POLICY. 1) Business Continuity Management 2) Disaster Recovery 3) Critical Incident Management 4) Risk Management

Transcription

1 POLICY Policy Title: Management Descriptors: 1) Management 2) Disaster Recovery 3) Critical Incident Management 4) Risk Management Category: Risk Management Intent Organisational Scope Definitions Policy Content References Contact Information 1. Intent Edith Cowan University (ECU) shall conduct and maintain Planning (BCP) to minimise any disruption to the continuity of its operations; and shall take the necessary steps to ensure the restoration of operational activities as soon as possible following an emergency or critical incident. 2. Organisational Scope This policy applies to all staff and areas within the University and ECU controlled entities (as defined by National Governance Protocols 10 and 11). 3. Definitions Term (BC) Plan (BCP) Business Recovery Team Business Impact Assessment (BIA) Planning Committee (BCPC) Definition The uninterrupted availability of all key resources supporting essential business functions (Australian National Audit Office, 2000). A collection of procedures and information developed, compiled and maintained in readiness of an emergency of disaster. Key members from a Faculty or Centre responsible for managing and co-ordinating the recovery of the affected area s critical functions. An analysis that identifies the impacts of losing University resources. The BIA measures the effect of resource loss and escalating loss over time in order to provide senior management with reliable data on which to base decisions on risk mitigation and continuity planning. An executive group that monitors the development and implementation of planning for critical incidents, Disaster Recovery (including IT), and within ECU.

2 4. Policy Content is a key element of the risk management process and addresses risks that could threaten the continuity of the University s teaching, learning and research capability., Critical Incident Management and IT Disaster Recovery are to be managed in accordance with this policy document and the Critical Incident Management Policy Each Faculty and Centre has a responsibility for the development, communication and ongoing maintenance of the BCP associated with their areas of responsibility. This process involves a number of steps to ensure that the information and associated plans remain relevant to organisational requirements, and is illustrated at Appendix 1. Plans are to be reviewed at least annually by representatives of the documents owners and the Coordinator, Risk Management and Audit Assurance (RMAA) A Business Impact Assessment is a key process in measuring the level of impact to organisational activities, and is to be completed, or reviewed annually or following a significant change in the organisational structure, or operational capability Testing the effectiveness of the BCP within Faculties and Centres is to be undertaken at least annually and is to be supported by RMAA. Testing of BCP s may be undertaken as either of the following: Hypothetical Theoretical exercise; Component Exercising individual BCP components; Module Exercising a combination of the BCP components; or Full Exercising all BCP components. Testing of BCPs is to be monitored by the Planning Committee, and managed and co-ordinated by the respective Business Recovery Team and Co-ordinator, RMAA RMAA in consultation with ECU Professional Development has the responsibility to ensure appropriate training is provided to staff at least annually. 5. References Policy Code: RM005 File No: 06/152 Policy Owner: Director, Risk Management and Audit Assurance Approved by: Vice Chancellor Date Approved: 18 October 2008 Revision Date: 18 October 2010 Amendments: Related Policies/Documents: Standards Australian/ Standards New Zealand: Management Handbook HB221:2004 Backup and Restoration, is011 Critical Incident Management Policy, rm003 Computer Disaster Recovery Plan, it030 Institute: Good Practice Guidelines 2008

3 6. Contact Information Contact Director, Risk Management & Audit Assurance Telephone: (08) Contact Telephone: (08) Coordinator, Risk Management and Audit Assurance.

4 Appendix 1. ECU Management process

5