Alexandrina Council Business Continuity Plan

Transcription

1 Alexandrina Council Business Continuity Plan Prepared by LGRS Risk Management Issue: Three Issue Date: 09 February 2015 C:\Users\christine.STRATH.000\AppData\Local\Temp\8\Alexandrina Council Business Continuity Plan_566D9F60.docx Page 1

2 Table of Contents Document Review...3 Abbreviations and Definitions...4 Introduction...5 Purpose...5 Objectives...5 Use of the BCP...5 Assumptions...6 Limitations...6 Audience Distribution...6 Authority...6 Training and Communication...6 Validation and Testing...7 Monitoring & review...7 Overview of Business Function Criticality...7 Scope...9 Methodology...10 Continuity Management Team...12 Roles and Responsibilities CMT...12 CMT Structure...12 Notification Declaration Process...14 Notification...14 Assessment...14 Declaration...14 Control Centre...15 Business Impact Analysis (BIA)...15 Responsibility Statements...15 Business Continuity Instructions (BCI)...15 Emergency Contacts...16 Initial CMT Meeting...16 Communications - General...16 Communications - Staff...17 Communications - Community...17 General Statement to Media in the event of a business interruption event...17 Responsibility Statements...18 BCI 1 BCI 2 BCI 2. BCI 3 BCI 4 Emergency Contacts Continuity Management Team...27 Emergency Contacts External...29 Continuity Management Team Meeting Agenda...30 Staff Business Interruption Alert...31 Media Enquiry Record Form...32 BCI 5 Press Release...33 BCI 6 Telephone Redirection Authorisation...34 BCI 7 Business Continuity Coordination Centre Checklist...35 BCI 8 Pandemic Response Information Guide...37 National, State & Local Pandemic Planning Matrix...37 Phases of Human Influenza Pandemic...38 Recommended Actions for Australian Businesses...39 BCI 9 Immediate Actions Guide

3 ...42 Critical Function Sub Plans...43 Organisation and Culture...44 Service Centre Call Centre...48 Customer Service...51 Engineering and Environment...57 CWMS...58 Food Safety Regulations...67 Environmental Health Emergency Management...70 Infrastructure & Assets...73 Information Management Vital Records...74 IT Services Service Desk...77 IT Services Infrastructure

4 Document Review Whenever this document is reviewed and or amended, details must be recorded on this page. Date Review Summary 16 Jan 2014 Updated for organisation restructure and contact details 14 July 2014 Updated for BCP Maintenance Workshop on 9 July January 2015 Updated for BCP Training Exercise on 28 January

5 Abbreviations and Definitions Term Definition Abbreviation Business Continuity Business Continuity Control Centre Business Continuity Management Business Continuity Plan(s) Business Process Assessment Business Impact Analysis Business Interruption Event Non Critical Function Action Plan Critical Function Sub Plan Continuity Management Team Emergency Event Maximum Acceptable Outage Corporate Governance Risk Management Information Technology Is the uninterrupted availability of all key resources supporting essential business functions. A central point of reference to co-ordinate the response to a business interruption event. To be established at the discretion of the CMT Director. Provides for the availability of processes and resources in order to ensure the continued achievement of critical objectives. A collection of procedures and information that is developed compiled and maintained in readiness for use in the event of an emergency or disaster. A management tool designed to assist in the identification and assessment of criticality of business processes and functions A management level analysis which identifies the impacts of function loss on the organisation. The BIA provides management with data upon which to base risk mitigation and continuity planning decisions. An event that by its duration exceeds the Maximum Acceptable Outage and / or has an adverse impact on business objectives and requires the implementation of the BCP or sub plans. An agreed documented course of action that identifies mitigation, response and recovery actions for business functions identified as non-critical. An agreed documented course of actions to be taken in the event of business function loss. Plan describes the key actions required under preparation, response and recovery phases. An assembly of executive management representatives and other seconded staff formed for the express purpose of responding to an organisational crisis. CMT management structure will overlay all normal management structures during the response process. An event due to an actual or imminent occurrence (such as a fire, earthquake, or epidemic which: 1. endangers or threatens to endanger the safety or health of staff or visitors to the organisation 2. destroys or damages, or threatens to destroy or damage, property of the organisation 3. Has the capacity to disrupt operations to the extent that it impacts on business objectives. The maximum period of time that Council can tolerate the loss of capability of a critical business function, process, asset or IT application. A system by which the organisation is directed and controlled. Corporate Governance activities are represented as four principal components: direction, executive action, supervision and accountability. The culture, processes and structures that are directed towards realising potential opportunities whilst managing adverse effects. The technology involved with the transmission and storage of information, especially the development, installation, implementation, and management of computer systems and telephone systems. BC BCCC BCM BCP BPA BIA BIE Non Critical Function Action Plan CFSP CMT Emergency Event MAO CG RM IT 4

6 Introduction Purpose The Alexandrina Council has adopted a comprehensive and integrated approach to the development of a Business Continuity Management Plan. The purpose of this plan is to build organisational capabilities to support the continued achievements of critical business objectives in the face of uncertainty or disruption. Council recognises that this plan (Business Continuity Plan) in isolation does not build capability; it provides the approach to establishing effective capability. Whilst the plan is important, it is an outcome of the more important planning and analysis process, and is a blueprint to kick-start the response to a business interruption event. This plan identifies the required facilities, technical infrastructure, key responsibilities, and processes that will be required to position Council to be able to respond and recover from a business interruption event. Objectives The objectives of the Alexandrina Council s Business Continuity Framework is to provide a mechanism that enables Council and its officers to: Identify business functions that are critical to Council in meeting its business objectives Develop resumption plans based on criticality of business functions rather than geographic location Build resilience within Council s operational framework Identify and document roles and responsibilities for key staff positions Minimise the impact of function loss on stakeholders and the community. The business continuity plan provides a framework for management and staff to enable them to implement an agreed response process. In assessing the business continuity risks of the Alexandrina Council it became evident that given the structure local government a number of inherent advantages were identified such as: Multiple facilities providing common services reducing the impact of a single facility loss Common IT systems with duplication and access across most facilities Ability to transfer staff and tasks to other facilities, and The ability to call on adjoining Councils for assistance in service delivery. In the event of a business interruption event, these advantages would suggest the business impact is a reduction in capacity rather than a loss of capability in a particular area. Use of the BCP This plan should be used in the event of a business interruption event that may impact on the ability of the Alexandrina Council to deliver business objectives. Managers and staff with responsibility for impacted areas of the business should use the BCP and any relevant sub plans to ensure a consistent and agreed course of action is implemented. 5

7 Assumptions The BCP is intended to provide guidance to Council officers to assist continuity of service for critical functions, where those officers are not normally responsible for managing the specific function affected. Where the Council officer who is normally responsible for managing the specific function is available, it is assumed that this document will serve as a check document to reduce the possibility for omission of important actions. Limitations It is not the intent of this document or process to develop Information Technology Disaster Recovery Plans. (IT DR) This process will however identify from a business perspective the business requirements for Information Technology resources that support the delivery of business critical function. This information should then be used to inform the development of ITDR plans. Audience Distribution The intended audience for the Alexandrina Council Business Continuity Plan is: Council Executive Team Critical Function Sub Plan Managers and Staff Non Critical Function Action Plan Managers and Staff. The plan is available to all Managers and staff via Councils intranet and is to be reviewed annually by the executive. Authority 1. The Alexandrina Council Business Continuity Plan has been developed under the authority of the managing executive. Prior to implementation the plan was reviewed and approved by that body. 2. A standing authority is given to the Sub-Plan owners by the managing executive to implement the actions identified within the sub plans. Training and Communication A key objective of the BCP is to increase the awareness within the Alexandrina Council of potential business interruption events that could impact Council. The plan outlines the response / recovery protocols associated with such an event. Training and communication will play a key role in achieving this objective. Initial training has been provided by the process facilitators however one of the benefits of a facilitated process is that engagement and ownership of the BCP is developed at the business unit level. Training was provided to the Senior Management Team as part of the BCP implementation. It will be the responsibility of the various Senior Managers to ensure that the requirements of the BCP are communicated to all staff and that induction / training programs include reference to business continuity in the context of sound risk management practices. Managers should be familiar with key deliverables as detailed in the Critical Function Sub Plans and ensure that staff are aware of their roles and responsibilities in the event of a business interruption event. 6

8 Validation and Testing Business Continuity Management is a process, not an event. Once the BCP has been prepared commitment to a pre-planned, annual test plan and maintenance schedule is required by Council to ensure BCP procedures remain viable into the future. The testing should include all aspects of the BCP, but not necessarily all in one year. Major components (Sub Plans) should be reviewed at least annually. Volatile information such as contact lists, or areas that are constantly undergoing changes, should be validated more frequently. In addition to the annual test and review of the BCP, any significant changes in the Alexandrina Council s operations should also trigger a review of the BCP. Version control of the BCP should be co-ordinated through the CMT Coordinator. Monitoring & review Monitoring and review is an integral component of the BCP process. Council recognises and is committed to ensure the following monitoring and review strategy is implemented. Activity for Review Accountability Timeframe 1 Business Continuity Plan (overarching plan) Continuity Management Team via the CMT Coordinator 2 Business Continuity Plan Training Continuity Management Team via the CMT Coordinator 3 Business Continuity Plan Exercise Continuity Management Team via the CMT Coordinator Organisational and Culture Monitor annually and action as required Annual training brief or refresher session Annual desk top exercise Simulation exercise each 2 years 4 Critical Function Sub Plans Relevant Manager Annual Review 4a Non Critical Function Action Plans Annual Review Infrastructure and Assets 5 Critical Function Sub Plans Relevant Manager Annual Review 5a Non Critical Function Action Plans Annual Review Engineering and Environment 6 Critical Function Sub Plans Relevant Manager Annual Review 6a Non Critical Function Action Plans Annual Review Overview of Business Function Criticality Integral to the BCP is the determination of the Maximum Acceptable Outage (MAO) of a particular business process. The loss of a critical business function for a period greater than the MAO will generally 7

9 result in the establishment of the Continuity Management Team to direct, oversee and support the emergency, continuity and recovery response phases. The following table summarise the functions as identified as critical, the maximum acceptable outage for that function and what Information Technology services are required to facilitate resumption. Division/Group Organisation & Culture Business Unit Critical Function Max Acceptable Outage Human Resources Payroll processing 1-5 Days - shorten Governance & Strategy Communications / Public Relations 1-2 hours Library & Customer Service Service Centre Call Centre 2 hours Library & Customer Service Customer Service 2 hours Division/Group Engineering & Environment Business Unit Critical Function Max Acceptable Outage CWMS Treatment Plant Operation 4 hours - 2 Weeks CWMS Pump Station Operation 4 hours - 2 Weeks CWMS Vacuum Operation 4 hours - 2 Weeks Roads Road Services 1 20 days Waste Management Waste Collection 2 Days Environmental Health Food & Safety Regulation 1 day Environmental Health Division/Group Environmental Health & Emergency Management Activities Infrastructure & Assets Business Unit Critical Function Max Acceptable Outage 1 day IT Service Desk Internal 1-14 Days IT IT Infrastructure Internal 1-14 Days IT IT advisory Service Desk 1-14 Days IT IT advisory ICT Infrastructure 1-14 Days IT Information Management Immediate to 2 weeks 8

10 Scope The object of the BCP is to ensure that appropriate structures and protocols are in place that enables effective response to a business interruption event that has the potential to impact on council s objectives. The BCP documents the processes and resources required by Council in the delivery of its critical business objectives. In identifying business continuity risks, the focus is on the building of resilience and response capabilities within business functions that have been identified as critical by the organisation. Treatment options for non-critical functions are also identified and documented within the framework; this ensures that Council has a whole of organisation view when responding to interruption events, as the nature of these events can change rapidly. The BCP does not cover requirements associated with a workplace emergency (safety) situation. A separate workplace emergency plan that is the responsibility of the Chief Warden / Emergency Services is to be implemented. In all cases of activation of the workplace emergency plan the Chief Warden will brief the Director of the Continuity Management Team of any implications for business continuity as a result of the emergency plan activation. Risk Management Framework Workplace Emergency & Evacuation Plan Council Emergency Management Plan via I-responda Alexandrina Council Business Continuity Plan IT Disaster Recovery Plan Organisation and Culture Engineering and Environment Infrastructure & Assets Critical Function Subplans Non Critical Function Action Plans Critical Function Subplans Non Critical Function Action Plans Critical Function Subplans Non Critical Function Action Plans 9

11 Methodology Business continuity encompasses the identification and risk management of Council s business processes. It involves a stepping process that seeks to identify, assess control and monitor Council s business functions. The plan has been developed with consideration given to AS/NZS 5050:2010 Business continuity - Managing disruption-related risk, AS/NZS/ISO 3100:2009 Risk Management- Principles and guidelines and the ANAO Business Continuity Management guidelines Keep the wheels in motion, and Societal Security Guidelines for incident preparedness and operational continuity management (ISO N022: 2007). Broadly, the steps in developing the Business Continuity Plan include: 1. Identify and Assess Business Processes and Functions Identify business processes and functions within each individual business unit/section/division. Once the functions are identified an analysis at a whole of organisational level is conducted to determine which functions are critical and require further planning to ensure the ability to respond in the face of a continuity interruption event. 2. Conduct the Business Impact Analysis (BIA) The BIA Is conducted on those functions identified as critical within the business process assessment. The BIA is intended to identify the impacts of the function loss on the business including penalties for non-delivery, functional interdependencies, organisational ownership, it also looks at the resources currently required to support the functions and assesses the minimum level of resources required to continue the availability. Importantly the BIA is the tool that is used to determine the Maximum Acceptable Outage (MAO). 3. Critical Function Sub Plan (CFSP) & Non Critical Function Action Plans The CFSP identifies the agreed actions that a business process owner will undertake to manage the loss of the function through the emergency, continuity and recovery phases. The sub plan identifies ownership, failure scenarios, and criteria for invoking the plan, agreed courses of actions for emergency, continuity and recovery. The CFSP also allows for targeted messages to be developed for specific function loss. The Non Critical Function Action Plans are designed to assist the organisation in adopting a risk management approach to the identification, assessment control and monitoring of those business functions determined in the planning phase as non-critical. 4. Overarching Business Continuity Plan (BCP) The BCP identifies the responsibilities of key Managers, with particular emphasis on direction setting and effective and timely communication to stakeholders at an organisational level. It is important to recognise that this document provides a flexible framework in which the organisation can plan for disruption of its critical functions. It does not attempt to identify and plan for every contingency or outage that could occur, it provides a flexible framework for the process owners to identify, plan and develop redundancy for business processes. 5. Test and maintain the BCP The BCP will be reviewed annually by the Executive, these actions are essential to ensure that it reflects the current practices of the organisation. Testing of the Critical Function Sub plans and overarching plans will provide management assurance that the plan(s) are effective. The testing regime is based on the following: 10

12 Desktop / paper audit to ensure that the appropriate documents are available and understood; for sub plans and overarching plan Structured walk through where a business interruption scenario is played out through a mock recovery; and a divisional or whole of organisation level, and Frequency and actions to be undertaken are identified within the monitoring and review section of this document. 11

13 Continuity Management Team Roles and Responsibilities CMT The CMT is established to provide a management mechanism that can ensure reporting lines and responsibilities are clear when the BCP is activated. The focus of the CMT is to manage the business interruption event from a corporate perspective while providing guidance and support to the Managers on site. This process is facilitated by the development of pre-determined courses of actions (Sub plans) thus allowing the CMT to focus on the strategic or whole of business response to the business interruption event. Resilience within the CMT is the responsibility of the CMT. Each position is to have an alternate member identified and trained in the role. CMT Structure Mayor (Community engagement) CMT Director Chief Executive CMT Coordinator Manager Governance & Strategy CMT Support Communications Officer CMT Member Engineering and Environment CMT Member Planning & Development CMT Member Information Technology CMT Member Organisation and Culture 12

14 CMT Position Staff Position Alternate Staff Position CMT Director Chief Executive General Manager Infrastructure & Assets CMT Member General Manager Engineering and Environment General Manager Infrastructure & Assets CMT Member Manager IT Services ICT Infrastructure & Security Coordinator CMT Member Manager Planning and Development Manager Infrastructure CMT Member General Manager Organisation and Culture Manager Human Resources CMT Coordinator Manager Governance and Strategy Manager Health, Environment and Community Safety CMT Support Communications Officer Executive Assistant 13

15 Notification Declaration Process Notification On first becoming aware of a possible business continuity event, the relevant function manager is required to assess the situation and if the event is likely to exceed the agreed MAO timeframe, then the CMT Director should be notified immediately by phone and where possible, with a follow-up or personal briefing detailing the key issues including: Nature of the incident time informed etc. Describe business elements impacted (Critical Functions) Facility / equipment impacted Staff Any response actions implemented (Critical Function Sub Plan) Any media involvement / interest Any immediate support requirements. Elements of the BCP (Sub Plans) can be implemented at the local level, where appropriate to address an immediate response requirement even if the event is expected to be resolved within an acceptable period. Assessment On receipt of a notification that will impact business continuity the CMT Director will: Formally note details Notify the other members of the Continuity Management Team (CMT) (consider Telstra conference call) Confirm the details of the incident and appropriate media strategies Conduct preliminary impact assessment (facility and technology infrastructure) Determine if a control centre needs to be opened. Ensure that the Insurer has been formally notified (if appropriate) Declaration The CMT Director is to review the preliminary information and if considered necessary declare a Business Interruption Event. The CMT Director is to facilitate the draft communications, both internal and external, for discussion at the initial CMT meeting. 14

16 Control Centre On the declaration of a business interruption event by the Director CMT and if deemed appropriate a control centre will be opened. The resourcing and opening of this centre is the responsibility of the CMT coordinator. Given the variable nature of Business Continuity Events, the following sites have been identified and prioritised. If the incident does not impact on the Alexandrina Council, Administration Building: 1. Council Chambers, If the Council Chambers is uninhabitable then: 2. Goolwa Depot - meeting room. Business Impact Analysis (BIA) Central to ensuring the ongoing viability of the business in an interruption event is the identification of critical business functions, the processes and assets (people & property) that support the delivery of these critical functions and the impact of the loss of the functions on the business are analysed within a Business Impact Analysis. BIA s have been completed for each of the identified critical functions and are contained within the Critical Function Sub Plans. Responsibility Statements Responsibility Statement for each position in the CMT and supporting positions have been developed to ensure there are clear and unambiguous directions available for each of the members of the CMT. All responsibility statements are to be approved by the CMT and this action is to be recorded on the statement. On activation of the BCP these statements come into effect. Business Continuity Instructions (BCI) Upon declaration of an interruption event the following instructions have been developed to provide assistance. However, any restoration plan developed by the CMT will take precedence over the respective instruction. Instruction Title Emergency Contacts CMT Sample Meeting Agenda Staff Business Interruption Alert Media Enquiry Record Form Press Release Telephone Redirection Authorisation Business Continuity Coordination Centre Checklist Pandemic Response Information Guide 15

17 Emergency Contacts A list of Emergency Contacts has been prepared including all nominated members of the CMT, their designated deputies as well as key external services. A copy of this listing should be held off premises by respective CMT & members and identified alternates to enable the listing to be referenced in the event that access is denied to the premises. Initial CMT Meeting The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevant business areas impacted, including: Staff Any associated Emergency Services issues Building facilities Public relations/media Damage/security, and Salvage of building and/or IT equipment. Salvage of records Review and conformation of delegation of authorities for staff. Ensure all team members understand their responsibilities and their assigned tasks. During the meeting information will have been gathered by the various CMT members to produce an evaluation of the incident. A formal record of the meeting to be collated by CMT Support person with particular emphasis on items to be actioned. This record needs to be regularly reviewed and updated as additional information comes to hand. The CMT Director to manage the restoration of business activities in line with the responsibilities defined in the BCP. Communications - General All communications will be coordinated through the Continuity Management Team Due to the nature of the media, the timeliness of reporting in these circumstances is critical. Prompt reporting to, and liaison with the Continuity Management Team is in the best interests in terms of allowing for the preparation of an appropriate response. The CE will develop the communications strategy that enables for: News releases to the media Communications between council and the emergency management control agencies Communications to staff Communication to contractors and other external contractors 16

18 It is Alexandrina Council s policy that no person other than the Chief Executive Officer (or delegated General Manager) and/or Mayor divulges any information to the media. This extends to contractors and other service providers and agencies and should be communicated in any site contractor agreements. In the initial stages of an event the Continuity Management Team will schedule briefings at a designated location. The Continuity Management Team will determine who will attend these meetings and if the meetings are in part or entirely, open to the media, members of the public and staff. Timing and frequency of the briefing meetings will be matched to severity of the event. Communications - Staff In the event of a business interruption event which significantly impacts on the service delivery of Council services a staff message will be communicated by , sms or UHF radio broadcast (BCI 3). This message should be initiated as soon as possible to avoid high volume of traffic on the network regarding details of the event. A more formal staff briefing by the Chief Executive Officer, should be undertaken following the Initial Meeting of the continuity Management Team. Communications - Community Alexandrina Council Communications Officer will be responsible for the delivery of communications and media actions on advice from the Continuity Management Team. The Communications Officer will: Provide a focal point for media releases and statements to the media Schedule requests for media interviews with the Chief Executive Officer or Mayor Manage the operations and logistics of the media briefings, including time, location, facilities, content and expectations Monitor and respond to rumours regarding the Council response and continuity management actions Ensure staff are adequately informed General Statement to Media in the event of a business interruption event In the event of a major incident, particularly after-hours, there may be a period of time elapsed before the designated media spokesperson is in a position to respond to media enquiries. Should any staff member be approached by media representatives for a comment they are only authorised to make the following statement: "I am sorry, but I am not authorised to make any statement at this time. The appropriate personnel are currently being briefed on the situation and a spokesperson will be available to talk to you shortly There is no such thing as an off the record comment. If you cannot immediately refer the journalist to the CE, please complete the Media Enquiry Record Form. Let the journalist know that someone will return their call promptly. Provide the Manager Media and Communications with the journalist s details as soon as possible. Also provide any background and relevant information that you have about the event, including how the journalist came to contact you. 17

19 Responsibility Statements 18

20 Responsibility Statement CMT Director Position CMT Director Staff Position Chief Executive During absence this role will be assumed by General Manager Infrastructure & Assets Position Statement The CMT Director is responsible for declaring a business continuity event and invoking the BCP. The CMT Director is required to oversee and manage all resumption activities. During a workplace emergency the Chief Warden has authority until the workplace emergency is resolved and control is returned to the CE or CMT Director if the BCP is to be activated Knowledge Requirements 1. High level of organisation activities and service delivery priorities 2. Community, Business and Regulatory contacts Responsibilities The CMT Director must make decisions as to the best strategy for business resumption based on information received by other CMT members. This strategy is then translated into an action plan by the supporting teams. Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Participate in monitor and review activities Participate in and ensure appropriate levels of training is undertaken On Activation: Activate the BCP Notifying and liaising with stakeholders Provide the focal point in communication to the staff, media and public Establishing and chairing all CMT meetings (may delegate) Authorisation of any detailed restoration plan Delegate tasks and overseeing resumption activities Monitor the gathering of business interruption event information Promote the wellbeing and safety of all staff Liaise with elected body via the Mayor Date approved by CMT 25 July

21 20

22 Responsibility Statement CMT Member Engineering and Environment Position CMT Member Staff Position General Manager Engineering and Environment During absence this role will be assumed by General Manager Infrastructure & Assets Position Statement A successful Continuity Management Team (CMT) relies on expertise from within the organisation as they are the people that understand the business processes and related risks. Accordingly, the Executive and Manager Team members are the designated members of the CMT and charged with implementing the whole of organisation response. However they still maintain responsibility for the continuity and recovery actions of their individual business units. The business unit activities are undertaken by the function managers in accordance with agreed sub plans. Knowledge Requirements 1. High level of group activities and service delivery priorities 2. High level knowledge of group critical function sub plans 3. High level knowledge of overarching BCP Responsibilities Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Participate in monitor and review activities Participate in and ensure appropriate levels of training are undertaken with Critical Function Sub Plan Managers On Activation: Operate as a member of the CMT Ascertain the impact on business unit activities and report to CMT Co-ordination of business unit Critical Function Sub Plan implementation as required Monitoring implementation against the Business Continuity Plan Maintaining information and report on costs to CMT Maintain communications with staff Date approved by CMT 25 July

23 Responsibility Statement CMT Member IT Services Position CMT Member Staff Position Manager IT Services During absence this role will be assumed by ICT Infrastructure & Security Coordinator Position Statement A successful Continuity Management Team (CMT) relies on expertise from within the organisation as they are the people that understand the business processes and related risks. Accordingly, the Executive and Manager Team members are the designated members of the CMT and charged with implementing the whole of organisation response. However they still maintain responsibility for the continuity and recovery actions of their individual business units. The business unit activities are undertaken by the function managers in accordance with agreed sub plans. Knowledge Requirements 1. High level of group activities and service delivery priorities 2. High level knowledge of group critical function sub plans 3. High level knowledge of overarching BCP Responsibilities Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Participate in monitor and review activities Participate in and ensure appropriate levels of training are undertaken with Critical Function Sub Plan Managers On Activation: Operate as a member of the CMT Ascertain the impact on business unit activities and report to CMT Co-ordination of business unit Critical Function Sub Plan implementation as required Monitoring implementation against the Business Continuity Plan Maintaining information and report on costs to CMT Maintain communications with staff Date approved by CMT 25 July

24 Responsibility Statement - CMT Member Planning & Development Position CMT Member Staff Position Manager Planning and Development During absence this role will be assumed by Manager Infrastructure Position Statement Knowledge Requirements A successful Continuity Management Team (CMT) relies on expertise from within the organisation as they are the people that understand the business processes and related risks. Accordingly, the Executive and Manager Team members are the designated members of the CMT and charged with implementing the whole of organisation response. However they still maintain responsibility for the continuity and recovery actions of their individual business units. The business unit activities are undertaken by the function managers in accordance with agreed sub plans. 1. High level of group activities and service delivery priorities 2. High level knowledge of group critical function sub plans 3. High level knowledge of overarching BCP Responsibilities Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Participate in monitor and review activities Participate in and ensure appropriate levels of training are undertaken with Critical Function Sub Plan Managers On Activation: Operate as a member of the CMT Ascertain the impact on business unit activities and report to CMT Co-ordination of business unit Critical Function Sub Plan implementation as required Monitoring implementation against the Business Continuity Plan Maintaining information and report on costs to CMT Maintain communications with staff Date approved by CMT 25 July

25 Responsibility Statement - CMT Member General Manager Organisation & Culture Position CMT Member Staff Position General Manager Organisation and Culture During absence this role will be assumed by Manager Human Resources Position Statement Knowledge Requirements A successful Continuity Management Team (CMT) relies on expertise from within the organisation as they are the people that understand the business processes and related risks. Accordingly, the Executive and Manager Team members are the designated members of the CMT and charged with implementing the whole of organisation response. However they still maintain responsibility for the continuity and recovery actions of their individual business units. The business unit activities are undertaken by the function managers in accordance with agreed sub plans. 1. High level of group activities and service delivery priorities 2. High level knowledge of group critical function sub plans 3. High level knowledge of overarching BCP Responsibilities Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Participate in monitor and review activities Participate in and ensure appropriate levels of training are undertaken with Critical Function Sub Plan Managers On Activation: Operate as a member of the CMT Ascertain the impact on business unit activities and report to CMT Co-ordination of business unit Critical Function Sub Plan implementation as required Monitoring implementation against the Business Continuity Plan Maintaining information and report on costs to CMT Maintain communications with staff Date approved by CMT 25 July

26 Responsibility Statement CMT Co-ordinator Position CMT Co-ordinator Staff Position Manager Governance and Strategy During absence this role will be assumed by Manager, Health Environment and Community Safety Position Statement The CMT Co-ordinator is required to assist the CMT Director in the management of the business resumption activities. The CMT Co-ordinator must be familiar with the business continuity plan, Critical function Sub Plans and team responsibilities. Knowledge Requirements 1. High level knowledge of overarching BCP 2. Understanding of organisation activities and service delivery priorities 3. High level of internal key contacts and accountabilities Responsibilities The CMT Co-ordinator is required to report to the CMT on the currency of individual and business level continuity plans and activities. Responsibilities include: Pre event co-ordination of BCP and Sub plans with relevant owners Co-ordination of training for CMT & CMT SG members Co-ordination of testing for the Business Continuity Plan Resourcing of Control Centre On Activation: Open Control Centre on direction of CMT Director Assisting CMT Director as required Notify Insurer and manage the insurance requirements Date approved by CMT 25 July

27 Responsibility Statement CMT Support Position CMT Support Staff Position Communications Officer During absence this role will be assumed by Executive Assistant Position Statement The CMT Support is responsible for the smooth functioning of the Control Centre (if established) and the administrative needs of the CMT. Knowledge Requirements 1. High level of internal key contacts and resource knowledge 2. High level of administrative functions and arrangements Responsibilities Responsibilities include: Maintain working knowledge of BCP & relevant Critical Function Sub Plans Maintain high level of administration skills On Activation: If required, assist with the setup of the Control Centre and arranging stationery, equipment etc. Arrange resources to assist CMT members (if required) Making arrangements for all CMT meetings Provide general administrative support (including log of all events and actions, resumption status, CMT members movements etc.). Create and maintain a chronological log of meetings and decisions made. Date approved by CMT 25 July

28 BCI 1 Emergency Contacts Continuity Management Team CMT Position Staff Position Contact Details Alternate Staff Position Contact Details CMT Director Chief Executive Officer Ph.: H: M: peter.dinning@alexa ndrina.sa.gov.au General Manager Infrastructure and Assets Ph.: H: M: neville.styan@alexandri na.sa.gov.au CMT Member General Manager Engineering and Environment Ph.: H: M: simon.grenfell@alex andrina.sa.gov.au General Manager Infrastructure and Assets Ph.: H: M: neville.styan@alexandri na.sa.gov.au CMT Member Manager IT Services Ph.: H: M: ryan.hill@alexandrin a.sa.gov.au ICT Infrastructure and Security Coordinator Ph.: H: M: mark.sommerville@alex andrina.sa.gov.au CMT Member Manager Planning & Development Ph.: H: M: sally.roberts@alexan drina.sa.gov.au Manager Infrastructure Ph: H: M: Stewart.ratcliff@alexand rina.sa.gov.au CMT Member General Manager Organisation & Culture Ph.: H: M: Victoria.mackirdy@al exandrina.sa.gov.au Manager Human Resources Ph.: H: n/a M: [email protected]. gov.au CMT Coordinator Manager Governance and Strategy Ph.: M: M: anne.liddell@alexan drina.sa.gov.au Manager, Health, Environment and Community Safety Ph.: M: M: karen.rokicinski@alexan drina.sa.gov.au CMT Support Communications Officer Ph.: H: M: Executive Assistant Ph.: H: M:

29 ndrina.sa.gov.au drina.sa.gov.au 28

30 BCI 2 Emergency Contacts External Service Company Contact Details Air Conditioning Westside Services Electricity DS&R Electrical Plumbing Horseshoe Bay Plumbing Police Goolwa Police Station Security Victor Harbour Security IT Computer Site Solutions/Interstate Electrical Information Management Steamatic

31 BCI 2. Continuity Management Team Meeting Agenda Initial CMT Meeting The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevant business areas impacted, including: Staff Any associated Emergency Services issues Building facilities Public relations/media Damage/security, Salvage of building and/or IT equipment, and Salvage of records During the meeting information will have been gathered by the various CMT members to produce an evaluation of the incident. A formal record of the meeting to be collated by CMT Support person with particular emphasis on items to be actioned. This record needs to be regularly reviewed and updated as additional information comes to hand. Other Issues for consideration include Scheduling of site visit Identification of affected departments Public notification Schedule of staff meetings Development of initial plan for operations (short term) Allocation of temporary work locations. 30

32 BCI 3 Staff Business Interruption Alert Situation At (insert time) on (insert date) the (insert Council) experienced (insert event) which has impacted on (insert impacts). The following services have been lost (insert losses). As a consequence the Chief Executive Officer has declared a Business Interruption Event and has opened the Business Continuity Coordination Centre (BCCC) to allow the Continuity Management Team to restor e Council s critical business functions. Plan Council is now operating in a continuity management phase with normal operations temporary varied to ensure Council can continue to provide key services to our customers. The continuity management team is reassessing the allocation of personnel which may involve reassignment of staff to new roles with the organisation. Administration The continuity management team is as follows: CMT Director CMT Team Members CMT Coordinator CMT Support A staff briefing will be conducted at (insert time) at (insert location) to discuss Councils strategy and the role you will play in restoration. Meanwhile, all staff must ensure they have access to the following resources (insert resources) and protective clothing (insert clothing requirements) All continuity actions must be authorised by the CMT Director. All staff must keep a personal log of actions and requests. Communications The BCCC can be contacted on (insert telephone number). The primary mode of communication within the organisation will be (insert communication method). As a result priority will be given to the following functions (insert functions). Council s business telephone number has been temporarily diverted to (insert location). CMT Director Insert Time Insert Date 31

33 BCI 4 Media Enquiry Record Form Taken by: Issue: Date: Time of call: Journalist name: Contact numbers: Media outlet: Deadline: Publication date: Question: Taken by: Issue: Response by: Position in (Insert Client Name): Response Date: Time: 32

34 BCI 5 Press Release On (insert day and date) at approximately (insert time) Council experienced a business interruption event (describe event) as a result of this event the following services are currently impaired: Rates Water & Sewer Roads Community Services. Services that are not impacted by the business interruption include: Libraries Swimming pools Meals on wheels Etc. Workarounds are currently being put in place in line with Council s Business Continuity Strategy. Council will advise the community via the media once service delivery strategies have been confirmed Councils contact number remains (insert number) ant will be manned from (insert times) until further notice Issued by Chief Executive Alexandrina Council Time Date 33

35 BCI 6 Telephone Redirection Authorisation Note that telephone redirection has not been setup by LGRS. Indications from Telstra are that clients will need to provide the following information to effect a redirection on phone numbers. Company name ABN Billing Address Redirection numbers. Only Authorised council account holders will be able to authorise effect and will need to be pre authorised. Emergency Redirections can be obtained with the above information by calling Telstra Corporate Faults. The following may be used to confirm your requirements with Telstra: (Date) (Council) (Address) (Town State Post Code) The Manager Telephone Redirections Dear Sir/Madam (Insert Council Name) is in the process of activating its Business Continuity Plan in response to a business interruption event. This fax is to request in writing Telstra immediately redirect the current (insert council name and number) to (insert alternate site name and number). Council will inform Telstra again in writing when a change to this arrangement is required. If you need clarification or to speak to a Council Representative please call (insert Mobile Number of CMT member). Issued by Chief Executive Alexandrina Council Time Date 34

36 BCI 7 Business Continuity Coordination Centre Checklist Business Continuity Coordination Centre Council Chambers Element Issues to be addressed Actions Required Location of BCCC Alternate Location of BCCC The location of the Alexandrina Council Coordination Centre is the Council Chambers within the administration building providing that the building is not subject to the interruption event 1. Goolwa Depot meeting room Diagram of BCCC Provisions of telecommunications facilities Provision of internet facilities Emergency power requirements for BCCC Management and Staffing Security Media Initial level of activation Stages of Operation Activation Mobile phones Fixed phones x 30 (Council Chambers) Internet available via fixed computers, laptop remote access and smart phones UPS and cashiers and switchboard (1-2 hour use) Council Administration building has auto emergency power for selected circuits Depot has emergency power for centre building See Responsibility Statements for nominated positions CMT Director CCMT Member CMT Coordinator CMT Support Officer Contracted proximity access for Administration building and depot CE, Mayor and relevant General Managers if unavailable Communications Officer Meeting or conference call to consider business interruption event and full team on declaration Review diesel storage at Goolwa depot Review Emergency power circuit for chambers to ensure functionality 35

37 Business Continuity Coordination Centre Council Chambers Information Displays Information Board required in BCCC Current Operations Display Board, showing all tasks currently being carried out Contacts Display Board Used to display important contact telephone and fax numbers in regular use Resources Allocation Board Showing resources location, resources committed and resources available Staff Rosters for longer or protracted use of the BCCC Timing Details recording of Briefing, meetings Situation Report etc. Media Releases Copies of publicly released materials Plans and Documents Administration Extended Operations Briefing Sessions Hard and soft copies of BCP, including Critical Function Sub Plans Stationary Equipment list to be developed by the CMT coordinator Staff Roster to be developed if protracted use of the BCCC is expected Suitable briefing timing sessions to be identified by the CMT 1. Staff 2. Media 3. Community 4. Elected Members Stages of Operation Stand down Stand down of the BCCC will be at the discretion of the CMT Director A stand down of the coordination centre may be a gradual phasing down over a period of time or it may be immediate cessation of the operation Forms Date approved by CMT CMT Coordinator to identify suitable forms to be used to collect and record information within the BCCC 25 July

38 BCI 8 Pandemic Response Information Guide If a pandemic of any description was to eventuate within any local government area, it is probable that state level disaster plans would be activated; these plans are separate to Business Continuity Plans and have a community response focus. Currently it is a requirement of the National Action Plan for Human Influenza Pandemic for all local government authorities to have in place a Business Continuity Plan. The Alexandrina Council BCP model places the importance on identifying what functions are critical to the business in delivering it objectives, identifying likely failure scenarios (Pandemic, loss of IT etc.) for those critical business functions and then developing plans to ensure the continuity of those critical functions. A pandemic event occurring may result in the failure scenario occurring loss of critical staff. It is the impact of that loss scenario that the business continuity plan is design to respond to. National, State & Local Pandemic Planning Matrix National Action Plan for Human Influenza Pandemic Commonwealth Government Action Plan for Influenza Pandemic Australian Health Management Plan for Pandemic Influenza State and Territory influenza pandemic plans (including health plans) Commonwealth Disaster Response Plan State and Territory emergency management plans KEY Other Commonwealth Plans Australian Veterinary Emergency Plan National Response Plan for Mass Casualty Incidents Involving Australians Overseas National Food Chain Continuity Plan Pandemic Other national plans Other State and Territory plans Commonwealth State/Territory National District & Local emergency management plans Council Business Continuity Plan Council Business IT Disaster Recovery Plan Local Government 37

39 Phases of Human Influenza Pandemic Global phase Australian phase Description of phase AHMPPI 2008 PREVENTION AND PREPAREDNESS AUS 0 Overseas 1 AUS 1 Overseas 2 AUS 2 Overseas 3 AUS 3 No circulating animal influenza subtypes in Australia that have caused human disease Animal infection overseas: the risk of human infection or disease is considered low Animal infection in Australia: the risk of human infection or disease is considered low Animal infection overseas: substantial risk of human disease Animal infection in Australia: substantial risk of human disease Human infection overseas with new subtype/s but no human to human spread or at most rare instances of spread to a close contact Human infection in Australia with new subtype/s but no human to human spread or at most rare instances of spread to a close contact Australian phases ALERT RECOVERY RESPONSE 4 5 Overseas 4 AUS 4 Overseas 5 AUS 5 Human infection overseas: small cluster/s consistent with limited human to human transmission, spread highly localised, suggesting the virus is not well adapted to humans Human infection in Australia: small cluster/s consistent with limited human to human transmission, spread highly localised, suggesting the virus is not well adapted to humans Human infection overseas: larger cluster/s but human to human transmission still localised, suggesting the virus is becoming increasingly better adapted to humans, but may not yet be fully adapted (substantial pandemic risk) Human infection in Australia: larger cluster/s but human to human transmission still localised, suggesting the virus is becoming increasingly better adapted to humans, but may not yet be fully adapted (substantial pandemic risk) DELAY DELAY Overseas 6 Pandemic overseas: increased and sustained transmission in general population DELAY 6 AUS 6a Pandemic in Australia: localised (one area of country) CONTAIN AUS 6b Pandemic in Australia: widespread SUSTAIN AUS 6c Pandemic in Australia: subsiding CONTROL RECOVER AUS 6d Pandemic in Australia: next wave RECOVER RECOVERY Source: National Action Plan April

40 Recommended Actions for Australian Businesses Aus Phase Description of phase Recommended Actions for Australian Businesses Aus 4 Human infection in Australia: Smaller cluster(s) consistent with limited human to human transmission, spread highly localised, suggesting the virus is not well adapted to humans Consider implementing remote work arrangements Consider suspending all overseas/interstate travel Purchase health and safety consumables such as disinfectant, gloves and face masks Distribute hard copies of staff contact and supplier contact list Educate staff that if they get sick and recover, they should return to work as they will be immune to the disease. If they believe they are unwell, they should not go to work. Prepare rosters that have no overlaps and include sufficient time for disinfecting the area before the new shift arrives Encourage staff to eat at their desks and stagger breaks to prevent groups meeting in the break rooms Provide staff with details of the location of fever clinics, designated influenza hospitals, infection control guidelines, the hotline for influenza and other relevant information Exercise the Business Continuity Plan examine how continuity will be affected in an environment of high absenteeism including up to 50% absenteeism, when regions are quarantined, preventing staff and goods from leaving or arriving, and when schools are closed and other social distancing is introduced. Plan to allow staff to work from home Plan for ways to increase social distancing in the workplace, e.g. video conferencing Identify the conditions where all but the critical functions would be suspended Update company succession plans in case the key staff succumb Review insurance policies for pandemic coverage Aus 5 Human infection in Australia: larger cluster(s) but human to human transmission still localised, suggesting the virus is becoming increasingly better adapted to humans, but may not yet be fully adapted Activate remote work arrangements Implement social distancing at work Cancel all non-essential work Activate rosters that have no overlaps and include sufficient time for disinfecting the area before the new shift arrives Maximise building ventilation Require staff to wear surgical masks, introduce cough etiquette and other hygiene measures Undertake daily temperature checks of staff Clean phones and all touched surfaces between shifts Aus 6a Pandemic in Australia: localised (one area of country) Maintain a register of staff who get sick but recover, as they are immune to the disease. Aus 6b Pandemic in Australia: Encourage immune staff to return to work 39

41 Widespread Maintain contact with all employees and provide situational updates Aus 6c Pandemic in Australia: Subsided When vaccine becomes available, organise for all non-immune staff to be vaccinated as early as practical Implement plan for the restoration of operations Adapted from: National Security Briefing Notes May

42 BCI 9 Immediate Actions Guide Notification On first becoming aware of a possible business continuity event, the relevant local Manager is required to assess the situation and if the event is likely to exceed the agreed MAO timeframe, then the CMT Director should be notified immediately by phone and where possible, a follow-up personal briefing detailing the key issues including; Nature of the incident time informed etc Describe business elements impacted (Critical Functions) Facility / equipment impacted Staff Any response actions implemented (Critical Function Sub Plan) Any media involvement / interest Any immediate support requirements. Elements of the BCP (Sub Plans) can be implemented at the local level, where appropriate to address an immediate response requirement even if the event is expected to be resolved within an acceptable period. Assessment by Director CMT On receipt of a notification that will impact business continuity the CMT Director will: Formally note details Conduct preliminary impact assessment (facility and technology infrastructure) Notify the other members of the Continuity Management Team (CMT) Confirm with the Mayor appropriate media strategies Determine if a control centre needs to be opened. Ensure that the Insurer has been formally notified Assemble & Brief CMT Time of incident Nature of incident Location of incident Staff involved Facilities / equipment impacted Community impact Emergency Services involved Initial indications of outage duration Media involvement Confirm responsibility statements Declaration The CMT Director to review the preliminary information and if considered necessary declare a Business Continuity Event and notify the Mayor. The CMT Director is responsible for all internal communications. A control centre may also be required to be opened. 41

43 CMT Director The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevant business areas impacted, including: Review situation information to date & record Review business unit impact statements Review Media statements Ensure all CMT members understand their responsibilities Develop a whole of business Business Impact Analysis Staff impacts During the meeting information will have been gathered by the various CMT members to produce an evaluation of the incident. A formal record of the meeting to be collated by CMT Support person with particular emphasis on items to be actioned. This record needs to be regularly reviewed and updated as additional information comes to hand. Initial Meeting Business Impact Assessment CMT Member Prior to undertaking the initial meeting each member of the CMT is to assess and document the impacts of the business interruption event At initial meeting each business unit is to report on Staff impacts Building / Facilities impacts Service Delivery impacts Media issues Other relevant issues Development and Implementation of Response Strategies Response strategies will need to be developed to address the business interruption event. Refer to Critical Function Sub Plans within the Business Continuity Plan for implementation strategies Briefing Media/Staff/Community/Insurer Due to the nature of the media, the timeliness of reporting in these circumstances are critical. Prompt reporting to, and liaison with CE and Mayor is in the best interests in terms of allowing for nomination of a spokesperson as well as preparation and appropriateness of response. In a business continuity event, all communications with the media relative to the business of Council shall be through the Director CMT or the Mayor for community impacts. 42

44 Critical Function Sub Plans 43

45 Organisation and Culture 44

46 Payroll Prepared by Manager Human Resources Date 8/9/2014 Sub Plan Owner This plan is owned by the Manager Human Resources who has overall responsibility for this plan. Identified Critical Business Functions The routine management of the plan in delegated to the Payroll Officer who has responsibility for ensuring the accuracy and currency of the plan and advising the Manager Human Resources of any changes required. The preparation, processing & transport of council s fortnightly payroll. Overview of Functions (Context) Council s payroll is processed on a fortnightly basis with pay periods ending every second Tuesday and the funds transferred to the bank electronically by 4pm on the Wednesday following the end of the pay period. Payments are made to staff in accordance with Council s Enterprise Agreements and Awards and other relevant legislation. Business Impact Analysis Business Impact of Function Loss Penalties for Non Delivery Functional Interdependencies Staff do not receive pay Staff complaint Staff do no present to work for industrial dispute Staff may request reimbursement of financial institution default charges Industrial unrest Timesheets and variations IT platform and software. Ability to transfer data to the bank Banking system to receive and action data. Current Resources Premises/ Equipment/ Staff Minimum Resources Required Alternate Manual Process or Work Around IT access & equipment (Synergy, internet banking, s) 1.8 Payroll officer Payroll officer & payroll manual 1.5 Payroll Officer Internet on Wednesday Synergy Soft/IT Vision Run last pay Ask other Council s, Yankalilla to process Alexandrina payroll or assist with payroll. Cadell St Offices Timesheet 45

47 Payroll Disruption Scenario Max Allowable Outage IT outage 1 to 2 days (pay week) Loss of staff (payroll) 5 days Loss of utilities 4 days Bank Failure 2 days Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds that Maximum Allowable Outage as described above. Key Decision Makers to be assembled Manager Human Resources, payroll officer/s General Manager Organisation and Culture Stakeholders other than process owner Internal External All employees ANZ Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located Electronic copies: G:Drive / Payroll Synergy Records Hard copies: Payroll cupboard 46

48 Payroll Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: The Manager Human Resources and Payroll staff to be informed immediately. Source of Disruption to be identified where possible (i.e. internal IT system/external banking or telecommunications infrastructure. Identify possible downtime with key decision makers (IT, HR, finance) Consult with stakeholders (i.e. let employees know of possible outcomes, liaise with bank, delay or variation/standard/base pay Implement emergency procedure Document & review emergency process taken Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Consult with key decision makers on appropriate course of action i.e. when will IT access again be available / discuss options = bank If deemed necessary, process standard hour pay run as per Emergency Procedure Communicate with stakeholders In the event of loss of staff the CMT to be informed to identify secondment or temp staff to assist in payroll. Communication Considerations Internal External Inform members of EMT Liaise with ANZ Provide all employees with up to date information (may need to use alternate methods if no s) o o Local branch Business banking s online Need emergency contact details if no IT available Notify applicable statutory bodies super and child support Further Treatment/ Action Plans Actions required for continuous improvement Treatment/ Action Plan Position Responsible for development Target Date Emergency procedure to be reviewed and updated Payroll officer June

49 Service Centre Call Centre Prepared by CS Manager Date Sub Plan Owner This plan is owned by the General Manager Organisation & Culture who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan. Identified Critical Business Functions Call Centre Overview of Functions (Context) Focal point of communication between Community and Council. Becomes a critical function in times of emergency. Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Inability for Council to coordinate a response with community Misinformation potential litigation Pressure on front office staff Inputs required CIS Staff Systems IT platform and software Phone system, CRM, Telstra Downstream Enquires not reaching office No feedback to or from Council Officers Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 2 full time employees Office space Desk space Switchboard stations (x4) MITEL application IT Network/backup ISDN Connection 4-6 full time employees (increase) Office space Desk space Switchboard stations (4-6) MITEL application IT Network/backup Loss of Switchboard Divert to Out of Hours Emergency services provider Initiate repair/replacement within 24 hours Longer than 24hours, reprogram system to use extensions in call group 48

50 Staff Training ISDN Connection Staff Training Loss of System Contact Telstra and divert to After hours Contact IT Service provider for repair/replace Set up diversions to neighbouring Council and set up laptop with phone and staff including VPN access Loss of Telstra Service Divert to Emergency After Hours Adelaide contact Telstra immediately Disruption Scenario Max Acceptable Outage Loss of Switchboard Loss of Phone System Loss of Telstra Service 2 Hours 2 Hours 2 Hours Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled General Manager, IT Manager, Manager Customer Services Stakeholders other than process owner Internal Customer Service Staff All Staff External Emergency After Hours provider Telstra IT Service provider Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies Hard Copies Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: 49

51 Contact Emergency After Hours to act as back up Notify CE and General Manager Organisation & Culture, Manager Customer Service Notify IT If internal Information Technology staff to advise on duration of outage. If outage is to be longer than identified MAO the continuity response to be enacted. Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Loss of Switchboard Divert to Emergency After Hours initiate repair/replacement within 2 hours Longer than 24hours, reprogram system to use extensions in call group Loss of System Contact Telstra and divert to Emergency After Hours Contact DMV for repair/replace Set up diversions to neighbouring Council and set up laptop with phone and staff including VPN access Loss of Telstra Service Divert to Emergency After Hours contact Telstra within 24 hours Arrange temporary connection from Telstra Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Communication Considerations Internal All staff including elected members External Service providers including website. On hold message. 50

52 Customer Service Prepared by Date Sub Plan Owner This plan is owned by the General Manager Organisation and Culture who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan. Identified Critical Business Functions Front Counter Service at two branches Goolwa and Strathalbyn Overview of Functions (Context) Focal point of communication between Community and Council. Becomes a critical function in times of emergency. Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Cannot deliver payments, receipting, library, and transactional dealings in general. Misinformation Pressure on front office staff PR / reputational damage Inputs required Front Counter trained operators Systems IT platform and software Phone system, Telstra Downstream Enquires not reaching office No feedback from Council Officers Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 3 full time employees 5 full time employees Office space Another location to be communicated e.g. Strathalbyn or alternative venue in Goolwa. Desk space Switchboard stations MITEL application IT Network/backup ISDN Connection 51

53 Staff Training 1 mobile Front counter tablet/desktop/laptop Disruption Scenario Max Acceptable Outage No access to buildings 2 Hours Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled General Manager Organisation Culture, Manager Customer Service, IT Manager, Manager Customer Services Stakeholders other than process owner Internal Customer Service Staff Elected members External Community All Staff Pre Event Preparedness Current policies & procedures & access points required to deliver function Signage ready to be deployed on main entrance Procedure for response, including script for customer enquiries Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Signage and communications. Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: As above. Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date 52

54 Develop procedure LGMR Aug 2015 Communication Considerations Internal Staff External Public 53

55 Communications Prepared by General Manager Organisation & Culture Date Sub Plan Owner This plan is owned by the General Manager Organisation & Culture who has overall responsibility for this plan. The routine management of the plan in delegated to Communications Officer who has responsibility for ensuring the accuracy and currency of the plan and advising the General Manager Organisation Development of any changes required. Identified Critical Business Functions Public relations communication and internal communications Overview of Functions (Context) In the event of any significant disruption to business continuity the ability of Council to communicate to its staff and its community will be essential and this communication is often undertaken by means which may themselves be affected by the business continuity disruption Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Unable to communicate the situation with staff Unable to communicate the situation including what Councils service strategy is at the time Telecommunications Server based Information Relay Server based intranet/internet Mobile Technologies Contact details Server based Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around Main server Goolwa Office Backup Goolwa works depot Contact details/address books electronic server based & paper based Mobile phones Disruption Scenario 1 Full time employee communications officer IT system 1x mobile phone Verbal briefings Notice boards white boards, pins Paper based contact list Buildings public announcement system Max Allowable Outage Interruption to Information Technology services 1 2 hours 54

56 Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Allowable Outage as described above Key Decision Makers to be assembled Communications Officer, Team Leader, Library and Customer service, Manager Information Technology services, General Manager Organisation & Culture Stakeholders other than process owner Internal All staff External All customers Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies Information Technology Disaster Recovery Plan Hard Copies Manual Contact list staff, key customer groups, media etc. Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Key decision makers review situation Source of disruption to be identified where possible (i.e. internal IT system / telecommunications infrastructure) Communicate with staff/public via briefing in building, public announcement system, signs, noticeboards, mobile phones, website, social media (Tourism), newspaper social media, radio Disruption to service that exceeds MAO communicate in local paper, remote access to website, erect notices in the community at local businesses. Visitor Information Centre used to provide advice/information to the community, social media (Tourism) Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Information Technology Disaster Recovery Plan 55

57 Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Prepare a manual including media contact list ensuring updated ¼ Communications Officer 31 July 2015 Communication Considerations 56

58 Engineering and Environment 57

59 CWMS Prepared by General Manager Engineering and Environment Date Sub Plan Owner This plan is owned by the General Manager Engineering and Environment who has overall responsibility for this plan. The routine management of the plan in delegated to CWMS Coordinator who has responsibility for ensuring the accuracy and currency of the plan and advising the General Manager Engineering and Environment of any changes required. Identified Critical Business Functions Community Wastewater Management Schemes Overview of Functions (Context) Alexandrina Council has over 6000 CWMS connections, four treatment plants, 58 pump stations Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Inability to release and transport sewage into the environment including waterways Public Health concern/risks increased Litigation Statutory Penalties including fines from the EPA, loss of licence from EPA PR Issues Inputs required Maintenance Staff Systems IT platform and software Plant Public Infrastructure Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 7 staff including an electrician 3 backup generators Depots including workshops at South Goolwa 3 light truck service units 3 Utes Failure of alarms on all systems 7 staff including an electrician 3 backup generators Depots including workshops at South Goolwa 3 light truck service units 3 Utes Failure of alarms on all systems Portable Generators Rewire control panels to enable basic operations can continue Install /use standby pumps 58

60 Disruption Scenario Max Acceptable Outage Power failure 8 Hours Flooding of Chambers 10 Hours Loss of staff 2 Weeks Treatment Plant Failure 4 Hours Authority for Invoking Plan A standing authorisation is given to the CWMS Supervisor to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled CWMS Coordinator, CEMS Supervisor, Manager Engineering Services, Manager Environmental Health, GM Engineering Stakeholders other than process owner Internal Chief Executive External EPA Department of Health Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Hard Copies CWMS Maintenance Operational Manual Waste Water Treatment Plant Operation Manuals Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: CWMS Maintenance Operational Manual Waste Water Treatment Plant Operation Manuals Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Risk assessment conducted by key decision makers in relation to specific nature of outage 59

61 Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Ongoing maintenance CWMS Supervisor Bi-annual Communication Considerations Internal CE External EPA, Department of Health 60

62 Waste Management Prepared by General Manager Engineering and Environment Date Sub Plan Owner This plan is owned by the General Manager Engineering and Environment who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan. Identified Critical Business Functions Waste Management Operation of Waste transfer stations, including collection of kerbside waste. Overview of Functions (Context) Alexandrina Council is a member of a local Government Subsidiary Fleurieu Regional Waste Authority who operates Councils waste transfer facility including the collection of kerbside waste and recyclables. Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies An increase of waste within the community Public Health Risk Adverse public reaction Loss of integrity / reputation Potential litigation Staff, plant and equipment from other organisations. Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 8 Trucks and 2 back up trucks Contract trucks can be sources if required 15 staff for WTF and 9 staff for collection trucks. 6 trucks can be used for a short time Hire additional trucks Re allocate resources / staff from WTF d Re prioritise tasks Disruption Scenario Max Acceptable Outage Plant breakdown that requires other trucks to be sourced 2 Days Staff unavailability that requires reallocation of tasks for Waste Transfer Facility staff 2 Days & ½ day for WTF closure 61

63 Disposal location (landfill) closes due to unforeseen circumstances Authority for Invoking Plan A standing authorisation is given to the Fleurieu Regional Waste Authority (FRWA) Executive Officer to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above. FRWA does not have its own business continuity plan. Nil Key Decision Makers to be assembled Executive Officer FRWA, Operations Manager - FRWA Stakeholders other than process owner Internal External CE Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies FRWA internal systems Hard Copies FRWA internal systems Emergency Response Immediate actions required if function is lost. Notify EPA that there has been a suspension of services Notify internally of interruption event Ensure communication of interruption is disseminated through Councils communication channels Initiate contact with FRWA due ascertain duration of outage Continuity Management Actions required to ensure continued availability of the function Maintain communications with FRWA to ensure contract obligations are maintained Consider closure of waste transfer station and diversion to alternative site Consider use of alternative contractor in the event that rubbish cannot be collected Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Liaise with FRWA to gain an understanding of their contingencies to deal with business interruptions. Position Responsible for development General Manager Engineering Target Date Jan

64 Services Communication Considerations 63

65 Road Services Prepared by General Manager Engineering and Environment Date 13/7/2014 Sub Plan Owner This plan is owned by the GM Engineering and Environment who has overall responsibility for this plan. The routine management of the plan in delegated to Manager Field Services who has responsibility for ensuring the accuracy and currency of the plan and advising the General Manager Engineering and Environment of any changes required. Identified Critical Business Functions Road Services Overview of Functions (Context) Overall maintenance of Councils public roads and associated infrastructure. Business Impact Analysis Business Impact of Function Loss Penalties for Non Delivery Functional Independencies Inability for residents to access areas safely Disruption to Council maintenance schedule Access for emergency services Potential Litigation Inputs required Staff, Heavy Equipment, availability of raw materials, contractors Systems IT platform and software Phone Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around Staff Plant Contractors Disruption Scenario 2 staff 2 utes Possibly grader (1) and/or other heavy machinery depending on type of business interruption. Contract labour / machinery Seek assistance from neighbouring Councils Max Allowable Outage Inability for residents to access properties 1 Day Heavy plant breakdown 20 Days Disruption to Council maintenance schedule 20 Days Inability for emergency services to access properties 1 Day Contractors not available 1 Week. 64

66 Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Allowable Outage as described above Key Decision Makers to be assembled Engineering Services Manager, Supervisors (civil and construction) and GM. Stakeholders other than process owner Internal CE External General Public Emergency Services Contractors Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies Various SOP s Intranet Plans Hard Copies Various SOP s Depots Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Contact Engineering Services Manager, Supervisors (civil and construction) and GM. Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Liaise with Engineering Services Manager, Supervisors (civil and construction) and GM. Liaise with Communications Officer to arrange media release(s) as appropriate Make direct contact with affected residents 65

67 Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Communication Considerations 66

68 Food Safety Regulations Prepared by Manager Health, Environment and Community Safety Date Sub Plan Owner This plan is owned by the Manager Health, Environment and Community Safety who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan Identified Critical Business Functions Food Safety Regulation Overview of Functions (Context) Emergency situations relating to food safety i.e. outbreaks of food-borne disease. Business Impact Analysis Business Impact of Function Loss Penalties for Non Delivery Functional Independencies Staff do not present for work Failure to fulfil legislative requirements Poor reception by media/community Illness/deaths in community Information unavailable Ombudsman/Minister intervention Liability to CE Inputs required Assistance to Department of Health Systems IT platform and software (Health module) Downstream SA Health to receive relevant information Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around Access to car/transport 2 full time employee EHO s 1 full time employee Environment Health Support Officer 1full time employee Manager Health, Environment and Community Safety Office space Desk space Laptops/terminal server Telephones IT system synergy health module Thermometers 2 full time employee EHO s + 1 FTE support officer Thermometers (3) Australian Food Safety Assessment (AFSA) - electronically or paper version Car / Transport Use AFSA inspection pads and carbon copy Use taxis or private vehicles 67

69 Disruption Scenario Max Acceptable Outage loss of key staff 1 day Interruption to Information Technology services 2 days Loss of vehicle access (if inspections are scheduled i.e. prohibition order being lifted) 1 day Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled Manager Health, Environment and Community Safety, Environmental Health Officers, General Manager Environmental and Development, Environmental Health Support Officer Stakeholders other than process owner Internal EHO s (Environmental health Officers) EH Support Officer External Department of Health Alexandrina Community Business implicated in outbreak Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies SOP s on Connect Intranet Workspace for Environmental Health team Hard Copies No hard copies available or required Department of Health is the lead agency for foodborne illness outbreak Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Manager Health, Environment and Community Safety informed immediately Identify if resources are adequate and second staff from other Councils if required Ensure AFSA available and food inspection kits ready source top ups if required. 68

70 Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Use manual AFSA if required Second extra staff EHO s from other Councils if needed Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Ongoing dialogue with adjoining councils to support of a reciprocal arrangement could be reached Manager Health, Environment and Community Safety Annual Emergency Kits including AFSA available and stocked Annual Communication Considerations Internal Inform all staff that EHO s are unavailable until further notice, due to emergency or direct regular enquires to an agreed point. External Media release potentially required to highlight what is being done. Must be very careful as investigation on going 69

71 Environmental Health Emergency Management Prepared by Manager Health, Environment and Community Safety Date Sub Plan Owner This plan is owned by the Manager Health, Environment and Community Safety who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan Identified Critical Business Functions Environmental Health Emergency Management Overview of Functions (Context) Emergency Management in the event of a natural disaster where the SA Department of Health is the lead agency Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Availability of Staff& Contractors to perform all business functions Poor perception in the community Illness / Death Current Resources Premises/Equipment/Staff Failure to meet statutory responsibilities / MOU agreements Poor media perception Minimum Resources Required Inputs required Assistance to Department of Health, Essential Safety equipment including vehicles Systems IT platform and software Alternate Manual Process or Work Around EHO s/manager/ EH Support Officer Office space Desk space Phones IT Systems Laptops/terminal/services Immunisation Contractors Disruption Scenario EHO s/staff Telephones Emergency Management Kit including alcohol gel, information, inspection sheets Vehicle Immunisation Contractors Use of private vehicles / taxis Max Acceptable Outage loss of key staff 1 day Interruption to Information Technology services 1 day No available vehicles 1 day 70

72 Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled Environmental Health Manager, General Manager, EHO s Stakeholders other than process owner Internal Staff Elected Members External General Public Department of Health Police and Emergency Services Other Government Agencies Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies Intranet Hard Copies Fact sheets in office Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Get kits and vehicle ready and await direction from Department of Health. Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Ongoing dialogue to other Councils for usage of staff to assist Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Routine Check of Emergency Management Kits EHO s December 2015 Ensure EHO s are emergency management trained 71

73 ongoing as required. Annual Communication Considerations Internal Inform Customer Service staff of what is occurring and how to contact EHO s and what service level will be during this emergency External Department of Health, Other Councils, Media. 72

74 Infrastructure & Assets 73

75 Information Management Vital Records Prepared by Team Leader Information Management Date 26/08/2014 Sub Plan Owner This plan is owned by the General Manager Infrastructure & Assets who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan Identified Critical Business Functions Information Management Overview of Functions (Context) Manage life cycle of documents for council, manage information and to meet legislative requirements (e.g. FOI) Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Cannot meet legislative requirements Legislative provisions for fines Inputs required IT system Cannot access information for Council operations Current Resources Premises/Equipment/Staff Minimum Resources Required Hard copy storage Alternate Manual Process or Work Around 1 Co-ord 3 FTE Local Govt Software Scanners (3) 7 computers Onsite 1 bunker 1 container (depot) Offsite (contracted) 4 staff (FTE) 3 Computers 1 Scanner Secure onsite storage 1 bunker 1 container (depot) Offsite (contracted) Incoming mail Building plans Excel recording Access to photocopier or scanner 74

76 Disruption Scenario Max Acceptable Outage IT Loss Loss of records (fire) No access to Principal Office No access to bunker No access to temporary storage provider Loss of 1 or more key staff Authority for Invoking Plan Plan Owner 1 Day Immediate 2 Days 2 Days 2 Days 1 Week Key Decision Makers to be assembled CE, 3 GM s, Manager IT Services, Coordinator Information Management Stakeholders other than process owner Internal All staff Elected members External State Records Affected stakeholders Pre Event Preparedness Current policies & procedures & access points required to deliver function All of council and internal team policies & procedures State Records audits Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Identify issue Understand timeframes Develop plan for situation - schematic Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Source alternative premises (Strathalbyn or work from home) to deal with IT flow Site must have bare minimum resources 75

77 Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Development of Vital Records Plan (in Draft) Aug 2015 Communication Considerations Internal All staff Elected Members External Applicable members of public Legislated stakeholders 76

78 IT Services Service Desk Prepared by Manager IT Service Date Sub Plan Owner This plan is owned by the Manager IT Services who has overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan. Identified Critical Business Functions Service Desk Internal / IT Advisory including contracted services. Overview of Functions (Context) Council s service desk provides support to internal staff in the operation of IT systems and equipment. Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Inability for staff to conduct their duties impacting on Council operations Breach of contract (IT Advisory) Systems IT platform and software Staff complaint Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 2 full time employee service desk officer One office space Desk space IT Systems Telephone Disruption Scenario 3 full time employee (internal) IT system Telephone (1 mobile) Infrastructure team to fill in Third party contractor maybe engaged Extend service time frames Divert phone Max Acceptable Outage Loss of Service Desk 4 hours Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled 77

79 Manager IT Services, Service Desk Coordinator Stakeholders other than process owner Internal Staff Elected Members External Partner Organisations (KI and Fleurieu Regional waste) Contractors Public Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies 1:\procedures Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Third party contractors to be engaged Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date Ongoing maintenance of DRP IT Mgr Aug 2015 Communication Considerations Internal Link to communications plan ensuring staff including elected members External Link to communication plan to advise Partner Organisations, public 78

80 IT Services Infrastructure Prepared by Manager IT Services Date Sub Plan Owner This plan is owned by the Manger IT Services who have overall responsibility for this plan, including routine management and responsibility for ensuring the accuracy and currency of the plan. Identified Critical Business Functions IT Infrastructure / IT Advisory including contracted services Overview of Functions (Context) The IT Infrastructure provides the underlying communication and business systems for Council. Business Impact Analysis Business Impact of Function Loss Penalties for Non-Delivery Functional Independencies Inability for staff to perform core business Inability for core functions to be undertaken Breach of contract Breach of legislative requirements Systems IT Infrastructure and software, Utilities, power, comms, airconditioning Current Resources Premises/Equipment/Staff Minimum Resources Required Alternate Manual Process or Work Around 2 full time employees Infrastructure Staff Office space Data centre space IT Infrastructure Telephone 2 full time employees Infrastructure staff Data centre space IT Infrastructure Utilities Engage third party Utilities Disruption Scenario Max Acceptable Outage Denial of access to the site 14 Days loss of key staff (Infrastructure and Security Coordinator) 1-2 Days loss of key staff (network systems admin) 14 Days Interruption to Information Technology services 12 Hours 79

81 Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the plan once the outage exceeds the Maximum Acceptable Outage as described above Key Decision Makers to be assembled Manager IT Services, Infrastructure and Security Coordinator, General Manager Corporate and Community Services Stakeholders other than process owner Internal Staff EM s External Partner Organisations Contractors Public Pre Event Preparedness Current policies & procedures & access points required to deliver function The current policy and procedures for this critical function can be located: Electronic Copies Password Manager I:\Passwords Procedures I:\Procedures Emergency Response Immediate actions required if function is lost. On being advised of a business interruption event the following immediate responses should be considered: Source of disruption to be identified where possible (i.e. internal IT system / telecommunications infrastructure) Determine duration If outage is to be longer than identified MAO the continuity response to be enacted. Continuity Management Actions required to ensure continued availability of the function In the event of a business interruption event occurring as identified within the Disruption scenario analysis, that exceeds the identified MAO the following responses may be appropriate: Restore some backups to external location provided by a third party Further Treatment/Action Plans Actions required for continuous improvement Treatment/Action Plan Position Responsible for development Target Date 80

82 Review IT Infrastructure DRP Manager IT Services Aug 2015 Communication Considerations Internal Link to Communication Plan to critical function plan including advising staff and elected member External Link to communication plan to advise partner organisation and public 81

83 1