State of Queensland, 2013. The Queensland Government supports and encourages the dissemination and exchange of its information.

The cop right in this pu!lication is licensed under a "reative "ommons #ttri!ution 3.0 #ustralia $"" %&' licence.

(nder this licence ou are free, )ithout having to see* our permission, to use this pu!lication in accordance )ith the licence terms.

Business Continuity Plan Template

&ou must *eep intact the cop right notice and attri!ute the State of Queensland as the source of the pu!lication. +ote, Some content in this pu!lication ma have different licence terms as indicated. -or more information on this licence, visit http,..creativecommons.org.licenses.! .3.0.au.deed.en

Contents
INTRODUCTION..................................................................................................3 /eveloping a %usiness "ontinuit 0lan..............................................................3 1ncorporates the 0revention element that identifies and manages the li*elihood and.or effects of ris* associated )ith an incident.................................................3 1ncorporates the 0reparedness element that identifies and prioritises the *e activities of a !usiness that ma !e adversel affected ! an disruptions.........3 1ncorporates the 2esponse element and outlines immediate actions ta*en to respond to an incident in terms of containment, control and minimising impacts. ..............................................................................................................................3 1ncorporates the 2ecover element that outlines actions ta*en to recover from an incident in order to minimise disruption and recover times...........................3 BUSINESS CONTINUITY PLAN..........................................................................6 /istri!ution 4ist.................................................................................................5 2eferences and related documents.................................................................5 SECTION 1...........................................................................................................8 6xecutive Summar $optional'.........................................................................7 8!9ectives.........................................................................................................7 Glossar ............................................................................................................7 SECTION 2.........................................................................................................10 2is* :anagement 0lanning..............................................................................10 1nsurance........................................................................................................12 /ata securit and !ac*up strateg .................................................................12 SECTION 3.........................................................................................................13 %usiness 1mpact #nal sis.................................................................................13 %usiness 1mpact #nal sis...............................................................................1; SECTION 4.........................................................................................................17 1ncident 2esponse 0lan....................................................................................15 1mmediate 2esponse "hec*list......................................................................15 6vacuation 0rocedures..................................................................................17

Page 1

6mergenc *it.................................................................................................17 2oles and 2esponsi!ilities............................................................................20 <e "ontact Sheet..........................................................................................21 6vent 4og........................................................................................................22 SECTION 5.........................................................................................................23 2ecover ..........................................................................................................23 2ecover 0lan................................................................................................23 1ncident 2ecover "hec*list...........................................................................2= 2ecover contacts..........................................................................................2; 1nsurance claims.............................................................................................25 :ar*et assessment........................................................................................25 SECTION 6.........................................................................................................28 2ehearse, :aintain and 2evie).......................................................................27 Training schedule...........................................................................................27 2evie) schedule.............................................................................................27

Page 2

Introduction
The purpose of developing a %usiness "ontinuit 0lan is to ensure the continuation of our !usiness during and follo)ing an critical incident that results in disruption to our normal operational capa!ilit . This guide )ill assist ou to underta*e a 2is* :anagement 0lan and %usiness 1mpact #nal sis, and create 1ncident 2esponse and 2ecover 0lans for our !usiness.

Developing a Business Continuity Plan

This template incorporates the 0revention, 0reparedness, 2esponse and 2ecover $0022' frame)or*. 6ach of the four *e elements is represented ! a part in the %usiness "ontinuit 0lanning 0rocess.

Page 3

0revention > 2is* :anagement planning - 1ncorporates the 0revention element that identifies and manages the li*elihood and.or effects of ris* associated )ith an incident. 0reparedness > %usiness 1mpact #nal sis - 1ncorporates the 0reparedness element that identifies and prioritises the *e activities of a !usiness that ma !e adversel affected ! an disruptions. 2esponse ? 1ncident 2esponse planning - 1ncorporates the 2esponse element and outlines immediate actions ta*en to respond to an incident in terms of containment, control and minimising impacts. 2ecover > 2ecover planning

- 1ncorporates the 2ecover element that outlines actions ta*en to recover from an incident in order to minimise disruption and recover times. @e have also included a section titled 2ehearse, :aintain and 2evie), )hich encourages ou to test, regularl revie) and update our %usiness "ontinuit 0lan to ensure that our staff are familiar )ith it, and that it reflects our changing !usiness needs. %usiness operators should use the follo)ing template as a guide to developing a %usiness "ontinuit 0lan. "ustomise it to suit our !usiness needs. The blue sample text is there to guide ou and can !e deleted after ou have completed the template. 2emem!er to save our document.

Page 4

Page 5

1nsert &our %usiness +ame

Business Continuity Plan

Page 6

/ate, A____________________________________________

Distribution List
To assist in updating and revising the plan, an up-to-date list of all plan locations and persons supplied with a copy of the plan should be included.
Copy Num !" N#m! Lo$#%&o'

001 002 003 003 00= 00;

References and related documents

nclude all documents that have a bearing on your Business Continuity Plan.
Do$um!'% T&%(!

Page 7

Section 1
Executive Summary optional!
!n executive summary is the plan in miniature "usually one page or shorter#. t should contain enough information for a reader to get ac$uainted with the plan without reading the full document. %epending on the si&e of your business and the length of your document, you may choose not to include an executive summary.

"b#ectives
'b(ectives serve as a means of clarifying the purpose of your plan and should describe the intended result. !n example of plan ob(ectives are listed below) The ob(ectives of this plan are to) underta*e ris* management assessment define and prioritise your critical business functions detail your immediate response to a critical incident detail strategies and actions to be ta*en to enable you to stay in business review and update this plan on a regular basis.

$lossary
This table provides a consistent and commonly agreed set of definitions for terms used in the plan. +ou should customise this list to suit your business.
Business Continuity Planning Business Continuity Plan Business mpact !nalysis -ey business activities .ecovery Time 'b(ective ".T'# a process that helps develop a plan document to manage the ris*s to a business, ensuring that it can operate to the extent re$uired in the event of a crisis,disaster. a document containing all of the information re$uired to ensure that your business is able to resume critical business activities should a crisis,disaster occur. the process of gathering information to determine basic recovery re$uirements for your *ey business activities in the event of a crisis,disaster. those activities essential to deliver outputs and achievement of business ob(ectives. the time from which you declare a crisis,disaster to the time that the critical business functions must be fully operational in order to avoid serious financial loss.

Page 8

.esources

the means that support delivery of an identifiable output and,or result. .esources may be money, physical assets, or most importantly, people. is the process of defining and analysing ris*s, and then deciding on the appropriate course of action in order to minimise these ris*s, whilst still achieving business goals.

.is* /anagement

Page 9

Section % Ris& 'anagement Planning

+ou need to manage the risks to your business by identifying and analysing the things that may have an adverse effect on your business and choosing the best method of dealing with each of these identified ris*s. The $uestions to as* yourself are) 0hat could cause an impact1 2ow serious would that impact be1 0hat is the li*elihood of this occurring1 Can it be reduced or eliminated1

!n example is provided in the following table for you.

Page 10

Ris& 'anagement Plan

0repared ! .,BBBBBBBBBBBBBBBBBBBBB/ate, BBBBBBBBBBB 2evie)ed ! , BBBBBBBBBBBBBBBBBBBB.. /ate, BBBBBBBBBBB <e )* * . L , + + + + )!"y *&,*&,.!/&um Lo0
L&2!(&-oo/ P"&o"&%y Imp#$%

R&12 D!1$"&p%&o'3

P"!4!'%#%&4! A$%&o'

Co'%&',!'$y P(#'1

nterruption to production processes -brea*down of *ey plant and e$uipment -damage to plant and e$uipment "e.g. fire# Burglary

42

ensure ade$uate insurance cover in place including business interruption and general property set up agreement with suitable supplier for 56 hour repairs and replacement for *ey plant and e$uipment source alternative production site "if location and e$uipment have been damaged# ensure ade$uate insurance cover in place including business interruption and general property including theft install alarm and video surveillance camera

immediate access to personal resources whilst waiting for insurance payments

*eep a list of sources for replacement property,e$uipment .

Page 11

Insurance
!s part of your ris* management plan you need to determine what types of insurance are available and put in place the insurance your business needs.
I'1u"#'$! %yp! Po(&$y $o4!"#,! Po(&$y !5$(u1&o'1
terrorism

I'1u"#'$! $omp#'y #'/ $o'%#$%

7+8 nsurance, ! Ph) 9: ;999 9999 Person

L#1% "!4&!0 /#%!

P#ym!'%1 /u!

Business nterruption

Business interruption due to) fire flood theft

99,99,99

tsunami landslide

!mount you pay and fre$uency. e.g. /onthly, yearly

Data security and bac&up strategy

2ow have you protected your data and your network "e.g. virus protection, secure networ*s and firewalls, secure passwords and data bac*up procedures#1 %etail your bac*up procedures in the table below.
D#%# 6o" #$2up 7"!8u!'$y o6 #$2up B#$2up m!/&#9 1!"4&$! P!"1o' "!1po'1& (! B#$2up p"o$!/u"! 1%!p1

Customer database

0ee*ly

<xternal hard drive

! Person

.emove external drive from fire safe Copy data from Customer database .eturn external drive to fire safe

Page 12

Section (
Business Impact )nalysis
!s part of the Business Continuity Plan business owners should underta*e a Business Impact Analysis which will use the information in your .is* /anagement Plan to assess the identified ris*s and impacts in relation to critical activities of your business and determine basic recovery re$uirements. Critical activities may be defined as primary business functions that must continue in order to support your business. +ou need to identify) your critical business activities what the impact to your business would be in the event of a disruption how long could your business survive without performing this activity.

!s part of your Business mpact !nalysis you should assign .ecovery Time 'b(ectives ".T'# to each function. The .T' is the time from which you declare a crisis,disaster to the time that the critical business function must be fully operational in order to avoid serious financial loss. The following $uestions may assist you to determine your critical activities.

Page 13

1. 1n the follo)ing ta!le, list the !usiness activities that must !e performed to ensure our !usiness continues to operate effectivel . 1f ou have a num!er of !usiness units.departments, complete one ta!le for each. 1 2 3 3 Production services

2. -or each !usiness activit listed a!ove, complete the follo)ing, %usiness #ctivit +ame, Production =ervices %usiness #ctivit /escription, Production of customised widgets for individual customer orders. a' @hat are the losses if this !usiness activit could not !e providedC 4oss of 2evenue, D:,>99 per wee* 1ncreased "osts, D?,! Staffing, Production staff numbers will need to be reduced. 0roduct.service, ?umber of widgets available for sale will be reduced until production resumes. -ines or penalties due to missed deadlines, ?,! 4egal lia!ilit , personal damage, pu!lic harm, ?,# 4oss of good )ill, pu!lic image, 0ill occur if unable to meet current client orders. "omments, Current stoc*s will meet demands for up to 5 wee*s. !' -or )hat maximum amount of time could this !usiness activit !e unavaila!le $either 100E or partial' !efore the losses )ould occurC AAAAAAAAAAAAAAAAAAAAAAA hrs AAAAAAAAAAAAAAAAAAAAAAAda s 2 )ee*s

AAAAAAAAAAAAAAAAAAAAAAAmonths "omments, f stoc* is not produced for more than 5 wee*s the business will lose sales and customers will source alternative widget manufacturer.
Page 14

c' /oes this activit depend on an outside services or products for its successful completionC

NO

YES 1f

es, chec* one of the follo)ing,

Sole Supplier

:a9or Supplier :an #lternate Suppliers

"omments, f production is lost, standing order with the supplier will need to be ad(usted to prevent build-up of excess widget material. d' 8n a scale of 1 to = $1 !eing the :ost 1mportant, = !eing the 4east 1mportant', )here )ould this !usiness activit fall in terms of !eing important to the operation of our department or !usinessC

>1

>2

>3

>3

>=

"omments, 0idgets production is the primary activity of the business.

"ompleted % , AAAAAAAAAAAAAAAAAAAAAAAAAA

/ate, AAAAAAAAAAAAAA

Page 15

Business Impact )nalysis

C"&%&$#( Bu1&'!11 A$%&4&%y D!1$"&p%&o' P"&o"&%y Imp#$% o6 (o11 "describe losses in terms of financial, staffing, loss of reputation etc# Production of customised widgets for individual customer orders. 2igh
reduced @:,>99 revenue per wee* build up of stoc* and inventory related to slow down in orders for design and production services customers will source alternate suppliers unable to meet business overheads eg rent, staff wages potential (ob losses "after 5 wee*s#.

RTO "critical period before business losses occur#

5 wee*s

Production services

Page 16

Section *
Incident Response Plan
This is to prepare you for a timely response to critical incidents and reduce the impact of those incidents on your previously identified business operations. t also prepares *ey personnel to provide an effective response to ensure minimal disruption to operations in the event of emergency. The following provides an example of the type of information, including chec*lists, you might include when planning your response to a critical incident. These together would form your Incident Response Plan.

Immediate Response C+ec&list

INCIDENT RESPONSE Fave ou, assessed the severit of the incidentC evacuated the site if necessar C accounted for ever oneC identified an in9uries to personsC contacted 6mergenc ServicesC implemented our 1ncident 2esponse 0lanC started an 6vent 4ogC activated staff mem!ers and resourcesC appointed a spo*espersonC gained more information as a priorit C !riefed team mem!ers on incidentC allocated specific roles and responsi!ilitiesC identified an damageC identified critical activities that have !een disruptedC *ept staff informedC contacted *e sta*eholdersC

ACTIONS TA:EN

Page 17

 understood and complied )ith an regulator .compliance reGuirementsC initiated media.pu!lic relations responseC

Evacuation Procedures
+ou need to have appropriate evacuation procedures that cater for both staff and visitors. These procedures should be stored in a place accessible to all staff. The ob(ective of an evacuation plan is to provide a set of procedures to be used by site occupants in the event of a critical incident. +ou should) start with a floor plan of the site clearly identify the location of emergency exits develop strategies for providing assistance to persons with disabilities ma*e sure that everyone *nows what to do if evacuation is necessary select and indicate a meeting place "evacuation point# away from the site test the plan on a regular basis.

Emergency &it
f there is damage to the building or if it must be evacuated and operations need to be moved to an alternative location, the emergency *it can be pic*ed-up and $uic*ly and easily carried off-site or alternatively stored safely and securely off-site. %ocument within your plan what is contained within your emergency *it and when it was last chec*ed. tems that you may wish to include are) Do$um!'%13 %usiness "ontinuit 0lan ? our plan to recover our !usiness or organisation in the event of a critical incident. 4ist of emplo ees )ith contact details ? include home and mo!ile num!ers, and even e>mail addresses. &ou ma also )ish to include next>of>*in contact details. 4ists of customer and supplier details.
Page 18

"ontact details for emergenc services. "ontact details for utilit companies. %uilding site plan $this could help in a salvage effort', including location of gas, electricit and )ater shut off points.

6vacuation plan. 4atest stoc* and eGuipment inventor . 1nsurance compan details. -inancial and !an*ing information. 6ngineering plans and dra)ings. 0roduct lists and specifications. -ormulas and trade secrets. 4ocal authorit contact details. Feaded stationer and compan seals and documents.

E8u&pm!'%3 "omputer !ac*>up tapes.dis*s.(S% memor stic*s or flash drives. Spare *e s.securit codes. Torch and spare !atteries. FaHard and cordon tape. :essage pads and flip chart. :ar*er pens $for temporar signs'. General stationer $pens, paper, etc'. :o!ile telephone )ith credit availa!le, plus charger. /ust and toxic fume mas*s. /isposa!le camera $useful for recording evidence in an insurance claim'.

?otes) /a*e sure this pac* is stored safely and securely on-site and offsite "in another location#. <nsure items in the pac* are chec*ed regularly, *ept up-to-date, and in good wor*ing order. .emember that cash,credit cards may be needed for emergency expenditure. This list is not exhaustive, and you should customise it to suit your business.

Page 19

Roles and Responsibilities

This table allows you to assign responsibility for completion of each tas* to one of your designated roles. +ou will then assign each role, or multiple roles, to one or more staff members and assign bac*-up staff as appropriate. The staff members involved should then be given this table in order to understand their roles and as a tas* assignment list for completion of preemergency planning and emergency tas*s. +ou should customise this table to suit your businessAs needs and structure.
ROLE DESIGNATED EMPLOYEES ALTERNATE

Team 3eader

+ame, Bill =mith "ontact 1nformation, 9699 999 999

+ame, Bohn Bones "ontact 1nformation, 9699 99C 99C

<mergency .esponsibilities) ensure the Business Continuity Plan has been activated ROLE oversee smooth implementation of the response and recovery section of the plan determine the need for and activate the use of an alternate operation site and other continuity tas*s communicate with *ey sta*eholders as needed provide important information to the Communication 'fficer for distribution *eep *ey staff apprised of any changes to situation. DESIGNATED EMPLOYEES ALTERNATE

Title

+ame, "ontact 1nformation,

+ame, "ontact 1nformation,

ROLE

DESIGNATED EMPLOYEES

ALTERNATE

Title

+ame, "ontact 1nformation,

+ame, "ontact 1nformation,

Page 20

,ey Contact S+eet

Contact List Internal Dse this table to document your staff emergency contact details. <ach business will have different positions identified in its contact list.
Person Contact number/s Email Responsibilities

- Bill =mith - Bohn Bones

9699 999 999 9699 99C 99C

Bill.=mithEwidgets.net.au Bohn.BonesEwidgets.net.au

BC Team 3eader !lternate BC Team 3eader

Contact List !"ternal Dse this table to document external services "including <mergency =ervices# contact details. <ach business will have different external suppliers and sta*eholders.
e! contacts
Police <mergency =ervices !mbulance /edical =ecurity nsurance company =uppliers 0ater and =ewerage Fas <lectricity Telephone

Contact number/s

Page 21

Event Log
Dse the <vent 3og to record information, decision and actions in the period immediately following the critical event or incident.
D#%! T&m! I'6o"m#%&o' 9 D!$&1&o'1 9 A$%&o'1 I'&%&#(1

9,9,9

9G99 hrs

!ctivate Business Continuity Plan.

T3

Page 22

Section Recovery
Recovery is the return to your pre-emergency condition. Performing your critical activities as soon as possible after a critical incident is your primary focus. +ou should complete this table with the intention of supporting recovery in Hworst caseA scenarios. t can then be modified according to the degree of loss to your business. The recovery process includes) developing strategies to recover your business activities in the $uic*est possible time identifying resources re$uired to recover your operations documenting your previously identified .T'As listing the person,s who have responsibility for each tas* and the expected completion date.

!n example is provided for you in the table following.

Page 23

Recovery Plan
C"&%&$#( Bu1&'!11 A$%&4&%&!1 Production =ervices - halted P"!4!'%#%&4!9R!$o4!"y A$%&o'1 R!1ou"$! R!8u&"!m!'%19 Ou%$om!1 put aside cash reserves to cover costs reduce costs where able research new products and services identify alternative production site. R!$o4!"y T&m! O ;!$%&4! 5 wee*s R!1po'1& &(&%y Comp(!%!/

re-assess financial position of business including cash flows due to loss of revenue to meet minimal overheads minimise overheads I review expenses and develop plan of action to reduce fixed and variable overheads include reduction of casual and permanent staff hours negotiate with suppliers to prevent build-up of materials and reduce costs source alternative production site diversify product range and services offered e.g. repairs and restoration.

Business owner, operator

9,9,9

Page 24

Incident Recovery C+ec&list

+ou will need to customise this list to include information specific to your business.
INCIDENT RESPONSE +o) that the crisis is over have ou, refocused efforts to)ards recover C deactivated staff mem!ers and resources as necessar C continued to gather information a!out the situation as if effects ouC assessed our current financial positionC revie)ed cash reGuirements to restore operationsC contacted our insurance !ro*er.compan C developed financial goals and timeframes for recover C *ept staff informedC *ept *e sta*eholders informedC identified information reGuirements and sourced the informationC set priorities and recover optionsC updated the 2ecover 0lanC captured lessons learnt from our individual, team and !usiness recover C

ACTIONS

Page 25

Recovery contacts
nclude all of the organisations,people that will be essential to the recovery of your business.
Co'%#$% Typ! I'1u"#'$! T!(!p-o'!9&'%!"'!% 1!"4&$!1 p"o4&/!" B#'29 u&(/&', 1o$&!%y Supp(&!" <.#&'= Supp(&!" <B#$2up= A$$ou'%#'% L#0y!" DEEDI R!,&o'#( D!4!(opm!'% O66&$!" O",#'&1#%&o' N#m!
7+8 nsurance

Co'%#$%
% =mith

T&%(!
Claims !dvisor

P-o'!9.o &(! 'um !"

9699 999 999

Page 26

Insurance claims
0hat insurance policies have you claimed for1
I'1u"#'$! $omp#'y D#%!
99,99,99

D!%#&(1 o6 $(#&m

7o((o0>up #$%&o'1

!BC nsurance

<nter details of claim and contact person.

!ctions re$uired by the insurer to process claim, eg photos, damage estimates

'ar&et assessment
3ist any areas of you mar*et that have changed due to the incident.
.#"2!% $-#',!1 Imp#$% %o u1&'!11 Bu1&'!11 op%&o'1

0hat has changed in the mar*et1

0hat impact will the mar*et changes have on your business1

2ow can your business adapt to suit these new mar*et conditions1

Page 27

Section .
Re+earse/ 'aintain and Revie0
t is critical that you rehearse your plan to ensure that it remains relevant and useful. This may be done as part of a training exercise and is a *ey factor in the successful implementation of the plan during an emergency. +ou must also ensure that you regularly review and update your plan to maintain accuracy and reflect any changes inside or outside the business. The following points may help) ! training schedule must be prepared for all people who may be involved in an emergency at the site. Pay attention to staff changes. t is best to use staff titles rather than names. f you change your organisational structure or suppliers,contractors this must be amended in your plan. !fter an event it is important to review the performance of the plan, highlighting what was handled well and what could be improved upon next time.

1raining sc+edule
.ecord details of your training schedule in the table below)
T"#&'&', D#%!
9,9,9

T"#&'&', %yp!
<vacuation drill

Comm!'%1
!ll personnel evacuated and accounted for within acceptable timeframe.

Revie0 sc+edule
.ecord details of your review schedule in the table below)
R!4&!0 /#%!
9,9,9

R!#1o' 6o" "!4&!0

?ew personnel in new roles

C-#',!1 m#/!
Plan updated to reflect changes to roles and responsibilities

Page 28