Writing a Multi-Purpose Business Continuity Plan

by

Recently, at the CMLS conference, a speaker was talking about the chaos COVID had recently caused, and asked “Who would have thought to have a pandemic plan at the ready?” I thought to myself “ALL of my clients who had me in to engage in risk management and business continuity planning in the past 14 years, that’s who.” Some of you might be thinking, “Clients sunk that much work into a plan, just in case of pandemic?”  Of course not! We wrote a multi-purpose plan.

Here’s how it works.

There are various types of disruptive disaster, for instance:

  • Loss of power
  • Loss of internet connectivity
  • Critical system failure
  • Flood
  • Fire
  • Hurricane / Tornado
  • Computer Crime
  • Burglary / Theft / Vandalism
  • Terrorism
  • Pandemic

Each one may be associated with one or more of the following parts of a business continuity plan:

  • Coordination
    • Alternate Work Sites
    • Alternate Computing Sites
    • Alternate Meeting Rooms
  • Communications Plan
    • Notification Procedure
    • Notification Call List
    • Staff Contact information
    • Phone Tree
    • Vendors and Suppliers
    • Members / Participants
  • Information Systems Disaster Recovery
  • Funding and Acquisitions
    • Supply Inventory
    • Equipment
  • Keeping the Plan Up to Date
  • Test Plan and Issue Mitigations

By writing a detailed plan based on the impacts of the disaster rather than for the disaster itself one does not need to duplicate plan sections for response to each disaster, merely refer to those relevant sections. For instance, a plan for fire might be as follows:

The impact of a fire varies from temporary restriction of access to work areas and equipment to long term loss of facilities, equipment and personnel.  In event of a fire, the following procedures will be needed to address the situation:

  1. Coordinate with Emergency Services (see Communication Plan)
  2. Communicate to first responders (see Communication Plan)
  3. Communicate to affected staff (see Communication Plan)
  4. Communicate to affected members (see Communication Plan)

For the following specific impacts, the following additional procedures should be followed:

Phone systems may become temporarily unavailable – limiting staff capability to provide service and communicate with each other and with members.

  • Forward phones to an alternate location – work with phone system company to forward phones to alternate locations if the phone system is likely to become damaged / lost. (see Information Systems Disaster Recovery)

Servers may become temporarily unavailable

  • Ensure failover has occurred (if applicable) and/or forward domains to servers in an alternate location so that users see either a message explaining the nature of the situation and/or a backup system running at an alternate location. (see Information Systems Disaster Recovery)

Computing equipment may be damaged / destroyed

  • Ensure failover has occurred (if applicable) and/or forward domains to servers in an alternate location so that users see either a message explaining the nature of the situation and/or a backup system running at an alternate location. (see Information Systems Disaster Recovery)
  • Coordinate support from vendors/suppliers (see Communication Plan)
  • Implement Funding and Acquisitions procedure, referring to Information Systems Disaster Recovery for information on equipment, installation, configuration, and restoration.
  • If data was lost, restore from backup (see Information Systems Disaster Recovery)

Facilities may be unavailable for a short period of time

  • Have affected staff report to alternate work sites (see Alternate Sites)
  • Have affected staff work remotely from home
  • Ensure members are aware that facility is unavailable for period of time

Facilities may be unavailable for an extended period of time / permanently

  • Have affected staff report to alternate work sites (see Alternate Sites)
  • Have affected staff work remotely from home
  • Ensure members are aware that facility is unavailable for period of time
  • Coordinate outside meeting rooms and training facilities
  • Engage in cleanup, reconstruction planning (see Funding and Acquisitions, Communications Plan – Vendors and Suppliers)

If your organization has written a business continuity plan that addresses the preparation, protection, response and recovery from various impacts that disasters can have, one end up with a multi-purpose plan that can easily be adapted to different types of disasters with little effort. Certainly, one never needs to start from scratch.