Business Continuity

The BCP contained the relevant information needed to enable the effective and efficient running of the business following an incident or crisis. It also improves the organizational resilience as part of "business as usual" and is intended to also be applied to dealing with the non-physical events such as supplier failure.

The BCP was written to conform to the standards and to incorporate the following framework:

• Prevention - risk management planning
• Preparedness - business impact analysis
• Response - incident response planning
• Recovery - recovery planning

In developing the BCP it was necessary to establish what was critical for the business recovery in a disaster/incident by identifying:

• Time-critical processes and IT systems
• People to manage and implement the recovery
• Places where work can be resumed

The BCP addressed the following time phases:

• Response - what to do immediately after the disaster/incident (this was normally managed by the emergency response team)
• Resumption - what to do in the first few days after the disaster/incident (normally managed by the business continuity management team)
• Recovery - what to do in the first month after the disaster/incident (involves recovery focal points)
• Restoration - what to do in the long term after 1 month (decided by the leadership team)

The key to the success of this project was having the right structure for the BCP organisation and the appropriate representation of the business on the project team.