Business Continuity Plan

Transcription

1 Business Continuity Plan Doc Ref: Sitt

2 Contents 1. Executive Summary Objective of the Plan... 7 Definitions Scope of the Plan Stages of Activation of Business Continuity Plan Scale of response Notification of an incident Out of Hours Emergency Response Centres (ERC) Key Personnel Managing a major incident Business Continuity Management Recovery Management Operational Log Documentation Debriefing Training Testing Departmental Business Continuity Plans Appendix Holders of Business Continuity Plan and building layouts Appendix Members of the Emergency Response Teams Appendix Emergency Contact Information (circulated to relevant staff separately)... Appendix Emergency Response Team Checklist # Appendix Emergency Response Team Checklist # Appendix Emergency Response Team Checklist # Appendix Operational Log Appendix Business Continuity Plan: Plan holder receipt sheet Appendix Business Continuity Plan: Notification of change form Appendix Bi-annual test Appendix Annual test Appendix Departmental Business Continuity Plans Doc Ref: Sitt

3 1. Executive Summary This document provides a management framework for responding to a major incident, which may threaten the Health & Safety of Integrated Services Programmes (ISP)'s community, or disrupt its programs and operations. The Business Continuity Plan establishes an Emergency Response Team that manages response strategies and allocates resources to ensure a major incident has minimal impact on ISP's business operation. The emergency responses are guided by ISP s overriding emergency goals of: Protecting life Securing the critical infrastructure and facilities Resuming services from our Centres. This document must link with ISP's specific emergency procedures relating to, emergency evacuation, dealing with bomb threats and building closure procedures, in addition to departmental business continuity plans. Holders of copies of ISP's Business Continuity Plan are identified in Appendix 1 The flow chart on the following page indicates the various stages of business continuity management and recovery. This plan has been developed to fulfil the requirements of BS : 2006 Business Continuity Part 1 : Code of Practice and BS : 2007 Business Continuity Management Part 2 : Specification. This document is part of ISP s Business Continuity Management System. Doc Ref: Sitt

4 Incident ERT assess the extent and effect of the incident on children, staff, students, carers and ISP organisation. Level 1 Response BRONZE ERT to co-ordinate and manage the immediate emergency response to an incident on behalf of ISP. ERT to ensure the necessary departmental plans are actioned Senior Managers to co-ordinate their departmental plans and feedback to ERT as required Upon notification of incident by ERT, EMT placed on alert ready to co-ordinate and manage the actions necessary for business continuity ERT to determine when an incident is deemed to be over Doc Ref: Sitt

5 Incident ERT assess the extent and effect of the incident on staff, students, carers and ISP Level 2 Response SILVER ERT to co-ordinate and manage the immediate emergency response to an incident on behalf of ISP. ERT to ensure the necessary departmental plans are actioned Senior Managers to co-ordinate their departmental plans and feedback to EMT as required Upon notification of incident. EMT to co-ordinate and manage the actions necessary for business continuity EMT to ensure the necessary departmental plans are actioned EMT notifies EMT and places them on alert in case incident escalates to GOLD status. EMT to determine when an incident is deemed to be over Doc Ref: Sitt

6 Incident ERT assess the extent and effect of the incident on staff, students, carers and ISP Level 3 Response GOLD ERT to co-ordinate and manage the immediate emergency response to an incident on behalf of ISP. ERT to ensure the necessary departmental plans are actioned Senior Managers to co-ordinate their departmental plans and feedback to EMT as required Upon notification of incident. EMT to co-ordinate and manage the actions necessary for business continuity EMT to ensure the necessary departmental plans are actioned EMT notifies EMT to co-ordinate and manage the recovery to full business operation in conjunction with the affected departments EMT to determine when an incident is deemed to be over Doc Ref: Sitt

7 2. Objective of the Plan The objective of this document is to co-ordinate the response of all departments within ISP to ensure business critical functions are reinstated as soon as possible, while full restoration of all services is planned and implemented on a concurrent basis. 3. Definitions Business critical functions - Functions within ISP that would have a serious impact on the business if they were unavailable for a limited period of time. Emergency Response Team (ERT) - The Front of House Team, led by the Centre Manager, is required to ensure adequate resources are in place at all times to manage the initial response to an incident. This team will assess the severity and impact of the incident and will decide upon the required response. The ERT are deployed on Bronze, Silver and Gold classified incidents Emergency Management Team (EMT) the MD Group are known as the Emergency Management Team (EMT), who will be tasked to implement department emergency plans should the incident escalate causing business interruption. The EMT are deployed on Silver and Gold classified incidents. Emergency Committee (EMT) - the MD Group within ISP are responsible for management of the incident and co-ordination of the recovery programme. The EMT are deployed on Gold classified incidents. Emergency Response Centre (ERC) - Dedicated facilities from which the EMT can effectively respond to any business interruption. Doc Ref: Sitt

8 4. Scope of the Plan ISP s Business Continuity Plan relates to all business functions and buildings and guides preparedness, response and recovery actions. The plan will be invoked when: Access to any of any ISP's building, in part or total, is denied due to an incident. ISP's business systems are interrupted. A Health & Safety incident affects staff, students and/or the local community and/or environment. The plan applies to a broad range of emergency incidents, and may be activated for the following: Total or partial loss of electrical supplies to the building Total or partial loss of water supplies to the building Total loss of gas supplies or gas leak. Flood Explosion Fire Disturbance of asbestos materials Release of other hazardous materials Loss of mission critical systems Medical emergency Access prevented to buildings by external factors ISP's Business Continuity Plan may be invoked when an incident is likely to, or will affect the business operations of ISP. Members of the Emergency Management Team will be placed on alert if the incident is deemed as silver and be ready to react should the incident require a gold response. The Plan may also be activated during an externally occurring incident that impacts ISP's personnel or business operations. Incidents falling outside those indicated above or deemed not to impact ISP as a whole may be managed as a localised departmental or branch emergency and handled in accordance with the departmental emergency plans. Doc Ref: Sitt

9 5. Stages of Activation of Business Continuity Plan In the event of an incident affecting the operation of ISP, the following stages will be used to classify a required response. In the event of an incident affecting the operation of ISP, the following stages will be used to provide members of the EMT and EMT sufficient warning of the activation of the plan. Bronze - No immediate threat to safety and/or property but emergency situation has an impact on the operation of the building(s) that may eventually lead to closure or limited occupancy/operation of building. This will be activated by a level 1 response (see below). Silver - Threat to safety and/or property identified but not immediate. Has a severe impact on the operation of the building(s) that could result in closure of the building. Staff to evacuate when ordered to do so by ERT or police/authorities. This will be activated by a level 2 response (see below). Gold - Immediate threat to safety and/or property requiring controlled evacuation and closure of the building(s) ordered either by the ERT or the police/authorities. Immediate activation of the business continuity plan and notification of members of the EMT and resources to be mobilised. This will be activated by a level 3 response (see below) Doc Ref: Sitt

10 6. Scale of response The scale and type of the business interruption will require different responses: For the purpose of this plan, the following scales of business interruption have been determined. In all circumstances, the Facilities Manager will be notified and provide assistance and support, as necessary. Level 1 - Business interruption affecting one or more departments and/or function an example of such an incident could be localised flooding or temporary loss of building services. Members of the EMT will be placed on alert by the ERT in preparedness should the incident escalate. Level 2 - Business interruption affecting one or more buildings resulting in short term closure of the building e.g. up to and including two working days and will be overcome by the relevant department(s) implementing their own departmental emergency response plan supported by the Facilities Manager. An example of such an incident could be total loss of building services to one or more buildings. Members of the EMT will be notified. Level 3 - Business interruption affecting the operation of ISP. An incident of this nature will invoke immediate activation of ISP Business Continuity Plan. An example of such an incident could be a terrorist attack on infrastructure of ISP or surrounding buildings, gas leak, major fire or other infrastructure problems. Members of the EMT will be notified. 7. Notification of an incident Please refer to the Accident/Incident Reporting Procedures. Doc Ref: Sitt

11 8. Out of Hours Workplace Support staff called to site in response to an incident will carry out an investigation. If it is considered, from the initial assessment, that the incident may affect ISP's operation, Head of Property and Facilities will be contacted. The information received will be reviewed and escalated if necessary. Contact numbers are available to all Workplace Support staff. Refer to Appendix 3 for details 9. Emergency Response Centres (ERC) For use by EMT Tunstall Court The Emergency Response Centre will be established in: Managing Director s Office, Tunstall Court Should an incident happen that results in Tunstall Court building being inaccessible, then will be used. Senior School, Church Street The Emergency Response Centre will be depend upon the location of the incident: Centre Managers Office at all sites The centres will provide: A dedicated facility from which ISP's response to any business interruption can be managed successfully A single place of contact for information relating to the business interruption. An area for the visual display of all information relating to the business interruption and the subsequent responses. Doc Ref: Sitt

12 In the event of a major incident, the centres will be made available 24 hours a day, seven days a week, if necessary. 10. Key Personnel Details of members of the Emergency Response Team are provided in Appendix 2. Key responsibilities to be addressed by members of the EMT: Life preservation Identify all staff and children involved Monitor progress of recovery with regular updates to members of the ERT Effective & timely communications Media Identify Company Spokesperson Provide accurate and regular updates throughout the incident. Learning Resources - Library; Media; Student IT Facilities Teaching Operations Recovery Identify areas affected Identify alternative resources within ISP Schools Identify resources outside ISP Schools Identify areas affected Identify alternative teaching space within ISP School Identify alternative teaching space outside ISP School Reschedule teaching to alternative locations Identify areas affected Identify alternative space within ISP Identify alternative space outside ISP Establish alternative space and relocate staff and equipment Maintain ISP s operating systems (HR, Finance, Student Records, etc) Liaison with ISP s insurers and loss adjusters Doc Ref: Sitt

13 Early appointment of an independent loss adjuster to act on behalf of ISP. Plan specialist recovery Plan repair works Plan re-establishment of normal operations Conservation and prevention of future damage 11. Managing a major incident The management of any major incident comprises a number of key activities: Immediate emergency response management Business continuity management Recovery management All of which require different skills and resources. Refer to appendices 4, 5 & 6 for response checklists. Immediate emergency response management ISP s Head of Property and Facilities will be consulted at this stage regarding Health, Safety and Fire Safety implications and issues. The following will also be updated on the action to be taken: The local Centre Manager The Heads of Department in other buildings Insurance Manager Senior Management Local Authorities It will be the responsibility of the Emergency Response Team to communicate with the above via ISP's telephone network or by personal notification. If immediate closure is necessary, ISP s escalation procedures, for the relevant building, will be invoked by Head of Property and Facilities, who will provide detailed instructions of the course of action to be taken. Should immediate closure be unnecessary, the Centre Manager will continually monitor the situation and report to the Head of Property and Facilities, as necessary. At all stages, those members of staff identified in this procedure will be updated on status of the incident. Doc Ref: Sitt

14 12. Business Continuity Management This is the responsibility of the Emergency Response Team. Refer to Appendix 2 for details. This team will be responsible for the ensuring the continuity of ISP's business and will allocate resources accordingly. Responsibilities: Identifying actions to be taken in order to recover from the incident as quickly as possible. Allocating sufficient resources to ensure quick return to normal business operations. Ensuring detailed log of decisions and subsequent actions taken is maintained. Ensuring external and internal communications are maintained Managing the cost of recovery Identifying the loss and managing the contacts with ISP. Early appointment of an independent loss adjuster to represent ISP. Appendix 5 shows a checklist of actions that may be required once the extent of the incident has been established and to minimise the effects of a major incident. 13. Recovery Management This is the responsibility of the Emergency Management Team. Once the incident is under control, it is important to recover as soon as possible in order to minimise any business impact. This process may require support in terms of specialist contractors and/or other ISP departments. The Emergency Management team will co-ordinate these activities of the Emergency Response Team. Members of the Emergency Response Team are shown in Appendix 2. Appendix 6 shows a checklist of actions that may be required once the incident is under control and to recover as quickly as possible from the effects of the incident. In addition, all costs associated with the incident must be recorded in order to determine the actual cost to recover from the incident and reported to the Head of Property and Facilities. Doc Ref: Sitt

15 14. Operational Log All decisions and actions taken by the EMT will be recorded and logged. Every decision will have a separate entry. Refer to Appendix 7 for details of log sheets. 15. Documentation Staff, as detailed in the EMT and Emergency Response Team, will be provided with copies of ISP s Business Continuity Plan. Staff should keep one copy at work and one copy at home. Plan holders will be expected to provide updated information relating to any contact details changes to Head of Property and Facilities, who will update and circulate the document. Copies of the Centres Business Continuity Plan will be circulated to appropriate Centre staff. Copies of the ISP Communicable Diseases Plan will be circulated to appropriate members of staff. 16. Debriefing There will be a debriefing, with all operational staff involved, once an incident has been successfully responded to, in order to feedback problems that will be fresh in peoples minds. An additional debriefing session will take place within two weeks of the end on an incident, the Emergency Response Team and other operational members of staff will review the Business Continuity Plan and process of responding to the incident in order to determine the plan's effectiveness. Proposals for changes and additions to the plan will be notified to the Head of Property and Facilities, via the form shown in Appendix 9, who will then update the master document and circulate the amendments to all plan holders. Doc Ref: Sitt

16 17. Training Prior to the implementation of the Business Continuity Plan, all members of staff with a responsibility within the plan will be provided with guidance and training. 18. Testing Annual test for holders of the plan (refer to Appendix 10 for details) ISP will test the plan in order to scrutinise those parts of the plan that are factual and measurable by either a pass or fail. Aspects of the plan that will be tested: The emergency contact list The plan documentation (the forms to be used in the event of the plan being activated) The bi-annual test will also include a talk through test whereby staff who have a responsibility within the plan will be questioned about their understanding of their role. Annual test for Emergency Response Team (refer to Appendix 11 for details). ISP will carry out a hypothetical walk through test. This may involve ISP establishing an emergency situation and activation of the plan, establishing the EMT and walking through the appropriate actions. This process is intended to ensure everyone is fully aware of their roles within the plan and to identify any weaknesses that need to be addressed and improvements that need to be made. Changes and additions to the plan will be notified to the Head of Property and Facilities, via the form shown in Appendix 9, who will then update the master document and circulate the amendments to all plan holders. THE EMERGENCY RESPONSE PLAN, BUSINESS CONTINUITY PLAN AND DEPARTMENAL PLANS WILL BE REVIEWED ANNUALLY. Doc Ref: Sitt

17 19. Departmental Business Continuity Plans Every department within ISP will prepare their own departmental business continuity plans which will support ISP s Business Continuity Plan. The emergency plans will identify the department s critical functions and assess how the function s loss will affect the operation of the department and the impact on ISP. The plans will identify the actions necessary for business recovery and include details of contacts. An assessment of each critical function must be carried out and actions agreed for each function. A pro-forma is shown in Appendix 12. Doc Ref: Sitt

18 Appendix 1 Holders of Business Continuity Plan Doc Ref: Sitt

19 Holders of ISP's Business Continuity Plan Managing Director Director of Operations Head of Schools Head of Outreach Education Head of Property and Facilities Head of Family Placements H R Manager Director of Finance Centre Managers Insurance Manager- Towergate Insurance. In addition, the plan will be held by all nominated deputies. Doc Ref: Sitt

20 Appendix 2 Members of the Emergency Response Teams Doc Ref: Sitt

21 Members of the Emergency Response Team (Strategic Response) Primary Team Managing Director Director of Operations Head of Schools Head of Outreach Education Head of Property and Facilities Head of Family Placements Doc Ref: Sitt

22 Key responsibilities to be addressed by members of the EMT: Life preservation Identify all staff, students and carers involved Monitor progress of recovery with regular communications with the ERT Keep staff and students affected informed of the status of the incident. Media Provide accurate and regular updates throughout the incident. Teaching Identify areas affected Identify alternative teaching space within ISP Identify alternative teaching space outside ISP Reschedule teaching to alternative locations Operations Identify areas affected Identify alternative space within ISP Identify alternative space outside ISP Establish alternative space and relocate staff and equipment Maintain ISP s operating systems (HR, Finance, Student Records, etc) Recovery Liaison with ISP s insurers and loss adjusters Plan specialist recovery Plan repair works Plan re-establishment of normal operations Establish IT systems recovery process Establish space requirements and arrange set up. Doc Ref: Sitt

23 Appendix 3 Business Continuity Contact list A list of the contact numbers for all holders of the plan will be updated quarterly and electronically distributed to the holders of the plan. Doc Ref: Sitt

24 Appendix 4 Emergency Response Team Checklist 1 Doc Ref: Sitt

25 Information required once the Emergency Response team has been established: Are the emergency services on site? What emergency services are on site? Who is the primary contact? Who is ISP's contact at the incident? What is the means of communication? What is the contact number? Have the utilities companies been notified? Have the Centre Managers / Head Teachers affected by the incident been informed? Have Centre Managers / Head Teachers not affected by the incident been informed? Has switchboard been notified? Is switchboard operational? What is the nature of the incident? Who is involved? How is it affecting ISP's operations? Building Systems failure Are departmental BCP s available? What is the extent of the damage? Are there any casualties? Who are they? Who is liaising with the emergency services to determine casualties? Are there up-to-date staff lists? Where are the staff lists? Has the incident hotline been established? Has contact been made with the media? Has press release been approved? Who is nominated as contact with the media? Has staff been notified that media contact is only through the nominated person? What emergency preservation measures have been taken? Removal of damages resources Recovery of damages resources Doc Ref: Sitt

26 Appendix 5 Emergency Response Team Checklist 2 Doc Ref: Sitt

27 Actions required once the extent of the incident has been established: Establish the full impact on the business of ISP Establish a system for identifying any casualties and where they have been taken. Establish a system for notifying the next of kin and provide them with all the information necessary. Establish a system for regular updating ISP's free phone hotline. Prepare accurate statement for the media. Establish log of decisions and actions agreed. Establish regular communications updates with emergency services, media and Centre Managers / Head of School in other buildings. Notify insurance company Appoint independent loss adjuster to represent ISP. Put specialist contractors on standby Removals Building maintenance Mechanical & Electrical Salvage Waste disposal Cleaners Conservation/restoration specialists Establish system for contacting staff and students affected by the incident Establish temporary accommodation Identify need to hire temporary equipment Identify business critical functions affected Establish priority program for both critical and non-critical functions Allocate resources to recover business critical functions Allocate resources to recover non-business critical functions Establish schedule of meetings and communications updates Doc Ref: Sitt

28 Appendix 6 Emergency Response Team Checklist 3 Doc Ref: Sitt

29 Actions required to enable ISP to recover from a major incident: Mobilise specialist contractors Removals Building maintenance repair Mechanical & Electrical repair Salvage Waste disposal Cleaners Conservation/restoration specialists Identify loss and update insurance company Use of independent loss adjuster to represent ISP Establish recovery costs Notify foster carers and children of possible change in venue for meetings, therapy etc. Notify suppliers and contractors of any changes Notify the Board, Local Authorities, Ofsted and any other statutory bodies. Prepare updated media statements Co-ordinate and monitor recovery program Manage and monitor recovery costs Doc Ref: Sitt

30 Appendix 7 Operational Log Doc Ref: Sitt

31 Emergency Response Team: Operational Log Incident Date: Time:.. Team Member:. Action Response Further Action Notes Doc Ref: Sitt

32 Action complete Doc Ref: Sitt

33 Appendix 8 Business Continuity Plan: Plan holder receipt sheet Doc Ref: Sitt

34 Business Continuity Plan: Planholder Receipt Sheet!,.. (name) confirm receipt of 2 copies of the ISP s business continuity plan (plan numbers....) and acknowledge that I have a role to play in ensuring the plan is kept current. I agree to keep the plans in a safe and accessible location, one in the office and one at home. Full amendments and correspondence regarding the plan should be sent to: Name: Job Title: Department: Extension number: Signed: Date: Please return this completed receipt sheet to: Doc Ref: Sitt

35 Appendix 9 Business Continuity Plan: Notification of change form Doc Ref: Sitt

36 Business Continuity Plan Notification of change form Change to page number.. Please amend as follows. Name: Signature: Department: Date: Completion notes: 1. Business continuity departmental co-ordinators to complete this form. 2. Forms to be completed either: a) On an 'as and when' basis if changes are required, or b) On a quarterly basis (even if 'nil' return) 3. Forms to be sent to the Buildings and Facilities Manager.. 4. The Insurance Manager will update the master document and issue amendment sheets. Doc Ref: Sitt

37 Appendix 10 Annual test for holders of the plan Doc Ref: Sitt

38 Annual test for holders of the plan ISP's Executive Group will test the plan in order to scrutinise those parts of the plan that are factual and measurable by either a pass or fail. Aspects of the plan that will be tested: The emergency contact list The plan documentation The plan itself by means of a talk through test Emergency contact list This is the most crucial of all the factual information contained within the plan. Head of Property and Facilities, will contact all those named on the contact lists to determine if the information is correct. The plan documentation The plan documentation includes all forms that will be used in the event of the plan being activated. Talk through test This test will consist of 'talking through' aspects of the plan with some or all of the people who have operational roles in the plan. Challenging questions will be asked and include the following: Do you understand the plan? Do you understand your role in the plan? Is there anything ambiguous about your role in the plan? Does any other person's role in the plan overlap with your own? Where is your copy of the plan now? Is the factual information contained in the plan current? Are the action checklists practical? Questions may be asked about a specific scenario and what actions may be required to be taken. A record and outcome of the test will be kept. Changes and additions to the plan will be notified to the Head of Property and Facilities, via the form shown in Appendix 9. The Insurance Manager will then update the master document and circulate the amendments to all plan holders. Doc Ref: Sitt

39 Appendix 11 Annual test for the Emergency Response Team Doc Ref: Sitt

40 Annual test for the Emergency Response Team ISP will carry out an annual test which consists of 'walking through' aspects of the plan so that practical implications of statements used in the plan can be tested for reliability: Do members of the EMT know where the Emergency Response Centre is located? Can the ERT be accessed at different times of the day? How will members of the ERT travel if an incident happens out of normal working hours? Are car park facilities available for members of staff outside normal working hours? Who will deactivate the intruder alarm systems? Are the voice and data points in both ERT's live? Is all the required equipment available? Can the Business Continuity Plan be accessed in the ERT's? ISP may establish an 'incident scenario' whereby the Business Continuity Plan is activated in order to monitor the responses and to identify weaknesses in the plan. A record and outcome of the test will be kept. Changes and additions to the plan will be notified to Head of Properties and Facilities, via the form shown in Appendix 9. The Insurance Manager will then update the master document and circulate the amendments to all plan holders. Doc Ref: Sitt

41 Appendix 12 Departmental Business Continuity Plans Doc Ref: Sitt

42 Departmental Business Continuity Plans Department: Critical function: Effect on the department: Effect on ISP: Recovery timescale: Other, please state: 1hour / 4 hours / 1 day / 1 week / 1 month / other (delete as required) Doc Ref: Sitt

43 Contact Information: Special Instructions: Assessor: Date of Assessment: Date of review: HoD approval: Doc Ref: Sitt