Business continuation planning is the process of defining procedures that will enable your company to continue operating after a disaster has struck. That process can be broken down into the following steps:PREPARE: Business continuation planning requires a significant investment of time, money and other resources. It also requires full support of senior management. Preparation includes appointing a coordinator, selecting committee members from each business unit, establishing meeting dates for a year, and developing a budget, schedule and project assignments for team members.
DEFINE THE SCOPE: The planning team defines the scope of the business continuity plan. It also identifies objectives and priorities, selects a typical disaster outcome that covers most likely events, and considers alternative business resumption strategies.
COLLECT DATA: Once priorities are clear and reinforced by senior management, the team begins collecting data. The purpose is to verify that disaster recovery plans are in place, that the company has up-to-date documentation of assets, and that vital records are protected, backed up, and accessible. The team also prioritizes business functions-rating them as critical, essential or important. Each department lists the minimum resources it needs to conduct business at an alternate site.
CONDUCT A BUSINESS IMPACT ANALYSIS: During this phase, each department determines the operational and financial impact of a disaster and the resources it needs to resume "critical" business functions. This process includes establishing recovery time objectives, setting up a business resumption timetable, and determining staffing and alternate locations. This can be done for essential and important functions as well. The business impact analysis is submitted to senior management for approval.
DEVELOP THE PLAN: In this step, key members of the planning team identify continuation strategies for each critical business function. The process consists of establishing recovery teams, developing tasks and procedures, ensuring adequate funding, and determining reconstruction requirements. By using financial impact data from the business impact analysis, the team can evaluate the cost/benefits of each strategy.
IMPLEMENT THE PLAN: After team members write the business continuity plan and it is approved by senior management, the company acquires all items it needs to support the plan. Multiple copies of the final plan are distributed to each recovery team member.
TEST AND MONITOR THE PLAN: Testing is critical-at least once a year. Tests can include structured walk-throughs, checklists, tabletop exercises, simulations and full-interruption tests.
MAINTAIN THE PLAN: The team develops a system to update names, responsibilities and contact information, as well as procedures to review and revise the plan on a regular basis.
This information is excerpted from the "Business Recovery Planning Guide" published by the Chubb Group of Insurance Cos., Warren, N.J.
