Continuity Planning is concerned with the development and implementation of a continuity strategy to reduce the damage a risk could inflict if it occurs. The first step of Continuity Planning is to develop a strategy that fills the gapbetween the Business Impact Assessment and Continuity Planning stage.
During the strategy development stage, the BCP team must identify which risks will be handled by the business continuity plan based on the prioritized list created in the previous phases. The team needs to contend with all the contingencies for the implementation of provisions and protocols required for zero downtime in the event of each and every possible risk. This requires a review of the maximum tolerable downtime (MTD) estimates so the team can decide which risks are deemed acceptable and which risks must attempt to be alleviated by BCP continuity provisions.
Once the BCP team has established which risks require mitigation and the scope of resources to be used for each mitigation task, the next stage of Continuity Planning, namely the provisions and processes stage may begin. The provisions and processes stage is the crux of Continuity Planning. Here, the BCP team develops procedures and methods that will alleviate risks declared unacceptable during the Strategy Development stage.
The BCP must ensure the safety of personnel before, during, and after an emergency. Once this is accomplished, plans can be implemented to allow employees to conduct both their BCP and operational tasks as effectively as possible given the circumstances.
To assure the completion of BCP tasks, employees should be provided with all of the resources needed to successfully execute their assigned tasks, including shelter and food where required. Organizations that require specialized facilities for emergency operations, such as operations centers, warehouses, distribution/logistics centers, and repair/maintenance depots; as well as standard office facilities, manufacturing plants, etc. would require full availability of these facilities to sustain the organization’s continued viability. Therefore, the BCP should establish mechanisms and procedures that can be put into place to fortify existing facilities against the risks defined in the strategy development stage.
If reinforcement of these facilities is not possible, the BCP should identify alternative sites where business operations can resume immediately or within a timeframe that is shorter than the maximum tolerable downtime. Every organization relies on a functional infrastructure to conduct its critical processes. For most organizations, an integral part of this infrastructure is an IT system that’s made of a number of servers, workstations, and critical communications links between sites.
One of BCP priorities is to determine how these systems will be safeguarded against risks identified during the strategy development stage. The BCP should identify methods and procedures to protect systems against potential risks by implementing protective measures such as computer-safe fire suppression systems and ongoing power supplies. Also, either redundant components or completely redundant systems/communications links can be applied to protect business operations.
