Documents and templates
How to document your planNow we come to documentation, this is everyone’s least favorite part of the process. But as we all know one of the most important parts of the whole thing, without the documents you could be in the position of not being able to recover .
01. Required Documents
The number and type of documents you will need to effect a business recovery will vary, a small company with a limited range of suppliers or customers. Will have very different needs when compered to a large company with many suppliers and customers.
Typically an organisation will need the following documents;
- Business Impact Assessment.
- Risk Register.
- Business Continuity Plan
- Disaster Recovery Documentation
- Key Process and Procedure Documents
- Emergency Procedures Document
- Support Contracts
- Customer and Supplier Contacts
- Insurance Document Copies
02. Document Layouts
The layouts of these documents will vary enormously, from possibly just one or two pages each, to fairly weighty documents in the case of things like the disaster recovery documentation.
It is important that the documents are functional, with the minimum of technical jargon. Remember it may not be the person who created the document that is using the document to effect a continuance of the business.
So plain English is best where practical, the specialist documents like disaster recovery plans may require more technical detail. It will likely require technical staff to implement the recovery.
03. Document Storage
The documents should always be available, never assume that systems or cloud storage will be available. They can be kept electronically, if you do keep them in more than one place – ensure the staff can access them.
They should also be in hard copy, preferably one held in off site storage – the plan is not any use if people cannot access it.
Where you have more than one office, store a copy at another location. Make sure that the staff are aware of the process for retrieving the documents. The document retrieval should be tested as part of a continuity plan test.
Don’t fail to plan
Remember failing to plan is the same as planning to fail
Over 80% of businesses do not have a current Business Continuity Plan, these are the most likely casualties when disaster strikes.
%
No Plan
%
Current Plan
Why have a plan
There may be more reasons than survival for having a Business Continuity Plan!
The requirements for a business continuity plan are not onerous when you consider what is at stake, not having a plan may impact in unexpected ways.
Some insurers are now placing the requirement in the policy small print, this is a consideration particularly around ransomware and some cyber threats.
Not having a plan in place could be costly indeed, checking your insurance details may be worth while. As some insurers are taking a more objective view if risk, particularly around the survival of a business under adverse circumstances.
When it comes to the business continuity plan, the sooner that the plan is created and tested – the lower the risk of the business failing.
The sooner that you start with the business continuity plan the better, in fact there are a number of advantages to early planning.
The most obvious is cost, the earlier that the process is started the less costly it will be in terms of both time and money.
Whether you are a Sole Trader or a small to medium sized company, having a business continuity plan should be a serious consideration.
The plan should have a customer oriented approach, it is important to maintain customer and supplier contact through any difficulties that the business experiences.
Keeping the plan simple is important, remember it may not be you that has to action the plan. For a small business there are few areas to look at, the key areas are probably;
- Fire
- Flood
- Burglary
- Cyber Attack
- Key People Leaving
- Communications Loss
There may well be other areas, but if we start with those above we can consider the options for a simple business continuity plan.
Remember this is for guidance, your plan is likely to have other considerations – which is why the best planner is you!
Creating the Document
Creating a document layout, keep it simple.
We are ready to look at what goes in the plan and how to lay the document out, in the section above we have a few examples of the key areas that our risk analysis identified.
Keeping the document simple is the aim here, where possible layout for each section should be consistent – even at the risk of having blank space on some of the pages.
For each of the key areas of risk identified in the risk analysis and entered in the risk register, there should be a section in the continuity plan.
The section may only be a single page and it may in some cases like “Fire” and “Flood”, be replicated or grouped into a single entry in the plan.
Other sections of the document may have to consist of a number of pages, detailing specific actions to be taken under certain circumstances.
Each section of the document will mean different things for different businesses, but for each section no matter what the business does there will be a defined process with the information in the appropriate section of the plan.
Having simple guidance, many of the things that you would do if you action a continuity plan are common sense – however when people are under stress things can and do get over looked, so check lists are a good idea.
It is important to make the escalation process easy to follow, with clear instructions on contacting more senior employees or management within the business.
Just developing the plan is likely to change someone’s mind set, it is one of the most important changes that a business can make. Having staff not understanding what is required is costly and will delay things, the staff should be fully involved where possible.
A favorite saying of motivational speakers in the 1990’s was, “your staff are your greatest asset”. When it comes to business continuity planning the staff are your greatest asset, they are even more important when they are required to get a business back up and running after a major impact.
The People.
This is stating the obvious, but the first consideration in all situations is the safety of people. This does not just cover the business staff, it also applies to customers, suppliers and any member of the public.
It also applies to the members of the emergency services, utility companies and anyone else that you have to contact or have on site.
Accessing the Plan.
There is no point in having a plan if you cannot access it when required, all your staff should know where the plan is held and how to get it.
The plan should be written in plain English with the minimum of technical content, that is for process and procedure documents and things like a disaster recovery plan.
For a Risk.
For each of the identified risks there should be a simple process, along with some simple guidance. For the most part the process should concentrate on getting the problem into the hands of the right person.
In most cases the issue the business is experiencing should be escalated, to a decision maker – someone who can make things happen.
It is a good idea to include a simple check list in the plan, although many of these things are common sense – when under stress it is all too easy to overlook something.
Getting in Touch!
This is an absolute fundamental for any Business Continuity Plan, you have to be able to get in touch with people when things go wrong!
Who you have to get in touch with is dependent on what the business does, but typically it may be;
| Contacts | Details |
| Staff | Name / Job title / Work number / Personal number / Email / Address |
| Suppliers | Company name / What they provide / Phone / Email |
| Customers | Name / Brief description (e.g. what they buy, how much they spend) / Phone / Email |
| Utilities | Company name / Utility / Phone / Email |
| Local emergency services | Ambulance / Fire Service / Flood line / Medical Services / Police |
| Insurance and finance | Company name / Service / Phone / Email / Policy Number |
Using Available Resource.
When things go wrong, your objective must be to get back to normal as quickly as possible. This may in certain circumstances mean that the resource you expected to have may not be available, here you have to make use of the resource that you have.
If your staff are compartmentalized from each other there can be issues, so having the staff exposed to other parts of the business can be an advantage.
Other Documentation.
Your Business Continuity Plan is a core document, on its own it is suitable for impact situations that do not require serious technical input. However if we take a situation like a ransomware attack or a major server outage, there will be other documentation required – along with specialist skills.
These documents need to be created as well, they should be readily available again from more than a single source. These documents are written for technical people, therefore all relevant technical information should be included.
Mitigate Key People
Losing any key people always hurts, most of the time there is a notice period and a handover – but this isn’t always the case.
Many businesses have key people and on occassion they leave or are unavailable, sometimes the departure is unexpected – this can leave a gap in the skillset and experience available.
Having process and procedures documentation will help in this situation, but someone has to create the documents and they have to be available.
Even the loss of key IT people is not a significant issue, if the appropriate documentation is available – emergency IT resource is available from a number of sources should it be required.
Get In Touch
6 Poplar Crescent, Gateshead, NE8 1QD
+44 77 88 71 03 06
info@volt-technology.com