What is a 'Business Continuity Plan' (BCP)?
It is a fact of life that emergencies will happen, and computer and communications systems will fail. To minimise the problems for your business it is advisable to have a business continuity plan which:
- Outlines what you have done in advance to prevent interruptions to vital services
- Lists the steps you and staff will take during an interruption to continue operations
- Lists the steps you will take to fully restore services after an interruption
- Sets up a Post Incident Review (PIR) after an interruption has occurred
Sample BCPs are available on the internet where you will also find sites that have extensive instructions on their construction and implementation.
The BCP should be very easy to find and always up to date:
This includes electronic copies and printed copies. Printed copies should be carefully located to enable easy access when computer systems are not working. Remember it is quite possible that the key people with all this information 'in their heads' will be absent when an interruption occurs. Keeping BCPs up to date is vital to ensure not only accuracy but credibility – your customers and staff need to be confident that services will continue to work.
What should be included in a BCP?
When creating your BCP, assess all the essential computer and communications services that make your business work. What you include depends on the level of risk, and the importance of each system. Think about and record:
- A list of crucial systems and services and what to do when they fail
- Ways you ensure availability of computers, printers, fax machines, power, and telecommunications (internal and external). Computers will include on-site and off-site systems especially web, e-mail and file servers.
- Site security – including setting up office at an alternative site if necessary
- Fire prevention and response arrangements
- Flood prevention and response arrangements
- Data back-up and restoral (including off-site storage of backed up data)
Identify strategies to get you through the outage:
Make a 'short list' of essential business activities and make sure they can function during a computer or communications outage – leaving other 'day-to-day' work to be performed once services are restored. For example, capture customer details manually and leave online processing for when systems resume.
Plan in advance what you will do if there is a service interruption:
It's much easier to plan when you are not in the middle of a crisis. At the very least outline the steps you will need to take when vital computers and communications services are not available and who will perform them.
How thorough should the BCP be?
The length of your BCP will depend on the size of your business – it can be as little as a few pages for small organisations. Make sure you include contact details – especially after hours – of all the people needed to help restore your services and details of where your off-site data backup is located.
Engage an IT professional if possible to consult on your BCP:
BCPs should ideally be prepared by an IT professional, but if this is not practical then at least write down all that you do know about your IT and communications set up. For example, this should at least include a list of IT, network and telephony equipment with names and phone numbers of service providers and if possible, a diagram of your IT configuration.