Writing a continuity plan

What the toolkit is

The Business Continuity Management Toolkit is a Cabinet Office guide written for small and medium organisations in the commercial and voluntary sectors that are new to the subject, following the lifecycle in the British Standard BS 25999. It defines business continuity management as identifying the parts of the organisation you cannot afford to lose, such as information, stock, premises and staff, and planning how to maintain them if an incident occurs. The toolkit boils the subject down to four questions. What are your key products and services? What critical activities and resources deliver them? What are the risks to those activities? How will you maintain them if an incident occurs?

Understanding the organisation

The foundation is a business impact analysis. List the key products and services whose disruption would hurt most. Document the impact of losing each over the first 24 hours, 24 to 48 hours, up to one week and up to two weeks. From that, set the maximum tolerable period of disruption for each, and then a recovery time objective, the time by which it must be resumed. Document the critical activities behind each product or service and the resources they need under five headings: people, premises, technology, information, and suppliers and partners.

A risk assessment follows. The toolkit's list of risks is loss of staff, loss of IT and telecommunications, loss of utilities such as water, gas or electricity, loss of or access to premises, loss of key suppliers, and disruption to transport. Rank each by likelihood and impact and decide whether to treat, tolerate, transfer or terminate it. For each resource the toolkit then offers tactics, from cross-training and remote working to off-site backups and dual sourcing; the staff and communications and utilities failure at work pages cover them.

What the plan should contain

The toolkit has no template, but it lists what a plan should contain. A statement of purpose and scope. A named owner and the person responsible for reviewing it, with version control. The roles and responsibilities of everyone involved. How the plan is invoked: who has the authority, in what circumstances, and how teams are mobilised and stood down. Essential contact details for all key stakeholders. The incident management tasks and who does each: site evacuation, mobilising safety and first aid teams, accounting for everyone who was on site, and ongoing staff and customer communications. A location from which the incident will be managed, with telecommunications, and an alternative. Then the continuity and recovery section: the critical activities to be recovered, the timescales and levels, the resources available at each point in time, and the actions needed. Copies should be kept on and off site.

The emergency pack

Annex B describes an emergency pack kept securely off site and checked regularly. Documents: the plan, a list of employees with home and mobile numbers, customer and supplier lists, contacts for glaziers, salvage firms, builders and utility companies, a site plan showing the gas, electricity and water shut-off points, the inventory, insurance and banking details, and headed stationery. Equipment: computer backups, spare keys, a torch, a charged mobile phone with credit, and a camera for insurance evidence.

Who owns it

Senior management support must be secured from the outset. The toolkit recommends naming someone at board level as accountable, and one or more people to take the programme forward, with a short policy setting out scope, aims and the programme of work. The next step, the one the toolkit says makes the arrangements reliable, is testing the plan.