In the first part of this series Getting Started with Business Continuity, we reviewed creating your BCP team and also how to determine the likelihood of possible threats using the Threat Analysis Tool.
In Part 2, we will review the high level steps to take when you have a BCP event.
Communication
When creating your BCP Plan determine the list of stakeholders and gather contact information of each person. In some cases you may have a backup person identified for key stake holders in Management, for your Customer, and Vendors, that you would contact if the first person is not available. Generally the list contact categories would look something like this:
- Employees – all employees impacted, including those remote and contractors.
- Management – all people managers, account managers, and support managers impacted by outage.
- Customer – key contacts of all clients impacted.
- Vendors/Suppliers – those that are directly impacted by your event, and those you may need to engage to help implement your BCP plan. I.e. Transportation, Hotels, Food Vendors.
Once your BCP event has started, and depending on the severity of the incident, the time of day and any danger to employees, communications should normally begin within 10 minutes of outage and continue every 15-30 mins until your outage is managed. To get to everyone in a timely manner, you may want to consider implementing an email distribution list, voicemail list, and/or toll free number for people to call into for updates. A predetermined template is also handy for consistent messaging.
Scenario Documentation
Create a template or check list to capture everything you will need to recall post your BCP incident:
- Description of service disruption
- Start times and end times
- Corrective notes
Return to Operations
Once your incident is resolved, refer back to your communication plan to provide your list of stakeholders the “all clear” update. Again, consider a predetermined template for consistent messaging.
Post Mortem
Call a meeting the day or following day of your incident to review the event in detail. The scenario documentation you gathered during the event will help you to recall the particulars. Review with the team what worked and what didn’t work. Keep and work the list of actions resulting from the meeting. This is an important step to keeping your plan alive and often gets missed!
