Contact your Parish Council

Business Continuity Plan Template

Business Continuity Arrangements 2009 � 10: Appendix 3

BUSINESS CONTINUITY PLAN for XXXXX service

(To be completed in conjunction with the Council�s Business Continuity Guide)

� New MBC logo.jpg

The xxxx section has x critical functions, which must be maintained:

1. Priority 1

2. Priority 2

3. Etc

Plan details
Section
Department
Plan Owner
Plan Manager
Plan Writer
Version No.
Date Written

Plan review details

Review Period

6 Monthly

Annually

Date of next review

Review details
Date to BCF
Date reviewed by BCF

All staff undertaking activities identified must be informed of this Business Continuity Plan.� The document signatory is also responsible for exercising this plan to confirm that it is still fit for purpose.� The Business Continuity Forum (BCF) shall be informed of these exercises and any changes to the current plan in order to maintain a log to comply with the Civil Contingencies Act 2004.

The Business Continuity Forum reserves the right to exercise the plan without warning.


Signature
Plan Owner
Date

Contents

Section 1 �� page 3�� Introduction

Section 2 �� page 4�� Invocation Procedure and Risk Assessment Criteria

Section 3 �� page 7�� Activity Summary (including any contingency arrangements)

Section 4 �� page 8�� Resource Summary

Section 4.1 �� page 8�� People

Section 4.2�� page 9�� Equipment / Facilities

Section 4.3�� page 10�� Documentation

Section 4.4�� page 11�� Suppliers

Section 5 �� page 12�� Further Action

Section 6 �� page 13�� Recovery Plan

Appendix 1�� page 14�� Contact Details

Appendix 2�� page 15�� Example Incident Log

Appendix 3�� page 16�� Incident checklist � what to do first

Section 1 - Introduction

Department role

Please provide a brief description of what the department does:

Staff resources day to day
Managers
Officers
Admin
Etc

Department core hours

24hour

Mon-Fri 0830-1700/1630

Other

If other, please give details

Section 2 - Invocation

Invocation of plan

The plan will be implemented in accordance with the Council�s overarching Business Continuity Strategy and Guidance.� The level of invocation will be determined by assessing the potential impact of the incident using the criteria defined in the Risk Assessment as described in the following diagram.

Any member of staff

Corporate Management Team

Line Manager

Who is responsible for invoking the plan, and who should be consulted?

Where the expected impact of the disruption is likely to fall into category 1 or 2 (see below) invocation of the plan and management of the incident will be the responsibility of the ************ or in his/her absence ***********.

If no Service Manager is available the ******* will be informed.

If the expected impact is likely to fall into category 3 they will inform the ********* officer who will be responsible for the invocation of the plan and management of the incident.

.�

If the expected impact is likely to fall into category 4 or 5, ******* will be informed and a silver command set up.

What procedure is required to invoke the plan?

Once the plan is invoked the staff that work in the area affected will be contacted, if not already aware, and asked to either remain on standby, and be contactable by mobile phone or other means, or to report to an identified place.

The managers of the department will have the current contact details of the staff with them as point of reference in case of IT failure.

The manager of the department should also ensure that, where appropriate, any key stakeholders, as listed in section 3, are informed of the incident in order to minimise any impact on them.�

** ONCE THIS PLAN IS INVOKED THE MANAGER / DEPUTY MUST ENSURE THAT A LOG IS KEPT OF ANY DECISIONS MADE OR ACTIONS TAKEN.� **

** AN EXAMPLE LOG IS GIVEN IN APPENDIX 2. **
Risk Assessment

Category	Potential or real impact assessment
Insignificant (1)	No impact on the performance of any department Minor internal disruption to the department No specialist personnel issues Activity recovered within 30 days
Useful (2)	No impact on the organisation�s service delivery Minor impact on the performance of the department Minor specialist personnel issues, but easily resolved Activity to be recovered within 14 days Potential for complaints from customers
Significant (3)	Potential limited impact on the Council�s service delivery Internal performance disruption on one or more departments; department may require assistance from one another Activity must be fully recovered within 2-3 days Potential financial loss in excess of �50,000 Potential for adverse local publicity in an ongoing nature or effecting local opinion Potential for significant injuries or ill health
Essential (4)	Significant impact on the Council�s service delivery in one or more areas Significant impact on the performance of several departments Full recovery must occur within 12 hours Potential loss in up to �2 million Potential for adverse national publicity or local publicity on a persistence nature affecting the local community Potential for fatality of one or more or serious injury to several people Potential for major claims which would be outside the insurance cover
Critical (5)	Major impact on the Council�s service delivery in one or more areas Inability to effectively integrate with other key stakeholders Inability to meet statutory responsibilities or critical service level demands Major specialist personnel issues � no resources/no resilience Recovery must occur within 1 hour Potential loss in excess of �2 million Potential for adverse national publicity or local publicity on a persistence nature affecting the local community Potential for fatality of one or more or serious injury to several people Potential for major claims which would be outside the insurance cover

Location Codes

1	Maidstone House Floor 1
2	Maidstone House Floor 4
3	Maidstone House Floor 5
4	Maidstone House Floor 6
5	Maidstone Gateway
6	Depot
7	Hazlitt Theatre
8	Museum
9	Town Hall
10	Crematorium
11

Section 3 � Activity Summary

Activity No	Risk Category ¹	Activity ²	SPOF ³	RTO ⁴	Does the activity depend on, or influence the activities of other departments within the Council or external agencies? If YES, list the departments ⁵	Contingency Arrangements ⁶ (To cover people, facilities, systems, suppliers, or any other arrangements)
Activity No	Risk Category ¹	Activity ²	SPOF ³	RTO ⁴
1
2
3
4
5
6
7
8
9
10

₁ all activities should be risk assessed using the criteria in Section 2

₂ list activities with the most critical first in descending order

₃ are any of the activities regarded as a Single Point of Failure (SPOF)

₄ Recovery Time Objectives (RTO) should indicate the priority/timescale to restore a process to minimum service levels (for category 3, 4 or 5 activities only � the remainder can be left blank).

₅ the Risk Assessment should take into consideration the effect on any interlinked departments or outside agencies/partners

₆ contingency arrangements should include any actions that can be implemented locally - i.e. relocation to other premises, transfer of work to other department, manual workarounds - whether agreed or identified as the potential for good practice.

Section 4 - Resources Required For Each Activity With Risk Category 3, 4 or 5

4.1 People

Activity No	SPOF¹	Minimum number of staff required to start/maintain activity		Specialist skills/training required by staff			Can staff from outside the department support this activity and if yes, where from which Dept/Organisation
		Number of staff	What skills/training ?		Y/N	Dept/Organisation
1
2
3
4
5
6
7
8
9
10

� ₁ are any of these people regarded as a Single Points of Failure (SPOF)

4.2 Equipment

Activity No	SPOF¹	Location Code (s)²	Standard Equipment³	Specialist Equipment⁴	IT Software⁵	Vehicles required⁶
1
2
3
4
5
6
7
8
9
10

₁ is any of this equipment regarded as a Single Points of Failure (SPOF)

₂ location codes are listed in Section 2

₃ identify number of workstations, phones, faxes, desktop or laptop computers, printers and any other standard IT hardware required

₄ identify any specialist equipment required i.e. scanner, A3 printer etc

₅ identify any software required over and above Council Office systems (Microsoft Word and Excel, e-mail, Y drive, Intranet)

₆ identify any specialist vehicle required

4.3 Activity Documentation

Activity No	SPOF¹	Essential Documents/Records²	Where are these stored?³	How are they accessed?
1
2
3
4
5
6
7
8
9
10

₁ is any of this documentation regarded as a Single Points of Failure (SPOF)

₂ technical manuals, emergency plans etc

₃ identify locations of physical documentation/records and locations on Council IT systems

4.4 Supplier Details

Activity No	SPOF¹	Supplier	Services Provided	Essential Supplier Documents/Records²	Where are these stored?³

₁ are any of these suppliers regarded as Single Points of Failure (SPOF)

₂ technical manuals, emergency plans, maintenance contracts etc

₃ identify locations of physical documentation/records and locations on Council IT systems

Section 5 - Further Actions

Have any Single Points of Failure (SPOF) been identified?
Activity No	What is the nature of the SPOF?	Logged on Departmental Risk Register?	Logged on Council Risk Register?	Date to be reviewed?

Exercises
List any exercising of the plan with appropriate debrief information
Date	Exercise Description	Debrief Information

Any other information that will assist in the implementation of this plan

Actions arising as a result of any of the above
Activity No	Action	Owner	Timescale

Section 6 � Recovery Plan for all activities identified -

Identify and develop a plan for dealing with any additional work that may be required once the cause of the invocation of the plan has been rectified in order to minimise any adverse effect on the restoration of day-to-day operations.

Areas for consideration might include: -

Inputting paper based information created as a result of the loss of I.T.
Testing of systems to ensure that they are functioning normally
Verifying information held on systems to identify any lost or corrupted data.
Correction of any errors discovered
Prioritised clearance of any backlogs of work that was suspended during the incident
Notification of dependent departments, external agencies, suppliers etc.

Appendix 1 - Key Contacts

Single Point of Contact

These details are required in case of Council-wide IT failure and must be staffed during the normal working hours of the department.

Extension No. or full

mobile phone number

Fax No.

Other

Key Departmental Contacts

Name	Title	Telephone No. / Extension	Mobile	Home	Radio

Other Key Contacts

This should include any stakeholders, dependent departments or suppliers identified in Section 3.

Name	Stakeholder / Supplier	Telephone No.	Mobile	Home	Other

Appendix 2 � Incident Log

Department:			Date:
Item No	Time	Details of Issue	Action Taken / Decision Made	Signature

Appendix 3 � Incident Checklist

Contingency Planning Generic Instructions � immediately following an incident (if evacuation is needed):

Please tick the following:

� Evacuate;

� Is everyone accounted for? (employees, contractors and visitors)

� Possibly co-ordinate this with HR or Heads of Service;

� Staff list and their contact details;

� Inform Emergency Services;

� Listen to radio or TV for advice;

� Contact emergency services for advice;

� Contact utility companies if needed;

� Has everyone who is responsible for the business continuity plan been informed?

� Inform Management Team of the incident;

� Tell non critical staff to go/stay home;

� Tell critical staff to get on with their business continuity responsibilities;

� Consider establishing Staff Information hotline;

� Check that all essentials stated in BCP are accessible;

� Begin media/ public relations process.

Contingency Planning Generic Instructions � immediately following an incident (if evacuation is not needed):

Please tick the following:

� Is everyone accounted for? (employees, contractors and visitors);

� Possibly co-ordinate this with HR or Heads of Service;

� Inform your staff of incident;

� Staff list and their contact details;

� Inform the staff of how it is being dealt with;

� Inform staff whether they can/ cannot leave the building;

� Listen to radio or TV for advice;

� Contact emergency services for advice;

� Contact utility companies if needed;

� Has everyone who is responsible for the business continuity plan been informed?

� Inform Management Team of the incident (if relevant) or those not on company premises;

� Tell non critical staff to go/ stay home (if relevant);

� Tell critical staff to get on with their business continuity responsibilities;

� Consider establishing staff information hotline;

� Begin media/ public relations process.

Upcoming elections

Contact your Parish Council

Activity No

SPOF1

IT Software5

SPOF¹

IT Software⁵