation of a facility, sheltering in place, ensuring the health and safety of employees, performing a damage assessment, and any other measures necessary to bring an organization to a more stable status after an event.

Go Bag

A bag, backpack or other easily transportable carrier, pre-filled with items individuals should have with them if directed to evacuate their home or workplace. The Go Bag should only be taken during the evacuation if it is immediately available and will not create a danger to others during the evacuation.

Loss

Negative consequence, which may be financial, e.g. loss of revenue or cash, or non-financial, e.g. loss of information, goodwill, economic value, function, natural resources, ecological systems, environmental impact, health deterioration, mortality, morbidity.

Off-Site Storage

Any place physically located a significant distance away from the primary site, where duplicated and vital records (hard copy or electronic or equipment) may be stored for use during recovery. Or, the process of storing hard copy or electronic records at a secure location removed from the normal place of use.