Bcms doc 06 1 business continuity management plan

Business Continuity Management Plan

ISO22301 Toolkit Version 3 ŠCertiKit 2016

Business Continuity Management Plan

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document The Business Continuity Management Plan sets out the objectives to be achieved within business continuity for the current financial year and a plan to deliver them.

Areas of the standard addressed This document is relevant to requirements in the following sections of the ISO22301 standard: 6.2 Business continuity objectives and plans to achieve them

General Guidance Prior to the certification audit you must ensure that the plan has been communicated to relevant staff, that they have understood it and that these facts are evidenced e.g. via meeting minutes. The inviting and answering of questions during such a meeting is likely to show evidence of understanding.

We would also recommend that the document is made available via the intranet if you have one or any other appropriate means.

Review Frequency We would recommend that this document is created each year as part of an exercise which should include significant business involvement to ensure that changed requirements are captured and feedback obtained. It should then be reviewed at least quarterly as part of your management review cycle.

Toolkit Version Number ISO22301 Toolkit Version 3 ŠCertiKit 2016.

Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name�.

To update this field (and any others that may exist in this document):

Version 1

Page 1 of 15

[Insert date]

Business Continuity Management Plan

1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly.

Further detail on the above procedure can be found in the Toolkit Completion Instructions within the Project Resources folder.

Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a trading name of Public I.T. Limited, a company registered in England and Wales with company number 6432088 and registered office at 5 Falcons Rise, Belper, Derbyshire, DE56 0QN.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third party copyright included in this document.

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to ensure that the content of any document you create that is based on our templates

Version 1

Page 2 of 15

[Insert date]

Business Continuity Management Plan

is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Version 1

Page 3 of 15

[Insert date]

Business Continuity Management Plan

[Replace with your logo]

Business Continuity Management Plan Financial Year YY/YY

Document Ref. Version: Dated: Document Author: Document Owner:

Version 1

Page 4 of 15

BCMS-DOC-06-1 1 [Insert date]

[Insert date]

Business Continuity Management Plan

Revision History Version Date

Revision Author

Summary of Changes

Distribution Name

Title

Approval Name

Version 1

Position

Signature

Page 5 of 15

Date

[Insert date]

Business Continuity Management Plan

Contents 1

INTRODUCTION ....................................................................................................................................... 7

2

BUSINESS CONTINUITY OBJECTIVES .............................................................................................. 8

3

PLAN TO ACHIEVE OBJECTIVES ..................................................................................................... 10

4

RESOURCES TO MANAGE AND IMPROVE THE BCMS ............................................................... 12 4.1 4.2 4.3 4.4

5

RISKS TO THE ACHIEVEMENT OF OBJECTIVES ........................................................................ 13 5.1

6

HUMAN RESOURCES .............................................................................................................................. 12 TECHNICAL RESOURCES ....................................................................................................................... 12 INFORMATION RESOURCES ................................................................................................................... 12 FINANCIAL RESOURCES ........................................................................................................................ 12

OPPORTUNITIES FOR THE BCMS.......................................................................................................... 14

CONCLUSION.......................................................................................................................................... 15

List of Tables TABLE 1 - BUSINESS CONTINUITY OBJECTIVES ............................................................................................................ 9 TABLE 2 - PLAN TO ACHIEVE OBJECTIVES................................................................................................................. 11 TABLE 3 - HUMAN RESOURCES REQUIRED TO RUN THE BCMS .................................................................................. 12 TABLE 4 - RISKS TO OBJECTIVES .............................................................................................................................. 13 TABLE 5 - OPPORTUNITIES FOR THE BCMS ............................................................................................................. 14

Version 1

Page 6 of 15

[Insert date]

Business Continuity Management Plan

1 Introduction [Organization Name] is committed to establishing effective business continuity plans to protect its key business activities and meet its obligations to its stakeholders.

As part of this commitment the organisation has established a Business Continuity Management System (BCMS) which complies with the requirements of the ISO22301 international standard for business continuity and will be seeking certification to this standard in the near future.

In line with the standard, it is essential that our busines continuity objectives are consistent with our policies, measurable where practicable, communicated effectively within the organization (and outside where appropriate) and updated as part of the BCMS management review process.

Objectives will be based on a clear understanding of our business continuity requirements, including those from interested parties, and will take into account the results of buisness impact and risk assessments carried out at various levels within the organization.

This document sets out the organisation’s business continuity objectives and plans for the financial year YY/YY, including     

Who will be responsible What will be done What resources will be required When it will be completed How the results will be evaluated

This document should be read in conjunction with the following other components of the BCMS which give background information about the organization’s business continuity policy and requirements:   

Business Continuity Context, Requirements and Scope Business Continuity Policy Business Impact Analysis Workbook

Version 1

Page 7 of 15

[Insert date]

Business Continuity Management Plan

2 Business Continuity Objectives In order to assess whether the BCMS is working as intended it is essential that clear objectives are defined and a system of monitoring and measurement established to record progress against targets.

High-level objectives for business continuity are described in the BCMS document Business Continuity Context, Requirements and Scope and the overall framework for setting lower-level objectives is defined in the Business Continuity Management System Policy, also a key component of the BCMS. Methods for determining to what extent objectives are being met are set out in the document Process for Monitoring, Measurement, Analysis and Evaluation.

As part of the BCMS management review process, objectives for business continuity are regularly set, reviewed and updated in the following major areas:      

Quality – generally how well the organization’s business activities are protected by the BCMS Capability – the knowledge, skills and experience available, mainly internally but also to some extent externally to the organization Cost – financial resources required to maintain and improve the BCMS Resource utilisation – how effectively organizational resources are employed Risk reduction – the degree to which known risks are treated to within acceptable limits Other – appropriate objectives that don’t fall into any of the above areas

In discussion with the management team and based upon documented requirements, [Organization Name] has agreed specific objectives in the area of business continuity as shown in Table 1 below.

Achievement against these objectives will be tracked as part of regular management reviews of the BCMS.

Version 1

Page 8 of 15

[Insert date]

Business Continuity Management Plan

Ref. Area

Objective

Tasks

1.

Ensure that all identified key business activities have a business continuity plan in place to protect them Ensure that all business continuity plans have been tested with the last 2 years Provide training in business continuity for key resources Reduce amount spent on business continuity

Hold workshops to define plans

Increase number of days provided by business teams for analysis and testing Reduce number of high priority risks on risk register

Agree allocation with top management

Quality

2.

3.

Capability

4.

Cost

5.

Resource utilisation

6.

Risk reduction

Measurement Method Percentage of key business activities with a plan

Target Timescale 80%

12 months

Person Responsible BC Manager

Agree testing schedule with top management

Percentage of plans tested within 2 years

75%

12 months

BC Manager

Identify courses; secure training budget

Number of people trained

5

6 months

Person A

Review budget to identify savings

Percentage reduction on last year’s budget Percentage increase over last year’s commitment Percentage reduction

5%

12 months

BC Manager

10%

12 months

Team leaders

10%

9 months

BC Manager

Increase focus on high priority risks; hold workshops to identify ideas

Table 1 - Business continuity objectives

Version 1

Page 9 of 15

[Insert date]

Business Continuity Management Plan

3 Plan to Achieve Objectives In order to achieve our objectives, it is essential that we have a clear plan that is adequately resourced and has the full support of top management. The success of this plan will determine whether [Organization Name] remains adequately protected against disruptive events and their potential impacts.

The plan is shown in Table 2 below. The tasks required in order to achieve each objective are listed, together with the resources required, person responsible and completion timescale for each one. The method of evaluating the success of each task will vary according to the nature of the task, but an attempt to determine this is also shown.

This plan will be managed in conjunction with background improvement activities, which may be driven by internal and external audit results, risk assessments and management reviews, amongst other sources. Additional, more detailed plans may also be created in order to control the activities required and take account of internal and external dependencies.

Progress against the plan will be tracked by the Business Continuity Manager and reported to top management on a regular basis. In the event that a task is looking unlikely to be completed within the target timescale, the effect on the relevant business continuity objective should be evaluated. Depending on the conclusion, top management may decide whether or not to take action, such as increasing the resources available, to improve the expected completion time.

In the event that business continuity objectives are changed, the associated plan will also need to be revised.

Version 1

Page 10 of 15

[Insert date]

Business Continuity Management Plan

Ref. Objective

Tasks

1.

All identified plans are in place

2.

All business continuity plans have been tested with the last 2 years Training in business continuity has been provided for all key resources

List plans Implement plans Verify plans Agree testing schedule Conduct tests Produce test reports Identify key resources Identify courses Attend courses Complete training records Review budget Identify savings Evaluate effect of reduction Agree allocation with top management Plan involvement Conduct activities Record days spent Hold workshops to identify ideas Implement ideas Reassess risks

3.

4.

Reduce amount spent on business continuity

5.

Increase number of days provided by business teams for business continuity activities Reduce number of high priority risks on risk register

6.

Resources Required Specialist IT team Internal audit Operational staff time

Person Responsible Business Continuity Manager Business Continuity Manager Training budget Business Time of Continuity attendees Manager

Completion Timescale 12 months

Evaluation Method

12 months

Business Continuity test reports

6 months

Training records

Finance Manager

Business Continuity Manager

12 months

Financial budget reports

Business teams

Chief Operations Officer

12 months

Timesheets of key personnel

Risk owners IT team

Business Continuity Manager

9 months

Risk register

Table 2 - Plan to achieve objectives

Version 1

Page 11 of 15

[Insert date]

List of signed off plans

Business Continuity Management Plan

4 Resources to Manage and Improve the BCMS In addition to the specific resources required to meet the objectives set out within this document, the following resources will be required on an ongoing basis to manage and improve the BCMS. 4.1

Human Resources

The human resources needed for the BCMS are shown in Table 3 below. For more details of the specific responsibilities and authorities of the roles described here, see the BCMS document Roles, Responsibilities and Authorities.

BCMS Role Business Continuity Steering Group Business Continuity Manager Business Process Owners Department Managers

Resources required Comments 1 day per quarter for Assuming quarterly meetings each member 1 x Full Time Equivalent Assumed to be a full-time role

IT Technicians

No additional resource

IT Users

1 day per annum

1-3 days per quarter 2 days per annum

Depends upon nature and number of processes owned Mainly awareness activities and participation in exercises and testing Business continuity is already part of relevant roles Attendance at awareness events

Table 3 - Human resources required to run the BCMS

[Describe any additional human resources that may be required e.g. contractors or secondments] 4.2

Technical Resources

[set out any equipment and IT hardware and software that will be needed as part of running the BCMS] 4.3

Information Resources

[State what additional information you will need e.g. new reports from existing systems, access to external sources such as subscriptions to relevant organizations] 4.4

Financial Resources

[What additional budget, if any, is needed? When is it required and is it capital or revenue?]

Version 1

Page 12 of 15

[Insert date]

Business Continuity Management Plan

5 Risks to the Achievement of Objectives The following risks have been identified to the plans to achieve the objectives set out in this document. These will be managed and updated as part of regular management reviews of the BCMS.

Ref. Risk 1.

Resources may not be available to take on the proactive elements of business continuity that are not currently being carried out.

2.

Timescales to implement the improvements necessary to achieve ISO 22301 may not be long enough given the degree of change and show sufficient track record for the audit

3.

Staff fail to engage with the BCMS leading to issues with plan development and testing

4.

Management are not sufficiently involved in the creation of the new quality system to carry it forward once certification gained

Likelihood Impact

Score

Risk Rating

Treatment

Table 4 - Risks to objectives

Version 1

Page 13 of 15

[Insert date]

Business Continuity Management Plan

5.1

Opportunities for the BCMS

The following opportunities have been identified which may assist in preventing or reducing undesired effects or achieving continual improvement within the BCMS: Ref.

Opportunity

1.

Recent disruptive incidents at competitor organizations have raised the profile of business continuity in the industry Increased budget in key departments

2.

Opportunity Owner Business Continuity Manager Business Continuity Manager

Potential benefit

Actions

Timescale

May make it easier to convince management of the need for additional strategies and plans Some of this budget could be invested in additional business continuity protection

Identify strategies that may have prevented the incidents at competitors

6 months

Discuss with department heads

12 months

Table 5 - Opportunities for the BCMS

Version 1

Page 14 of 15

[Insert date]

Business Continuity Management Plan

6 Conclusion This business continuity management plan is an essential part of the continual improvement of the BCMS within [Organization Name]. The objectives set for the year under consideration and the plans made to achieve them are intended to be challenging but achievable and will go a long way to protecting the organisation from disruptive incidents that may occur both now and in the future.

Version 1

Page 15 of 15

[Insert date]