Z Emergency management and business continuity programs

Transcription

1 Z Emergency management and business continuity programs

2 Legal Notice for Standards Canadian Standards Association (CSA) standards are developed through a consensus standards development process approved by the Standards Council of Canada. This process brings together volunteers representing varied viewpoints and interests to achieve consensus and develop a standard. Although CSA administers the process and establishes rules to promote fairness in achieving consensus, it does not independently test, evaluate, or verify the content of standards. Disclaimer and exclusion of liability This document is provided without any representations, warranties, or conditions of any kind, express or implied, including, without limitation, implied warranties or conditions concerning this document s fitness for a particular purpose or use, its merchantability, or its non-infringement of any third party s intellectual property rights. CSA does not warrant the accuracy, completeness, or currency of any of the information published in this document. CSA makes no representations or warranties regarding this document s compliance with any applicable statute, rule, or regulation. IN NO EVENT SHALL CSA, ITS VOLUNTEERS, MEMBERS, SUBSIDIARIES, OR AFFILIATED COMPANIES, OR THEIR EMPLOYEES, DIRECTORS, OR OFFICERS, BE LIABLE FOR ANY DIRECT, INDIRECT, OR INCIDENTAL DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES, HOWSOEVER CAUSED, INCLUDING BUT NOT LIMITED TO SPECIAL OR CONSEQUENTIAL DAMAGES, LOST REVENUE, BUSINESS INTERRUPTION, LOST OR DAMAGED DATA, OR ANY OTHER COMMERCIAL OR ECONOMIC LOSS, WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER THEORY OF LIABILITY, ARISING OUT OF OR RESULTING FROM ACCESS TO OR POSSESSION OR USE OF THIS DOCUMENT, EVEN IF CSA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES. PORTIONS OF NFPA 1600, STANDARD ON DISASTER/EMERGENCY MANAGEMENT AND BUSINESS CONTINUITY PROGRAMS, 2007 EDITION (NFPA 1600), HAVE BEEN USED IN THIS DOCUMENT BY PERMISSION OF THE NATIONAL FIRE PROTECTION ASSOCIATION (NFPA ). THE CONTENT OF THIS DOCUMENT, HOWEVER, HAS BEEN EXCLUSIVELY DETERMINED BY AND THROUGH THE CONSENSUS STANDARDS DEVELOPMENT PROCESS OF CSA. THE NFPA BEARS NO RESPONSIBILITY FOR THE USE, SELECTION, OR ADAPTATION OF ANY MATERIAL FROM NFPA 1600 THAT MAY BE CONTAINED HEREIN AND HEREBY DISCLAIMS ANY LIABILITY WHATSOEVER WITH RESPECT TO THIS DOCUMENT. FOR MORE INFORMATION CONCERNING NFPA CODES AND STANDARDS AND IMPORTANT NOTICES AND DISCLAIMERS WITH RESPECT TO THEIR USE, SEE In publishing and making this document available, CSA is not undertaking to render professional or other services for or on behalf of any person or entity or to perform any duty owed by any person or entity to another person or entity. The information in this document is directed to those who have the appropriate degree of experience to use and apply its contents, and CSA accepts no responsibility whatsoever arising in any way from any and all use of or reliance on the information contained in this document. CSA is a private not-for-profit company that publishes voluntary standards and related documents. CSA has no power, nor does it undertake, to enforce compliance with the contents of the standards or other documents it publishes. Intellectual property rights and ownership This document is a derivative work adapted by the Canadian Standards Association (CSA) from NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs (2007 edition), the rights to which were licensed to CSA by the National Fire Protection Association. Copyright to this document is held by the National Fire Protection Association. CSA is the owner of all trademarks (except as otherwise noted to the contrary). Without limitation, the unauthorized use, modification, copying, or distribution of this document may violate laws that protect NFPA and CSA, as authorized licensee, and may give rise to a right in NFPA and/or CSA to seek legal redress for such use, modification, copying, or distribution. To the extent permitted by licence or law, CSA and the NFPA reserve all intellectual property rights in this document. Patent rights Attention is drawn to the possibility that some of the elements of this standard may be the subject of patent rights. CSA shall not be held responsible for identifying any or all such patent rights. Users of this standard are expressly advised that determination of the validity of any such patent rights is entirely their own responsibility. If you do not agree with any of the terms and conditions contained in this Legal Notice, you may not load or use this document or make any copies of the contents hereof, and if you do make such copies, you are required to destroy them immediately. Use of this document constitutes your acceptance of the terms and conditions of this Legal Notice.

3 CSA Standards Update Service Z August 2008 Title: Emergency management and business continuity programs Pagination: 50 pages (viii preliminary and 42 text), each dated August 2008 Automatic notifications about any updates to this publication are available. To register for notifications, and/or to download any existing updates in PDF, enter the Online Store at and click on My Account on the navigation bar. The List ID for this document is To receive printed updates, please complete and return the attached card. Name Organization Address City Province/State Country Postal/Zip Code I consent to CSA collecting and using the above information to send me updates relating to this publication. Visit CSA s policy on privacy at to find out how we protect your personal information. Z

4 Affranchir suffisamment Place Stamp Here ASSOCIATION CANADIENNE DE NORMALISATION BUREAU CENTRAL DE L INFORMATION 5060, SPECTRUM WAY, BUREAU 100 MISSISSAUGA ON L4W 5N6 CANADA CANADIAN STANDARDS ASSOCIATION CONSOLIDATED MAILING LIST 5060 SPECTRUM WAY, SUITE 100 MISSISSAUGA ON L4W 5N6 CANADA

5 CSA Standard Z Emergency management and business continuity programs Published in August 2008 by Canadian Standards Association A not-for-profit private sector organization 5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N Visit our Online Store at

6 100% The Canadian Standards Association (CSA) prints its publications on Rolland Enviro100, which contains 100% recycled post-consumer fibre, is EcoLogo and Processed Chlorine Free certified, and was manufactured using biogas energy. To purchase CSA Standards and related publications, visit CSA s Online Store at or call toll-free or ISBN Technical Editor for CSA: Ron Meyers 2008 National Fire Protection Association All rights reserved. No part of this publication may be reproduced in any form whatsoever without the prior permission of the Canadian Standards Association (CSA), as authorized licensee of the National Fire Protection Association. National Fire Protection Association and NFPA are registered trademarks of the National Fire Protection Association, Quincy, Massachusetts, USA.

7 Emergency management and business continuity programs Contents Technical Committee on Emergency Management and Business Continuity v Preface viii 1 Scope 1 2 Reference publications 2 3 Definitions 2 4 Program management Leadership and commitment Program coordinator Advisory committee Program administration General Policy Program goals and objectives Program plan and procedures Program budget Records management Program review Laws and authorities Financial management 4 5 Planning Hazard identification, risk assessment, and business impact analysis Hazard identification Risk assessment Business impact analysis (BIA) Planning process Common plan requirements 6 6 Implementation Prevention and mitigation General Prevention Mitigation Resource management Mutual aid/mutual assistance Emergency response Strategy Plan Incident management Communications and warning Assessment and coordination Systems Procedures Public warning Public awareness Emergency information 9 August 2008 iii

8 Z Crisis communications capability Operational procedures Facilities Training Business continuity Recovery 10 7 Exercises, evaluations, and corrective actions 11 8 Management review 11 Annexes A (informative) Commentary 12 B (informative) Emergency management and business continuity resources 30 iv August 2008

9 Emergency management and business continuity programs Technical Committee on Emergency Management and Business Continuity G. Jannaway Jannaway & Associates, Toronto, Ontario Chair J. Ash Paramedic Association of Canada, Ottawa, Ontario J. Bates Federation of Canadian Municipalities, Ottawa, Ontario L. Benini Benini Consulting Ltd., Victoria, British Columbia L. Biblow Calgary Disaster Services, Calgary, Alberta Associate C. Blair Alberta Emergency Management Agency, Ministry of Alberta Municipal Affairs and Housing, Edmonton, Alberta S. Brindley Independent Electricity System Operator, Toronto, Ontario B. Burrell Canadian Association of Fire Chiefs, Calgary, Alberta G. Burrill Teegor Consulting Inc., Fredericton, New Brunswick R. Fitzner Canadian Association of Petroleum Producers, Calgary, Alberta M. Fournier Public Safety Canada, Ottawa, Ontario M. Genyk MTS Allstream Inc., Winnipeg, Manitoba A. Gordon Canadian Centre for Emergency Preparedness, Burlington, Ontario P. Harkness British Columbia Ministry of Transportation, Burnaby, British Columbia D. Harrison Georgian Emergency Management and Associates, Wasaga Beach, Ontario Associate Associate August 2008 v

10 Z B. Holowachuk Manitoba Emergency Measures Organization, Winnipeg, Manitoba Associate D. Johanis Greater Toronto Airports Authority, Toronto, Ontario P. Kovacs Institute for Catastrophic Loss Reduction, Toronto, Ontario Associate E. Ladouceur Transport Canada, Ottawa, Ontario D. Lancaster Emergency Management Ontario, Toronto, Ontario J. Lavery British Columbia Ministry of Health, Victoria, British Columbia Associate J. Lindsay Department of Applied Disaster and Emergency Studies, Brandon University, Brandon, Manitoba K. Lundy Association of Canadian Port Authorities, Toronto, Ontario E. MacGillivray Emergency Measures Organization, Government of New Brunswick, Fredericton, New Brunswick W. MacKay MacKay Emergency Management Consulting Inc., New Hamburg, Ontario N. McCormick Corporate Health Works Inc., Winnipeg, Manitoba T. Mehes Vale Inco Ltd., Copper Cliff, Ontario A. Normand City of Brampton, Brampton, Ontario Representing Ontario Association of Emergency Managers B. Porrier Royal Canadian Mounted Police, Ottawa, Ontario M. Salib The Zeta Group, Ottawa, Ontario D. Shropshire Canadian Red Cross, Ottawa, Ontario S. Smith Greater Toronto Airports Authority, Toronto, Ontario Associate vi August 2008

11 Emergency management and business continuity programs M. Soegtrop Bank of Montreal Group of Companies, Toronto, Ontario Representing Business Continuity Institute I. Stronach Alcan Inc., Montréal, Québec L. Webb Emergency Management Ontario, Toronto, Ontario Associate Associate M. Wilson Ontario Association of Fire Chiefs, Courtice, Ontario J. Yamniuk TELUS Corporate Business Continuity, Calgary, Alberta R. Meyers Canadian Standards Association, Mississauga, Ontario Project Manager August 2008 vii

12 Z Preface This is the first edition of CSA Z1600, Emergency management and business continuity programs. This new Canadian Standard outlines the requirements for a comprehensive emergency management program. The goal of this Standard is to establish the elements of a continuous improvement process to develop, implement, maintain, and evaluate emergency management and business continuity programs that address the functions of prevention and mitigation, preparedness, response, and recovery. The National Fire Protection Association (NFPA) has allowed the CSA Technical Committee on Emergency Management and Business Continuity to use and adapt NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs, 2007 edition, for the purpose of developing this Canadian Standard. The agreement between NFPA and CSA to use NFPA 1600 in developing this Standard grew out of the strong commitment of both organizations to work collaboratively to promote awareness, knowledge, and application of Standards and industry best practices in the community and the workplace. NFPA 1600 incorporates a risk-based, all hazards approach that integrates emergency management and business continuity programs for a total program approach. This approach provides both opportunity and rationale for collaboration among diverse stakeholders. Canadian public and private sector stakeholders have a strong interest in ensuring that Canadian and American emergency management and business continuity systems and Standards evolve to be truly binational in scope and application. Because these Canadian and American Standards are generally consistent, they provide a common focus and platform for emergency management and business continuity programming and serve as a model for any organization or institution, private or public. They also provide an effective benchmark to allow organizations to evaluate their emergency management and business continuity programs. Annex A provides further information on some of the clauses in the body of this Standard. These clauses are identified by an asterisk (*) beside the clause number in the body. This Standard was prepared by the Technical Committee on Emergency Management and Business Continuity, under the jurisdiction of the Strategic Steering Committee on Community Safety and Well-Being, and has been formally approved by the Technical Committee. August 2008 Notes: (1) Use of the singular does not exclude the plural (and vice versa) when the sense allows. (2) Although the intended primary application of this Standard is stated in its Scope, it is important to note that it remains the responsibility of the users of the Standard to judge its suitability for their particular purpose. (3) This publication was developed by consensus, which is defined by CSA Policy governing standardization Code of good practice for standardization as substantial agreement. Consensus implies much more than a simple majority, but not necessarily unanimity. It is consistent with this definition that a member may be included in the Technical Committee list and yet not be in full agreement with all clauses of this publication. (4) CSA Standards are subject to periodic review, and suggestions for their improvement will be referred to the appropriate committee. (5) All enquiries regarding this Standard, including requests for interpretation, should be addressed to Canadian Standards Association, 5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N6. Requests for interpretation should (a) define the problem, making reference to the specific clause, and, where appropriate, include an illustrative sketch; (b) provide an explanation of circumstances surrounding the actual field condition; and (c) be phrased where possible to permit a specific yes or no answer. Committee interpretations are processed in accordance with the CSA Directives and guidelines governing standardization and are published in CSA s periodical Info Update, which is available on the CSA Web site at viii August 2008

13 Emergency management and business continuity programs Z Emergency management and business continuity programs 1 Scope 1.1* This Standard establishes a common set of criteria for emergency management and business continuity programs. 1.2* This Standard establishes the elements of a continuous improvement process to develop, implement, maintain, and evaluate emergency management and business continuity programs that address prevention and mitigation, preparedness, response, and recovery. The elements of a continuous improvement process included in this Standard are (a) program management; (b) planning; (c) implementation; (d) evaluation; and (e) management review. 1.3* This Standard covers programs in which the functions of prevention and mitigation, preparedness, response, and recovery are considered independently or in combinations. 1.4 The elements of programs covered by this Standard address the functions (prevention and mitigation, preparedness, response, and recovery) commensurate with the risks established by the entity s hazard identification, risk assessment, and business impact analysis. 1.5 This Standard applies to public, not-for-profit, and private entities. 1.6 In CSA Standards, shall is used to express a requirement, i.e., a provision that the user is obliged to satisfy in order to comply with the standard; should is used to express a recommendation or that which is advised but not required; may is used to express an option or that which is permissible within the limits of the standard; and can is used to express possibility or capability. Notes accompanying clauses do not include requirements or alternative requirements; the purpose of a note accompanying a clause is to separate from the text explanatory or informative material. Notes to tables and figures are considered part of the table or figure and may be written as requirements. Annexes are designated normative (mandatory) or informative (non-mandatory) to define their application. August

14 Z Reference publications This Standard refers to the following publications, and where such reference is made, it shall be to the edition listed below, including all amendments published thereto. CSA (Canadian Standards Association) CAN/CSA-Z Emergency preparedness and response CAN/CSA-Q (R2007) Risk management: Guideline for decision-makers Government of Canada An Emergency Management Framework for Canada, Emergency Management Policy Directorate, Public Safety and Emergency Preparedness Canada, 2006 NENA (National Emergency Number Association) NENA (2004) NENA Minimum Standards for Emergency Telephone Notification Systems NFPA (National Fire Protection Association) NFPA Standard for the Installation, Maintenance, and Use of Emergency Services Communications Systems NFPA Standard on Emergency Services Incident Management System NFPA Standard on Disaster/Emergency Management and Business Continuity Programs 3* Definitions The following definitions apply in this Standard: Business continuity an ongoing process supported by senior management and adequately funded to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery strategies and recovery plans for the continuity of services and operations, or continuity of government, following a disruptive event. Business impact analysis (BIA) a process that identifies, quantifies, and qualifies the business impact on an organization of a loss, interruption, or disruption of business processes and provides the data from which appropriate continuity strategies can be determined. Emergency management an ongoing process to prevent, mitigate, prepare for, respond to, and recover from an incident that threatens life, property, operations, or the environment. Entity a governmental agency or jurisdiction, private or public company, partnership, non-profit organization, or other organization that has emergency management and business continuity responsibilities. Incident management system (IMS) a system that defines the roles and responsibilities of personnel and the operating procedures to be used in the management and direction of emergencies and other events. Mitigation actions taken to reduce the risks and impacts posed by hazards. 2 August 2008

15 Emergency management and business continuity programs Mutual aid/mutual assistance agreement* a pre-arranged agreement entered into by two or more entities whereby the parties to the agreement undertake to render assistance to one another. Preparedness* measures taken in advance of an emergency to ensure an effective response and recovery. Prevention* measures taken to avoid an incident or stop an emergency from occurring. Recovery* activities and programs designed to return conditions to a level that is acceptable to the entity following an emergency or other event. Resource management a process for identifying and managing available resources to enable timely and unimpeded access to the resources needed to prevent, mitigate, prepare for, respond to, or recover from an incident. Response* actions taken during or immediately after an emergency to manage its consequences. Situation analysis the process of evaluating the severity and consequences of an incident. Stakeholder any individual, group, or organization that might affect, be affected by, or perceive itself to be affected by an emergency. 4 Program management 4.1* Leadership and commitment Senior management shall provide leadership and assume overall responsibility, accountability, and authority for the program. 4.2* Program coordinator The program coordinator shall be appointed by the entity and authorized to administer the program and keep it current. 4.3 Advisory committee 4.3.1* An advisory committee shall be established as required by the entity s policy The advisory committee shall provide input to or assist in coordinating the preparation, implementation, evaluation, maintenance, and revision of the program * The advisory committee shall include the program coordinator and others who have the appropriate expertise, knowledge of the entity, and the capability to identify resources from all key functional areas within the entity. Applicable external representation shall also be included. 4.4 Program administration General The entity shall have a documented program that includes the components described in Clauses to August

16 Z Policy The entity shall establish a policy that includes a vision, mission statement, roles and responsibilities, and enabling authority. The policy should be approved by the executive of the entity * Program goals and objectives The entity shall establish program goals and objectives * Program plan and procedures The entity shall establish program plans and procedures for the functions of prevention and mitigation, preparedness, response, and recovery Program budget The entity shall establish a program budget and schedule that includes milestones * Records management The entity shall (a) document and maintain logs and records of activities and decisions related to the program; and (b) establish an effective records management process Program review The entity shall establish program validation, evaluation, change management, and continuous improvement processes. Note: See Clause 8 for information on management review. 4.5 Laws and authorities 4.5.1* Compliance The program shall comply with applicable legislation, policies, regulatory requirements, and directives The entity shall know and understand the procedures of the various levels of government and other decision-making authorities so that it can influence or recommend changes to applicable legislation, policies, regulatory requirements, directives, standards, and industry codes of practice. 4.6* Financial management The entity shall develop financial procedures and controls to support the program before, during, and after an emergency Financial procedures shall be created and maintained for expediting fiscal decisions in accordance with established authorization levels and fiscal policy * Financial procedures shall include the following: (a) establishment and definition of responsibilities for the program finance authority, including its reporting relationships to the program coordinator; (b) program procurement procedures; (c) payroll for personnel involved with the program; (d) accounting systems to track and document costs; and (e) management of funding from external sources. 4 August 2008

17 Emergency management and business continuity programs 5 Planning 5.1* Hazard identification, risk assessment, and business impact analysis 5.1.1* Hazard identification The entity shall identify and monitor the hazards that can have an impact on its operations or areas of responsibility. Hazards from the following categories shall be considered: (a) natural; (b) human-caused; and (c) technological Risk assessment * The entity shall conduct a risk assessment The risk assessment shall include evaluating the likelihood of a hazard or combination of hazards occurring, taking into account factors such as threat analysis, frequency, history, trends, and probability * The risk assessment shall include data on the impact of the risk event on the entity and on people, property, and the environment * Business impact analysis (BIA) The entity shall conduct a business impact analysis The business impact analysis shall (a) take the entire entity into consideration when the critical business functions, associated resource requirements, and interdependencies are identified; (b) build on the findings from the risk assessment; and (c) consider possible events and how they could affect the entity over time. 5.2 Planning process The entity shall follow a planning process to develop and maintain its emergency management and business continuity program The planning requirements shall depend on the program s objectives and results of the hazard identification, risk assessment, and business impact analysis described in Clause The planning process shall result in the development and documentation of a single integrated plan or multiple plans. August

18 Z The entity shall engage in the planning process on a regularly scheduled basis, or when the situation has changed in such a way that the existing plan(s) is put into question The entity shall include key stakeholders in the planning process where applicable. 5.3 Common plan requirements Plans shall have clearly stated objectives Plans shall identify the functional roles and responsibilities of internal and external agencies, organizations, departments, and positions Plans shall identify lines of authority for internal and external agencies, organizations, departments, and positions Plans shall identify logistics support and resource requirements Plans shall identify the process for managing activities Plans shall identify the process for managing the communication and flow of information, both internally and externally The entity shall make appropriate sections of the plans available to those assigned specific tasks and responsibilities therein and to other stakeholders as required. 6 Implementation 6.1* Prevention and mitigation General The entity shall develop and implement prevention and mitigation strategies * Prevention The entity shall develop and implement a strategy to prevent incidents that threaten people, property, and the environment The prevention strategies shall be based on the information obtained from the hazard identification, risk assessment, and business impact analysis outlined in Clause 5.1 and shall be kept current. 6 August 2008

19 Emergency management and business continuity programs The entity shall have a system to monitor the identified hazards and adjust the level of preventative measures commensurate with the risk The prevention plan shall establish interim and long-term actions to eliminate hazards that could impact the entity * Mitigation The entity shall develop and implement mitigation strategies to limit or control the consequences, extent, or severity of an incident that cannot be reasonably prevented The mitigation strategies shall be based on the results of the hazard identification, risk assessment, and business impact analysis described in Clause 5.1, as well as program constraints, operational experience, and cost-benefit analysis The mitigation plan shall establish interim and long-term actions to reduce the impact of hazards that cannot be eliminated. 6.2* Resource management 6.2.1* The entity shall establish resource management objectives consistent with the overall program goals and specific objectives for the hazards identified * The entity shall establish resource management procedures to ensure that adequate human, physical, informational, and financial resources are provided An assessment shall be conducted to identify the resource capability shortfalls and the steps necessary to address them A current inventory of internal and external resources shall be maintained * The entity shall determine if donations could be forthcoming and, if required, establish objectives and procedures to manage donations of solicited and unsolicited goods, services, personnel, facilities, and money. 6.3* Mutual aid/mutual assistance The entity shall determine the need for mutual aid/mutual assistance. August

20 Z * The entity shall establish mutual aid/mutual assistance agreements as required Mutual aid/mutual assistance agreements shall be referenced in the program plan. 6.4 Emergency response Strategy The entity shall develop and implement a strategy to respond to emergencies that threaten people, property, and the environment Plan The entity shall develop an emergency response plan that establishes immediate actions to respond to emergencies. 6.5 Incident management 6.5.1* The entity shall establish an incident management system to direct, control, and coordinate operations during and after an emergency The incident management system shall assign specific organizational roles, titles, and responsibilities for each incident management function The entity shall establish procedures for coordinating response, continuity, and recovery activities. 6.6 Communications and warning 6.6.1* Assessment and coordination The entity shall determine communication needs to support the program. The entity shall coordinate communications activities with key stakeholders in accordance with the incident management requirements of Clause * Systems Telecommunication and other communication systems shall be established and regularly tested. The entity shall address the need for redundancy, interoperability, and security of communication systems * Procedures Communication procedures shall be established and regularly exercised * Public warning Emergency communication and warning systems to alert people potentially impacted by an actual or impending emergency shall be developed and periodically tested. 8 August 2008