Using a business continuity plan template: A free business continuity template and guide

The business continuity (BC) planning process contains several steps. These include project initiation, risk assessment, business impact analysis, strategy development, plan development, plan exercising and maintenance, emergency communications, awareness and training and coordination with public authorities.

For many professionals, these steps present a formidable challenge. To make the process easier, people seek out alternatives, such as software, templates, checklists, or consultants. While each of these options can build a plan and its associated program elements, too often these tools are used to "get something done" quickly. Typically, the process involves some data gathering and interviewing, followed by a "fill-in-the-blanks" process that somehow magically creates a finished product.

Free download: SearchDisasterRecovery's business continuity template

A GUIDE TO USING OUR BUSINESS CONTINUITY TEMPLATE

Here's a look a the structure and content of the template, indicating key issues to address and activities to perform.

• Initial data: If you have identified various people to contact in an incident, locate their contact information at the front of the plan, so you won't have to waste valuable seconds paging through a lengthy document.
• Revision management: Have a page that reflects your change management process.
• Purpose and scope (Sections 1.1 through 1.6): Provide details on these attributes, as well as assumptions, team descriptions, a list of terms, and other background information.
• How to use the plan (Sections 1.7.1 through 1.7.4): Provide information on circumstances under which the plan will be activated, including outage time frames, who declares a disaster, and who should be contacted on this situation.
• Provide policy information (Section 1.7.5): this is a good place to use standards documents as references.
• Emergency response and management (Section 1.7.6): Specify situations in which the plan is to be activated and response procedures.
• Use step-by-step procedures (Sections 1.7.7 through 1.7.10): These are easier to follow than broad general statements such as "relocate to alternate building" that require considerable details to work properly.
• Describe how often the plan is to be reviewed and updated, and by whom (Section 1.8).
• Assuming a situation has occurred, Section 2 provides steps to take to address it; these can be in the form of checklists (useful to keep track of scheduled and completed tasks) and flow diagrams that provide a high-level view of response and recovery.
• Information needs to be gathered before officially declaring a disaster; this includes damage assessment data and first-hand reports from staff and first responders; convene meetings as needed with key emergency team members to evaluate the facts before proceeding to a declaration.
• Section 3 addresses actions to take when it becomes obvious that management needs to declare a disaster. A damage assessment can be initiated either before or after the declaration; it is up to company management.
• Section 4 provides detailed instructions on recovering operations, relocating to an alternate site and related activities.
• Detailed appendices are provided in Section 5; these include lists and contact details on all emergency teams, primary and alternate vendors, alternate work space locations, and other relevant information. It is very important to keep this information up to date.
• Additional forms can be found in Appendix 5.7; these should be developed in advance, validated by exercising (as is the entire plan) and kept in a ready-to-use format.

GENERAL BUSINESS CONTINUITY PLANNING TIPS

Here's a checklist of things to keep in mind during business continuity planning:

• Take the process seriously. If you want to protect your business from unplanned events that could disrupt operations, create a plan. It doesn't have to be hundreds of pages long. It just needs the right information, and that information should be current and accurate.
• Use disaster recovery/business continuity standards as a starting point. Almost two dozen business continuity standards are available worldwide. In the U.S., several options are currently in use:
1. NFPA 1600 (the current U.S. national standard)
2. BSI BS 25999 (the British standard)
3. FFIEC Business Continuity Handbook (used by the banking and finance sectors)
4. DRII/DRJ Generally Accepted Principles (GAP)
• Keep it simple. Less can definitely be more in this situation, unless the user is primarily a technology-based group, such as IT.
• Limit content to actual disaster response actions. Assuming you are creating a plan to respond to specific incidents, include only the information needed for the response and subsequent recovery.
• Make it happen. Once the business continuity plan is complete, exercise it to ensure that the documented procedures make sense in the sequence indicated.
• Be flexible. A single template may not be universally applicable to all department and/or locations in your organization; consider other templates, software or consultants.

The keys to a creating a successful business continuity plan are to define step-by-step procedures for response and recovery, validate these activities through periodic exercising, and maintain the plan and its various components up to date.