Business is not a stagnant entity. There are multiple moving parts that embody change, allow for progress, and promote growth. Corporate emergency management programs and business continuity plans (BCP) must be adjusted to reflect these changes. Whether change results from facility modifications, corporate mergers, or employee turnover, BCPs need to be reviewed, at a minimum, on an annual basis.
A business continuity review should evaluate identified critical processes necessary for operation. Through this evaluation, shortcomings in mitigation efforts, response coordination, resource capabilities, and response processes can be revealed. The plan may have to be adjusted to incorporate operational changes, employee turnover, and/or new company policies. In a business continuity review, each department should evaluate current critical processes, mitigate identified deficiencies, and update the plan as necessary.
The following critical business continuity areas should be assessed for accuracy, potential mitigation opportunities, new equipment or resources, and potential policy changes:
- Data and computer needs: Identify the procedural details of computer backups, data restoration methods, and the minimum program needs to re-establish critical business processes. Companies should examine current data center outsourcing to ensure continuity and accessibility or research alternatives.
- Notification lists: Update contact lists to ensure all information is accurate. Business continuity planners must be certain that new employees are included in the plan, as necessary, and that notifications are being delivered to accurate e-mail addresses and/or phone numbers. If maintaining accurate contact information is challenging, consider opting for a e-mail notification verification system the enables the contact to verify their own information through hyperlinks.
- Communication needs: Clear and effective communication channels must remain available in order to disseminate information to employees, assess and relay damage, and coordinate recovery strategies. Evaluate current communication equipment and/or mass notification systems to communicate to key individuals, company employees, or an entire client base.
- Supply Chain: As a company’s needs change and new suppliers come online, plans should be updated to include these critical suppliers. Alternate suppliers should be included in the BCP to ensure consistent delivery and continued operations in the event primary suppliers are subjected to business continuity circumstances, as well.
- Essential Personnel: Ensure necessary minimum staffing levels are acceptable to remain operational. Make changes, as necessary. Ensure staff, contractors, and suppliers understand their adjusted individual responsibilities and recovery time objectives.
- Equipment needs: Identify and procure necessary equipment and establish processes for continued operations and recovery. This will prevent unnecessary downtime and additional recovery efforts. If applicable, relocate equipment and arrange for essentials prior to incident. This eliminates time consuming and potentially costly efforts.
One of the most important aspects of updating a BCP is ensuring that employees are trained in plan components, and plan revisions are exercised. Each of the following phases of a BCP should be reviewed with employees:
Initial Response: The organization’s initial response to a business interruption. The processes and procedures that incorporate the Initial Response Phase may include, but is not limited to, the following:
- Initial Notifications
- Business Continuity Team (BCT) activation
- Business Unit personnel activation
- Initial BCT briefing
- Perform Impact Assessments and determine scope of recovery
- Review specific recovery strategies/tasks for BCP implementation
- Implementation of Business Continuity Action Plan
Mobilization and Relocation: The mobilization of resources (equipment and personnel) for relocation to alternate sites. Through mobilization and relocation, the BCP can be fully implemented to sustain minimum service levels defined for each critical process. This stage includes “Work from Home” and “Alternate Facility” relocation strategies. The Relocation Phase includes, but is not limited to:
- Confirmation of staff relocation schedules and assignments
- Mobilization transportation resources
- Activation of alternate facility equipment and infrastructure resources
- Occupation of alternate facilities by necessary department members.
Recovery: The period after personnel and equipment are relocated, to restoration of primary or permanent alternate facilities. Procedures to include in the recovery phase of the Business Continuity Plan are:
- Implementation of recovery strategies
- Damage assessment of primary facilities
- Evaluation of restoration goals/timeline
- Mobilization of tactical teams for Recovery
- Monitoring recovery status and plan updates, as necessary
- Initialization of restoration
Restoration: The period in which personnel return to restored or permanent alternate facilities, to when normal business operations are resumed. Procedures to include in the restoration phase are:
- Confirm completion of restoration goals for primary facilities and infrastructure
- Confirm staff relocation schedules and begin relocation to permanent facility
- Consolidate and archive incident documentation
- Review and update BCP based on lessons learned
- Return to normal operations