University of Glasgow. Business Continuity Management. Guidance Notes

Transcription

1 University of Glasgow Business Continuity Management Guidance Notes 1

2 Contents Page 1 Introduction to Business Continuity Management 3 2 Roles and Responsibilities 4 3 Business Impact Analysis 5 4 Developing a Business Continuity Plan (BCP) 6 5 Implementing a BCP Invocation & Escalation Procedures Post-Event Reporting Procedures Exercising, Maintenance, Auditing & Review 7 Appendices Appendix A Emergency Plan 9 Appendix B Business Impact Analysis template 12 Appendix C Appendix D Business Continuity Plan supplementary information templates Business Continuity Management process overview flowchart Appendix E Flowchart of Invocation & Escalation Procedure 30 Appendix F BCM incident Record/Governance Report template 31 Appendix G BCP Training & Exercise Programme 32 Appendix H Glossary of Terms and Acronyms 33 2

3 1. Introduction to Business Continuity Management Business Continuity Management (BCM) is the process by which organisations minimise the impact of unexpected events which have the potential to cause disruption to normal services and activities. Whilst BCM is closely aligned to Emergency Planning (EP), it is about more than how we respond to emergencies. It is also about the planning for such events and their potential impact on the work we do, a feature that is crucial to the likely success of any emergency response. (Appendix A provides a copy of the University s Emergency Plan) This document provides practical guidance on developing and implementing Business Continuity Plans (BCPs) for Schools/ Research Institutes/ Services across the University. In order to prepare a BCP, it is first necessary to identify those activities that are most time-critical or urgent to the operational objectives of the School, Research Institute or Professional Service and the wider objectives of the University. The next requirement is to highlight any potential vulnerabilities those activities may have (such as dependencies on other partners who could be affected by the same emergency) and to consider the effectiveness of any existing measures designed to counteract such vulnerabilities. This part of the BCP is referred to as Business Impact Analysis (BIA). Resource, time and capability constraints imposed in an emergency situation will mean that the University must focus its business continuity activity on those processes most important to its strategic objectives. Prioritisation is therefore a key element of BCM and this may mean the continuing disruption of some of the less urgent activities for defined periods until resources are available to restore them. The aim of this document and its Appendices is to provide a step-by-step guide to the development of Business Impact Analyses and Business Continuity Plans at School/ Research Institute/ Service Level as appropriate. As well as serving the needs of the School/Institute/Service, these will be used to inform and support the group overseeing the University s Emergency Plan and any future Emergency Response. 3

4 2. Roles and Responsibilities Secretary of Court (David Newall) Ensure the University has an effective BCM framework Business Continuity Management Officer (Director of Health, Safety & Wellbeing) Provide advice on BCM policy Arrange the provision of training in BCM for appointed BC Coordinators and other employees nominated to assist in the preparation of BC plans Provide high level monitoring of BCM arrangements and Promote best practice in BCM College Secretaries Ensure suitable BCM procedures are in place within Colleges Promote BCM awareness at College Level Appoint a Business Continuity Coordinator (BCC) Nominate the BCC to attend appropriate training Heads of School, Directors of Research Institutes and Support Services Ensure the production of BCPs within the School/ Research Institute/Service Promote BCM awareness at a local level Take measures to ensure the BCC receives the necessary support and cooperation within the School/ Research Institute / Service to carry out their role. Approve scope of local BC management programme Approve final Business Continuity Plans Business Continuity Coordinator (within each School/Institute/Service) Attend Business Continuity training as requested Maintain an up-to-date BCP for the School/Institute/Service, through regular review with BC Steering Group members Ensure staff are made aware of the BCP and their responsibilities within it. Undertake periodic testing of the BCP Provide regular updates on local BCM at senior management meetings Ensure BCM is included in the local formal induction process Ensure BCM aligned to the other local risk management arrangements Act as the contact with the University's BCM Officer Forward any Governance Reports (Appendix F) to the BCM Officer 4

5 3. Business Impact Analysis (BIA) Business Impact Analysis (BIA) helps us assess the impact of adverse events on our Teaching, Research, Commercial and Support activities. Prior to commencing BIA, a scoping exercise is undertaken to establish a proposal on which core activities are to be considered within the BC programme. The focus of BIA, should be the consequences of an event rather than the event itself e.g. if a fire has occurred in a building, it is the loss of the building, rather than the fire itself, which is relevant to the BIA. The scale and range of that impact may vary depending on the timing and duration of the loss of resource; loss of large rooms becomes much more critical at exam time; inability to deliver commercial contractual commitments may incur immediate financial penalties, as well as jeopardising future contracts in the longer term. High level BIA Initial high level BIAs will be conducted through the Deans of Research Group, the Deans of Learning & Teaching Group and University Services Management Group Appendix B provides a framework for preparing a BIA for each School/ Research Institute/Service. This involves an assessment being made of the likelihood and impact of losing any activity or resource. The BIA should take into account whether the loss or interruption of an activity would (or could) result in such negative impact as: Loss of life, serious injury or staff/ student safety being compromised Serious damage to property Loss/reduction of services to students Adverse impact on partnerships or community confidence Risk of wider health and safety implications Loss of operational capability in respect of internal or commercial activities Loss/damage to information Loss/damage to resources Damage to reputation Breach of the law Loss of key skills Financial loss or liability Loss/reduction of security Activities should be identified and prioritised in order of criticality, starting with those that are most crucial to effective Teaching, Research, Commercial and Support Activities. Consideration should be given also to the impact over time of the loss of the activity, or a reduction in the ability to deliver it. Two timescales should be identified: The Maximum Tolerable Period of Disruption (MTPD), the period beyond which the University cannot contemplate continued interruption to the Teaching, Research or Service; and 5

6 The Recovery Time Objective (RTO), which must be shorter than the MTPD but must be set at a realistic timescale, perhaps involving a staged recovery and thereafter the resumption of normal service. You must also establish: The Maximum Tolerable Data Loss (MTDL), the loss of data (hours, days, weeks) beyond which the University would be unable to recover its operational capability. What needs to be established is: The maximum time period after the start of any disruption to business within which each activity needs to be resumed The minimum level at which the activity must be performed upon resumption The length of time by which normal levels of operation must be resumed 4. Developing a Business Continuity Plan (BCP) The BIA has identified potential vulnerabilities and the timescales for addressing these. The next stage is to plan how best to achieve this; i.e. the business recovery arrangements, and to record this in a BCP that can easily be followed by anyone likely to have to respond to the situation. BCPs should also include risk mitigation/recovery plans for each of the critical activities. Resources required to deliver the acceptable level of service must be identified, with consideration given to the following: People and skills Accommodation Vehicles, plant and equipment Information technology (hardware, software and access to corporate networks and applications) Communications equipment and access to systems (radios and/or telephony) Supplies and services The BCP should specify the point in time by which each of these resources is required. It may be possible to identify a fall back site to ensure the continuity of an activity, in the event of a permanent loss or temporary denial of access to the principal site. If so, this should be covered by an agreement between the heads of the host/guest School/ Research Institute/ Service identifying the following: The accommodation that is to be used The circumstances under which it is to be used Arrangements for gaining access Arrangements for contacting relevant staff Similarly, where the continuation of an activity relies on an external agency or supplier, a service level agreement should be formulated agreeing levels of service to be provided. 6

7 Appendix C provides templates for gathering supplementary information that may be required as part of a BCP, and also a checklist of matters to consider. BCPs should consider arrangements needed to ensure smooth transition from business continuity mode, through business recovery to the resumption of business as usual. Once approved the master copy of the BCP should be signed off by the Head of School, Director of Research Institute or Support Service, and copies circulated throughout the School/ Research Institute/ Service as necessary. A copy of the plan should be submitted to the University's BCM Officer and a copy held by the local BC Coordinator. Appendix D provides a flowchart overview of the Business Continuity Management process at local level. 5. Implementing a BCP 5.1 Invocation & Escalation Procedure The reporting of an event that could result in a critical disruption of service provision is the responsibility of whoever first discovers or receives information about an emergency situation. Appendix E provides a flow chart which explains the required action, depending on the circumstances of an incident and related to the Recovery Time Objective (RTO) set within the BCP for the affected activity/activities. 5.2 Post-Event Reporting Procedures It is highly likely that many, low-level disruptions will be dealt with by local management using routine management recovery procedures. In such instances there will be no requirement to invoke any BCM procedures. However, such disruptions and the way in which they are resolved may well serve to inform, improve or update the BCP. Appendix F provides a form which should be used, in the event of a disruption, or an incident which had the potential to cause disruption, by the relevant BCP holder, or nominated depute, for completing the governance report and forwarding it to the BCM Officer for information 5.3 Exercising, Maintenance, Auditing & Review It is important to exercise any BCP to ensure its effectiveness. Maintenance and auditing are essential to ensure compliance with the standards adopted. We will continually review our arrangements and test the plans appropriately. All plans should be reviewed at appropriate frequency, and fully exercised over a 3 year rolling programme. Exercising programme Exercising allows the evaluation of a BCP, identifying any gaps or weaknesses. It provides an opportunity for key personnel to rehearse and gain familiarity with the BC processes. 7

8 The exercise programme should be a progression of exercise types, each one building on the lessons of the previous exercise, finally culminating in a full test of the BCP. The component parts of the plan should be exercised more frequently. The local BCP Holder(s), in conjunction with the BCM officer, are responsible for organising the component tests. The BCM Officer will coordinate the University s BCM exercise programme. Support and guidance in preparing for the BCP testing will also be provided. Appendix G provides a template for recording Training and Exercise Programmes An example exercise programme from the BS25999 is shown below. Complexity Exercise Process Checks Good Practice Frequency * Simple Desk top Review/ amend content Update/ validate At least annually Challenge content of Audit verification Annually Medium Complex Plan walk through Simulation Critical Activity Exercise Full BCP inc. Incident BCP Challenge content of BCP Use created situation to ensure BCP(s) contains enough/ necessary information Invoke BCP in controlled situation without impacting on business Building/ Campus/ Exclusion Zone exercise Validity of interactions and participant roles Incorporate associated plans e.g. run defined operations from back-up site Annually Annually or twice yearly Annually or less frequently Annually or less frequently management * Exercise frequency depends on: organisational needs, operating environment, stakeholder needs etc. Needs to be flexible to allow for other issues such as organisational change and the outcome of previous exercises Maintenance, audit and review The University exists in a dynamic environment. It is subject to changes in people, processes, supplies, risk and environment. To remain current, BCM arrangements must be reviewed and updated, as well as being subject to audit and inspection. Local BC Coordinators are responsible for the local maintenance, review and testing of their BCP(s), whilst the University s BCM Officer is responsible for the high level monitoring of BC Management procedures. Appendix H provides a Glossary of Terms 8

9 University of Glasgow Emergency Plan Appendix A Introduction This document seeks to outline the University emergency planning and response model. The University Emergency Planning and Response Model Glasgow University operates a cellular emergency planning and response model. An emergency will be declared by the strategic group chair (or deputy) based upon the scale, extent and impact of events. In the event of an emergency the strategic group will be called to meet and begin emergency management. The strategic group is managed by the Secretary of Court or the Deputy. The strategic lead will be responsible for ensuring that the Principal and University Court are kept up to date with relevant developments. The strategic group will comprise of cell leads as required for the management of an emergency. There are eight cells; Communications and media Incident Management and Investigation Staff Management Estates and Buildings Students Schools and Colleges Emergency Planning/Health and Safety IT infrastructure. A ninth cell can also be constructed if artefacts become part of the emergency unfolding. The cell leads will be responsible for assisting in the management of such an emergency as part of the strategic group. Only the cells with a direct role in progressing the emergency response will be required to attend the strategic group. The decision as to attendance at the strategic group lies with the strategic group manager (or deputy). An early priority will be the formation of a working strategy to ensure clarity of action and purpose. An action log will be maintained by the chair and will form the basis for on-going work. Where appropriate the University will consider the use of a Risk assessment matrix in relation to priority setting. Meetings will be scheduled by the chair as appropriate. 9

10 Tactical/Operational Delivery After the strategy has been set and course of action agreed the cell leads will return to their respective cells to work towards tactical or operational delivery. They will use the strategy set as the medium for priority setting within the cell and will ensure staff are briefed as such. The cell leads will also be responsible for providing succinct feedback from the cells to the strategic group. Each cell has prepared a list of roles which can be delivered by staff during such an emergency. Strategic Recovery Team At the commencement of an incident a senior member of staff will be appointed to lead a Strategic Recovery team to ensure that equal priority is given to business continuity and early recovery. The strategic lead and deputy (Recovery Team) should also sit on the Strategic group to ensure clarity and common purpose. As the emergency phase moves to a controlled and managed status, the recovery team should begin to lead in a joined up and consistent fashion. External Agencies In the event that an emergency occurs which is managed by an external agency or group such as the Police, if a crime has been committed or the Strategic Coordinating Group if the event is so severe as to require a multiagency managed response then the same arrangements will continue to apply in relation to the University strategic and tactical groups. The chair of the strategic group (or deputy) should consider sitting on the external management group to act as a point of coordination and up to date information. In such an event there will of course be a requirement for close collaboration to ensure consistency of approach and message and this may include access to potential witnesses, joint clarity of communications messages, shared access to decision making amongst other things. 10

11 Training Training should be managed on a rolling three year planning cycle. Year 1 Training internally within a single cell to ensure that staff members are aware of their role, where they sit in the overall university emergency planning and response structure and the products they may be asked to deliver. Year 2 Inter cell training involving a developing incident where cells require to work together to experience some of the interdependencies of emergency responding. Year 3 To involve multi agency training to exercise jointly with external agencies. The aim is to build relationships and mutual understanding in the event that these skills and knowledge are required in earnest. Conclusion The university is developing a generic approach to Business continuity management and the subsequent plans will of course form the basis for decision making in the event of an emergency. This document will be the subject of review on a yearly basis through the University Senior management group to ensure it is fit for purpose. David Newall Secretary of Court 21 st August

12 Appendix B University of Glasgow Business Impact Analysis School/ Research Institute/ Service: Completed by: Date: Location(s) Location 12

13 Activity Summary Identify activities in your business area, starting with those that are most critical to sustain the University's Teaching, Research, Commercial and Support Services. Activity 1 SPOF 2 RTO 3 Does the activity depend on, or influence the activities of other departments within the University or external agencies If YES, list the departments Contingency Arrangements 4 (To cover people, facilities, systems, suppliers, or any other arrangements) 1. List activities with most critical first in descending order 2. Are any of the activities regarded as a Single Point of Failure (SPOF) i.e. an activity whose loss alone would directly prevent the maintenance of effective Teaching, Research, Commercial or Support activities. 3. Recovery Time Objectives (RTO) should indicate the priority / timescale to restore an activity to a minimum level 4. Contingency arrangements should include any actions that can be implemented locally i.e. relocation to other premises, transfer of work to other department, manual workarounds whether agreed or identified as the potential for good practice 13

14 Personnel resources required for each activity with a risk category of unacceptable, substantial and moderate Provide information on the number and grade of staff required, along with requisite competencies and details of any other areas within the University where staff also meet these requirements and may be able to assist. People Activity No SPOF 1 Minimum number of staff required to start/maintain activity and grade if necessary Specialist skills/training required by staff Can staff from outside the department support this activity and if yes, where from Y/N 1. Are any of these people regarded as a Single Points of Failure (SPOF)? i.e. people without whom an activity would not be possible e.g. single post-holders 14

15 Equipment Activity No SPOF1 Location(s) 2 Standard equipment 3 Specialist equipment 4 IT software 5 Vehicles required 6 1. Is any of this equipment regarded as a Single Points of Failure (SPOF) 2. Give details of location abbreviations or codes below 3. Identify number of workstations, phones, faxes, desktop or laptop computers, printers and any other standard IT hardware required 4. Identify any specialised equipment required e.g. scanner, A3 printer etc 5. Identify any software required over and above generic systems 6. Identify any specialist vehicle required 15

16 Crucial Activity Data Give details about any data, (documentation, information or records) crucial to your identified critical activities, the format in which they are stored (hard, microfiche, electronic etc) and their physical or network locations Activity No SPOF1 Essential Documents/Records 2,3 How are these stored Where are they accessed 4 1. Is any of this data regarded as a single point of failure (SPOF) 2. Technical manuals, emergency plans etc 3. What is your Maximum Tolerable Data Loss (MTDL)? i.e. How much data could you afford to lose minutes, days, weeks? 4. Identify locations of physical documentation/records and locations on University IT systems 16

17 Crucial Supplier Details Information on your key suppliers and the nature of goods or services they provide. Include details of crucial documentation linked to this supplier and where this can be found. Activity No SPOF1 Supplier Goods/Services Provided Essential Supplier Documents/Records 2 Where are these stored 3 1. Are any of these suppliers regarded as single points of failure (SPOF) 2. Technical manuals, emergency plans, maintenance contracts etc 3. Identify locations of physical documentation/records and locations on University IT systems 17

18 Crucial Customer Details Information on your key customers and the nature of services you provide to them. Include details of crucial contractual documentation linked to this customer and where this can be found. Activity No Customer Services Provided to Customer Essential/ contractual Documents/Records 1 Where are these stored 2 1. Contractual Documents, Service Level Agreements, Contact Details, Penalty Clauses 2. What format, how, and where these are stored and methods of access. 18

19 Accommodation Requirements This section should be used to assist in putting together a basic requirement for a fall-back site. Depending on the complexity of the activities that your School/ Research Institute/ Service performs, either complete one template for each activity, or complete a single form giving an overview of the requirement. You should then identify a suitable site (or sites) that is both of a sufficient size to meet your needs and will also be available when you might need it. Activity and brief overview of requirement: Minimum number of people required Type of space required e.g. generic office, Lab accommodation or any specific requirements Number Number or or quantity that Resources required (refer to quantity can be resource requirement etc.) required provided by the host site Who will provide any additional items that are required? In what timescale can these items be provided? What are the arrangements for obtaining these items? Is there any agreement in place to cover the provision of these items? Workspaces (i.e. desk, chair etc) Other furniture Facilities and infrastructure (including communications, networks and utilities) 19

20 IT equipment IT systems or applications access Communications equipment Other equipment Details of Identified Fall-back site (if required) PREMISES Location The following fall-back accommodation has been identified in the event that the site at which the activity is normally performed is unavailable Contact name and number at the Specification alternative site Transfer arrangements to the alternative accommodation are: Manager at host site: Date arrangements agreed: What to do upon arrival at fall-back site List the steps necessary to achieve the objectives set out in the previous sections. Wherever possible they should link with similar activity elsewhere to minimise use of resources Task Description Person responsible Etc 20

21 Further Actions Summarise any required actions identified in the course of the preceding pages, linking it to the activity number and providing the name and post of the responsible person and required timescale for completion Have Any Single Points of Failure (SPOF) been identified Activity No What is the nature of the SPOF? Logged at Departmental Level? Logged on risk register? Date to be reviewed? Any other information that will assist in the implementation of this plan Action arising as a result of any of the above Activity No Action Responsible Person Timescale 21

22 Appendix C Business Continuity Plan supplementary Information Contact Information List any contact details and numbers that may be of use populate as required. Key Personnel (including details of Deputies) Role/Responsibility Contact Details Office Home Mobile 22

23 Communication Plan List of who needs to be contacted, their involvement to the activity in question and contact details/ mechanisms. Key stakeholder Activity interest Preferred method of communication Contact details 23

24 GENERAL RECOVERY TASKS AND RESPONSIBILITIES APPENDIX C, CONTINUED This list of prompts is intended to help departments go about making an initial assessment of the incident; establish what action is required and what additional information is needed. If incident occurs during working hours, account for all staff, students and visitors, including any contractors working in the area of the incident. Establish whether any staff, students or visitors have been injured as a result of the incident. Liaise with the EPG to ensure appropriate support is provided. Arrange a meeting of key staff. Ensure emergency services and individuals involved in salvage and security are made aware of any hazardous materials or key equipment Conduct an initial assessment of the impact on the department Teaching Research Commercial activities Administration Materials Environment Equipment Make a summary of the initial assessment and determine the approach to creating and maintaining a formal inventory of all losses. Assign responsibility for this. Determine what activities can be suspended short term and what activities must continue. Establish the extent of unaffected environments and equipment within the department and consider how it can best be utilised in the short term. Consider the best means of communicating short term actions to staff and students 24

25 Formulate initial communication to staff and students. Ensure this addresses Staff and student wellbeing Access to the affected site Site safety Personal belongings Initial alternative arrangements Future means and mode of information provision Establish what central support is required from the University Human Resources Finance Staff and Student wellbeing Public Relations Accommodation Materials and Equipment IT Establish EPG liaison contacts for each of these areas Consider initial options available to continue priority activity in the short term, including environment and equipment needs Liaise with Estates Central Room Bookings concerning access to alternative facilities. Liaise with the Insurance and Risk Manager concerning insurance and loss adjuster access. Consider initial feedback from staff and students Agree ongoing responsibilities for team members Schedule next meeting of the local Emergency Response Team 25

26 INSTRUCTIONS TO STAFF AND STUDENTS This list of prompts is intended to inform communications. It is important to communicate quickly and consistently with staff and students to minimise uncertainty. Contact staff and students and inform them of the situation. Use telephones, intranet, and physical notices. Provide instructions about alternative work place or staying at home. Advise current and anticipated arrangements for access to the affected area. Ask each staff member, and where appropriate postgraduate student, to prepare a short summary of their current work activities, including any deadlines or critical dates, in connection with prioritising recovery resources Ask each staff member for information about the detail and location of work related items which need to be salvaged if possible. Where necessary ask staff members to establish communications with other members of staff and provide contact details using the table overleaf Inform each staff member to maintain a record of actions taken, and any additional expenses incurred in response to your instructions Inform them when and how you will next be in contact with them and provide any final instructions 26

27 RECOVERY ACTION - <1 DAY RECOVERY ACTION DAYS Description of Task Done? Description of Task Done? REVIEW ACTIONS UNDER GENERAL RECOVERY TASKS AND RESPONSIBILITIES. CONSIDER LIAISON ARRANGEMENTS ON SALVAGE TO ENSURE SAFETY AND MINIMISE LOSS OF MATERIALS LIAISE WITH UNIVERSITY EMERGENCIES PLANNING GROUP (UEPG) CONCERNING INTERNAL AND EXTERNAL COMMUNICATIONS. ARRANGE FOR NOTIFICATION TO STUDENTS AND STAFF NOT TO ATTEND AFFECTED AREA. AND PHYSICAL NOTICE. ADVISE OTHER DEPARTMENTS WHOSE STAFF OR STUDENTS MAY BE AFFECTED WITH SUPPORT FROM THE UEPG, SECURE ARRANGEMENTS FOR SAFE ACCESS FOR NOMINATED STAFF TO THE AFFECTED AREA TO BEGIN ASSESSMENT. COMPLETE A HIGH LEVEL ASSESSMENT OF UNAFFECTED RESOURCE WITHIN THE DEPARTMENT CONSIDER HOW BEST TO UTILISE THIS SHORT TERM. THIS MAY INVOLVE SHARING UNAFFECTED FACILITIES WORK WITHIN THE DEPARTMENT TO IDENTIFY POSSIBLE ALTERNATIVE RESOURCES AND SPACE. IF NECESSARY ALSO LIAISE WITH THE UEPG TO DETERMINE AVAILABLE RESOURCES AND SPACE OUTSIDE THE DEPARTMENT MAKE AN INITIAL INVENTORY OF LOST IT HARDWARE LIAISE WITH UNIVERSITY IT SERVICES TO ESTABLISH WHETHER ALTERNATE EQUIPMENT CAN BE QUICKLY SOURCED. ARRANGE A QUARANTINE ENVIRONMENT FOR MATERIALS WHICH MAY BE SALVAGED PREPARE SUMMARY BRIEFING/ADVICE FOR STUDENT AND STAFF OBTAIN STAFF AND STUDENT FEEDBACK RECOVERY ACTION DAYS START TO FORMALISE ALTERNATIVE BUSINESS/ TEACHING SCHEDULE/ENVIRONMENT START TO FORMALISE DATA CONCERNING LOST MATERIALS ESTABLISH ALTERNATIVE OFFICE ENVIRONMENT LIAISE WITH IT CONCERNING CONNECTIVITY TO ALTERNATIVE ENVIRONMENT WORK WITH HR ON STAFF SUPPORT UPDATE STAFF AND STUDENTS ON ANTICIPATED MEDIUM TERM ARRANGEMENTS AND RECEIVE FEEDBACK RECOVERY ACTION - > 3 DAYS CONSIDER HOW BEST LOST MATERIALS CAN BE REPLACED OR SUBSTITUTED WORK WITH THE FINANCE OFFICE TO ESTABLISH WHETHER RESEARCH FINANCE SHOULD BE SUSPENDED (THIS MAY ENSURE THAT THE UNIVERSITY S BUSINESS INTERRUPTION INSURANCE POLICY PROVIDES FINANCE TO REINSTATE RESEARCH TO THE POINT OF LOSS) DETERMINE STRATEGY TO COMMUNICATE WITH EXTERNAL STAKEHOLDERS INCLUDING RESEARCH FUNDING BODIES CONSIDER ACTION REQUIRED TO REASSURE AND RETAIN KEY STAFF ESTABLISH PROTOCOLS WITH THE FINANCE OFFICE TO EXPEDITE THE REPLACEMENT OF LOST MATERIALS BRIEF STAFF AND ESTABLISH A SCHEDULE OF PROGRESS REVIEW MEETINGS OVER ANTICIPATED RECOVERY PERIOD. BEGIN FORMALISING POLICIES ON ISSUES ARISING FROM THE INCIDENT SUCH AS STUDENT APPEALS AND POSITION ON ONGOING RESEARCH ACTIVITY. CONSIDER STRATEGIC ISSUES ARISING FROM LOSS OF KEY MATERIALS AND THE APPROACH TO OBTAINING SUBSTITUTES OR ALTERNATIVES. CONSIDER STRATEGIC ISSUES ARISING FROM LOSS OF KEY MATERIALS AND THE APPROACH TO OBTAINING SUBSTITUTES OR ALTERNATIVES. ORGANISE A FULL DEBRIEFING, SHARE KNOWLEDGE AND LESSONS LEARNED OTHER ACTIONS? CONDUCT BRIEF MEETINGS WITH STAFF TO DISCUSS AND AGREE THEIR SHORT TERM ACTIONS AND RECEIVE INDIVIDUAL FEEDBACK. CONSIDER POSSIBLE STUDENT POLICY ISSUES ARISING EXEMPTIONS/APPEALS WORK WITH UNIVERSITY FINANCE AND LOSS ADJUSTERS WORK WITH ESTATES/SALVAGE CONTRACTORS AND STAFF TO ENSURE THAT MATERIALS ARE NOT UNNECESSARILY DISPOSED OF (NEEDS TO BE DONE IN PARALLEL WITH TEACHING ACTIVITY. ENSURE SECURITY IS ALSO ADDRESSED.) 27

28 This table should action as an aide memoire to staff working under pressure post incident. It should contain a series of prompts to support recovery of activity. The content should be sufficient so that, in the absence of senior staff, other staff members can direct the department s recovery. OTHER ACTIONS? Description of Task Done? Description of Task Done? 28

29 Local Business Continuity Management Process Overview Appendix D WHO? WHAT? CONSULTING WHOM? Heads of School, Directors of Research Institutes and Professional Services 1. Appoint Business Continuity Coordinator (BCC) 3. Nominate BCC to attend Training 3. Attend appropriate training as nominated University Business Continuity Management Officer Business Continuity Coordinator 4. In consultation with local managers prepare draft proposal on scope of Business Continuity Management Programme 5. Submit proposed scope to local Management Group for approval Local leaders and managers (Heads of Subject/ Service) Local Management Group 6. Conduct Business Impact Analyses (BIAs) on activities in scope of BCM Programme Local leaders and managers (Heads of Subject/ Service) 7. Use BIAs to inform development of Business Continuity Plan and submit to local Management Group for approval. Local Management Group 8. Hold BCP and, with BCSG members, conduct regular reviews of BCP to ensure current and on target. 29

30 Appendix E Incident/ Issue Notify Secretary or Dept Sec of Court. Only affects local work area/dept Yes No Affects only School/ College/ RI/ Support Service No If required the strategic manager will assemble the required cell leads. Resolve locally No Yes Issue managed/ Service resumed Yes No Disruption beyond Department/ area critical time line? Procedure ends Do NOT invoke major incident process. Do submit Governance/ Incident Report as required. Yes Does it impact at College/ School/RI/ Support Service level? No Yes Can it be contained within College/ School/RI/ Support Service? Yes Resolve. Inform Senior Management No Resolve locally Service resumed Service resumed. Procedure ends. Submit Governance/ Incident Report as required Procedure ends Submit Governance Incident Report 30

31 Appendix F BCM incident Record/Governance Report Time and date of incident location Discovered by Contact no. Incident Manager Contact no. State whether potential disruption, local resolution or plan invoked Type of incident (place x in appropriate box) ITC failure Power failure Denial of access Utilities loss Property/Facilities Equipment failure Staffing issue Severe weather Fire Supply chain failure Flood External incident Gas leak Other (specify) Summary of circumstances and (potential) impact on business (critical and non critical) Corrective action (to include details of any further action required to minimise likelihood of re-occurrence) Person submitting Please submit to Business Continuity Management Officer Date: 31

32 Appendix G Training and Exercising Programme (To include both planned exercises and a record of those already carried out) Date of test Element of BCP tested (what resource tested) Type of test carried out (simple/medium/complex) Findings Went well Not so well Lessons learned Remedial action taken (amendments to BC plan) Staff training List any staff training with appropriate debrief information Date Training description Debrief information 32

33 Appendix H Glossary of terms and acronyms BCM BCMT BCP BIA CMG MPTD MTDL RTO Business Continuity Management Business Continuity Management Team Business Continuity Plan Business Impact Assessment College Management Group Maximum Period of Tolerable Disruption Maximum Tolerable Data Loss Recovery Time Objective 33