Annex 1. Business Continuity Management Policy

Transcription

1 Annex 1 Business Continuity Management November 2008

2 p 2 Thanet District Council Business Continuity Management Contents Foreword Definition of Terms...5 Document History...6 This policy is supported by the Business Continuity Institute s Good Practice Guidelines 2007 A Management Guide to Implementing Global Good Practice in Business Continuity Practice. These documents provide the current best practice guidelines on Business Continuity Management and Thanet District Council would like to acknowledge the Business Continuity Institute for providing these key documents. The documents available are listed below:- Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Business Continuity Management and Programme Management Understanding the Organisation Determining Business Continuity Management Strategy Developing and Implementing Business Continuity Management Response Exercising, Maintaining and Reviewing Business Continuity Management Arrangements Embedding Business Continuity Management in the organisations Culture Version 2 16/03/2009

3 Thanet District Council Business Continuity Management p 3 Foreword The importance of effective business continuity management within Thanet District Council is clear: we face numerous risks such as information systems failure, terrorist attack, natural and man-made disasters, and pandemics. But we should not forget that our business can be disrupted by much more commonplace problems such as poor weather, electrical failure or flooding. Effective business continuity management is a core management function, a key strand of Corporate Governance, and must become an integral part of the planning and management processes in every part of our organisation. Planning will only succeed if awareness levels remain high, and staff understand what is expected of them should a disruption occur. All parts of the Council should therefore do their utmost to foster and communicate a business continuity culture within their organisations. Business continuity management cannot succeed without the continued commitment and co-operation from both line management and staff and they must be provided with ample opportunity to acquaint themselves regularly with local business continuity arrangements. Where part or all of a service or product is outsourced, the responsibility for its continuity remains with the Council. This requires a resilient supply chain which can absorb disruptions without seriously impacting the delivery of services/products to our customers. This publication, complemented by the Business Continuity Institute s Good Practice Guidelines, sets out the policy on business continuity management and provides best practice advice. Over recent years, improvements in business continuity management have been made across the Council. While this positive trend is encouraging, there is always more we can do to increase resilience and further embed business continuity management into the council s culture. Business interruption is almost always unexpected; consequently we need to ensure we are properly prepared. Chief Executive or Business Continuity Management Champion Version2 16/03/2009

4 p 4 Thanet District Council Business Continuity Management 1. It is vital for the maintenance of effective delivery of council services that critical business functions are identified, and measures put in place to recover them within an acceptable timeframe should a disruptive event or events occur. Where an event affects a wide range of service areas, the corporate priorities will be set by the Governance Group. 2. The Business Continuity Institute s Good Practice Guidelines 2007 provides a coherent approach to business continuity management and these documents provide the Council with best practice guidelines on implementing business continuity management. 3. Business continuity management is a core management function, a key strand of corporate governance, and must be an integral part of the planning and management processes undertaken throughout the council; it is not a secondary planning activity. Directors and managers must be proactive in managing risks to business continuity, and in particular: Make reference to business continuity as a specific type of risk management measure in their annual Managers Assurance Statements, which feed into the Annual Governance Statement. Business continuity issues are to be discussed at the Governance Group and that Group is to meet at least bi-annually. The Governance Group, with agreement from Corporate Management Team, should give clear direction as to which business functions are critical, how business continuity management principles shall be applied to protect them, and what degree of business continuity planning shall be adopted. Each directorate/service area shall apply business continuity management principles locally, and construct a service specific business continuity plan. Service business continuity plans must reflect their service requirements and will feed into the corporate business continuity plan. Each service specific business continuity plan must be reviewed as a minimum annually, or as part of the annual management planning and objective setting process. More frequent reviews may be triggered by any of the following: Key business change Restructuring Expansion/contraction New product/service introduction Relocation or location consolidation An incident and the associated recovery Where appropriate, outsourced activities (suppliers) must be subject to inspection in order to ensure a resilient supply chain which can absorb disruptions without seriously impacting the delivery of products and services. Deleted: Manual Deleted: Continuity of B Deleted: manuals Deleted: Business Continuity Deleted: S Deleted: Area s Deleted: Continuity of B Deleted: manual Version 2 16/03/2009

5 Thanet District Council Business Continuity Management p 5 All service specific business continuity plans and the corporate business continuity plan must be maintained regularly to ensure they are up to date, and all planning assumptions and recovery arrangements must be tested and exercised, and any lessons identified actioned. Deleted: Continuity of Deleted: Business Deleted: manuals Should any incident occur, serious enough, to trigger an invocation of a business continuity plan, the relevant Business Continuity Planner must raise a post incident report for the Business Continuity Champion and management. Business continuity management is only effective if awareness levels are high, and if all staff understand what is expected of them should a disruption occur. All staff within Thanet District Council should do their utmost to foster a business continuity culture within their organisations, and managers must provide staff with ample opportunity to acquaint themselves regularly with local business continuity arrangements. Definition of Terms Business continuity management (BCM) A management process that helps manage the risks to the smooth running of an organisation or delivery of service, ensuring that it can operate to the extent required in the event of a disruption. Business continuity plan (BCP) A documented set of procedures and information intended to deliver continuity of critical functions in the event of a disruption. Business Continuity Champion Lead officer responsible for business continuity management and the invocation of business continuity plans in the event of a disruption. Business Continuity Planner Officer responsible for the upkeep of the corporate business continuity plan. Service specific business continuity plan (BCP) A documented set of procedures and information particular to a specific area intended to deliver continuity of critical functions in the event of a disruption. Version2 16/03/2009

6 p 6 Thanet District Council Business Continuity Management Document History Version Date Agreed by Minute ref V1 5 Nov Dec Jan Feb 2008 Governance Group Governance and Audit Committee Cabinet Council GG/07-08/13 R190 C15 85 V2 10 Nov Dec Feb 09 V3 V4 Governance Group Governance and Audit Committee Cabinet Gov04 (10/11/08) Version 2 16/03/2009