South Norfolk Council Business Continuity Policy 1
Title: Business Continuity Policy Date of Publication: TBC Version: 2 Published by: Emergency Planning Team Review date: April 2014 Document Owner: Document Authoriser: 2
Amendment Record Version Number Amendment Date Date issued Comments V1 July 2008 Agreed by CMT 2009 Incorporated 2010 Incorporated V2 2013 3
Foreword The Civil Contingencies Act 2004 requires South Norfolk Council to ensure that it has prepared so far as is reasonably practicable critical activities and an emergency response during any emergency or disruptive event. In addition to the Civil Contingencies Act, the Councils approach to business continuity is based on BS 25999 with a transition to BS ISO 22301 2012 by 2015. BS 25999 and ISO 22301 take the form of good practice guidance and recommendations, indicating what practices an organisation should, or may, undertake to implement effective business continuity management (BCM). The standards establish the process, principles and terminology of BCM, providing a basis for understanding, developing and implementing business continuity within our organisation. The Business Continuity Policy Statement set out in this document outlines the Council s vision for Business Continuity Management. It is vital that we are able to continue to provide essential services to the residents and businesses of South Norfolk, whatever disruption or emergency might affect the Council. All services have a role, and every member of staff has a responsibility to make sure the Council can continue to service our communities whatever the disruption. The Policy Statement in Section 5 demonstrates that the Council is committed to ensuring that robust and effective Business Continuity Management is in place as a key mechanism to restore and deliver continuity of key services in the event of a disruption or emergency. Signed Chief Executive South Norfolk Council Leader of the Council South Norfolk Council 4
Contents Amendment Record... 3 Foreword... 4 Contents... 5 Purpose... 6 Business Continuity Management Policy Statement... 7 South Norfolk s framework... 8 Roles and Responsibilities... 9 Senior Leadership Team...9 Senior managers/heads of Service...9 The Business Continuity Workgroup...10 Emergency Planning Team...10 Business Impact Analysis & BC Options Process... 11 Training... 12 Review Process... 12 Distribution and Amendment... 12 Audit and Governance... 12 5
Purpose The strategy adopted for development of the Business Continuity Plans can be summarised as follows: The Strategic Business Continuity Plan is an operational document designed for development and review, with close links to the relevant risk management programmes. The Plan sets out priorities and communications to ensure an appropriate response to any disruption. For this immediate objective the Plan is a generic plan for the Council. Specific plans will be developed where the risk indicates sufficient likelihood of occurrence and the impact is seen to be severe. It addresses the full range of the Council's functions and buildings critical to these. The process currently being used within the Council is based on the BCM model outlined in BS 25999 Business Continuity Management Part 1: Code of practice published by the British Standards Institute, shown at Fig.1. Figure 1 6
Business Continuity Management Policy Statement 1. South Norfolk Council is committed to ensuring robust and effective Business Continuity Management as a key mechanism to restore and deliver continuity of key services in the event of a disruption or emergency. 2. The Council s Business Continuity Management (BCM) arrangements will meet the statutory requirements within the Civil Contingencies Act 2004 and will be based upon the following standards: BS 25999 Business Continuity Management Part 1: Code of Practice BS 25999 Business Continuity Management Part 2: Specification These are both recognised standards of corporate governance. There will be a transition to ISO 22301 by 2015. 3. At a corporate level the Council will determine its main Critical Activities and identify the main threats. This analysis will be undertaken annually and will determine the scope around which business continuity planning will be undertaken. 4. Each service delivery process within the Council is owned by a respective Director who will ensure that they understand and support the main BCM strategies; and are in a position to ensure implementation of the main strategies. 5. Each Director will contribute to an annual review of the BCM documentation within their Directorate monitoring the review process, challenging the results and providing support where necessary. 6. Building on good work already in place for risk management, BCM ensures all existing processes are integrated into the overall framework. 7. Contracts for goods and/or services deemed critical to the District of South Norfolk Council business continuity will aim to include a requirement for each nominated supplier to provide, for evaluation, a business continuity plan covering the goods and/or services provided. Every tender for business continuity critical goods and/or services will include business continuity as an element of the tender evaluation model. 8. All Council staff will be made aware of the plans that affect their service delivery areas and their role following invocation of any Business Continuity plan(s). 9. Regular tests of the plan will be carried out to validate the arrangements by holding regular exercises and revisions to ensure validity. 10. The Strategic Business Continuity Plan will identify the recovery objectives, the structure for implementation, mitigation measures and the communication process to keep staff, members, partners and the public informed. Signed Chief Executive South Norfolk Council Leader of the Council South Norfolk Council 7
South Norfolk s framework The diagram below identifies the framework for those involved in the Business Continuity Programme: Cabinet Members/ Environment, Regulation & Growth policy committee Corporate Management Team SNC Business Continuity Policy Business Continuity Work Group 8
Roles and Responsibilities Senior Leadership Team The Corporate Management Team will: Act as a point of strategic leadership and support to the Business Continuity Workgroup. Act to ensure/monitor the overall strategic direction of Business Continuity across the Council. Represent the Council s senior decision - making / crisis management team in the event of any incident or situation that produces significant disruption or potential disruption to the Council. This includes support to the Emergency committee in the event of a major emergency and subsequent recovery. Ensure that the Business Continuity Management Policy, Strategic Framework and Delivery Plan is implemented and resourced appropriately. Ensuring there is a media policy in place to enable the appropriate spokesperson for the Authority is appointed. Make decisions arising from the assessments and recommendations produced by the Business Continuity Workgroup. Senior Managers/Heads of Service The Senior Managers/Heads of Service will: Assist with the preparation of a Business Continuity Plan for their service including the identification of risks and liaison with the Compliance and Risk Manager Allocate Business Continuity objectives to managers in their service Determine appropriate membership for the Business Continuity Workgroup Nominate one manager/staff member who will have specific responsibility for business continuity in their service. Nominate a deputy to assist the lead representative. Allocate sufficient resources to the nominated BCM coordinators for development, training, rehearsals and maintenance of business continuity plans. Ensure that service business continuity arrangements are regularly reviewed and are activated in the event of any incident or situation that produces significant disruption or potential disruption to the Council. Review the Business Impact Analysis for their area of responsibility assistance with this will be given by the Emergency Planning Team. Make decisions arising from the assessments and recommendations produced by the Business Continuity Workgroup Where significant partnerships and contractors are concerned the Council shall obtain details of their Business Continuity arrangements. 9
In addition to the above the Head of Asset Management will also: Work in partnership with service and corporate representatives on Business Continuity Management issues Support those services in exercising Business Continuity Plans at both Corporate and Service levels The Business Continuity Workgroup The Business Continuity Workgroup will monitor, support and progress the Business Continuity Management Programme by: Providing a forum for discussion of relevant business continuity issues that could affect the council Providing assistance to the Emergency Planning Team in achieving the Business Continuity Delivery Plan Assisting Services to implement their own Business Continuity Plans Assist with periodic testing of completed BC Plans Membership of the group should include the Acting Emergency Planning Manager, the Emergency Planning Officer and a member of staff from every Service/Directorate within South Norfolk Council relating to delivery of services to stakeholders. Emergency Planning Team The Emergency Planning Team is the professional lead for Business Continuity within South Norfolk Council and will: Review and develop the Policy in line with industry best practice and the needs of South Norfolk Council. Monitor standards and compliance with the Policy. Provide support and guidance to Directors/Senior Managers/Service Heads and the Business Continuity Work Group. In collaboration with other category 1 responders, as defined by the Civil Contingencies Act, make arrangements to promote Business Continuity Awareness, advice and assistance to the commercial and voluntary sector within the District. Make arrangements to support District services in undertaking risk and business impact analysis. Support and provide guidance to the organisation in the event of any incident or situation that produces significant disruption or potential disruption to the Council. 10
Business Impact Analysis & Business Continuity Options Process The outline process for the Business Continuity Plans can be seen as follows: Understand the Directorate Organisation Options Do nothing Change/suspend Loss mitigation / or terminate risk treatment Business Continuity Document & Sign Off Risk management programme Activity options based on acceptable operating levels Workforce, skills & knowledge Workspace facilities Supporting technologies Data & information Equipment & supplies Human welfare 11
Training Employees will need to take part in regular training and exercises as required. The exercises will take place at a time when its effect on our customers or clients is minimal. Any lessons learned from training, exercises or indeed invocation will be incorporated into the rolling annual review process. Review Process The Policy was originally implemented in July 2008 and will be reviewed annually from that date. It will also be reviewed in light of changes in legislation or best practice. All BC Plans will be reviewed annually to ensure staff and contact details are correct. It is the responsibility of each Directorate to notify the Emergency Planning Team of any significant changes that occur between these review dates. At regular intervals, the Plan will be reviewed against the Community Risk Register to ensure the Business Continuity Plan accurately reflects the current assessment of the likelihood of adverse events. For further enquiries please contact the Emergency Planning Team. Distribution and Amendment The Strategic and Directorate Plans are controlled documents. A distribution list will be included in each of the plans. When amendments are issued either replacement pages will be issued and sent to each plan holder and they will have to sign upon receipt or, if the changes are significant, a new plan will be issued. The Emergency Planning Unit will maintain a record centrally of all amendments. The distribution list will be reviewed as part of the wider plan review or following any major restructuring of the council. Audit and Governance This policy originally took effect from July 2008. The master copy of this document, a record of review and decision - making processes will be held by the Emergency Planning Team (EPT), South Norfolk Council. Services are required to notify the EPT of any changes that may impact on the content or procedures outlined in this document. The Policy supports the current Equalities legislation and we will adhere to its principles. This policy will be reviewed in accordance with the protocol detailed above, in order to ensure the best quality service delivery to the public. It has been produced on the above basis. Engaging with suppliers to ensure their Business Continuity arrangements are in place. All staff must be made aware of the plans that affect their Service and their role following invocation of Business Continuity Plans. 12
Business Continuity Management arrangements for South Norfolk Council are subject to Audit and all plans and documents will be available for audit as necessary. 13