business resumption planning

A Comprehensive Guide To Business Resumption Plan

• Ossian Muscad
• June 5, 2023
• No Comments

Last Updated on June 5, 2023 by Ossian Muscad

The global pandemic has caused businesses to experience unprecedented disruption that has crippled entire markets. But as the world recovers, businesses must prepare for the new normal. For that reason, a comprehensive business resumption plan is key in enabling companies to resume operations while mitigating risks and detecting new challenges.

Creating a business resumption plan might sound tedious, but with proper knowledge and a comprehensive plan, you can easily create and execute your plan. This guide will show you how to prepare and create a business resumption plan that will help you get back on track:

What is a Business Resumption Plan?

A Business Resumption Plan (BRP), also known as a business reopening plan, is a strategic document outlining the processes and procedures an organization needs to follow to resume normal business operations after a disruption or crisis. This plan will help the organization recover from a crisis by enabling them to identify risks, create strategies for recovery and return to normal operations.

Elements of a Business

The main objective of a BRP is to minimize downtime, reduce financial losses, and ensure a smooth transition back to normal operations. The plan typically includes the following:

• Risk Assessment: Identifying potential threats and vulnerabilities that could disrupt business operations and evaluating their potential impact on the organization.
• Recovery Strategies: Develop strategies and contingency plans to address disruptions, such as natural disasters, cyberattacks, or supply chain issues.
• Critical Functions Identification: Determining the most essential business functions that must be restored first to minimize losses and maintain customer trust.
• Communication Plans: Establish clear communication channels to keep employees, customers, suppliers, and other stakeholders informed during the recovery process.
• Resource Allocation: Allocating necessary resources, such as personnel, equipment, and finances, to support the recovery efforts.
• Training and Testing: Regularly training staff on their roles and responsibilities during disruption and conducting tests to evaluate the plan’s effectiveness.
• Maintenance and Updates: Continuously review and update the BRP to ensure it remains relevant and effective in light of changing business needs and evolving risks.

A well-crafted Business Resumption Plan can help organizations mitigate the impact of disruptions, protect their reputation, and ensure the continuity of essential services. It is a crucial component of a comprehensive business continuity management strategy.

Importance of Business Reopening Planning

Business reopening planning is crucial for organizations that have experienced a temporary shutdown or disruption due to unforeseen events such as natural disasters, pandemics, or other emergencies. A well-structured reopening plan ensures a smooth and safe transition back to normal operations while minimizing risks and potential losses. Here are some key reasons why business reopening planning is essential:

Employee Safety and Well-being

A reopening plan prioritizes the safety and health of employees by implementing necessary safety measures, guidelines, and protocols, such as social distancing, sanitization, and personal protective equipment.

Customer Trust and Loyalty

A well-executed reopening plan demonstrates a commitment to customer safety and satisfaction, which can help retain existing customers and attract new ones.

Regulatory Compliance

Reopening plans ensure businesses adhere to local, state, or federal guidelines and regulations that may have been established in response to the disruptive event.

Operational Efficiency

A comprehensive reopening plan helps identify essential business functions, streamline processes, and allocate resources effectively to minimize downtime and restore operations quickly.

Financial Stability

By resuming operations promptly and efficiently, businesses can reduce financial losses, regain revenue streams, and maintain cash flow.

Reputation Management

A successful reopening can help protect a company’s reputation and brand image by demonstrating resilience, adaptability, and a commitment to safety and quality.

Risk Mitigation

Reopening planning involves assessing potential risks, vulnerabilities, and challenges that may arise during the process, allowing organizations to develop strategies to address and mitigate these risks.

Learning and Improvement

Reopening planning enables businesses to learn from the disruption, identify areas of improvement, and implement changes to strengthen their overall resilience and preparedness for future crises.

5 Key Elements for Effective Business Reopening

To ensure effective planning for reopening or resuming a business, it is essential to consider the following key elements:

Business Impact Analysis of Critical Processes and Systems

Conducting a thorough business impact analysis helps identify the most critical processes and systems that must be prioritized during the reopening. This enables organizations to allocate resources effectively and minimize downtime, ensuring a smooth and efficient return to normal operations.

Employees, Customers, and Business Partners

Ensuring the safety and well-being of employees, customers, and business partners is paramount during reopening. Develop and implement safety protocols, such as social distancing measures, sanitization procedures, and personal protective equipment requirements. Additionally, provide training and support to employees to help them adapt to new processes and guidelines.

Facilities Assessments

Before reopening, conduct a comprehensive assessment of your facilities to identify any potential hazards or issues that may have arisen during the shutdown. Then, address these concerns promptly and make necessary modifications to ensure a safe and functional work environment.

Inclusive Communications

Maintain open and transparent communication with all stakeholders, including employees, customers, suppliers, and regulators. Keep them informed about your reopening plans, safety measures, and any product or service changes. Establish clear channels for feedback and concerns, and respond promptly and empathetically to any issues.

Lessons Learned

Use the reopening process as an opportunity to learn from the disruption and identify areas for improvement. Analyze what worked well and what didn’t during the crisis, and use this information to strengthen your organization’s overall resilience and preparedness for future challenges. Then, implement changes based on these lessons learned and continuously review and update your reopening plan to ensure its effectiveness.

By focusing on these five essential elements, businesses can develop a comprehensive and effective reopening plan that prioritizes safety, minimizes disruptions, and fosters a smooth transition back to normal operations.

Tips When Creating a Business Resumption Plan

Creating a business resumption plan doesn’t take long if you know what steps to take. Here are some useful tips to follow when creating your plan:

• Conduct a thorough risk assessment: Identify potential threats and vulnerabilities that could disrupt your business operations, such as natural disasters, power outages, cyberattacks, or supply chain disruptions.
• Identify critical functions and prioritize them: Determine the core operations your business relies on and which ones need to be resumed first to minimize disruptions.
• Develop clear recovery objectives: Set specific, measurable, and time-bound goals for resuming each critical function. This will help you allocate resources effectively and track progress during recovery.
• Establish a dedicated recovery team: Assign roles and responsibilities to employees responsible for executing the Business Resumption Plan. Ensure they are trained and aware of their duties during a crisis.
• Create a communication plan: Develop a strategy for communicating with employees, customers, suppliers, and other stakeholders during a disruption. This should include communication channels, key messages, and designated spokespersons.
• Test and update your plan regularly: Conduct regular exercises to test the effectiveness of your Business Resumption Plan and identify areas for improvement. Update your plan as needed to account for business operations, technology, or regulatory environment changes.
• Backup Important Data and Systems: Ensure critical data and systems are securely backed up and can be quickly restored in case of a disruption. Consider using cloud-based backup solutions for added security and accessibility.
• Develop Contingency Plans for Suppliers and Partners: Identify alternative suppliers and partners who can step in if the disruption affects your primary sources.
• Consider Insurance Coverage: Review your existing insurance policies to ensure adequate coverage for potential disruptions, and also consider adding business interruption insurance if necessary.
• Promote a Culture of Preparedness: Encourage employees to take responsibility for their preparedness by providing training and resources on emergency procedures, personal safety, and business continuity best practices.

Create a Business Resumption Plan Template Using a Low-code Platform

If you’re looking for a fast and easy way to create your Business Resumption Plan, look no further than low-code. Low-code platforms give non-technical users an easy way to build powerful applications without writing code. This makes them perfect for creating data-driven documents like business resumption plans.

DATAMYTE is a quality management platform with low-code capabilities. The DataMyte Digital Clipboard , in particular, is a low-code workflow automation software that features a checklist and smart form builder. This tool lets you create a comprehensive business resumption plan template to use and share with your team.

To create a checklist or form template using DATAMYTE, follow these steps:

• Log in to the DATAMYTE software and navigate to the ‘Checklist’ module.
• Click “Create Checklist.”
• Add a title to your checklist; select the category where it belongs.
• Start adding items to the checklist by clicking “Add Item.” 
• Define the description of each item, what type of answer it requires, and other relevant specifications (e.g., reference documents, acceptance criteria, limits).
• Assign a team member responsible for conducting the inspection using the checklist.
• Add signature fields for approvals (e.g., supervisors, quality assurance personnel).
• Save the checklist—you can now access it anywhere, and it will be available on any device.

DATAMYTE also lets you conduct layered process audits, a high-frequency evaluation of critical process steps, focusing on areas with the highest failure risk or non-compliance. Conducting LPA with DATAMYTE lets you effectively identify and correct potential defects before they become major quality issues.

With DATAMYTE, you have an all-in-one solution for creating and implementing business resumption plan templates. Book a demo now to learn how DATAMYTE can help you create and manage a comprehensive business resumption plan.

Don’t get left behind in the post-lockdown economy. A comprehensive business resumption plan can help ensure your business stays up and running no matter what happens. Low-code platforms like DATAMYTE make it easy to create a business resumption plan template and confidently manage the process. Get started today!

Related Articles:

• Cafe and Restaurant Reopening Checklist: A Comprehensive Overview
• A Comprehensive Guide To Risk-based Inspection Audit Template

• Implementation
• Case-Studies
• White Papers
• Knowledge Base

Experts in the Connected Factory

• 1-800-455-4359
• (763) 553-0455 ext. 1
• [email protected]

Six Critical Components of a Business Resumption Plan

by The Integris Team

There are a lot of moving parts that help the daily operations of your business run smoothly. In the event of a crisis, those parts all need to be accounted for and attended to.

When building a business resumption plan , it is important to consider six different components of your business that may be affected in an emergency situation. Breaking the process down into these segments will make it easier to delegate duties and implement a planned strategy if and when a disaster occurs.

1. Operational

The day-to-day operations of a company are likely to be affected in a critical emergency. Your plan should outline how to get things up and running again as efficiently as possible. For instance, if computer systems are not available, what alternative means do you have to carry out processes?

2. Client Support

Even in the event of a disaster, natural or technological, your clients are going to need attention. They may have questions about how the situation will affect them or simply need your services. It’s important to have a plan so your company can continue to tend to clients throughout the crisis.

3. Phones/Internet

In this day and age, phone and Internet systems are your company’s strongest link to your clients. If either or both of these systems go down, you’re going to need to have a way to get in touch with clients.

4. Financial

Money can be a major issue when it comes to emergencies. Will the business lose money in the event of a disaster? What are the best ways to ensure monetary loss is at a minimum? Having some money set aside in savings for crisis situations is also very wise.

5. Company Data

Your company’s data is one of the most precious resources you have. Loss of data, especially with no viable backup, can have catastrophic consequences. Be sure to have multiple backup systems in place so that in the event of a disaster, that data is easily restored and accessed.

6. Hardware/Software

Damage to hardware or software can throw a huge wrench in the works. Do you have backup computers available, if needed? How about extra copies of the software in case that information gets wiped from the hardware?

Need a partner when developing your plan? Reach out to Integris today.

Keep reading

How to Create a Desktop Shortcut to a OneNote Notebook or Section

Creating a desktop shortcut to a Microsoft OneNote notebook or section can be a real productivity and organizational boost for users who frequently access specific notes or projects. A desktop shortcut enables instant access to important information, bypassing the...

How to Record, Transcribe, and Save Your Meetings with Microsoft 365

Have you ever wished you could record Microsoft Teams meetings you participate in, so you could refer to it later? Would it benefit your staff to be able to pull information directly from meeting transcripts when they’re working on their projects? For most...

Why Is My Laptop Draining So Fast?

Before You Replace Your Laptop Battery, Try These Fixes First Stuck with a laptop that’s running out way before it’s standard 8-10 hours of run time? Don't throw it out just yet.  Try these quick fixes to extend its life: Reduce your screen brightness If possible,...

• Recent changes
• Random page
• Help about MediaWiki
• What links here
• Related changes
• Special pages
• Printable version
• Permanent link
• Page information
• View source

Business Resumption Planning (BRP)

• 1 What is Business Resumption Planning (BRP)?
• 2 Key Components of Business Resumption Planning
• 3 Importance of Business Resumption Planning
• 4 Steps in Developing a Business Resumption Plan
• 5 Challenges in Business Resumption Planning
• 6 Conclusion
• 8.1 Further Reading

What is Business Resumption Planning (BRP)?

Business Resumption Planning (BRP) is a strategic process designed to enable businesses to resume critical operations as quickly and efficiently as possible following a disruption. Unlike broader Business Continuity Planning (BCP) that covers an organization's recovery process—including IT recovery, crisis management, and more—BRP focuses specifically on the strategies and procedures necessary to restart key business functions after a halt. It's an essential component of risk management and disaster recovery, ensuring that a company can continue to operate or quickly return to operation after an interruption, whether due to natural disasters, technological failures, cyberattacks, or other unforeseen events.

Key Components of Business Resumption Planning

• Critical Function Identification: Determining which business functions are critical to the organization's survival and understanding their dependencies.
• Recovery Time Objectives (RTOs): Setting clear objectives for how quickly critical functions need to be resumed to minimize impact.
• Resource Requirements: Identifying the resources (human, technological, financial) required to resume critical operations.
• Communication Plan: Establishing internal and external communication protocols during the recovery process.
• Recovery Strategies: Developing specific strategies for resuming critical operations, which may include alternative processes, relocation plans, or the use of contingency sites.
• Employee Training and Awareness: Ensuring staff knows the BRP, understand their roles in resumption efforts and are trained in relevant procedures.

Importance of Business Resumption Planning

• Minimizes Downtime: BRP helps reduce the time it takes to get critical business functions up and running, minimizing operational downtime.
• Protects Brand Reputation: Quick and efficient recovery from disruptions can help maintain customer trust and confidence in the brand.
• Financial Stability: By resuming operations swiftly, businesses can mitigate financial losses associated with prolonged downtime.
• Regulatory Compliance: For some industries, having a BRP is a regulatory requirement to protect sensitive data and provide critical services.
• Employee Confidence: A clear and actionable BRP gives employees a sense of security, knowing there are plans to safeguard their jobs and the business.

Steps in Developing a Business Resumption Plan

• Conduct a Business Impact Analysis (BIA): Identify critical business functions and the impact of their disruption.
• Develop Recovery Strategies: Based on the BIA, devise strategies to resume critical operations within the determined RTO.
• Plan Development: Document the resumption plan, detailing procedures, resources, and personnel involved in the recovery of operations.
• Training and Testing: Train employees on their roles within the plan and conduct regular tests to ensure the plan's effectiveness and to familiarize staff with recovery processes.
• Maintenance and Review: Regularly review and update the BRP to reflect changes in the business environment, operational processes, or emerging risks.

Challenges in Business Resumption Planning

• Complexity of Modern Businesses: The interconnectedness of modern business operations can make identifying critical functions and dependencies challenging.
• Resource Allocation: Determining the optimal allocation of limited resources for maximum efficiency in resuming operations can be difficult.
• Keeping Plans Up-to-Date: Rapid changes in technology, business processes, and external environments require ongoing updates to the BRP.
• Ensuring Employee Readiness: Continuously training and engaging employees to ensure they are prepared to execute the BRP can be resource-intensive.

Business Resumption Planning is a crucial aspect of an organization's overall resilience strategy, focusing on the rapid recovery of critical business functions following a disruption. A well-crafted BRP not only minimizes operational downtime and financial losses but also plays a vital role in maintaining customer trust and regulatory compliance. Through careful planning, regular testing, and continuous improvement, organizations can enhance their ability to navigate and recover from disruptions, ensuring long-term stability and success.

Business Resumption Planning (BRP) is a component of business continuity planning focused specifically on the strategies and procedures required to resume business operations after a disruption. While business continuity planning covers the entirety of maintaining operational functions during a crisis, BRP zeroes in on the recovery aspect—how to quickly restore critical services to a minimum operational level following an interruption, and then eventually to full functionality. BRP typically involves identifying essential business functions, determining the resources required to resume those operations (such as personnel, technology, and information), and establishing clear guidelines and timelines for recovery.

• Business Continuity Planning (BCP) : Discussing the broader strategy that includes business resumption planning, crisis management, and disaster recovery to ensure that an organization can continue operating during and after a disaster.
• Disaster recovery (DR): Covering the specific strategies and procedures for recovering technology systems, data, and infrastructure critical to an organization after a disaster or disruption.
• Risk Management : Explaining the process of identifying, assessing, and controlling threats to an organization's capital and earnings, which includes planning for potential business disruptions.
• Crisis Management : Discussing the methods used to deal with sudden and significant negative events. Crisis management involves steps taken before, during, and after an event that threatens the integrity or reputation of the company.
• Impact Analysis : Covering the process of assessing the effects of potential business disruptions on company operations, which is a critical component of BRP to determine which business functions are essential.
• Emergency Preparedness: Discussing the readiness of organizations to respond to an emergency in a timely and efficient manner, which includes having a BRP in place.
• Operational Risk : Explaining the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events, highlighting the importance of BRP in mitigating these risks.
• Supply Chain Resilience : Covering the ability of a supply chain to anticipate, prepare for, respond to, and recover from disruptions, which is closely related to business resumption planning.
• Information Technology (IT) Resilience: Discussing the ability of IT systems and operations to maintain acceptable service levels despite challenges or disruptions, a key focus area in many BRPs.
• Workplace Recovery: Explaining strategies for restoring the physical workspace and operational capabilities, including alternate working locations and remote work options.
• Regulatory Compliance: Covering the need for organizations to act in accordance with relevant laws, regulations, and guidelines, including those that may require specific business resumption capabilities.
• Communication Plan: Discussing the plan that outlines how information will be communicated to internal and external stakeholders during and after a disruption, an essential element of BRP.

Further Reading

• Business Resumption Planning: Exercising the Disaster Management Team Calstatela.edu
• Business Resumption Planning Step by Step Datasure

Business Resumption Planning in Small and Medium-Sized Offices

As Originally Published on InformIT.com , February 17, 2006

Your small business can go from thriving to surviving in the time it takes for an earthquake, an intruder, or some other disaster to wreak havoc on your property. Leo Wrobel explores some steps that even very small businesses can take to prevent or handle a disaster and get back to normal.

Size Does Matter

People tend to think of business resumption planning in terms of the Fortune 1000, but probably 90% of the businesses that could really use a plan are small or medium-sized. The sheer number of businesses that may fall into the "small to medium-sized" category boggles the mind: professional services providers such as law firms or doctors' offices, manufacturers such as machine shops or "job shops" that do custom manufacturing or build and sell PCs; car dealerships; local banks; even municipal works such as city, county, or taxing authorities. The list goes on and on.

Due to physical size, location, or financial resources, small and medium-sized firms often have to do things a little differently than large companies. Whether big or small, however, any company can end up broke if it can't recover from a disaster in time. So every organization, regardless of size, needs to have a plan. In this article, we'll explore what works for large companies, small ones, or both. On the way, I'll provide a few hints on how you can get something in place quickly for your small or medium-sized business.

Decide What You're Protecting

• Lost employee productivity
• Lost revenue
• Lost market share
• Lost customer confidence
• Potential legal liability
• Cleanup costs

Let's consider each of these areas in a bit more detail.

Lost Employee Productivity

Lost revenue, lost market share.

On the other hand, many or even most of your 75 employees are probably field service personnel who work out of trucks and vans, rather than your corporate location. In this type of business, if you take even the most rudimentary precautions beforehand, your business could still go on. For example:

• Setting up a meeting place in advance in case your main place of business is inaccessible.
• Assure employees that they're still going to be paid. Don't underestimate the importance of this step when 75 people see your building burned to the ground.
• Make sure that your inbound telephone numbers still work and are answered at a new location so your customers can reach your business. This is probably the most important issue, and we'll address it again shortly.

Lost Customer Confidence

Potential legal liability.

You may not even have considered that loss of business capabilities could put your business at risk for legal liability. What if your business is a law office or doctors' office and you can't serve your clients? What if a client is injured (financially, physically, emotionally, etc.) as a result? What if an employee is injured or killed when a disaster occurs on the job? Are you prepared for lawsuits?

Cleanup Costs

NOTE: Such efforts can be expensive. Make sure that your business insurance policies include these types of recovery expenses.

Don't forget the virtual side of your business! Computer viruses, hacking, and so on can damage your data, your web presence, and even your reputation. Your disaster plan needs to prepare for protecting and recovering your electronic information as well as restoring your physical properties. Remember that offsite backups are a crucial part of protecting your electronic info.

Build Awareness of the Need To Plan for Disaster

At a minimum, your disaster recovery plan must establish a meeting place where workers can assemble if a disaster renders your primary business location unusable. This backup location might be another branch location, a residence, a hotel--even the CEO's house. The key is determining the location in advance and then making sure that it has adequate telephone service, computer and fax equipment, and administrative support for coordination of the recovery process. This alternate location will be your emergency command center for recovery operations. The emergency plan for one of my clients, a bank, had everyone meeting in a parking lot. I can think of better locations, but at least they had defined a place. You should, too.

Prepare for Maintaining Contact with Employees and Customers

PBX Versus Centrex Phone Lines : If your business has more than a few employees, you probably have a private branch exchange (PBX) phone system, in which employees share outside lines for direct dialing and have extension numbers for internal calls. In this type of setup, the switching equipment is physically located in your building. A central office exchange service (Centrex) is a type of PBX service in which switching occurs at the local telephone company, not at your location. Because you don't have the switching equipment onsite, your company is protected against everything from power failures to total loss of a PBX. Some companies give supervisors Centrex (direct) lines and other workers PBX lines. This way, they're protected if they lose either one.

When you think about it, phone companies and providers of enhanced Internet services have already paid much of the capital-intensive part of disaster recovery. Using vendor-provided services such as the following can be a quick and inexpensive way to improve your disaster plan:

Remote Access to Call Forwarding (RACF)

• Voice over IP (VOIP)
• Wireless phone and Internet access

The following sections provide some details on these possibilities.

Consider the following true story: A medium-sized municipality in North Texas (population 7,500) added the RACF feature on their main lines. About a year later, City Hall burned to the ground. Can you imagine the number of calls that came in when people saw or heard the news? Virtually all of those calls were received seven miles away, at backup facilities in the county offices, simply by activating the RACF feature.

Just a few steps are involved:

• Call the special RACF telephone number.
• Enter your personal identification number (PIN).
• Enter the phone number from which you want to forward calls.
• Enter the *72 code.
• Enter the number where you want the calls to ring.

RACF runs about $1.50 per month per line. Where else can you get this kind of insurance so inexpensively? Get this feature installed on your phone lines today.

Voice over IP (VoIP)

TIP : If you have VoIP service, ask your service provider how quickly they can drop ship an integrated access device (IAD) to you in the event the old one is damaged or destroyed in the disaster. Better yet, keep an extra IAD at an offsite location just in case.

Many medium-sized businesses use high-capacity Internet access services such as T1 or primary rate interface (PRI) for trunk lines. VoIP-based services are available for them as well; for example, WorldCall Internet offers a platform that provides a PRI interface to your PBX, but sends the calls out over a high-speed Internet connection.

It makes for some interesting possibilities. Suppose your business is a medium-sized university, office park, hospital, or multi-tenant building, served by four PRI circuits. It might be advisable for you to cancel one of your telephone company services and replace it with a VoIP service. Use the new VoIP PRI for outgoing calls or long-distance access in "normal" times. In a disaster, however, you can transfer your inbound calls via RACF, command routing, or porting to your temporary location where a high-speed Internet connection exists. Ask potential service providers about each option and how you should prepare.

Wireless Services

Wireless phones can be indispensable as a means of command-and-control after a disaster. Be aware that there might be blockages after a widespread event such as a hurricane. But in that situation, voice mail would still work for inbound calls.

Perform Physical Security Inspections

• Are equipment closets locked and accessible only to authorized personnel? (If janitors store their equipment in the same closet with the telephone or server equipment, that's a disaster waiting to happen.)
• Does your equipment room use a backup power supply?
• Does the equipment room get too hot or cold for the equipment, especially during non-business hours? Is air conditioning or heating shut off for extended periods?
• Are combustibles--paper, cardboard boxes, flammable liquids, etc. stored safely, and away from the equipment room?
• Does your PBX have a power failure feature, so phones still work in case of a blackout?
• Is your server or PBX equipment located under or near a water source such as sprinklers or plumbing pipes?
• Are water pipes clearly labeled for shutoff in case of a leak? Are they located where they could freeze and break in cold weather? Is the number for building maintenance posted in case water has to be shut off quickly, even after hours?
• Are fire extinguishers available and properly charged? Are your personnel trained in using an extinguisher?
• Are emergency numbers posted prominently?
• Are smoke alarms present and working?
• Do waste containers have fireproof lids?

Summary: Start Planning Now

Leo A. Wrobel , has over 35 years of experience with a host of firms engaged in banking , manufacturing, telecom services and government. An active author and technical futurist, he has published 12 books and over 800 trade articles on a wide variety of technical subjects. A sought-after speaker, he has lectured throughout the United States and overseas and has appeared on several television news programs. Leo is CEO of two Dallas-based consulting practices, Tel Com Labs Inc. and b4Ci. Inc. See www.tlc-labs.com and www.b4ci.com . Leo is also President of a 25 year old Milwaukee based not for profit, the Networks and Systems Professionals Association. www.naspa.com For more information on Leo call (214) 888-1300 or email [email protected].

©Copyright - All Rights Reserved

DO NOT REPRODUCE WITHOUT WRITTEN PERMISSION BY AUTHOR.

Related articles

8/7/2006· Business Management

Dealing with Difficult People

By: Dorothy Pederson

The business of service is an interesting one to say the least. The subtle path to success lies in knowing ourselves. You might ask what I mean. What I am saying is that it is only in gaining understanding into our own feelings, reactions, and habits that we master the real art of relationship. It is always all about us

Managing Frontline Employees for Customer Success: A Toolbox of Employee Satisfaction Ideas

For decades there has been a chasm between frontline employees, typically hourly, and management. Frontline employees recognize a problem and feel powerless to "fix it." They blame management and expect them to "fix it!" They perceive that management does not listen to them. They feel discounted. So they rebel

5/18/2018· Business Management

My Life as a Microsoft Dynamics Expert Witness

By: Eric Kimberling

I have been involved with Microsoft Dynamics implementations for nearly 20 years now. I have also spent the last decade providing Microsoft Dynamics expert witness testimony in implementation failures and lawsuits.

• Expert Witnesses
• Consultants
• Press Releases
• Membership Information
• Testimonials
• Request Expert
• Our Facebook Page
• Our Twitter Page
• Partner With Us
• Terms of Use
• Privacy Statement

Suggestions

Guide To Business Resumption Plan

The business resumption plan addresses restoration of your business after an emergency. Different from the disaster recovery plan and business contingency plan, the BRP does not contain continuity procedures used during an emergency; instead it focuses on preventative measures and after the dust settles.

What is a Business Resumption Plan?

A BRP account for steps to be taken in the event of a natural or man-made disruption, which is likely to result in an interruption to the business’s normal trading activities. Key assumptions in the BRP include:

• Timely restoration of building and infrastructure access
• Restoration of IT configuration and systems.
• Restoration of utility services.

Certain people will be absent as a result of the disaster. It is unlikely that they will all be able to return on the same day of disaster strike. Therefore, the BRP looks into possible locations to house staff, ensuring employee safety and preserving critical resources.

What Should be Included?

Include a crisis communications section so that employees, supply chain members and customers are informed of the nature of the business interruption and what help to expect. The communications section will also provide details about additional crisis communication instructions.

You may need to set up a location where certain staff are displaced because of the disaster. The business continuity plan should include possible locations with contact numbers and information to connect employees to corporate networks.

More robust communications may be required if you are going to maintain customer service operations during the crisis.

If you need to move critical operations to a different location, your plan should include plans for the employees that are called on to perform those duties.

Whether you have employees in the affected location, or teleworkers who need to continue working in the disaster area, the plan should detail what equipment is required to allow them to continue their work until an office can be reoccupied, or alternate facilities have been restored.

The BRP is a significant part of disaster planning. Content should be reviewed regularly to assess the efficacy against your company’s changing risk profile.

The Business Resumption Plan is a document that details actions that are meant to restore your business after an emergency. The BRP differences from the other plans in that it does not address continuity procedures used during an emergency.

Small and midsize businesses without the high level of IT sophistication used by larger companies, rely on a business continuity plan. When a company has a business continuity plan, it is less likely to experience significant losses, in comparison to a corporation that does not have a business continuity plan.

Business Continuity Plan Basics

The business continuity plan has four primary goals:

To ensure that the activities of an organization can continue as seamlessly as possible in the times following a disruptive incident or disaster. These disruptive manifestations could be  weather related natural disasters , or they could be man-made disturbances like terrorist acts or workplace violence scenarios.

To meet and mitigate the effects of the disruptions that occur, and ensure that the organization’s business objectives are being achieved.

To ensure the safety of the staff that works for the company.

To facilitate communication between management and employees, so that the former can prepare staff for the disruptive incidents, and the latter can know their roles and responsibilities when a disruptive event occurs.

The Business Continuity Plan specifics how business operations will continue in the event of a disruption. In order to accomplish this, the business continuity plan includes different types of policies and procedures, like the following:

Individual job descriptions,

The formal description of the organization’s policies and procedures for emergency, which include the scope of the emergency.

The types of continuity plans, which are known as business recovery plans. The business recovery plans have different components that are analogous to the emergency response organizations that are available in the community.

The business continuity plan ensures that when a disruptive event occurs, the employees of an organization will be in a position to minimize the effects that the disruption will have on the organization itself. The business continuity plan is different from the disaster recovery plan, which describes how the organization will continue operation following a natural disaster or a man-made devastation that occurs to a facility or a community.

Small and mid-size businesses, with a size of less than 500 staff, may not need a business continuity plan in the same degree when compared to larger corporations, which have high levels of business computing sophistication.

When a business continuity plan is done right, there are specific things that occur, including:

The smooth continuation of the organization’s activities in the wake of a natural or man-made disaster.

Reduced employee or customer safety concerns.

The reduction of the type and scope of theft or property loss that may occur. Unless there is a structured business continuity plan in place, employees are likely to be fearful for their safety following a man-made or natural disaster. It is important that they know their role and responsibilities in the wake of an emergency situation. Staff are likely to have a sense of direction and purpose, when they know what they need to do, and they understand why the existing emergency guidelines are in place. When employees understand the business continuity plan, the company can realize decreased employee turnover and improved employee morale.

Prevention of the disruption of the business activities of the organization in the times after an emergency or disaster has occurred.

A business continuity plan can be described as a document that details the emergency response and resumption procedures that the organization’s employees will follow in times of disruption and disaster. Unlike the disaster recovery plan, which deals with the recovery of the organization following natural and man-made disasters, the business continuity plan is what management uses to assess the potential disruptions, and the potential impact that they may have on the organization.

Business Continuity Plan Purpose

The purpose of the business continuity planning is to minimize the impact that an emergency or disaster will have on an organization’s ability to deliver products and provide services. It involves looking at the different aspects of the organization, including its physical assets and its information system assets, and determining the degree of risk that they pose to the operation of the organization.

It is necessary for the company to know a variety of critical components in advance of a disruptive event, including the following:

The strategies and procedures that will be used to deliver the organization’s products and services.

The staff roles and their responsibilities, including the emergency contacts and back-up staff that will be available, and the steps that they will follow when a disruptive event occurs.

The evacuation or shelter-in-place strategies, which will be adopted if an emergency situation does occur.

The recovery site where the organization can resume its business.

The steps that will be needed to be taken, to resume communications, to rebuild the IT computer systems, and more.

Critical departments of the organization, which will need to be restored following a disruptive event.

The business continuity plan, which could be nothing more than a few pages in length, can be different for each small or mid-size business, as it is based on the magnitude of the risks that are perceived. The business continuity plan will also be specific for the different business units of larger corporations, as each unit will have a different level of importance and vital role in supporting the corporate profit and business objectives. Good business continuity planning will ensure that a company can continue to provide the services and the products that are vital to its existence.

The business continuity planning covers certain questions, including the following:

What is the likelihood of a disruptive event occurring in the area of operations of the company? What kind of disruptive events pose the greatest risk to the company? What is the continuity website of the company? What is the backup facility? What is the supply chain dependence of the company? What kinds of insurance does the company have? What is the reliability or the cause of disruption or business interruption for the company? What are the facility risks for the company?

The answers to the above questions will guide the company in conducting appropriate insurance coverage, and in developing the critical aspects of the business continuity plan, and identifying the appropriate components of the plan from among others.

Business Continuity Planning for Small Businesses

There are three critical components that need to be considered when developing a small business continuity plan:

• Allocated resources, which is the total company workforce, including everyone, including the owner(s), management, and the specialists, to run the business.
• Priority of interdepartmental dependencies, each having a high importance to the organization, including the loss of which would paralyze the organization.
• General dependencies, including the ones that do not have immediate, but are mandatory to the organization, such as the creditors, suppliers, and the customers.

Once the above information is known, it is possible to develop the business continuity plan, which will be sustainable and robust.

A business can be exposed to different kinds of natural or man-made hazards which could lead to a disruption in the normal business operations.

Hassan Ahmed

Leave a reply cancel reply.

Your email address will not be published.

Save my name, email, and website in this browser for the next time I comment.

Latest from Blog

Dedicated Teams: The Backbone of Agile Development

How to Remove Unwanted Personal Data from Online

Top 5 Bitcoin Layers Helping to Scale Bitcoin

Why Invest in an ID Card Printer?

From Green Ideals to Green Profits: How to Run a Sustainable Business

New Generation of Vapes

A Comprehensive Guide on the Power of Neurofeedback

Navigating the Executive Search Process: Tips for Hiring Senior Leaders

What is a 1031 Tax Exchange? What Investors Need to Know

How To Store THC-A Flowers For Maximum Potency This Summer?

• Topical Index

Federal Reserve System

Community Banking Connections

A supervision and regulation publication.

System Outreach

Policy and guidance.

• District Connections

Business Resumption Planning for Banks by Aaron Cohen, Technology Architect, Federal Reserve Bank of Chicago, and Anthony Toins, Examiner, Federal Reserve Bank of Chicago

Business resumption planning is a comprehensive bankwide process that defines how a bank is to respond to and recover from business disruptions, enabling a bank to continue to support constituents and stakeholders alike. The plans incorporate business processes, people, and technology.

Many community banks rely heavily on third-party service providers to deliver core banking solutions that, when key services fail, create a single point of failure for these banks. In 2012, when Superstorm Sandy disrupted payment processing and thereby affected liquidity levels, many community bankers realized the importance of having cost-effective solutions to manage single-point-of-failure situations.

Business resumption planning is not only about third-party risk but should also address everything from pandemics, like the 1918 flu pandemic, 1 to terrorist attacks, such as the September 11th attacks, to natural disasters, to nation- or state-sponsored cyberattacks 2 against financial sector institutions. The planning process should address the range of disruptions or failures that could occur and include mitigants for each type of disruption or failure.

This article discusses business resumption in the context of business continuity and disaster recovery planning. 3 The goals are to provide banks with concepts and ideas to consider when developing or strengthening their business continuity planning processes as well as to encourage a dialogue between institutions and examiners about business resumption planning based on a shared language. 4

Business Continuity Planning Process

The business continuity planning process includes developing strategies for the resumption of critical business processes and the technical recovery of critical information systems supporting those functions. A bank should approach business continuity planning as a bankwide responsibility that should prioritize business objectives. Business continuity planning should consider how essential processes, business units, departments, and information systems will contribute to a coordinated response to a bankwide disruption. The approach should include plans for both short-term and long-term disruptions and recovery operations. A tight integration of the institution’s overall planning process with that of the individual business units’ plans for resumption of essential processes is critical for business resumption and recovery. Bank senior management should set the tone at the top that business continuity is everyone’s responsibility and not just an information technology (IT) issue handled by the IT function.

Banks should consider adopting an iterative approach to business continuity planning. The four steps for an effective program are (1) business impact analysis, (2) risk assessment, (3) risk management, and (4) monitoring and testing. 5 Additionally, when key bank functions are outsourced, third-party risk should be considered during the planning process. The business continuity planning process should evolve continuously in response to changes in potential threats and business operations and to address audit recommendations and test results.

Business Impact Analysis

The first step in the business continuity planning process is the business impact analysis, which identifies mission-critical business functions and quantifies the impact a loss of those functions (for example, operational and financial) may have on the organization. 6 It also should determine how quickly essential business units and/or processes can return to full operation following a disruption, as well as identify the resouces required to resume operations. It is important that the analysis include a bankwide view, with contributions from senior management representatives from all lines of business, not just the IT function. And, finally, the business impact analysis should be approved by both the bank’s senior management and board of directors and should be updated at least annually or when there are significant changes at the bank to either business processes or the IT infrastructure.

A business impact analysis should include:

• an assessment and prioritization of all business processes;
• identification of the potential impact of business disruptions resulting from uncontrolled, unknown events on the bank’s business functions and processes;
• identification of the legal and regulatory requirements;
• an estimate of maximum allowable downtime; and
• an estimate of recovery time objectives, 7 recovery point objectives, 8 and critical path recovery (banks should document how recovery times/objectives are determined and whether they are validated by testing).

Risk Assessment

Risk assessment is the second step in the business continuity planning process. While a risk assessment determines what could cause an outage, a business impact analysis attempts to measure the effects should an outage occur. The risk assessment identifies threats, vulnerabilities, and the potential impact on a bank’s critical activities and supporting resources. Senior management should use this information to identify where risks exceed risk appetite and develop a program to reduce the likelihood and impact of disruptions.

The risk assessment should include:

• an evaluation of business impact analysis assumptions using various disruption scenarios;
• analyses of potential disruptions based on the impact to the bank, its customers, and the local economies served;
• prioritization of potential business disruptions based on severity; 9 and
• an analysis of the gap between existing business continuity planning and the policies and procedures that should be implemented..

A bank’s senior management should be responsible for maintaining a current risk assessment based on changes to the bank’s IT environment, audit findings, and business continuity/disaster recovery planning test results.

Bankwide Risk Management

Risk management is the third step in the development and maintenance of a sound business continuity planning process. Risk management in this context should be able to measure and reduce risks to an acceptable level through a well-developed business continuity planning process. This process should be based on the business impact analysis and risk assessment. While the development and maintenance of the business continuity plan may be outsourced, the ultimate responsibility for risk management resides with the bank’s board and senior management. 10 The business impact analysis and risk assessment should be an integral part of the formally documented business continuity plan. The impact analysis and risk assessment should provide the bank with sufficient information to monitor its business continuity plan and to determine when material and significant changes in internal and external conditions have occurred that necessitate revisions to the plan. The business continuity plan should focus on threats that have a relatively high likelihood of disrupting operations and should describe the various types of realistic events that could prompt the formal declaration of a disaster and the process for invoking the business continuity plan. Also, the business continuity plan should be updated by each business unit, reviewed and approved by the board and senior management at least annually, and communicated to employees for timely implementation. 11

Monitoring and Testing the Plan

Monitoring and testing make up the final step and validate that the business continuity planning process remains viable and does not overlook significant changes that may require revisions to the plan. Therefore, senior bank management should commit sufficient budget, staff, and time to a robust bankwide testing program to validate that the business resumption plans would actually work in the event of a disruption. Bank testing programs should define roles and responsibilities; outline test strategies and test plans; analyze and report testing results, including lessons learned; and lead to the development of action plans to address weaknesses identified through the testing.

Business Continuity Planning for Outsourced Technology Services Management

Banks are increasingly outsourcing critical operations to third-party service providers. However, this practice does not relieve bank management of its oversight responsibility for ensuring that outsourced activities are conducted in a safe and sound manner. An effective vendor management program should provide the framework for bank management to identify, measure, monitor, and mitigate the risks associated with outsourcing. The bank’s oversight process should provide sufficient information to monitor the performance of its third-party service providers that could negatively affect the bank’s ability to recover IT systems and return critical functions to normal operations in a timely manner. There are four key areas of business continuity planning that banks should address with respect to the resilience of technology services: 12

• Third-Party Management addresses the bank’s responsibility to control the business continuity risks associated with its technology service providers and their subcontractors.
• Third-Party Capacity addresses the potential impact of a significant disruption of a third-party servicer’s ability to restore services to multiple clients.
• Testing with Third-Party Technology Service Providers addresses the importance of validating business continuity plans with technology service providers and provides considerations for a robust third-party testing program.
• Cyber Resilience addresses aspects of business continuity planning unique to disruptions caused by cyber events. 13

Test Strategies and Approaches

After building out an effective business continuity planning program and incorporating third-party risk, a bank should test its plans at least annually. 14 However, there may be situations that require a bank to test the plans more frequently. For instance, if a bank undergoes a merger or acquisition or if there have been material changes to business processes or the IT infrastructure, the bank should consider retesting the business resumption plans to reflect the new environment.

There are four testing approaches 15 (listed in order of least to most rigorous):

• Tabletop exercise
• Walk-through drill
• Functional drill
• Full-interruption test

Preliminary Exercises. Tabletop exercises and walk-through drills should be viewed as preliminary tests to the more rigorous testing methods discussed below. In these preliminary tests, representatives from each of the bank’s functional areas meet and review the business resumption plans. In a tabletop exercise, the bank’s business line representatives review and evaluate the plans in context of objectives, scope, assumptions, and organizational structure, as well as review testing, maintenance, and training requirements. In a walk-through drill, the representatives take testing one step further and identify a specific potential disruptive event scenario. The representatives talk through the steps that would be performed as part of the restoration and recovery of the bank’s business operations. The challenge with these two methods is that they give minimal insight into how the bank would actually respond in the event of a real disruption because none of the business resumption plan components are actually engaged and evaluated for real-world effectiveness.

Real-World Testing. Functional drills and full-interruption tests involve implementing and executing the bank’s business resumption plans in a setting that closely mimics real-world disruptive events. A functional drill is a full test of the bank’s plans and generally includes running the bank’s business operations from an alternate site and the primary site concurrently and comparing the results. The end goal is to determine if the alternate site can support the bank’s business operations. By contrast, a full-interruption test shuts down the primary site’s operations and has the alternate site support the bank. The full-interruption method should be thoroughly planned before executing to ensure that business operations will not be negatively affected.

Senior bank management should ensure that the appropriate staff is assigned to participate in testing. Senior bank management should also evaluate the inherent tradeoffs between testing rigor and the level of confidence provided by the testing approaches and select a method that is most appropriate for the bank. The selected testing method should reflect the bank’s experience with business resumption for its current environment in the context of size, complexity, and nature of its business. Some banks have addressed the inherent tradeoffs in testing methods by performing an annual functional drill test and benchmarking their results against formally defined recovery time and point objectives.

Business Resumption Testing Documentation

Banks should document the following when performing any test:

• Date/time of testing
• Locations tested
• Business processes tested
• A summary comparing testing objectives with actual testing results
• Identification of material deviations from test plans, including whether or not intended participation levels were achieved
• Issues identified during testing, including remediation plans
• Evaluation by a qualified independent party not involved in the testing

For testing results to have meaning, senior bank management should review the results and provide a report on its assessment of the results to the board, audit function, functional business units, and the IT function. Consistent with conducting testing at least annually, reporting should also be performed at least annually. The reporting that is presented to the board should provide enough information to allow the board to determine if the business resumption plans meet the objectives embodied in the business impact analysis.

Change Control

When there are material changes to the environment either from a business process or technology perspective, bank examiners expect that the business resumption plans will be updated to reflect the new environment and tested to determine that the plans are still valid. Examples include regulatory changes (such as data retention requirements), mergers and acquisitions activity, changes in vendor relationships, and changes to the IT infrastructure.

Typical Business Continuity and Disaster Recovery Planning Deficiencies Noted by Examiners

Typical deficiencies noted during examinations have included the following:

• Business continuity/disaster recovery test plans and/or testing not completed or updated in a timely manner
• Business impact analyses that do not
• Identify critical business processes
• Identify supporting systems, maximum allowable downtime, recovery time objectives, or recovery point objectives
• Inadequate staff training
• Testing inadequacies
• Failure to demonstrate recovery capability
• Failure to test alternate site relocation, including connectivity tests
• Failure to test all critical systems at least annually
• Inadequate or infrequent annual reporting of test results to the bank’s board of directors, including the failure to provide timely information about
• Overall program status
• Testing and training results
• Lessons learned
• Test results against recovery time and point objectives

Business resumption concerns have the potential to go to the very heart of a community bank’s ability to serve its key stakeholders, including customers, vendors, and business partners, as well as its ability to maintain appropriate liquidity levels. Therefore, when a bank’s senior management reviews its business resumption program, bank management should make sure that there is a well-defined and comprehensive process incorporating appropriate real-world scenarios and corresponding response plans based on those scenarios. The process should transcend business resumption planning for just the IT function and embrace all lines of the bank’s business. In the final analysis, examiners need the bank to demonstrate that it has an appropriate recovery mechanism for the entire bank and has the wherewithal to maintain ongoing operations and support key stakeholders when a disruptive event occurs.

• 3 Bank senior management should not view business continuity and disaster recovery as one and the same. The goal of business continuity planning is to restore essential business processes. Disaster recovery is a subset of business continuity planning that focuses on bringing information systems back online.
• 4 While a business resumption examination is traditionally performed by information technology (IT) examiners, business resumption planning should extend beyond the bank’s IT area and include all bank functions and departments.
• 7 Recovery time objective is the amount of time it takes to recover from a disruptive event.
• 8 Recovery point objective is the acceptable amount of data loss measured in time that can be lost from a disruptive event.
• 9 Prioritization should reflect a continuum of disruptions. For example, if a rural bank is located near a railroad track, the bank should perform a risk assessment that would include a train derailment and chemical spill representing a low-probability/high-impact disruption in contrast to a temporary weather-related power outage representing a high-probability/low-impact disruption.
• 10 Note that some aspects of development and maintenance could be outsourced, such as IT and documentation generation and updating; however, the bank is better positioned to address other aspects, such as succession planning and the identification of critical personnel.
• 11 Note that this may indicate that a bank and not the servicer should perform the development and maintenance function.
• 15 These test methods are also commonly referred to as “structured walk-through test,” “simulation test,” “parallel test,” and “full-scale test,” respectively.

In This Issue

• Asset Concentrations Present Deep Tradeoffs for Community Banks and Bank Supervisors
• Development and Maintenance of an Effective Loan Policy: Part 3
• Agencies Issue Final Rule for New Flood Insurance Requirements

The Federal Reserve System provides various resources for training, services, and more.

Connect to various Federal Reserve resources, including SR and CA Letters, regulations, request for comment on rulemaking proposals, the latest Federal Reserve System speeches, and more.

Community Banking Connections is a quarterly Federal Reserve System publication available electronically or in print .

We want to hear from you! Please share with us any comments, suggestions, or topics that you would like to see on our website or in our publications.

• Privacy Policy

What is Business Continuity Planning

Since the horrific events of September 11, the federal government has been catalyzed into moving forward expeditiously in formation of business continuity plans (BCP) and associated risk management. What exactly is BCP and its associated risk management and what benefit does it have for the company, business partners, and employees?

All businesses, regardless of the industry they are in, should understand the value and necessity of sustaining the continuity of the business and/or sustaining or recovering functions and processes that provide assured reliability and availability of assets (i.e., asset management).

What Is Business Continuity Planning?

BCP/contingency management is a process that reduces the likelihood of a service interruption and provides documentation for the recovery of services that support critical customer business functions. The primary objective of any business resumption plan is to enable an organization to survive a disaster and to reestablish normal business operations.

Business continuity — emphasis on "continuity" — is the ability of a business to continue operations in the face of a disaster condition. This means a business with a viable business continuity plan will be better able to continue doing what it did before a disaster event while assets damaged by the disaster event are recovered — until "business as usual" is resumed.

• A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats.
• A risk assessment involves evaluating existing physical and environmental security and controls and assessing their adequacy relative to the potential threats to the organization.
• A business impact analysis involves identifying the critical business functions within the organization and determining the impact of not performing the business function beyond the maximum acceptable outage. Types of criteria that can be used to evaluate the impact include customer service, internal operations, legal/statutory, and financial.
• Identifying critical business functions
• Identifying risks to critical functions
• Identifying ways to avoid or mitigate the risks
• Having a plan to continue business in the event of a disaster condition
• Having a plan to quickly restore operations to "business as usual"

Disaster recovery is an integral part of business continuity. Business continuity does not replace insurance. It is a form of insurance, and should include insurance for life, health, facilities, product, and business interruption.

Normally, personnel are assigned to recovery teams that are responsible for accomplishing defined objectives and actions. While the BCP provides a roadmap for recovery from significant service interruptions, occurrences of a less severe nature are controlled at appropriate management levels as part of normal operating procedures. Regardless of the type of threat, the goals of business continuity planning are to ensure the safety of customers and employees during and following a disaster.

Types of Contingency Plans

Contingency planning represents a broad scope of activities designed to sustain and recover critical business processes following an emergency. IT contingency planning fits into this much broader emergency preparedness environment that includes organizational and business process continuity and recovery planning. Ultimately, an organization would use a suite of plans to properly prepare response, recovery, and continuity activities for disruptions affecting the organization's business processes, systems, and facilities. The BCP serves as the umbrella under which all other contingency plans are couched. Because there is an inherent relationship between a system and the business process it supports, there should be coordination between or among the various plans during development and updates to ensure that recovery strategies and supporting resources neither negate each other nor duplicate efforts.

In general, universally accepted definitions for contingency planning and these related planning areas do not exist. Occasionally, this has led to confusion regarding the actual scope and purpose of various types of plans. To provide a common basis of understanding regarding contingency planning, this section identifies several types of plans and describes their purpose and scope relative to the umbrella BCP. Because of the lack of standard definitions for these types of plans, in some cases, the scope of actual plans developed by organizations may vary from the descriptions below.

Business Continuity Plan (BCP). The BCP serves as the umbrella plan and focuses on sustaining an organization's business functions and business processes during and after a disruption. An example of a business function may be an organization's payroll process or consumer information process. A BCP may be written for a specific business process or may address all essential business processes. The various systems are considered in the BCP only in terms of their support to the larger business processes. In some cases, the BCP may not address long-term recovery of processes and return to normal operations, solely covering interim business continuity requirements.

Business Recovery Plan (BRP — also called Business Resumption Plan). The BRP addresses the restoration of business processes after an emergency. The BRP is couched in the BCP, but unlike that plan, the BRP typically lacks procedures to ensure continuity of critical processes throughout an emergency or disruption.

Continuity of Operations Plan (COOP). The COOP focuses on restoring an organization's (most often a headquarter's element) essential functions at an alternate site and performing those functions for up to 30 days before returning to normal operations. Standard elements of a COOP include delegation of authority statements, orders of succession, and vital records and databases. Because the COOP emphasizes the recovery of an organization's operational capability at an alternate site, the plan does not necessarily include IT operations. In addition, minor disruptions that do not require relocation to an alternate site are typically not addressed. FEMA is the proponent agency governing COOP activities.

Continuity of Support Plan. This requires the development and maintenance of continuity of support plans for major applications or general support systems and contingency plans for major applications.

Disaster Recovery Plan (DRP). As suggested by its name, the DRP applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. Frequently, DRP refers to an IT-focused plan designed to restore operability of the target system, application, or computer facility at an alternate site after an emergency. The DRP scope may overlap that of an IT contingency plan; however, the DRP is narrower in scope and does not address minor disruptions that do not require relocation.

Incident Response Plan (IRP). The IRP establishes procedures to address cyber attacks against an organization's IT system(s). These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denial of service, or unauthorized changes to system hardware or software (e.g., malicious logic such as a virus, worm, or Trojan horse).

Occupant Emergency Plan (OEP). The OEP provides the response procedures for occupants of a facility in the event of a situation posing a potential threat to the health and safety of personnel, the environment, or property. Such events would include a fire, hurricane, criminal attack, or a medical emergency. OEPs are developed at each facility level, specific to the geographic location and structural design of the building. (General Services Administration [GSA] owned facilities maintain plans based on the GSA OEP template.)

Bringing it All Together

The paramount priority for any business is the safety of people first and then the thorough analysis of business functions and the potential and probable threats (or impacts). The organization must develop mitigation strategies to sustain critical business functions and to effectively and efficiently recover impacted "critical" business functions. Organizations, both in the public and private sector, must also recognize business process automation. Information technology enablers have been developed to "automate" previously manual processes.

When looking at company operations, the critical business processes should be the initial focus. After identifying the critical business processes, the next step would be to identify how automation supports those processes. For those functions that have been automated (business process automation), it will be critical to involve the IT department in addition to the functional departments within the company, not only in supporting the identification analysis of risks, threats, and impacts, but also in potential restoration methods and procedures.

The initial step in a risk analysis is conducting a business impact analysis (BIA). The product of a comprehensive BIA will be the identification of critical functions, risks/threats, potential impacts associated with the risk, probability of occurrence, and then mitigation strategies for any residual risk that may exist. The development of any type of continuance or recovery plans takes time, comprehensive involvement, leadership, and motivation. In the end, your company, channel partners/business partners, and company employees will benefit by having developed a comprehensive program.

One last item: organizations must invest in training core personnel who will lead and manage your continuity efforts. These people must be supported by the executives and should be charged with educating your company and business partners.

• Sustainability
• Executive Education
• Join the Cutter Community
• Subscribe to our Newsletters
• All Experts
• Leadership Experts
• Sustainability Experts
• Technology Experts
• Industry Experts
• Corporate Overview
• Testimonials
• Privacy Policy & Terms of Use
• Write for Cutter

Business Resumption Planning (BRP)

2. An all-encompassing "umbrella" term covering both disaster recovery planning and business resumption planning. 1) Process of developing advance arrangements and procedures that enable an organization to respond to an event that lasts for an unacceptable period of time. The process typically addresses all activities from the event to performing its critical business functions after an interruption and may include steps indicating how to return home. 2) Frequently used to refer to a business department recovery rather than technology elements.

( Source: Disaster Recovery Institute International / Disaster Recovery Journal - DRII/DRJ)

• BCM Institute Glossary
• BCM Institute Crisis Communication Glossary
• BCM Institute Crisis Management Glossary
• BCM Institute DR Glossary
• BcmBoK 5 CL 2B
• BcmBoK 5 CL 2C
• BcmBoK 5 CL 2CC
• BcmBoK 5 CL 2D

Navigation menu

Personal tools.

• Request account
• View source
• View history
• About BCM Institute
• Business Continuity
• Crisis Management
• Crisis Communication
• Disaster Recovery
• Supply Chain BCM
• Cyber Security
• Operational Resilience
• Pandemic Flu
• Competency Level
• OR Competency Level

Chinese Glossary (S)

Bahasa glossary (m).

• Examination
• Certification
• Recertification
• Meet-the-Experts
• World Continuity Congress
• BCM Institute Website
• Specialist Series
• Dictionary Series

Acknowledgment

• Contributors

ISO Glossary

Bcm glossary.

• Request Changes
• What links here
• Related changes
• Special pages
• Printable version
• Permanent link
• Page information
• This page was last edited on 28 October 2020, at 07:20.
• Privacy policy
• About BCMpedia. A Wiki Glossary for Business Continuity Management (BCM) and Disaster Recovery (DR).
• Disclaimers

Business Continuity Management Policy

• Issued On 11/16/2022
• Download PDF

Resiliency and effective response to events that may impact the University’s ability to achieve our business objectives is critical to the organization. These objectives include safeguarding human and capital assets, cash flow, brand reputation, and the best interests of the community and our stakeholders.  The preparedness for, response to, and recovery from such events significantly influences the confidence and trust of board members, patients, students, and the community.

The objective of a business continuity management program is to develop and implement plans that ensure expeditious response, continuity, and recovery of critical business functions or services during and after an incident. An incident is defined as an occurrence or event, natural or human-caused that requires the activation of business continuity plans to protect life or property, continue critical services, or resume normal activities.

Business continuity is a critical component of the University’s risk management portfolio. It includes four disciplines.  Each has a specific area of focus, but many times overlap and have interrelated activities and dependencies.

• Emergency preparedness planning: the planning for, and response to localized emergencies.
• Crisis management: the coordination of resources to mitigate the impact of significant emergencies or crises.
• IT disaster recovery: the recovery of electronic systems or data.
• Business resumption: the processes implemented to maintain or restore the organization to its pre-incident state.

Business continuity plans shall be developed and documented for the critical business functions identified in the business impact analysis conducted throughout the University.

Table of Contents

Business Continuity Requirements

• The Business Continuity Management Program (BCMP) is responsible for the systematic and consistent assessment of the state of business resiliency planning across the University, and for regularly reporting the status of same to senior management.
• Departments will identify and analyze the risks to their critical processes and locations. Documented response and recovery plans are required for all critical functions, IT systems, and locations delivering processes where an interruption to the normal delivery would have a significant impact on the university.
• Departments are responsible for developing, testing, and approving their continuity plans.
• Emergency preparedness plans must provide for timely and coordinated management of an incident to expedite resumption of normal services and minimize impact.
• Business resumption plans must have content explaining how to deliver critical processes or outputs in the event of significant interruptions including staff absences, IT System interruptions, inability to access normal facilities or an interruption to services and resources provided by internal and external suppliers and/or partners. These plans must be actionable, should be tested annually, and must be approved by appropriate management. Plans must be updated to comprehend organizational and process changes as they occur.
• Disaster recovery plans must provide for information technology resources to be available within the defined timeframes determined by the business.
• Division functional groups (Environmental, Health, and Safety; Human Resources; Information Technology; Facilities, etc.) will be engaged by the business units to effect appropriate coordination related to emergency preparedness planning, crisis management, IT disaster recovery, and business resumption plans.

Business Continuity Responsibilities

Business continuity program.

• Maintain business resumption planning tools, reporting systems, and processes necessary to comply with the Business Continuity Management policy.
• Engage and train business continuity focal points in the disciplines of business continuity.
• Assist with post Incident assessments, when necessary, in conjunction with the business units and information security management.
• Promote the integration of business continuity efforts across the University.
• Facilitate communication among members of the business continuity community through the governance and steering committees.
• Reporting on the overall status of business resumption planning to senior management as required.

Governance Committee

• Facilitate identification of department’s critical processes and/or locations.
• Support and/or participate in management reviews to communicate business continuity status and action plans.
• Serve as a liaison between the BCMP and departments.
• Assist BCMP with ensuring response/recovery/resumption plans are developed.
• Provide advice regarding significant changes to policies and disseminate those changes.

Department Management

• Assign business continuity planning responsibilities to employee(s) within their departments who will be identified as the business continuity management liaisons.
• Champion the identification of critical business processes and locations within their departments.
• Accountable for the department’s compliance with this policy.

Business Continuity Management Liaisons

• Life safety/patient health
• Financial (loss of revenue)
• Brand/organizational reputation
• Compliance/regulatory
• Loss of productivity
• Employee morale and retention
• Document and update departmental continuity plans.
• Address the risks and potential impacts of a disruption.
• Include response and/or recovery strategies.
• Define roles and responsibilities of key personnel that need to be involved in the response to a disruption.
• Include strategies to effectively communicate steps to notify, respond, and recover.
• Provide that they are to be tested on an annual basis with realistic scenarios to test the plan and team’s response to identify gaps and take corrective actions to improve the plan.
• Manage all business continuity plans in the approved content management system.
• Follow directives provided in applicable continuity plans. This may include responsibilities such as keeping their contact information up-to-date with department supervisors and, if provided in the departmental plan, taking home a University-assigned laptop at the end of each working day to enable remote work in the event the employee’s University office becomes inaccessible due to an emergency.

Appendix 1: Definitions

Business Continuity: An ongoing process to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery strategies, recovery plans, and continuity of services.

Business Continuity Planning: Processes and procedures that enable the University to respond to an event so that critical business functions continue with acceptable levels of performance.

Business Continuity Management Program (BCMP) : A program that manages the Business Continuity governance process by providing a policy, consultation, training, tools, and status reporting to the BCM governance committee.

Business Impact Analysis: Process that identifies, quantifies, and qualifies the impacts resulting from interruptions or disruptions of an entity’s resources.

Emergency Preparedness Planning (EPP): The discipline that ensures the University’s readiness to respond to an unexpected or unwanted event of a safety, health, or environmental nature that calls for immediate action at a specific location. These plans also include the coordination of resources to mitigate the impact of significant emergencies or crises. Each location is required to have access to the Emergency Preparedness Plan.

Business Resumption Plan (BRP): Documented processes and procedures, and recovery strategies developed to protect and restore critical business operations in the event of an interruption. The primary objective is to minimize the negative effects of a disruption, and restore the business processes and related sub-processes to normal operations.

IT Disaster Recovery (DR):   The activities and plans are designed to both restore the University’s information and communication systems to an acceptable condition; and, to minimize loss of data in the event of a major interruption in services.

Appendix 2: Contact Information

Please address any questions or concerns with any policies set forth within this document to the University of Rochester Business Continuity Program Office ( [email protected] )

How one millennial quit a corporate job, became self-employed, and set himself up financially to start a small business

• In 2017, Paul Millerd left his high-paying consulting job to work for himself.
• He set himself up financially by saving a 12-month cash runway and negotiating a gradual transition.
• This article is part of " Unlocking Small Business Success ," a series providing micro businesses with a road map to growth.

In 2017, Paul Millerd walked away from a six-figure consulting salary.

The decision also meant paying back his full $24,000 sign-on bonus to his previous employer, he said.

"It wasn't this cliché of, 'I'm going to boldly quit my job and run into the sunset and bet on myself,'" the 39-year-old solopreneur and author of " The Pathless Path " told Business Insider. "It was more of an exasperated only-option-left mindset. I wasn't loving my job. I was working with a boss that I wasn't getting along with."

Since graduating from college, Millerd had worked for five companies, convinced every move was "the final stop" but finding himself right where he found himself in 2017: burned out and looking for a different consulting gig.

It was time to try something new, but he wasn't sure what. He shared the steps he took that set him up to leave corporate America and exchange a comfortable paycheck for the unknown.

1. He had a 12-month cash runway

Millerd had about $50,000 in savings after paying back his bonus. It was enough to sustain him for roughly a year, according to back-of-the-envelope math.

He wouldn't necessarily have felt comfortable quitting without the cash cushion. "As soon as I calculated I could live a minimal life on 50 grand a year, I was out of there," he said, adding that he didn't always have savings. Business school "wiped out" what little he'd saved early on in his career and left him with about $70,000 in student-loan debt.

"As soon as that savings account built up, I became a little bolder in terms of taking risks," he said. "It was like, this is some potential freedom to try different things."

2. He negotiated a gradual transition with his company

Millerd didn't give two weeks' notice or leave immediately.

"I negotiated to stay on and train some people," he said. "I really had no plan, so I needed at least a couple of months."

If anything, he stayed "a month or a month and a half too long," he added, but it gave him time to prepare for his next chapter and think about what freelancing would look like.

"I set up my LLC," he said. "I started networking . I reached out to some small consulting firms to see if they needed contractors. I reached out to friends in business school. I built a website. I did some writing."

The networking paid off: It was at a business-school reunion that he landed his first freelance gig after reconnecting with one of his former professors who was looking for consulting work.

3. He lowered his expenses and funded a cheaper life through freelance projects

After leaving his firm in May 2017, the "first phase" of working for himself, as Millerd described it, was: "Get paid; lower costs."

He became a more conscious spender, he said: "A lot of people start with, 'Here's what I make; here's what I budget and spend.' I flipped this equation in my head. For me, it was, 'Everything I spend, I need to earn 30% more than that because of taxes.' So if I'm going to go out for ramen and it costs $20 in New York, that's going to cost me $26. I need to earn the $26."

It helped that he temporarily moved to Boston for his first freelance gig in late 2017. He sublet his New York City apartment, moved in with roommates in Boston, and "really simplified my life," he said, adding that he cut his cost of living from about $6,500 a month to $3,500 a month.

An early money mindset he adopted was "buying time" by living on as little as possible, Millerd, who moved to Taiwan in 2019 and decreased his expenses even more, said. The less he spent, the longer his runway would last.

"If you're spending $1,000 a month, you can buy six months for $6,000," he said. "That was the mode I was in from years two to three."

Lowering costs takes some of the earning pressure off, but it helps to have income coming in even if you have a cash runway.

"I think the smoothest transitions are what I did: Go from full-time work to freelance work, which is essentially doing full-time work, but you're just doing it in a more flexible contract way," said Millerd, who encourages aspiring entrepreneurs to start asking their employers about flexible, part-time work. "Go to your company and say, 'I don't want to quit. Would you be open to a pitch of me turning this into a four-day-a-week job? Could I do three days a week? Here's what I want to do. Here's how much I charge for this.'"

If your manager doesn't want to lose you, they may be more open than you think to part-time work, he said.

4. He had a 'break the glass' plan

In a worst-case scenario, if he drained his savings and couldn't land any freelance gigs, Millerd always knew he could find a way to make money.

Since leaving corporate America in 2017, his revenue streams have included freelance consulting, coaching , online course sales, book sales, and affiliate marketing.

If he never figured out how to make money working for himself , "there was always the sense that I had the capability of breaking glass in case of emergency," he said, adding: "I'm creative enough to figure out how to make money. I can go work at a restaurant. I'll take any job if I need to. Especially now with a kid, I don't have an ego when it comes to taking care of my family."

• Main content

Education Secretary Cardona touts new student debt relief plan

Baltimore bridge collapse highlights risks Latino labor force faces

First woman, Latina CEO leads Elmhurst Hospital in Queens

‘I need you badly,’ Biden tells Latino voters

Cuban President Miguel Díaz-Canel addresses protests over shortages

Ricky Martin opens up about new role on ‘Palm Royale’

Inflation on the menu: San Francisco's $22 burrito

Man opens workshop in Cuba making trailers from scrap metal

Puerto Rican students use TikTok to highlight poor conditions in schools

Mother put in ICE detention after ending up on Interpol's red notice list

Thousands rally in Mexico to 'protect democracy' ahead of election

Rare look inside El Salvador's mega prison

Latino voters in Nevada struggle to choose a presidential candidate

Growing pushback in Mexico after ban against bullfighting is lifted

Protesters angered at resumption of bullfighting in Mexico City

Coveted Latino voters get familiar ally in fight against disinformation

Deadly roof collapse at Mexican church leaves dozens killed or injured

Behind the racial disparities in New York City's public schools

Virginia home to the largest Bolivian population in the U.S.

Family of Latino man fatally struck after encounter with deputies speak out

Education Secretary Miguel Cardona lauded a newly proposed student debt relief plan that could benefit more than 30 million people. Cardona told NBC Latino that the Biden Administration wants to provide as much “debt relief to as many people as possible.” April 8, 2024

Best of NBC News

NBC News NOW

March inflation report shows costs rose 0.4% on a monthly basis.

Iran's supreme leader pledges punishment for Israel over killings in Syria

Surveillance video shows a woman attacked and robbed outside a New York City church

Early TODAY

Biden says netanyahu is making a 'mistake' with his handling of the war with hamas.

WrestleMania XL becomes most successful event in WWE history

Prosecutors say Alec Baldwin had 'no control' of emotions on 'Rust' set