Introduction to Business Continuity Management (BCM) Andy Fyfe MBCI Resilience Manager Buckinghamshire County Council

Transcription

1 Introduction to Business Continuity Management (BCM) Andy Fyfe MBCI Resilience Manager Buckinghamshire County Council

2 Aim To provide an introduction to Business Continuity Management (BCM).

3 Objectives Understand what Business Continuity Management (BCM) is Understand the rationale for BCM Understand where to find more information on BCM Explain an approach to BCM BCM and Organisational Resilience Note will use the Buckinghamshire County Council model / terminology as an example.

4 What is Business Continuity Management?

5 History, best practice and standards Historical: Contingency planning Disaster Recovery PAS 56 Dec BS25999:1 / ISO22301 ISO (Guidance) ISO (business impact analysis) ISO (supply chain resilience) etc

6 Business Continuity ISO capability of the organisation to continue delivery of products or services at acceptable predefined levels following disruptive incident

7 Business Continuity Management ISO22301 formal definition holistic management process that identifies potential threats to an organisation and the impacts to business operations those threats, if realised, might cause, and which provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities

8 Business Continuity Management ISO22301 formal definition holistic management process that identifies potential threats to an organisation and the impacts to business operations those threats, if realised, might cause, and which provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and valuecreating activities

9 Business Continuity Management A management process that will ensure the continuation of all (Mission) Critical Activities in the event of an internal disruptive challenge, to an appropriate level and within an accepted timeframe, and which provides a framework for the prioritisation of the return to normal service provision i.e. Process of strategically driven prioritisation (+) Not contingency planning for specified hazards / threats. Not specifically life / limb incidents Focus on continuation of specific, prioritised activities Not just a plan! Not about Insurance / Business Interruption Insurance insufficient Not Risk Management

10 Why have Business Continuity Management?

11 Rationale for BCM Statutory duty / Regulations Internal Assurance: Services you deliver Services delivered by our service providers on our behalf ( downstream ) Services delivered to us by our providers ( upstream ) - supply chain resilience Duty of care Risk assessment - Value for Money Benefits to Business / best practice

12 NB BCM Assurance may be a legal requirement of your customer Benefits of BCM to a business Assurance for prospective clients enhances marketability / profitability Assurance for stakeholders clients / customers / employees Resilience in the event of an internal disruption or external emergency affecting the business Optimizes business opportunities from risk Greater understanding of business - management system more efficient and resilient

13 Why wouldn t you have Business Continuity Management arrangements?

14 Overview of Business Continuity Management

15 Elements of BCM (in BCC) Policy & Programme CONTEXTUALISATION BIA Resource Analysis Risk assessment Review & maintenance Response AWARENESS Risk Analysis Training & Exercising Plan development

16 How risk is analysed / used for BCM Contextualisation phase external risks (hazards / threats) Consider National Risk Register National Business Resilience Planning Assumptions N.B. include loss of IT Local Resilience Forum Community Risk Register Risk assessment: Identify consequences of hazards / threats Compare with NBRPA Incorporate into BCM analysis of impact of risk

17 Understanding the Organisation Confirm Core Activities Identify Critical Activities Confirm Continuity / Recovery Timeframes & level of continuity / recovery Business Impact Analysis (BIA) Confirm Mission Critical Activities Confirm Resource requirements Confirm workarounds / strategies for BRPAs Strategic solutions? Sign-off then prepare to develop the BCP

18 Business Continuity Plan - Definition Documented procedures that guide organisations to respond, recover, resume and restore to a pre-defined level of operation following disruption

19 Business Continuity Plan - Contents Emergency Contact Information Confirmation of MCAs and RTO / MTPD Generic Roles and Responsibilities Incident Management immediate actions* Locations Continuation strategies / actions* Includes strategies for specific BCPAs / consequences Critical interdependencies Identification of Critical Activities Critical Contact Information Appendices / Related plans * To include who, what, when, where, with what etc

20 What next? Training Exercising Review & Maintenance

21 Relationship with other departments in the organisation

22 Organisational Resilience Physical Security Audit & Assurance Health and Safety Risk Management The Resilient Organisation Information Security Management Business Continuity Management Disaster Recovery

23

24

25 Quick wins (1) Contact lists Collate all extant Emergency Plans, contingency plans etc BCM Policy Confirm the incident / crisis management C2 structure Check suppliers have BCM arrangements if not, check the contracts & commissioning process Cyber 10 steps; cyber essentials Have hard copies of plans / critical documents Keep a weather, and news, eye out and think what if? Consider how to communicate with your staff in an emergency Who are your key stakeholders and how to contact them Tell suppliers your expectations (RTO / MTPD etc)

26 Quick wins (2) Away-day / Management Team workshop: What s the purpose of the organisation? What activities are essential to achieve this? Who does these activities and with what? Consider how to continue them in the event of a loss of IT, landline / mobile telephony, staff, electricity - collate current work-arounds to problems & identify more.

27 More information Business Continuity Institute ( Local Business Continuity / Resilience Fora ContinuityCentral.com National Risk Register; NBRPAs (Direct.gov) Local Resilience Forum - Community Risk Register National Counter Terrorism Security Office (NACTSO) NB Counter Terrorism Security Advisers Centre for the Protection of National Infrastructure (CPNI) CERT-UK ( Direct.gov Cyber Essentials etc

28 Conclusion Understand what Business Continuity Management (BCM) is Understand the rationale for BCM Understand where to find more information on BCM Explain an approach to BCM BCM and Organisational Resilience

29 Any Questions?

30 More information Business Continuity Institute ( Local Business Continuity / Resilience Fora ContinuityCentral.com National Risk Register; NBRPAs (Direct.gov) Local Resilience Forum - Community Risk Register National Counter Terrorism Security Office (NACTSO) NB Counter Terrorism Security Advisers Centre for the Protection of National Infrastructure (CPNI) CERT-UK ( Direct.gov Cyber Essentials etc

31 National Risk Register BACK

32 National Business Resilience Planning Assumptions Nature of Disruption Denial of access / loss of premises Financial Disruption to retail banking services; payments systems disruption International trading disruption Staff absence Telecommunications failure Transport / Aviation Transport / Domestic Roads disruption Transport / Domestic Coastal flooding Utilities loss of electricity national Utilities loss of electricity regional Utilities national gas shortage Utilities water & waste water service disruption Loss of Information Technology BACK Impact Extreme Severe Severe Extreme Moderate Moderate Moderate Extreme Extreme Moderate Severe Moderate NOT MENTIONED!

33 Example Core to Critical Activities BACK All Business Activities of your Service Does it meet the Critical Activity Criteria? Which Critical Activity? If not why not? Opening for business Yes 2, 3 Banking of funds Yes 2 Accounting Yes 5 Stock replenishment Yes 2, 3 Cleaning down of shop fridges No Once food sold / expired the fridges can be cleaned once then left empty. They would then only need one clean prior to restocking if fridge stock to be sold. Security / loss prevention Yes 1, 2, 4 Newspaper deliveries No 2 Minimal income / not doing this saves money on paper rounds Window job vacancies No 2 Minimal income 1 Any activity, if not in operation, would threaten the welfare of staff or members of the public 2 Any activity, if not in operation, would lead to financial losses 3 Any activity, if not in operation, would lead to loss of customers 4 Related to health and safety, hygiene. 5 Failure would lead to regulatory action against the business

34 Example Continuity / Recovery Timeframes Critical Activity Timescale that activity needs to be resumed at a basic operation Immediate (0-3 hours) 3-24hrs 1-2 days 2-3 days 3 7 days 1 week 1 month No significant timescale Maximum Tolerable Period of Disruption Not specified select what is the most appropriate timeframe for the critical activity. Continuity / Recovery Level Opening for business 1-2 days 1 wk Newspaper / coffee stall Banking of profits 2-3 days 1 wk 100% Accounting 2-3 days 2 weeks 100% BACK Stock replenishment 2 3 days 3 7 days 50% 100% - 2 weeks Security / loss prevention Immediate Immediate Physical locks; intermittent guard CCTV within 3 days

35 Opening for business Banking of funds Accounting Stock replenishment Security / loss prevention Example BIA BACK Potential Impact of Critical Activity Loss On: Key: 1 = Not applicable 2 = Low impact 3 = Medium impact 4 = High impact 5 = Intolerable impact Profits Health & safety of staff Health & safety of customers Suppliers Customers Reputation Competitive edge Legislative / Regulatory risk

36 Example Summary of MCAs BACK Serial Critical Activity - Intolerable Recovery Time Objective 01 Security / loss prevention Immediate 02 Opening for business 1 2 days 03 Stock replenishment 2 3 days Serial Critical Activity High Impact Recovery Time Objective 04 Banking of funds 2 3 days 05 Accounting 2-3 days Serial Critical Activity High Impact Rationale for not continuing 01 NA Serial 01 NA Critical Activity Low / Very Low Impact or Not applicable Position Name & Signature Date BCP Compiler: Store Manager: Proprietor:

37 Resource Analysis BACK People Premises ICT Equipment Information / Data Suppliers / Service Providers / Critical Interdependencies Other