Business Continuity and Disaster Recovery Plan

Transcription

1 Business Continuity and Disaster Recovery Plan 1.0 Introduction Our plan relies upon excellent communications and this is reviewed on a regular basis to identify any weakness and forms part of our board meeting agenda. Lessons that we learn from our operations are fed back into this plan. 2.0 Definition of a 'disaster' Globally, almost every day there are many disasters which are either natural or man-made, which go unpublished. These disasters devastate both public and private sector businesses. Where the disaster affects critical business procedures, the consequences can be severe and include substantial loss, not only in financial terms but in terms of service delivery, goodwill and credibility. As a result, the consequential damage can have an even wider impact on the welfare of both our clients and the communities in which we work. The benefit of having a recovery plan, which can be implemented with the minimum of delay, will reduce the level of disruption and ensure a rapid return of services to our clients. At the same time, time it seeks to protect the environment. 3.0 The scope of this plan The aim of this plan is to ensure that the critical functions located at Corry Place, Belfast, regional offices in Manchester & London, Crag Avenue Business Park, Clondalkin and regional office in Cork, Ireland are reinstated as soon as possible. This is essential to enable us to provide a consistent level of customer service and business as usual'. Our plan sets down the actions required by the Extraspace board, is assisted by a selected support staff. Each of our directors will have a plan for their department and further sub plans for the sections for which they have responsibility. 4.1 Objectives A. Is to protect the shareholders' investment. B. Is to mobilise the organisational structure. C. Is to identify less the immediate action required for individual named events occurring. D. To list the short-term measures necessary to replicate essential systems. E. To list the medium-term measures necessary to assemble the systems to be replicated. F. To itemise, minute and explain our long term recovery action. G. To learn from any events and amend the plan. 5.0 Plan assumptions The cornerstone of our plan is, that being in the modular accommodation business, in each hub, Belfast, Dublin & cork, we have alternative accommodation ready and available in the event of an unforeseen disaster situation. The transfer to this accommodation, however inconvenient, will be relatively seamless to the outside world.

2 Our plan assumes a worst-case scenario, in which critical information, systems and resources are partly destroyed or destroyed, by natural events, fire or by unauthorised entrance, physically or remotely committing acts of destruction, theft or sabotage, that prevent us providing key service delivery functions. We already have in our office locations: general computer security/virus protection, record management, file management, standards of fire prevention, physical security, environmental impact, Health and Safety at work standards, for both our staff and those of our clients. It covers human resources; key staff and skill dependency, furthermore Supply Chain risks e.g. procurement, inventories, regulations and loss and/or disruption of supplies are also covered. Each department carries/maintains asset registers of hard/software, our other business systems and major items of equipment. Standard generic action checklists are devised to assist with the emergency events. 6.0 How the Extraspace plan should be used. We have designed this plan with the intention that it is used by all the staff that will be involved in the disaster and the recovery process. 7.0 Recovery Strategy Buildings Extraspace Solutions has in place, in each of its main locations, alternative office accommodation, ready and available, in the event of an unforeseen disaster. The nature of our business affords us this luxury, in terms of the accommodation, and yard space, to house such accommodation. It is anticipated that within 24 hours all systems will be up and running, as most are already facilitated. We have a reciprocal arrangement with a local modular accommodation manufacturer to allow us work in a portion of their factory on two shifts, in order to keep our manufacturing facility operational, during the downtime due to any such disaster affecting the production facility. 8.0 Recovery Strategy IT We have protocols and named people, together with their responsibilities and contact numbers and those of the emergency services. Our IT server room is protected by cooling equipment, fire alarms and fire suppression systems. The servers have redundancy features such as dual power supplies and RAID configurations. Daily tape back-ups are stored off-site. The tape back-ups are supplemented by on-site back-ups directly to a NAS (Network Attached Storage). The NAS is located in a separate building to the server itself thus providing additional protection. In the event of full loss of all IT, communications equipment and access to our own premises we have facilities in place with our IT and ERP support companies to reinstate critical hardware and software within 24 hours. These facilities will be located at our IT support company s premises and will include the full reinstatement of our ERP system, data, facilities, website and internet access as well as providing

3 telephone and fax facilities. Our telecommunications service providers have confirmed 24 hour redirection of telephone and fax numbers. In the interim our support provider can provide alternate and telephone facilities. All key staff have company mobiles and these numbers will be provided. We are currently incorporating service server virtualisation, coupled with a centralised storage device, which reduces the number of servers and limits the amount of lost data suffered in downtime from the point of failure. This has the added value of using less power, again contributing to our green approach. Our approach to the workplace users is to categorise the various departments and their users into essential and non-essential uses. Thereafter, we consider the periphery items such as mobile devices, printers, photocopying, scanning, etc. We have a paper system for system failure, which is tested regularly. Telephone: Fax: MD Website: Stock Control System: EPC Ordering and Payment System: We can use our existing laptop computers to use remotely. We have mobile phones that will be used until the landline is connected. This can be connected to an available line and the number distributed by PA to This is held remotely by an external provider. This will be replicated from the backup, off site server. This will be replicated from the backup. 9.1 Emergency Management Team (EMT) Managing Director Conor Hanratty Project Manager/Contracts Administrator- Eimear Phelan Operations Director Paul Tierney Finance Director/IT Manager Ray Doyle After Sales Manager Lorraine McGee Contracts Manager Declan Murtagh Emergency team assistance We have a named emergency team from whom we will select people to attend the disaster and physically help EMT responsibilities Immediately advising the emergency services and our insurers of the event Initial evaluation of the extent of the damage and potential consequences Taking photographs and statements Implementing measures to prevent further loss or damage to life, property, resources and the environment and making the site secure and safe Authorising recovery procedures in order to provide an operational service to staff and clients. Advising our clients progress and coordination

4 Advising our staff of progress Ordering and acquiring replacement equipment where authorised Keeping control of expenditure arising out of recovery operations Organising the return to normality once the emergency period has passed Managing Director Is known as the Emergency Team Leader and organises the overall recovery plan and its implementation. He assigns impromptu tasks and ownership to other members of the emergency team Head of IT Immediately goes to our offsite data storage facility to safeguard and upload a secure copy of the business data. Organises the implementation of replacement hardware/software and communication links, to our emergency back-up accommodation Operations Manager Organises essential services, phone and power, to be transferred to our emergency backup accommodation Finance Director Organises salvage and security. Liaises with emergency services. Authorises the purchase of new equipment as deemed necessary Senior Operations Manager Organises the replacement of damaged equipment and supplies Site Managers Will assess the impact on service delivery and then prioritise replication requirements. They will control both the nominated site and staff recovery duties Plan Activation The activation of the disaster recovery plan is broken down into three escalation phases; Initial activation The evaluation phase Full activation 18.0 Initial Activation Out of Hours, the plan will be activated by the EMT leader upon receipt of information from the emergency planning unit duty officer, or any other source, i.e. security officer or office cleaner. During office hours, normal emergency procedures will be followed and the immediate situation managed by the Manager/Director affected. He/she will then contact the EMT leader.

5 Contact emergency numbers for all anti-members and selected staff within Extraspace are in the Extraspace emergency contact directory, issued quarterly Evaluation Phase If not already on site, the EMT leader contacted will immediately make his way to the scene, in order that an initial evaluation of the extent of the damage can be made. The other members of the EMT will be placed on standby at this stage. Depending on the evaluation of the level of damage, the EMT leader will either take no further action or will initiate full activation Full Activation If the plan is fully activated EMT leader will carry out the following actions: Instruct the EMT to rendezvous at the head office boardroom or other nominated location. Instruct one of the EMT members to contact department heads affected and moved to the site. Open and maintain a log of events. Contact the finance director and instruct him to contact our insurers. Start preparing a preliminary report. All EMT members will alert and deploy the supporting members of their respective functional groups Action Checklists. EMT checklists are shown as follows: Immediate action: Action taken during the next three hours Action taken during the next 24 hours Action taken during the next month 22.1 Departmental Resource Requirements Departmental functions have been categorised against the following list of priorities; Essential core business and supporting functions needing to be restored in the shortest possible time. Important core business and supporting functions needing to be restored within an established timeframe. Loss, which would have no immediate impact on the service delivery but which list needs to be restored in the longer term Supply Chain As part of our supply chain agreements with other modular building contractors, they will open up their premises for major emergencies to allow access to materials. Alternative Supplying & Sourcing Strategy - It is our policy to have at least two suppliers for each product that we source and usually more, so that should a disaster strike, we will always have an alternative supplier.

6 Our finance director will make arrangements for payments to be made in a timely fashion, to ensure that our material supplies remain uninterrupted Fleet Management One of our main shareholders owns and runs a motor dealership for both commercial and private vehicles (Opel/Vauxhall). Arrangements are in place to ensure the provision of adequate replacement fleet within 5 working hours Epidemic/Pandemic Illness In the event of epidemic/pandemic illness or forecast, Extraspace will seek advice from our OHA and will consider the following palliative measures: Fast Track Private medical treatments of key staff Group vaccination plans Home/remote working Due to the significant number of contracts being undertaken by Extraspace, we will be able to re-organise our front-line staff in order to maintain reasonable service levels at all times. We can also increase team levels with the use of our long-term supply chain partners Communications Plan This is designed to instruct how information is cascaded in the event of a complete systems failure. See 21 & 22 above Specifications and Suppliers Specifications and supplier details for all main pieces of equipment will be kept offsite and in a secure location for easy reference.