1. Preparation

    Assign responsibilities for the lifecycle of the BCP process:

• Governance and coordination.
• Implementation and project management.
• Documentation.
• Incident readiness and response.
• Ongoing management.

2. Risk assessment

• Perform a Business Impact Analysis (BIA) to quantify the costs to your business of various adverse scenarios.
• Identify the Critical Business Processes (CBPs) that must be recovered in an emergency. Calculate the maximum tolerable downtime for these functions.
• Calculate the cost to the business if the CBPs are disrupted, including lost revenue, lost customers, financial penalties, and damage to your reputation. Consider the key supports associated with the CBPs, including personnel, ICT services, work areas, and suppliers.
• Identify the risks that are most likely to threaten these functions, including man-made, natural, and technical hazards.
• Prioritise these risk factors based on likelihood and potential impact on the business. Remember that large-scale disasters are the least likely events to occur – commonplace occurrences like power outages are far more likely and should feature more highly in your plan.
• It is impossible to mitigate all potential risks, so determine which ones the business is prepared to accept and which it will address.

3. Strategy

• Choose the most appropriate continuity strategies for areas of the business identified as under high risk of disruption.
• Factors to consider include your business objectives, customer obligations, statutory obligations, and cost-effectiveness.
• Prepare a business case for the entire BCP process and obtain senior management support.

4. Development and implementation

• Develop detailed failure scenarios for each of the highest priority risk factors.
• For each failure scenario determine the countermeasures required to prevent disruption or reduce it to acceptable levels.
• Develop an IT Disaster Recovery Plan (ITDR) that enables you to allocate ICT budget to your most vital infrastructure and provides backup and recovery solutions for critical ICT resources. This may include a secondary back-up site, alternative communications solutions, replication of data, and multiple layers of failover.
• Consider a managed hosting and storage solution to provide a safe hosting environment, uninterruptible power, and 24/7 monitoring, security, and maintenance.
• Develop an IT Services Continuity Management Plan (ITSCM) to ensure mission critical ICT services are restored in the correct priority order.
• Consider mirroring all data and software to an alternative work site so key personnel can be quickly relocated to maintain your critical business processes.
• Create a Crisis Management Plan (CMP) – also called an Emergency Response Plan (ERP) – that provides a management framework designed to reduce the business impact of adverse events.

5. Testing and maintenance

• Design and implement test scenarios on several levels, such as for senior executives, for crisis teams, for ICT infrastructure, or across the whole company.
• Stage regular BCP and ITDR drills to assess your organisation’s disaster preparedness.
• Review and amend your plans using the results of testing.
• Update the plan if the company is reorganised, hardware or vendors are changed, or priorities shift. Plans for Critical Business Processes should be updated every six months and plans for general business functions annually.

6. Integration

• Confirm the BCP is aligned with your business objectives and priorities.
• Continually reassess the plan as part of your ICT roadmap, reviews of security, HR policy, etc. This process should become part of your daily business decision-making.
• Make BCP one of the key decision criteria for every business decision.
• Establish an on-going BCP awareness programme.
• Provide ongoing BCP training for new and existing staff.