Step by step interpretation of Business continuity planning involves

Stage 1 - Project Initiation:

Planning and implementing an effective, targeted Business Continuity Plan is a complex task - it can take several months to complete an initial BCP. It is therefore essential to set the planning process within the framework of a formal project, so that it is managed and co-coordinated throughout the planning cycle . Like all well run projects, we start with a project initiation phase. During this stage we set up our BCP project team and formally establish Senior Management commitment to the BCP by developing and getting their endorsement of a Business Continuity Management Policy Statement. We also ensure that any essential, pre-requisite processes are in place to ensure the continued viability of the Business Continuity Plan. e.g., in the context of Information and Communications Technology (ICT), an effective Configuration Management Policy and Change Control Process is in place – key to the continued viability of any Business Continuity Plan. 

Stage 2 - Functional Requirements:

 During the second stage we seek to gain a thorough understanding of the business. We establish the operational and business aims and objectives of the organization, and the mission critical activities and processes that support them. We conduct a Business Impact Analysis (BIA) and Risk Identification, Assessment & Control exercise to ensure that we plan only for those risks that are relevant to the organization – those that could threaten Business Critical Activities and Resources. In other words, we identify the Business Continuity Scenarios we need to plan for. This very important stage provides an all-important focus for the subsequent stages in the BCP process. From experience, this stage is best achieved by first conducting interviews to gather baseline information and then, using this information as the basis, running a number of workshops, which should be facilitated by a Business Continuity Management consultant, and attended by key stakeholders from the organization. This approach has proven to be very successful, since it allows all participants to contribute and be brought up to a common level of understanding of what we wish to achieve. It engenders ownership and buy-in to the whole process - an important aspect that should never be underestimated.  

 Stage 3 - Design & Development:

 We are now at the stage where we know the Business Continuity Scenarios for which we need to develop a Business Continuity Management Strategy, or should I say Strategies, because we will need to develop strategies to deal with issues at Organizational and Process level and a strategy to address Recovery of Resources. These will give a high-level outline of the Plans to be developed.

 Stage 4 - Developing & Implementing BCPs:

 Once we have agreed our strategies for the different levels of the organization, and got the all-important senior management sign up to these, it is time to start developing the detailed plans that will be brought to bear for each of our endorsed BCP Scenarios. There are a range of issues that must be addressed by the detailed BCP, ranging through:

•        Emergency Response and Operations.
•        Crisis management.
•        Liaison with external bodies & organizations.
•       4 Typical aspects would include but not be limited to: information   backup strategies, degree of resilience required, call-out and other procedures, use of off-site DR facilities,
•        Resourcing (both internal and through outsourcing partners).
•         Communications and ….
•         How to deal with Public Relations and the Media

The benefits of planning for these latter items are often underestimated but…. it is a critical aspect that gives the public the lasting impression of how you dealt with the crisis situation, an important consideration when considering how quickly and how well you recover from an incident. Lose the confidence of your customers and they will not hesitate to go elsewhere! There are other aspects, of course, and these are covered in the BSI BCP Management Guide, resulting in a plan describing who does what, where, when and how, what the DR plan invocation triggers are and when you can “stand down”

. Stage 5 - Building & Embedding a BCP Culture:

The best strategies and plans in the world are absolutely useless unless the staff required to implement them buy into the rationale and understand why the plans are needed. In other words, you need to develop a BCP culture within your organization. I alluded to this earlier when I discussed the benefits of using the workshops approach in Stage 2, but the difficulty in building up this culture should not be under-estimated. Establishing a BCP is likely to mean changes to existing working practices and, like all change, people can be resistant to them. However, by developing an effective and, importantly, ongoing, awareness, education and training programme, the culture will become embedded into your organization. Good 2-way communications and taking the concerns of staff into account will be important, after all, the staff will know how practical a plan is in practice – a critical test of whether the BCP will succeed or fail.

 Stage 6 - Exercising, Maintenance & Updating:

 The benefits of a well thought out training and exercising programme cannot be under-estimated. ·         You should design the exercise schedule such that each element of the plan is  tested, usually on an annual rolling basis to minimize disruption to normal operations.

• The Business Continuity exercises provide a valuable vehicle for validating the efficacy of your plans, for rehearsing and training your staff and BCP teams and reassuring both them and senior management that the plans will work when they are invoked for real.
• Almost inevitably, you will find errors or shortcomings in the processes during these exercises or you may find that your operations have moved on and elements of the plans you previously developed no longer support the needs of the organization. The BCP exercises provide a valuable means of validating your plans. The lessons learned should be fed back into the planning process and the underlying business assumptions upon which your plans had been based, and if necessary the plans themselves, be amended.
• In addition to the exercise schedule or perhaps in parallel with it, each plan should be reviewed on at least an annual basis to ensure that they remain relevant to the business. You do this by reviewing you business critical processes and outputs and checking that the plans you have still support them.
• More regular updating should be delegated to the Plan “owner”, an operational manager, who can incorporate this into routine business processes. This is particularly relevant for dynamic information, such as critical phone numbers, names, suppliers, locations, etc., which may change more frequently than can be managed by an annual review. Clearly, it is critical that these key changes are reflected in the BCP.
• Finally, to ensure that the plans remain effective and that staff training  is being kept current, a regular audit of the business continuity   management process should be conducted.