PS 170 Business Continuity Management Policy

Transcription

1 PS 170 Business Continuity Management Policy July 2013 Version 2 Statement of legislative compliance This document has been drafted to comply with the general and specific duties in the Equality Act 2010; Data Protection Act; Freedom of Information Act; European Convention of Human Rights; Employment Act 2002; Employment Relations Act 1999, and other legislation relevant to policing. PS 170 Business Continuity Management Policy Page 1 of 5

2 Table of Contents Statement of legislative compliance... 1 Aims and objectives of the policy... 2 Application... 2 Purpose... 3 Policy statement... 3 Benefits... 4 Responsibilities... 4 Related documents and Appendices... 5 Administration... 5 Version Control... 5 Monitoring and review... 5 Registered Owner... 5 Aims and objectives of the policy The Nottinghamshire Police business continuity policy provides the framework within which the Force can comply with its statutory duties as a category 1 responder under the Civil Contingencies Act 2004 and the business continuity requirements of the organisation and all interested parties, by introducing a business continuity management system (BCMS) that aligns with ISO 22301:2012 Societal security Business continuity management systems - Requirements. Business continuity management is being established to ensure the Force can continue to deliver a minimum level of service in the event of any disruption. Plans must be made, published and tested for key services and critical functions as agreed by the chief officer team, divisional commanders and departmental heads. Application The policy applies to all areas of the Force. All employees within divisions and departments must be made aware of this policy. The policy applies in particular to divisional commanders, departmental heads BC single points of contact (SPOC) and plan writers. PS 170 Business Continuity Management Policy Page 2 of 5

3 Purpose The Nottinghamshire Police business continuity policy provides a structure through which: A comprehensive BCMS is established and maintained; Key services together with their critical processes and activities and supporting resources and interdependencies, will be identified; Business impact analysis and risk assessment will be applied to our critical processes and activities, supporting resources and interdependencies; Plans will be developed to ensure continuity of key services at a minimum acceptable level and within specific timeframes following disruption; Invocation of business continuity plans and communication with our customers (the public), partners, suppliers and other interested parties can be managed: Plans are subject to ongoing exercising and revision; and The chief officer team and the Nottinghamshire Office of the Police & Crime Commissioner (NOPCC) can be assured that the Force complies with the requirements of the Civil Contingencies Act 2004 and that BCMS remains up to date and relevant. Policy statement Divisional commanders and departmental heads will be designated business continuity plan owners and ensure: A Business Continuity SPOC is appointed for each division and department Crisis management team members are identified and details regularly updated within the plan. Business impact assessments are carried out to identify critical functions/services, which are then subject to risk assessment. Plans, capable of maintaining a minimum acceptable standard of service delivery are in place for each critical function/service within their area of operation. All plans will take into consideration any reliance on, or support to, any regional or collaborative operational unit or service provider and include risk mitigation for any disruption to shared services. Functional departments (e.g. Information Services) will provide professional support to improve resilience of critical functions and resources that support those functions. Each division and department will carry out an annual review of its business continuity process. The Force BC Lead will monitor the review process, benchmark the results and provide support where necessary. PS 170 Business Continuity Management Policy Page 3 of 5

4 Each division and department will exercise its business continuity plans at least once a year and make modifications where necessary, to take account of the exercise results. A force table top exercise for SPOC s will be held in the first quarter of each year. Contracts with suppliers of critical goods and services to the force will include a requirement for the supplier s business continuity processes to be approved and to be exercised to the satisfaction of the force. All staff must be made aware of business continuity plans that affect their division or department, how any disruption may affect their normal working practices and any specific role they may have following invocation of the plan. All interested parties, key customers, suppliers and partners are to be kept informed about our BCM arrangements as they affect the service provided to them. Benefits The policy provides a clear commitment to establishing a business continuity management system within Nottinghamshire Police that will enable the force to: Continue to provide critical functions and key services in times of disruption; Make best use of personnel and other resources at times when both may be scarce; Reduce the period of disruption to the Force our partners and the public we serve; Resume normal working more efficiently and effectively after a period of disruption; Comply with standards of corporate governance; Improve the resilience of the Forces infrastructure to reduce the likelihood of disruption; and Reduce the operational and financial impact of any disruption. Responsibilities The Deputy Chief Constable holds the responsibility for business continuity issues. This policy is owned by the Deputy Chief Constable. The Force Business Continuity Lead will chair the Business Continuity Forum (BCF) meeting quarterly and responsible for implementing and embedding BCMS throughout the organisation Divisional commanders and heads of department will be designated BC plan owners. The Force BC Lead is the professional lead for business continuity within the Force and will: Review and develop the policy in line with ISO 22301, industry best practice and the need of the Force; Monitor the performance of the BCMS and compliance with the policy; and Provide support and guidance to the Chief Officer Team, BCF, divisional commanders, departmental heads, business continuity single points of contact and plan writers. Provide advice and assistance to the Nottingham Office of the Police and Crime Commissioner, Regional and National Business Continuity Forums and assist with the production of business continuity plans for regional/collaborative units. PS 170 Business Continuity Management Policy Page 4 of 5

5 Related documents and Appendices Civil Contingencies Act 2004 British Standard ISO 22301:2012 Societal security Business continuity management systems - Requirements Administration Version Control Section changed Details of change New Document To comply with ISO 22301:2012 standard Monitoring and review Measure Date/period and process of review Annual Review Force BC Lead to review yearly to reflect and respond to organisational change Registered Owner Owner Author DCC, S. Fish Read Hibbert, Strategic Support Officer - Force BC Lead PS 170 Business Continuity Management Policy Page 5 of 5