Airport Business Continuity Handbook First Edition 2019

Combatting Human Trafficking Handbook: 1st edition 2019
ACI advances the collective interests of, and acts as the voice of, the
world’s airports and the communities they serve, and promotes professional
excellence in airport management and operations.
DISCLAIMER
No subscriber or other reader should act on the basis of any information

contained in this publication without referring to applicable laws and
regulations and/or without obtaining appropriate professional advice.
Although every effort has been made to ensure accuracy, Airports
Council International (ACI) shall not be held responsible for loss or
damage caused by errors, omissions, misprints or misinterpretation of
the contents hereof, including for contributions provided by third parties.
Furthermore, ACI expressly disclaims all and any liability to any person,
whether a purchaser of this publication or not, in respect of anything
done or omitted, and the consequences of anything done or omitted,
by any such person through reliance on the contents of this publication.
No part of this publication may be reproduced, recast, translated,

reformatted or transmitted in any form by any means, electronic or
mechanical, including photocopying, recording or use of any information
storage and retrieval system, without prior written permission from ACI.
Airport Business Continuity Management Handbook

First Edition (2019)
Copies of this publication are available from:
Publications Department
ACI World
800 rue de Square Victoria
Suite 1810, P.O. Box 302
Montreal, Quebec H4Z 1G8
Canada
Email: aci@aci.aero
Web: www.aci.aero/publications
ISBN: 978-1-927907-72-6
©2019 Airports Council International. All rights reserved.
ACI World | Airport Business Continuity Management Handbook | 2019 3

FOREWORD
The idea of a guidance handbook on business

continuity management emerged in discussions
in the ACI World Facilitation and Services
Standing Committee following the 2010 volcano
eruptions in Iceland that caused enormous
disruptions to air travel across western and
northern Europe. Members of a task force under
the committee developed a table of contents
and wrote and sourced material, including best
practices from both inside and outside of the
aviation industry.
This handbook has been written and thoroughly

reviewed by a range of experts. We believe it
is a useful summary of the actions that airport
operators should undertake to create a robust
business continuity management plan in order
to mitigate against, prepare for, respond to and
recover from potential events that may disrupt
normal business operations. This can never be
an “off-the-shelf” exercise, but must be fully
tailored to the circumstances of events and the
individual airport.
We sincerely hope that this handbook will

help our members to produce better and more
appropriate plans that take account of a wide
range of possible events and enable the airport
operator to prepare and cope with a crisis, and
return to normal operations as soon as possible,
making full use of business continuity planning.
I commend the handbook to you and thank its

authors for their time and effort.
Angela Gittens
Director General
ACI World
4 ACI World | Airport Business Continuity Management Handbook | 2019

ACKNOWLEDGEMENTS
ACI World would like to thank the following contributors and

authors who have worked on this handbook:
• ACI World Facilitation

and Services Standing Committee (WFSSC)
With special thanks to Seoul Incheon International

Airport, Hong Kong International Airport, Hamad
International Airport, Bangalore International Airport,
Aéroports de Montréal and Houston Airport System for
the contribution of many examples and materials.
• ACI World Business Continuity Task Force, including:
• InterVISTAS Consulting Inc

• Barich, Inc
• Las Vegas McCarran Airport
• Lisbon Airport
• Perth Airport
• ACI World Environment Standing Committee
• ACI World Safety and Technical Team
• ACI EUROPE Aviation Security Team
• Lam Lha USA

TABLE OF CONTENTS
EXECUTIVE SUMMARY 10
INTRODUCTION 11
1.1 Statement of Purpose 12
1.2 Target Audience 13
1.3 Research and Publications 13
2. BUSINESS CONTINUITY
MANAGEMENT PLANNING PROCESS 16
2.1 Setting the Scene – the Airport Context 16
2.2 Risk Assessments 18
2.3 Determining Impacts and Uncovering Vulnerabilities

to Airport Operations 23
2.3.1 Conducting a Business Impact Analysis (BIA) 23
2.3.2 Performing a Vulnerability Assessment 23
2.3.3 Identifying Business-Critical Processes

Required to Maintain Air Service Operations 24
2.3.4 Mapping the Business Processes

and Identifying Single Points of Failure 25
2.3.5 Identifying the Criticality of Each of your Processes

Against a Recovery Time Objective (RTO) 25
2.4 Developing Response and Recovery Strategies 27
2.4.1 Assigning Roles and Responsibilities 27
2.4.2 Degraded Level of Services (LoS) 27
2.4.3 Quick Reference Handbooks 28
2.4.4 Incident Response Plan 28
2.5 Testing, Evaluating and Updating the BCM Plan 29

3. BUSINESS CONTINUITY MANAGEMENT
POLICY AND GOVERNANCE SYSTEM 30
3.1 Overview of the ISO 22301: 2012 Standard 30
3.2 Business Continuity Management Life Cycle 32
3.3 Business Continuity Management Team 34
4. INCIDENT MANAGEMENT 36
4.1 Incident Management System 36
4.2 Operations Control Centre (OCC) 36
4.3 Public Communication 37
4.4 Post-Incident Debrief 38
5. CREATING AN AIRPORT ORGANIZATIONAL CULTURE

THAT VALUES BUSINESS CONTINUITY MANAGEMENT 38
1. Business Continuity Management Organizational

Culture and the Glasgow Airport Attack 40
2. BCM and Hong Kong International Airport

Typhoon Preparedness 41
6. CASE STUDIES AND LESSONS LEARNED 42
Case Study 1: Hong Kong International Airport (HKIA)

– rapid response and recovery from adverse weather 42
Case Study 2: Houston Airports (HOU) – lessons learned

and key take-aways from Hurricane Harvey (August 2017) 44
Case Study 3: Incheon International Airport (ICN)

– contingency measures to cope with snowstorm
and baggage-handling-system delays 46
Case Study 4: Princess Juliana International Airport,

Saint Martin/Sint Maarten (SXM) – 2017 Hurricane
Irma destruction 49
APPENDIX A: Resources 50

APPENDIX B: Abbreviations and Glossary 51
Abbreviations 51
Glossary 52
APPENDIX C: Checklist for Physical Sortation Failures

in the Baggage Handling System 53
APPENDIX D: Bangalore Airport BCM Template 59
APPENDIX E: Example of a Business Continuity

Management Template 72
APPENDIX F: Example of a High-Level Business Continuity Plan 88
LIST OF TABLES
TABLE 1: List of Potential Threats and Hazards

that May Affect Airport Operations 20
TABLE 2: Function Criticality and Recovery Time Objective 25
TABLE 3: List of Airport Business-Critical Processes 26
TABLE 4: Incheon International Airport Levels of Malfunction

Severity and Remedial Actions 48
TABLE 5: Princess Juliana International Airport – Post-Hurricane

Recovery Timeline 49
LIST OF FIGURES
FIGURE 1: SWOT Matrix 18
FIGURE 2: PESTEL Analysis 19
FIGURE 3: Risk Matrix 19
FIGURE 4: Business Continuity Management

Improvement Framework 31
FIGURE 5: Four Phases of the Incident Life Cycle 32
FIGURE 6: Key Steps for Developing and Implementing a BCM Plan 33
ACI World | Airport Business Continuity Management Handbook | 2019
8
EXECUTIVE SUMMARY
Airport business continuity strategies help • Section 3 details the establishment of the
ensure that airports can maintain the flow international standard for business continu-
of passengers and goods in the event of an ity management, introduces the incident
emergency or other disruption. Effective business life cycle and outlines the necessary steps
continuity strategies will safeguard passengers to develop and implement business conti-
and the airport community, enable the delivery nuity management.
of services to customers, sustain commercial
revenue streams and protect infrastructure. The • Section 4 addresses incident manage-
potential for events to disrupt normal business ment, including an overview of the incident
operations at airports creates the need for robust management system, communication
business continuity management plans that help with airport stakeholders and post-incident
operators mitigate against, prepare for, respond debriefing procedures.
to and recover from such events.
• Section 5 describes how to cultivate
The Airport Business Continuity Management an airport culture that values business
Handbook provides general guidelines that continuity management planning.
airport authorities can refer to as they engage in
business continuity management. The handbook • Section 6 includes several case studies
is structured as follows: and best practices that highlight significant
themes and results applicable to business
• Section 1 defines the purpose and the tar- continuity management practices. These
get audience of the handbook, and includes cases studies are mostly related to weather
a brief review of the existing literature on phenomena that could occur more often
business continuity management. This and impact airports in the future due to
sample of publications offers useful con- climate change.
text that business continuity practitioners
in the aviation industry can use as they • The Appendices offer readers further useful
develop policies and plans for sustain- resources, including a list of abbreviations,
ing operations under adverse conditions. a glossary of terminology, applicable tem-
plates and checklists for business continuity
• Section 2 describes the business continuity management practitioners.
planning process. This entails risk analysis
or an identification of threats, vulnerabili-
ties and consequences. Risk analysis helps
reveal how airport assets are impacted as a
result of business disruption and provides
the basis for developing recovery and/or
threat mitigation strategies for the business
continuity management plan.

1. INTRODUCTION
Business continuity management (BCM) significant impact on local, national and global
focusses on building and improving organiza- economies. As they are connected to the local
tional resilience and the capability to recover community they serve, airports are critical for
quickly and effectively from any type of dis- access to the region, especially when emergency
ruption, whatever its size or cause. It involves responses are needed. These considerations,
identifying and safeguarding key products and while likely to vary from airport to airport, will
services, and the most urgent activities that help define “business-critical activities”, the
underpin their production and delivery. bedrock of business continuity.
However, business continuity management is Organizations that embrace BCM will have a
much more than simply developing mitigation solid framework in place to manage unforeseen
plans for unplanned incidents. It must incorporate events and return to normal operations quickly
a holistic programme of strategies that becomes and efficiently.
part of an organization’s culture and is actively
supported by senior management. Importantly,
BCM must be framed as an improvement of
organizational resilience and part of “business as
usual” rather than a stand-alone activity utilized
only for rare incidents. Globally, not a single risk
“Business continuity
is eliminated from the registry, but new ones
keep on adding to the existing numbers. A
management (BCM)
holistic and concerted approach to reducing the
risk or its ultimate impact on people and assets
focusses on building
is the only solution.
and improving orga-
Variations in size and operational model can
make BCM difficult to define for airports. nizational resilience
When thinking about the need for BCM in
the airport context, many specialists focus on and the capability to
the response to low-probability, high-impact
events, such as aircraft crashes, terrorist attacks recover quickly and
and major fires—all of which will require an
initial emergency response. The danger of this
approach is that it may distract or deter airports
effectively from any
from developing and maintaining a more
comprehensive BCM programme.
type of disruption,
The complex nature of the aviation industry adds
whatever its size
another layer of difficulty to defining business
continuity management in an airport context. or cause.”
Some airports are state-owned while others are
privatized. Furthermore, there is an increasing
amount of non-aviation-related activities at
airports. Airports are also the nexus for a wide-
ranging network of commercial activity with

1.1 STATEMENT OF PURPOSE
This handbook is based on a review of existing The plan should:

literature to provide the most current theoretical
frameworks and evidence-based practice • Reflect an understanding of the
guidelines for BCM and resiliency planning. The business – identify the assets, including
information presented within this document is people and processes, critical to
intended to equip airport authorities (operators delivering products and/or services.
and/or owners), regulatory authorities, airlines
and/or third-party service providers with enough • Detail responses – including the initial
knowledge of BCM in the airport environment response to an incident and the longer-
to support the development of functional term implementation of measures for a
plans, the evolution of effective policies and return to “business as usual”.
the cultivation of a robust governance system.
Specific operational guidance is not included in • Consider continuity preparations – how
this document because plans should be adapted to make the organization more resilient
to localized contexts. while BCM is being developed.
A business continuity management plan is an • Provide an exercise framework – how

essential part of any organizational response the business will test, review, adjust and
plan. It lays out how the business will operate update its BCM.
following an incident and how it will return to
“business as usual” as quickly as possible. Also,
it should not be hazard-specific. Rather, the plan
should reflect an all-hazards approach that can be
applied to any type of disruption. The plan should
outline the procedures, personnel and resources
necessary to maintain critical business functions
during an incident. The document should avoid
vague internal references and abbreviations,
and be structured in a way that is easy for users
across the organization to comprehend.

1.2 TARGET AUDIENCE
The handbook principally targets airport that could accompany pandemics or other global
authorities (owners and/or operators), regulatory health-related emergencies.
authorities, airlines and/or third-party service
providers directly involved in day-to-day ACI recommends that airports establish one
activities at airports. The assumptions and business continuity management system to
recommendations of the handbook are designed cover the full range of operational safety risks.
to apply to airports worldwide, no matter their ACI’s approach to this project is to define a
size and complexity. framework and development process that builds
on best practice examples from airports that
have mature systems in place.
1.3 RESEARCH AND PUBLICATIONS
Available from the ACI World Airport Facilitation
documentation page: https://aci.aero/about-
The body of research and publications on the aci/priorities/facilitation/documentation
topic of BCM at airports is extensive. Research
projects have analyzed contingency planning
for disruptive events, guidance on developing Emergency Preparedness and Contingency
tailored emergency plans and procedures, and Planning Handbook, ACI World Safety
recommendations for achieving operational and Technical Standing Committee (First
resilience. Edition, 2014)
The following is a selection of industry A useful summary of actions that airport

publications that provides useful context. operators should take to develop an emergency
Furthermore, additional resources are provided plan. Each plan must be fully tailored to the
in Appendix A. circumstances of the individual airport and
should never be an “off-the-shelf” exercise.
The handbook helps airports to produce better
Best Practice Paper: Business Continuity emergency plans that take into account a wide
Management Framework and Case Studies range of possible events. A well-formulated plan
for Health-Related Disruptions at Airports, will enable the airport operator to cope with a
ACI World Facilitation and Services Standing crisis and return to normal operations as soon as
Committee (2012) possible, making full use of business continuity
management planning.
In response to the severe acute respiratory
syndrome (SARS) and avian influenza outbreaks Available from the ACI World publications store:
in 2003–2005, the industry established https://aci.aero/publications
contingency measures for public health events
of international concern. Aviation stakeholders
instituted several measures, including arrival Landside Security Handbook, ACI World Secu-
and departure screening processes, health rity Standing Committee (First Edition, 2018)
declaration forms and contingency plans for
inbound aircraft with suspected cases on board. The handbook is intended to help airport
However, aviation industry partners have not operators ensure that all aspects of landside
achieved the same level of preparedness for security, including prevention, deterrence and
protracted disruptions to civil-aviation operations incident management, have been considered

in their procedures. It updates and brings Available from: https://publicapps.caa.co.uk/
together the best elements of managing docs/33/CAP1244_Passenger_welfare_
security from the current experience of airports guidance_for_UK_airports.pdf
around the world.
Available from the ACI World publications store: Managing Airport Disruption: Achieving
https://aci.aero/publications Resilience through Collaboration, Booz &
Company Inc (2013)
Policy Brief: Airports' Resilience and A review of resilience capabilities and

Adaptation to a Changing Climate, ACI World practices at nearly 30 of the world’s leading
Environment Standing Committee (First airports provides valuable insight into how
Edition, 2018) best practices are defined and achieved. The
resilient airports proactively work to address
The policy brief helps airport operators to better the most manageable factors, including: (1)
understand the risks related to more adverse implementing a clearly defined command and
weather events, and to conduct risk assessments control architecture; (2) conducting collaborative
to define adaption plans for existing and new planning with stakeholders; (3) ensuring
infrastructure and operations. This brief helps coordinated management of passenger welfare;
airport management teams to learn from their and (4) identifying, safeguarding and/or creating
peers as it includes case studies of best practice redundancies for operation-critical equipment
adopted at airports in Norway, Australia, Hong and resources. Ten specific recommendations
Kong, Istanbul, Amsterdam and Singapore. are provided to achieve or enhance operational
As climate-related events will become more resilience. Airports are encouraged to prioritize
common as a consequence of climate change, their most critical areas for improvement as
it also provides recommendations, an extensive part of a coherent strategy with all the airport
overview of potential climate stressors and their stakeholders.
related possible impacts on infrastructure and
operations. Available from: https://www.strategyand.
pwc.com/media/uploads/Strategyand_Man-
Available from the ACI World publications store: aging-Airport-Disruption.pdf
https://aci.aero/publications
Airport Cooperative Research Program

Passenger Welfare at Times of Major (ACRP) Report 65 - Guidebook for Airport
Disruption - Guidance for UK Airports (CAP Irregular Operations (IROPS) Contingency
1244), UK Civil Aviation Authority (2014) Planning (2012)
In response to the issues and challenges of The report is intended to aid airport operators
air transport disruptions, the UK Civil Aviation of all sizes in developing, continually evaluating
Authority (CAA) and the Airport Operators and updating their contingency plans for IROPS
Association (AOA) developed a set of key procedures that may cause significant disruptions
principles and recommended practices to for customers. Aviation system partners can
help airports verify that appropriate disruption use the guide to improve customer care during
management procedures and plans are in place. a broad array of IROPS conditions. Step-by-
By properly preparing for incidents that could step contingency plan templates that include
interrupt operations, airports can increase the necessary communications, collaboration and
likelihood that passengers receive the outcomes coordination preparation are also provided.
they expect when travelling by air.

Available from: http://www.trb.org/Publica-
tions/Blurbs/166569.aspx Guidance on Part 1 of the UK Civil Contin-
gencies Act of 2004
Airport Cooperative Research Program Part 1 of the Civil Contingencies Act 2004
(ACRP) Report 93 - Operational and Business establishes a consistent level of civil protec-
Continuity Planning for Prolonged Airport tion activity across the United Kingdom. The act
Disruptions (2013) defines what basic tasks should be performed
and how cooperation should be conducted.
The report is intended to help airport operators Together with emergency response and recov-
plan and prepare for disruptive or catastrophic ery guidance, it establishes a generic framework
incidents. These incidents can cause prolonged for civil protection. The scope of the framework
airport closures, resulting in adverse impacts includes anticipation, assessment, prevention
on airports and local, regional and national and preparation for emergencies. Local respond-
economies. The report includes a guidebook ers may follow this common framework but
and software tool designed to provide operators should adjust their planning arrangements to
of all sizes and types of airports with concise local circumstances and priorities.
guidelines for planning, preparing, assessing
and recovering from catastrophic incidents. A Available from: https://www.gov.uk/govern-
broad range of factors such as infrastructure, ment/publications/emergency-preparedness
management, business and operational
sustainability, and continuity are considered.
Industry best practices are identified and a
critical path framework is introduced to help
identify immediate and long-term needs. As a
result, recovery priorities can be established in
advance of a catastrophic incident.
Available from: http://www.trb.org/Publica-

tions/Blurbs/169246.aspx

2. BUSINESS CONTINUITY 2.1 SETTING THE SCENE
MANAGEMENT PLANNING PROCESS – THE AIRPORT CONTEXT
Airports often differ in complexity and have

The business continuity management (BCM) unique features. Some are small relatively
planning process is used to identify potential uncomplicated facilities, while others are large
risks facing an organization; determine how communities with industrial and commercial
those risks will impact business operations; operations serving major metropolitan areas.
implement controls and measures designed Additionally, airports may be operated by a state
to mitigate those risks; and monitor, test and government, a local government (such as a city
evaluate the strategic plan to keep it current. or county jurisdiction) or a private operator.
Incidents, including emergencies and other
The ACI Policy Handbook references the impor- operational disruptions, present vulnerabilities
tance of business continuity in the context of for all airports irrespective of their differences.
service quality to generate value for airport oper-
ators and customers. The handbook states that Operational disruptions can:
airports “should… develop airport BCM plans
which are comprehensive and coordinated with • arise anywhere and at any time;
all parties”. 1 First, states should include airports • vary in degrees of magnitude;
in their respective business continuity planning • develop under any weather conditions;
efforts given their role in moving people and the • occur instantaneously or develop gradually;
economy. Second, airports should develop a • last only a few minutes or continue for days,
BCM plan that effectively integrates with state weeks or even months;
plans, first responders and service providers. • be natural, such as a hurricane, an earthquake
The handbook advises airports to subject plans or a snowstorm;
to testing, conduct exercises with all relevant • be “human induced”, either accidentally or
stakeholders and train staff to fully understand intentionally, such as an aircraft accident, a
business continuity procedures. hazardous materials spill, terrorism, major
fire or power outage.
Emergencies such as acts of terrorism or natural

disasters (e.g. tornados, earthquakes, floods,
hurricanes, typhoons, etc.) carry a risk of high
impact, but other incidents (eg disruptions to
jet-fuel-supply chains or wildlife interference)
could also have a major impact on airport
operations. It is important not only to identify
incidents that could shut down an airport but
also circumstances that could severely reduce
the throughput level of passengers and aircraft
operations.
ACI Policy Handbook, 9th Edition, January 2018, Article 3.1 – Quality service
1

Courtesy of Incheon International Airport

2.2 RISK ASSESSMENTS
Risk is a calculation based on threat levels, It is recommended that airports integrate the
vulnerability and consequences – i.e. the risk assessment within other elements of the
probability of occurrence multiplied by the airport’s overall corporate risk assessment
potential magnitude of loss. For an airport, risk is plans, including security and safety, financial and
the loss or disruption of business caused by not reputational risks among others. This provides
addressing vulnerabilities2. executives with a holistic view and provides
support for risk management initiatives.
Airports need to plan to mitigate and manage

RISK = all potentially disruptive events, not just
those related to security. Horizon-scanning
THREAT × VULNERABILITY × CONSEQUENCE frameworks may be helpful, such as the SWOT
(Strengths, Weaknesses, Opportunities, Threats)
analysis and PESTEL (Political, Economic, Social,
Technological, Environmental, Legal) analysis.
These are valuable tools that may be used to
identify, analyze and monitor relevant macro-
environmental factors that have an impact on
organizational operations, as well as on the
airport’s overall competitive environment.
Opportunities Threats
(external, positive) (external, negative)
Strength-Opportunity strategies Strength-Threats strategies

Strengths Which of the company's strengths How can you use the company's
(internal, positive) can be used to maximize the strengths to minimize the threats
opportunities you identified? you identified?
Weakness-Opportunity strategies Weakness-Threats strategies

Weaknesses What action(s) can you take How can you minimize the
(internal, negative) to minimize the company's company's weaknesses to avoid
weaknesses using the opportunities the threats you identified?
you identified?
Figure 1: SWOT Matrix. Source: https://articles.bplans.com/how-to-perform-swot-analysis
See the ACI Landside Security Handbook for further examples of threat and risk assessment methodology.
2

Figure 2: PESTEL Analysis
Understanding the types of external influences

High impact
may help airport operators to prioritize potential

threats based on impact and probability. This can Have a
be accomplished by creating a risk matrix with Continuity Avoid
impact on the y-axis and probability on the x-axis, Plan
as shown in Figure 3.
Businesses tend to:

Low impact
• accept low-impact, low-probability events; Accept Reduce

• reduce low-impact, high-probability events;
• avoid high-impact, high-probability events;
• create a continuity plan for events that
appear in the high-impact, low-probability
box, as these are the unforeseen events that Improbable Very probable
have serious consequences3.
Figure 3: Risk Matrix
Sadgrove, K. (2015), The Complete Guide to Business Risk Management, New York: Routledge.
3

Scenario-planning can take this categorization Table 1 presents a sample of plausible threats
of threats a step further. To create a scenario- and hazards that may affect airport operations. It
planning framework, business continuity is worth noting that many of the hazards listed
planners must narrow their scope to two as threats could be caused by a weather event,
impactful uncertainties. The selected pair is e.g. high winds affecting ability to land, weather
then used to produce stories or plausible future events causing airfield lighting failure, or extreme
realities that can help businesses understand weather causing supply-chain shortages (de-
the implications of potential future conditions, icing fluid, airline fuel, transportation services).
develop appropriate responses and maintain
organizational longevity. These actions can form
the foundation for BCM focussed on preparing
the business for the future.
Table 1: List of Potential Threats and Hazards that May Affect Airport Operations
# Threat Description
• Hurricane/typhoon
• Tornado
• Flood/sea-level rise
• Snow/blizzard
Severe weather event • Sand/dust storm
• Thunderstorms/lightning
• Wild/forest fires
• Smog/low visibility
• Drought/extreme heat
Natural • Earthquake
1
disaster • Tsunami
Geological event • Volcanic eruption
• Lava flow
• Ash fall/cloud
• Rock fall/slide
Landslide • Debris flow
• Mud flow
Avalanche
Hazardous
material escape • Spill of hazardous material
Industrial accident Chemical, biological • Failure of containment
2
or disaster or nuclear incident
Fire or explosion

Perimeter intrusion
Terrorist activity
Local criminal activity
Bomb threat
Suspicious activity/bag • Drones
Landside attack
Chemical/biological attack
Unlawful
Event/incident near
interference or
3 airport impacting
high-security
operations
event
• Olympics
Disorderly group during
• World Cup
major event
• Super Bowl
Visiting dignitaries • Air Force One/Presidential visit
• Public Health Event of International Concern

Public health scare /
covered by WHO International Health
communicable disease
Regulations
outbreak
• Not covered by IHRs
Health-related
4
incident
• Suicide/attempted suicide
• Heart attack/stroke
Personal accident • Mental health concern
• Fall from height
• Crowd disorder
• Wildlife on runways/taxiways
• Associated effects:
Aircraft incident or
• Runway closure or restricted operation
accident
with a disabled aircraft
Aircraft • Damage to runways/taxiways
5
event
FOD (foreign object

• Ground debris
damage)

• Information displays (FIDS/GIDS/BIDS)
• Common Use Passenger Processing System
• Video-management system
• Data network
• Radio communication
Major system/ • Baggage system
equipment failure • Automated people movers
• Fire system monitoring or suppression
• Airfield lighting or Navaids
Airport technical
6 • Snow-removal equipment
issue
• Parking system
• Access-control system
Utility outage • Electricity, water, sewage, drainage
Loss of water to
• Concessions, restrooms
the terminal
Political protest
Social/legal
Social media scare
7 issue/civil
Strike outside the airport
unrest
Data privacy issue
• Critical stakeholder agency

Strike/work stoppage
• Service provider
related to the airport
• Transportation service
Airport
8 stakeholder
issue Supply chain failure • De-icing chemicals, airline fuel
Bankruptcy
• System failure
Technical issue
• Network failure
Airline
9
issue Labour issue/strike/
work stoppage
Bankruptcy
• Unintentional error (by staff)

Intentional or unintentional
• Criminal activity
hack into systems
• Terrorist act
Cybersecurity • SCADA (Supervisory control and data

10 acquisition) – Control systems
issue
• Information displays (FIDS/GIDS/BIDS)
System failure • Common Use Passenger Processing System
• Video management system
• Data network
• Radio communication

2.3 DETERMINING IMPACTS AND assessment plan, a loss-impact analysis should
UNCOVERING VULNERABILITIES be conducted that defines loss criteria as either
TO AIRPORT OPERATIONS quantitative (financial) or qualitative (operational).
The steps needed to perform a vulnerability
assessment include the following:
2.3.1 CONDUCTING A BUSINESS
IMPACT ANALYSIS (BIA) a. Take an inventory of all organizational
assets and activities.
A BCM plan should include a business impact
analysis (BIA) which predicts the conse- b. Identify vulnerabilities or weaknesses that
quences of disruption to a business function. would make the assets susceptible to loss
A BIA considers the impact and duration of (e.g. no data backup plan when physical
disruptions, and provides the basis for devel- assets are damaged leads to vulnerability).
opment of an investment in recovery and/or
threat-mitigation strategies. • Consider existing defence/deterrence
control measures.
A BIA should, at a minimum, include the • Assets/activities that may also
following steps: increase target attractiveness to
malicious actors.
• Interview those with detailed knowledge
of systems and services to reveal potential c. Define the ratings for impact of loss
impacts on functions or processes if there (varies from airport to airport).
is an interruption.
• Identify critical business processes • Degree to which services are
and required resources. impaired (e.g. devastating, severe,
• Develop priorities and noticeable, negligible).
recovery-time objectives.
• Document potential impacts resulting
from disruption.
2.3.2 PERFORMING A
VULNERABILITY ASSESSMENT
After threats are identified, a vulnerability

assessment will uncover major weak points of
the airport susceptible to damage or disruption
from an incident. A vulnerability assessment
looks at the relationship between assets (e.g.
people, property, operations, environment,
infrastructure) and determines to what extent
an asset may be exposed to a potential threat.
An understanding of vulnerabilities will assist
with developing strategies that reduce risk
from future events. The goal of a vulnerability
assessment is primarily to determine the
potential impact of disruptive incidents on airport
business processes. As part of a corporate risk-

Once this process is completed, the report 2.3.3 IDENTIFYING BUSINESS
should identify: -CRITICAL PROCESSES REQUIRED TO
MAINTAIN AIR SERVICE OPERATIONS
• critical departments and processes;
• significant interdependencies; Key airport operations include passenger
• a summary of the vulnerability assessment; and luggage screening, aircraft fuelling and
• recommended recovery priorities. air traffic control (ATC). Some regions may
have additional processes that are required to
Furthermore, the airport should prepare its resume normal airport operations. In regions
business contingency plan to cope immediately where airports are designated as official places
with the loss of all or part of a facility or critical of refuge, restoration of normal operations
infrastructure. Such facilities include but are not may be impossible until a state of emergency
limited to runways, taxiways, aprons, passen- has been fully resolved.
ger terminals, freight facilities, fuel facilities,
road access, administration buildings and com-
puter facilities4.
Courtesy of Incheon International Airport.
See ACI’s Emergency Preparedness and Contingency Planning Handbook, First Edition, 2014
4

2.3.4 MAPPING THE BUSINESS a problem as well as the department that must
PROCESSES AND IDENTIFYING continue operating despite a system failure, area
SINGLE POINTS OF FAILURE inaccessibility or other scenario that interferes
with operational functions.
Listing and mapping business functions is
the first step in identifying critical business Assessing recovery time is not an easy task
functions. During this task, many interdepen- and multiple variables, such as the timing of an
dencies and single points of failure—critical incident (peak vs non-peak operations), must be
system components that have no backup and considered before suggesting an RTO.
can therefore cause an entire system failure—
can be easily identified. After functions are mapped, they can be cate-
gorized according to criticality and assigned a
The next step is to categorize the functions suitable RTO:
as follows:
Table 2: Function Criticality and RTO
1. Essential functions: the activities directly

responsible for the delivery of products
Recovery Time
and/or services. Rating Description
Objective (RTO)
2. Essential supporting functions:
the primary sources of support for the
essential functions. Immediate resolution
3. Non-essential supporting functions: 3 Critical within minutes
non-critical, secondary sources of support. (e.g. < 30 min)
While mapping business processes, it is

beneficial to identify which agencies and Resolution within
2 Important
key stakeholders (including companies) are hour(s) (e.g. < 1 hour)
responsible or accountable for the functions.
This information is needed to assign incident-
response roles and responsibilities. Resolution within
1 Convenient
day(s) (e.g. < 2 days)
2.3.5 IDENTIFYING THE

Non-
CRITICALITY OF EACH OF YOUR 0
essential
N/A
PROCESSES AGAINST A RECOVERY
TIME OBJECTIVE (RTO)
In order to understand the criticality of functions, All stakeholders involved should participate
it is paramount to determine the recovery in the process of rating the functions to help
time objective (RTO) for each of the mapped ensure that resources and effort are allo-
scenarios. The RTO is the maximum amount cated appropriately.
of time the function can be disrupted before it
must be restored following an incident5. This
information is vitally important to both the
department responsible for fixing the cause of
RTO should be calculated in periods of 30 minutes. If not, then it can be a single digit but with a Maximum Allowable
5
Outage (MAO) on a scale from three minutes to 72 hours, beyond which airports/aviation cannot afford disruption (see
Bangalore BIAL template in Appendix D).

Table 3: Examples of Airport Business-Critical Processes
• Law enforcement
• Passenger screening
Agency/stakeholder • Luggage screening
1
processes • Ramp control
• Air traffic control
• Emergency facilities (rescue and firefighting)
• Aircraft fuelling
Ground handling • Aircraft waste/sewage management and disposal
2
processes • Aircraft turnover processes (cleaning, maintenance
inspections, checklists, etc.)
• Stakeholder communications (airport staff, airlines,

ATC, pilots, weather service provider)
• Airfield maintenance (lighting, pavement, radio
and visual navigation aids, radars, weather stations)
• Facility maintenance (fixed bases, hangars,
de-icing facilities, fuel farms)
3 Airfield processes
• Wildlife management
• Airfield inspections
• Winter maintenance (snow removal)
• Rescue and firefighting operations
• Emergency response
• Water run-off and treatment facilities
• Communication to passengers, stakeholders, mutual

aid agencies and public
• Maintenance of major facilities and equipment
• elevators
• escalators
• jet bridges
• tow vehicles
• X-ray machines
• restrooms
• generators
• baggage belts
Airport terminal
4 • Gate management in common use environment
processes
• Passenger movement to and from terminals
• shuttle buses
• automated people movers
• Access control and security passes
• Environmental
• storm water
• system and operations
• IT services
• AODB, CUTE, CUSS, runway lighting system, etc.
• Food and beverage, commercial services
• Ground transportation and access to airport facilities

for employees and passengers
5 Off-airport processes • Roads and car parks
• Railway
• Bus

2.4 DEVELOPING RESPONSE AND
RECOVERY STRATEGIES
Based on the results of the business impact airport operators in addressing issues in some
analysis, airport operators should develop key areas.
a plan composed of response and recovery
strategies that address the effects of a dis- It should be also noted that recovery
ruption. Effective planning protects facilities, strategies should be classified as either
physical assets and information, prevents corporate strategy (centralized and applicable
environmental contamination and safeguards to all) or process-based strategy (applicable to
the reputation of the airport. a particular process).
Recovery strategies include the following

elements: 2.4.1 ASSIGNING ROLES
AND RESPONSIBILITIES
• detailed procedures that maintain or restore
operations during and after a disruption; Early communication (including alerting and noti-
• reference lists that include contact infor- fication) with response and recovery partners
mation for emergency responders, relief regarding business continuity roles and respon-
organizations, critical business contractors sibilities will help to facilitate greater community
(for both equipment and supplies), informa- preparedness, as well as increased performance
tion backup sites, emergency supplies and and inter-organizational coordination during an
other critical data; incident.
• reunification and family assistance centres;
• evacuation and shelter-in-place procedures; Furthermore, early communication allows
• reporting to the aviation regulatory agency; partners to identify and address skills gaps,
• communicating with the media. understand the recovery value of partner
resources, share best practices and encourage
Other business recovery considerations include: awareness of and adherence to rules and
processes. Partners should be actively involved
• command hierarchy charts; in business continuity management training and
• methods for addressing the needs of vulner- planning exercises.
able and/or dependent populations (people
with disabilities including those with reduced
mobility and/or requiring assistance of ser- 2.4.2 DEGRADED LEVEL OF
vice animals, non-native language speakers, SERVICES (LoS)
elderly people, families travelling with young
children, etc.); Most organizations institute service-level
• airport maps that show evacuation routes; agreements (SLAs) and/or operational-level
• triage area for mass-casualty incidents; agreements (OLAs) with internal and external
• quarantine protocol for contagious-disease stakeholders. However, a disruption may make
outbreaks; it temporarily impossible to adhere to SLAs
• pre-staged, inventoried stocks of appropriate or OLAs. As a result, defining a degraded
protective equipment for personnel. level-of-service (LoS) standard should be
considered. This standard allows operators to
Critically, BCM plans and associated recovery anticipate the level of service required for a
strategies do not follow any clearly defined function that has been affected by an incident.
rules. However, the following may assist

2.4.3 QUICK REFERENCE 2.4.4 INCIDENT RESPONSE PLAN
HANDBOOKS
Airports might consider partnering with others
Developing and distributing a common-use to provide operational assistance in the case
quick reference handbook ensures a standard of major emergencies. For example in North
document is used by all airport stakeholders America, the Southeast Airport Disaster
and helps the incident commander to manage Operations Group, or SEADOG6, is an informal
the response. Individual stakeholders should not collection of airports who have come together to
develop separate protocols as this increases the provide operational assistance to airports hit by
risk of disruption and decreases the effective- natural disasters, such as hurricanes or floods.
ness of incident response procedures. SEADOG coordinates fast responses to specific
operational needs, supplying teams of volunteer
Typically, quick reference handbooks consider airport staff and necessary equipment needed to
the following items: return an airport to operational status. SEADOG
works closely with WESTDOG, its Western
• duties and responsibilities of each party US counterpart. Participation in SEADOG is
within the chain of command; voluntary and open to all.
• communication plans including call-out
charts, etc.; Similarly, in the Asia-Pacific region, ACI’s
• data-gathering procedures to allow a fully Emergency Cooperation Scheme7 provides a
informed assessment of incident criticality; platform to enhance communications among
• business continuity phase procedures; airports during emergency situations (e.g. disas-
• recovery phase procedures; ters or aircraft accidents) and seek aid from
• response diagrams for the different other airports to handle and recover from the
scenarios. situation. Aid might include technical expertise,
heavy machinery, operational equipment, per-
sonal items or food and drinking water.
When developing a BCM response plan, the

focus should be on the operational impact of a
system failure rather than considering the ways
a system could fail. For example, for an IT-related
incident, the response plan may include:
• areas impacted by a total or partial loss

of the system;
• estimated incident duration;
• incident timing effect (peak operations);
• demand vs available capacity.
https://seadogops.com
6
http://www.aci-asiapac.aero/ecs/en/
7

2.5 TESTING, EVALUATING
AND UPDATING THE BCM PLAN
BCM plan testing exercises allow airport opera- Following an exercise, participants should
tors and their stakeholders to train employees, convene for an after-action review (AAR) to
evaluate strategies and identify any procedural discuss response strengths and weaknesses
shortcomings or gaps in emergency-response and uncover lessons learned that are used to
resources and capabilities. Identifying areas guide future responses and drive BCM changes.
for improvement and developing corrective Due to the changing nature of airport procedures,
actions through a testing process helps airports laws and regulations, plans should be regularly
to cultivate business management approaches updated to ensure they are harmonized with the
focussed on continuous improvement. current rule regime.
Testing the plan can be accomplished through

the following types of exercises8:
1. Discussion-based exercises:
“Following an
a. seminars
b. workshops exercise, participants
c. table-top exercises
d. games should convene for
2. Operations-based exercises: an after-action review
a. drills
b. emergency documentary practices (AAR).”
c. functional exercises
d. full-scale exercises
Full-scale emergency exercise. Courtesy of Aéroports de Montréal
US Department for Homeland Security, 2013 Homeland Security Exercise and Evaluation Program (HSEEP) guide:
8
https://www.fema.gov/media-library-data/20130726-1914-25045-8890/hseepapr13.pdf

3. BUSINESS CONTINUITY 3.1 OVERVIEW OF THE ISO 22301:
MANAGEMENT POLICY AND 2012 STANDARD
GOVERNANCE SYSTEM
During the 1980s and early 1990s, information
A business continuity management policy technology played a key role in contingency
and governance system will help the organi- planning and disaster response. However, there
zation better understand its importance. BCM was a growing recognition that preparations
is not exclusively for airport operators. Rather, needed to become business-led processes con-
all stakeholders within the airport community sidering the broadest possible set of disruptions.
must support, understand and adhere to the As a result, the discipline became known as
programme for it to be effective. It is important business continuity management (BCM).
to have a clear governance system in which
all entities are represented. An effective BCM In 2012, the International Organization for
policy cannot be created in a vacuum; all organi- Standardization (ISO) published an International
zations that would be impacted by BCM should Standard addressing BCM. The standard was
have equity in the final plan. established to help organizations—regardless of
their size, location or activity—to be more resil-
Many stakeholders have business continuity ient when confronted by any type of disruption.
management roles in an airport environment.
Some organizations will contribute daily, while The key concepts of ISO 22301 relevant to BCM
others have a direct role only under special cir- policy and governance for airport operators are:
cumstances (such as during or after a major
crisis). Generally, airports do not have enough • Define roles and responsibilities.
resources to respond to every emergency, so • Set out a response activation process.
external actors usually play significant roles in • Detail the objectives of actions taken in
preparation for and response to an incident/ response to the immediate consequences
disruption at an airport. of a disruptive incident, including:
i. a focus on individual welfare;
It is beneficial for airport operators to involve ii. the airport’s strategic, tactical and
local, regional and national organizations (civil operational response options;
aviation authorities, law enforcement, customs iii. prevention of further loss.
and border authorities, etc.) in the develop- • Outline communication details for:
ment of their BCMs. These organizations bring i. employees;
additional expertise and resources that can be ii. emergency contacts;
employed for the mutual benefit of all parties. iii. other key interested parties.
Similarly, local and regional authorities may • Describe how the airport will continue
incorporate airports’ resources and business or recover prioritized activities within
continuity management capabilities into their predefined recovery time objectives.
emergency response planning. • Detail media engagement procedures (spe-
cifically focussing on communication plans,
media statement templates and designating
spokespeople).
• Establish a post-incident stand-down
procedure.

The ISO 22301 standard provides a global Organizations that use ISO 22301 are eligible to
framework helping organizations to plan, obtain an accredited certification to demonstrate
establish, implement, operate, monitor, review, to legislators, regulators and other interested
maintain and continually improve a BCM parties that the organization is adhering to
system. ISO 22301 is expected to help organiza- BCM practices. ISO 22301 also enables the
tions protect against, prepare for, respond to and business continuity manager to demonstrate
recover from disruptive incidents, irrespective of to executives that a recognized standard has
their form or scale. been achieved. Finally, the standard can be used
within an organization to measure itself against
industry best practices, as well as by auditors
reporting to management.
Figure 4: BCM Improvement Framework. Source: InterVISTAS.

3.2 BUSINESS CONTINUITY
MANAGEMENT LIFE CYCLE
Response planning and coordination for any An airport operator should take responsibility for
type of incident must be undertaken well the business continuity management process.
in advance of an actual incident. Similarly, This includes the following:
relationships should be established with orga-
nizations involved in incident response early 1. Determine how the airport operator will
in the business continuity planning process. manage and control identified risks to
Furthermore, incident management does not ensure business continuity.
end when the “fire is extinguished”. Recovery 2. Allocate knowledgeable personnel
is a gradual process of restoration through inter- and adequate financial resources to
organizational resource coordination that may implement BCM.
take months or years to complete. 3. Ensure that BCM is independently
reviewed and approved periodically.
The incident life cycle includes four phases: 4. Train employees to understand their
roles in the implementation of BCM.
• Phase 1: Mitigation and Prevention 5. Evaluate BCM regularly, incorporating
• Phase 2: Preparedness tests into training scenarios including
• Phase 3: Response emergency exercises.
• Phase 4: Recovery
Figure 5: Four Phases of the Incident Life Cycle

Developing and implementing a BCM plan at The ACI World best practice paper, Business
an airport is not a simple undertaking. To be Continuity Management Framework and
successful, there needs to be a dedicated effort Case Studies for Health-Related Disruptions9,
driven by the airport top management team with identifies the key steps to developing and imple-
specific resources that define the BCM structure menting BCM:
and oversee its implementation.
Figure 6: Key Steps for Developing and Implementing a BCM Plan
Download free from: https://aci.aero/Media/36a635e4-cee5-457b-a2ec-552035369c8b/0DHz_A/About%20ACI/

9
Priorities/Facilitation/2012_ACI_Business_Continuity_Best_Practices_WFSSC_v1.pdf

3.3 BUSINESS CONTINUITY
MANAGEMENT TEAM
The best practice paper recommends that the The crisis-management capabilities review is a
project oversight team should, at a minimum, be critical step in the BCM process. Crisis response
composed of the following participants: requires communication, coordination and con-
trol, made possible by an effective crisis-man-
• Airport operator representatives: agement strategy, properly trained emergency
• Director of operations or response personnel and adequate equipment.
senior operations manager; Normally, a dedicated crisis-management centre
• Engineering and maintenance is needed, separate from the facilities used to
senior manager; monitor and manage normal operations. While
• Business process owners; the tactical response to a critical event on the
• Senior safety and security managers; ground will differ, the crisis-management ap-
• Environmental department senior proach should be similar. Its role is to minimize
manager; the scope, scale and duration of the crisis and to
• Administration and human resources restore normal operations as quickly as possible.
(HR) manager.
• Airport business partner and

external participant representatives:
• Civil aviation authorities;
• Public health authorities;
• Emergency services;
• Airlines and aircraft operators;
• Customs;
• Border police;
• Local police;
• Air catering operators;
• Air traffic management
and air navigation service providers;
• Local station managers;
• Ground and ramp handlers;
• Line and base maintenance operators;
• Fuel suppliers; Crisis-management meeting. Courtesy of Houston
• Local transport authorities Airport System.
(taxi, rail, bus, etc.);
• Utilities and supplies
(water, electricity, etc.).
It should be noted that a BCM team in each

organization is critical. This should be ideally
a three-tier system with a steering commit-
tee at the top level and a core group/cham-
pions at the bottom level. There should be
a mentor group in between the two which
has the authority to review and approve the
plans and programmes.

Airport and external partners participate during an emergency exercise. Courtesy of Aéroports de Montréal.

4. INCIDENT MANAGEMENT 4.2 OPERATIONS CONTROL
CENTRE (OCC)
4.1 INCIDENT MANAGEMENT SYSTEM The roles and responsibilities of the operations
control centre (OCC) need to be carefully
Airport operators should have a clear approach assigned. Decision makers need to have the
to incident management that addresses appropriate competencies, training and level of
command principles through a common orga- authority. It is also important to select decision
nizational structure. This structure is meant makers that have a demonstrated ability to
to improve coordination between response maintain situational awareness, vigilance and a
organizations and to aid in the management of calm demeanour under pressure. One member
resources. For example, in the United States the of the incident management team located at the
National Incident Management System (NIMS) OCC should be nominated as the person who
and Incident Command System (ICS) provide a directs the response.
scalable and flexible framework for an effective
airport response. OCCs are typically located in remote areas,
strategically placed apart from main facilities to
help ensure survivability. However, site selection
should also consider a location’s effect on incident
response and command and control functions.
“It is also important These centres serve as clearing-houses for crit-
ical information (e.g. resources, allocations) and
to select decision as communication hubs for essential airport
stakeholders (e.g. air traffic control (ATC), ground
makers that have a handlers, immigration and customs authorities).
As a result, the airport operator should identify
demonstrated ability an alternate location should the primary loca-
tion be affected by the incident or otherwise
to maintain situa- unavailable or inaccessible. It is not necessary

for the alternate location to replicate the capabil-
tional awareness, ities of the primary location, but it should have

the minimum capabilities necessary to maintain
vigilance and a calm

operations. A relocation plan guiding movement
to the alternate location during a major incident
response should be developed.
demeanour under
pressure.”

4.3 PUBLIC COMMUNICATION
Effective communication can minimize harm

to airport community stakeholders, expedite
recovery and help to ensure credibility and
maintain public trust. During an incident, various
stakeholders will seek information in order to
gauge the impact of an incident and to coordinate
assistance efforts. If airport operations are
disrupted, customers will want to know how
services will be affected, as well as what actions
should be taken to avoid potential harm.
Current information will need to be provided to

internal audiences, including airport employees,
as well as to external audiences, including
family members and friends, the media,
local government officials and public, private,
and non-profit partners. Airport operators
should respond to information requests using
information dissemination procedures based on
the following recommendations:
a. Centralize crisis communication

operations within a single facility.
b. Assign a public information officer to
unify messaging to the media and public.
c. Develop key messaging that is factual,
timely, clear and consistent.
d. Accommodate special needs audiences
(i.e. vulnerable populations) through
tailored communications.
e. Establish information release
clearance protocols.
f. Select communication platforms to
disseminate information (traditional and
new media). Whatever the communication
need may be, airport operators have a suite
of information tools at their disposal:
In addition, it should be noted that public

communications differ from crisis alert and
notification systems. Without defining a crisis
alert and notification system, process and
procedures, the incident response is incomplete
and less effective. Further, there should be
a defined call tree within each process and
departments for internal alert dissemination.

4.4 POST-INCIDENT DEBRIEF 5. CREATING AN AIRPORT
ORGANIZATIONAL CULTURE THAT
Similar to an after-action review conducted VALUES BUSINESS CONTINUITY
following an exercise, it is important to have a MANAGEMENT
post-incident debrief. The debrief should include
everyone that responded to the incident. Inviting BCM is fundamentally shaped by, and should be
response-wide feedback will help to form a responsive to, the organizational culture within
complete picture of how an incident was resolved an airport. As such, during the development of
and may lead to corrective measures that can BCM, the organization of the airport should be
be used to enhance response procedures. A thoroughly considered, and the BCM process
second debrief should be conducted in the days should be responsive to organizational changes.
following an incident. The second debrief allows Moreover, active steps should be undertaken to
for the presentation of information that may not embed BCM within the organization, ensuring
have been available immediately following an that the plan is acknowledged and understood.
incident, including investigation results or other
updated analyses.
Emergency training exercise. Courtesy of Aéroports de Montréal

Senior management should subsequently • Clear personnel responsibilities: roles
ensure that BCM remains a priority. Time should must be clearly defined and each staff mem-
be dedicated to periodically review both the BCM ber should clearly understand their role in
contents and the level of staff preparedness the context of BCM.
to enact BCM. Executive staff should ensure
their complete familiarity and demonstrate the • Strong relationships with outside stake-
significance of the plan within an airport’s organi- holders: measures should be taken to
zational culture by leading communication efforts ensure that relationships are strong with
and actively participating in training exercises. outside stakeholders involved in BCM and
that contact information for these stakehold-
The details of how BCM becomes embedded ers remains current and easily accessible
within the culture of an airport will differ signifi- (see Section 3.3 for further guidance).
cantly depending on its specific organizational
culture. However, key elements that facilitate • Readiness of personnel: developed through
the creation of a robust culture surrounding training and simulated exercises (announced
BCM include: or unannounced) to familiarize personnel
with BCM procedures for a wide range
• Executive sponsorship: with the airport of incidents.
leadership actively participating in the devel-
opment of BCM, providing knowledge and • Clear vision: a clear and effectively commu-
airport oversight expertise. nicated vision will help personnel understand
the purpose behind their efforts and maxi-
• Top-level support: ensuring that require- mize the chances of their acceptance of and
ments are defined and that BCM is aligned meaningful support for BCM.
with the organization’s strategic objectives.
• Strong communication: hosting “lunch and
• Establishment of a steering committee: learn” events, developing newsletters, dis-
representing the ensemble of organizational seminating weekly emails, placing posters or
stakeholders with robust representation of having members of the steering committee
key operational divisions. visit department-level meetings to discuss
BCM planning efforts and acknowledge suc-
cesses and accomplishments are measures
which may consolidate the BCM culture
“The details of within an airport.
how BCM becomes The effectiveness of BCM and the extent to

which the plan has been embedded within an
embedded within organizational culture can be gauged by review-

ing the quality of BCM execution by airport
the culture of an personnel following an incident.
airport will differ sig- Two notable examples that provide evidence
of a successful embedding of BCM within
the organizational culture of an airport are pre-
nificantly depending sented below.
on its specific orga-

nizational culture.”

1. Business Continuity Management
Organizational Culture and the Glasgow Airport Attack
Following the failed attack on Glasgow Airport hardware store to aid in the evacuation of water,
on 30 June 2007 by two assailants in a Jeep and external stakeholders such as the local fire
4x4 vehicle, critics scrutinized the airport’s department were successfully engaged to help
ability to effectively respond to the high-level resolve any post-incident concerns.
incident. However, a review of the airport’s
response shows that airport personnel had a Furthermore, a roster of personnel was used to
clear understanding of BCM and their responsi- ensure that business recovery efforts ran around
bilities, and that BCM was a key component of the clock, with critical operations identified and a
Glasgow Airport’s organizational culture. list of employee replacements identified for each
post. The roster ensured that each employee
received adequate recuperation time between
shifts, regardless of whether they held a strate-
gic, tactical or operational role.
The actions undertaken by Glasgow Airport and

the performance of airport personnel leading to
successful execution of BCM show the impor-
tance of an organizational culture in which BCM
is deeply embedded.
Damage caused by the attack on Glasgow airport.
The business recovery team at Glasgow Airport

was operational within one hour of the attack.
Short-, medium- and long-term critical success
factors were rapidly established and measures
were taken to achieve these goals. The issues
that affected the business operations of the air-
port (e.g. significant water damage caused by
the fire suppression system, some smoke dam-
age from fire) were rapidly counteracted through
effective communication and action within the
airport. For example, the maintenance depart-
ment procured 200-litre water drums from a

2. BCM and Hong Kong
International Airport Typhoon Preparedness
Hong Kong is struck by typhoons with relative

frequency. As further developed in Section 6,
Hong Kong International Airport (HKIA) relies
extensively on its BCM to ensure that the impact
of a typhoon on everyday airport operations is
minimal and that recovery from high‑intensity
typhoon events is enacted rapidly and efficiently.
HKIA has undertaken far-reaching measures in

creating an organizational culture which fully
embraces BCM as a key operational planning
tool. A notable organizational culture element
is the top-to-bottom embrace of a philosophy
surrounding holistic and proactive risk manage-
ment and mitigation. When a typhoon threat is
identified (three to five days before the incident),
BCM is enacted to ensure that key business
resumption/recovery elements are confirmed
and that key personnel are briefed and prepared
for a variety of scenarios. Typhoon Lan. Courtesy of NASA.
After the intensity of the typhoon is assessed,

the risk mitigation plan and subsequent BCM The above examples demonstrate two
processes are carried out during and after the different organizational cultures that have
weather event in order to ensure key business firmly embedded BCM. Glasgow Airport has
continuity elements are safeguarded (e.g. cus- an organizational culture that encourages
tomer care, maintenance, operational recovery). employees to take the initiative. This is clearly
A high level of preparedness of HKIA personnel visible in the “above and beyond” approach
across key departments is considered crucial to taken by Glasgow Airport employees carrying
the success of BCM. out BCM.
HKIA sees their BCM as a constant process, HKIA takes an approach where the organiza-
underpinned by a common understanding of tional culture of the airport operator cultivates
the necessary responses to a variety of event a view of actions as processes. Their constant
intensities. BCM is disseminated across the and proactive reassessment of their BCM
organization using a shared personnel philoso- demonstrates this strong and established
phy and positions BCM as an important part of a organizational culture.
holistic organizational culture.
Section 6 offers additional case studies that
HKIA have prepared a video outlining their highlight how different airports are approach-
business continuity management strategy: ing the development and application of their
https://extranet.hongkongairport.com/busi- BCM in different contexts.
ness_continuity/index.htm

6. CASE STUDIES
AND LESSONS LEARNED
weather briefings in advance of the typhoon’s

Case Study 1: Hong Kong International impact and coordinate with the HKIA community
Airport (HKIA) – rapid response and in terms of necessary contingency measures,
recovery from adverse weather including any rescheduling of flights. The Flight
Rescheduling Control System (FRCS) allows
airlines to realistically plan flight arrivals and
Adverse weather is a major risk for airports departures under adverse weather conditions to
around the world. Airport operators must have achieve effective recovery.
plans in place that minimize the impact of dis-
ruption and ensure a rapid and smooth recovery. During a typhoon, AAHK activates the Airport
Taking a proactive role, Airport Authority Hong Emergency Centre (AEC). The AEC provides pro-
Kong (AAHK) has been working closely with the active, multi-agency coordination in support of
airport community to strengthen the ability of FRCS activity. During an incident, the AEC also
HKIA to prepare for and respond to any potential supervises resource allocation including aircraft
weather disruption. For example, prior to the ground holding, ramp handling of baggage at the
onset of any typhoon, AAHK will liaise closely apron, passenger crowd management and cen-
with both the Hong Kong Observatory and air tralized aircraft tractor deployment. Finally, the
traffic control to track and assess the potential AEC communicates with transport companies to
impact of the typhoon. AAHK will organize ensure that transit between the airport and city
centre is maintained where possible.
Emergency exercise. Courtesy of AAHK

After weather constraints have eased, allowing The airport keeps its own stock of passenger
more take-offs and landings, AAHK continues provisions (e.g. blankets, mats and bottled
to work closely with airlines, ramp handlers and water) while also pooling provisions with airlines.
line maintenance operators to ensure all parking The airport also proactively communicates with
bays are made available and that resources can embassies and consulates to escalate larger
cope with the increasing numbers of flights. passenger group needs and visa requirements.
Throughout a typhoon response, the AAHK

maintains timely and effective communication
with all relevant parties. Passengers and the
public are informed by announcements made at
the terminals, on the AAHK website and through
mobile applications. AAHK also engages actively
with the media, conducting on-site news brief-
ings together with home-based airlines.
In their report 'Managing Airport Disruptions:

Achieving Resilience through Collaboration'
(2013), Booz & Company Inc describe how this
works in practice.
"Hong Kong Airport conducts more than 200

seminars and drills each year, with recent
simulations engaging some 650 participants.
"The airport combines a customer service

culture with well-coordinated protocols.
Though not specifically outlined in contracts, Emergency exercise. Courtesy of AAHK
airport staff are expected and willing to assist
with passenger welfare when needed. Staff
deployments are pre-arranged and there is a
clear understanding of roles. The airport and
airlines jointly established a dedicated area
for stranded passengers. The area includes
separate facilities for passenger rebooking
that ensure regular operations are not dis-
rupted. Additional WiFi capacity, power points
and data signal links are made available to
facilitate rebooking and check-in, when the
disruption ticketing system is deployed to Weather briefing at Hong Kong International Airport.
ease the passenger queuing experience." Courtesy of AAHK

Case Study 2: Houston Airports (HOU) – Post-incident analysis identified the following
lessons learned and key take-aways from strengths:
Hurricane Harvey (August 2017)
• teamwork;
• employees working outside of their areas
In August 2017, Houston Airports (HOU) of responsibility;
were forced to close for three days following • coordination with federal, local, state and
Hurricane Harvey before returning to functional- air-operation partners;
ity. Infrastructure damage was minor and did not • activation of the City of Houston
require activation of a continuity of operations Emergency Operations Center (EOC) and
plan (COOP). Instead, HOU was faced with a briefing the mayor twice daily;
prolonged period of flooding, a situation that the • maintenance of airport EOC operation;
airport had not addressed in their hurricane plan • communication with tenants, stakeholders
or otherwise prepared for. and constituents;
• resumption of operations without incident.
Impacts of Hurricane Harvey on George Bush
Intercontinental Airport (IAH) were the following:
• From 26 August to 5 September 2017, there

were 2,604 flight cancellations (74% of all
cancellations in 2017).
• Staff working for the airport authority, the
airlines, the vendors and the various service
providers were unable to leave the airport
or receive relief supplies.
• Passenger flight operations had to
give way to military, rescue and
humanitarian missions. Houston police officers aiding Hurricane Harvey
• Millions of dollars were lost in flight reve- recovery efforts. Courtesy of Houston Airport System
nues, gate fees, concessionaire income etc.
Flooding was a serious problem in Houston following Hurricane Harvey

Following Hurricane Harvey, Houston Airports • Implementing a call tree for employees.
are taking steps to address the weaknesses of • Better utilizing non-essential staff, improv-
their hurricane plan, including transitioning to ing ability to bring in additional staff.
an all-weather mitigation plan and addressing • Identifying the need for high-water vehicles.
flooding separately. Objectives include: • Planning for airport egress and ingress
during flooding events.
• Developing an all-weather plan. • Developing tracking system for resource
• Commencing communications with city and requests.
airline partners sooner. • Addressing the lack of widespread
• Designating a spontaneous landing zone for knowledge of WebEOC (crisis management
the United States Coast Guard. software).
• Developing long-range staffing plans. • Addressing fixed-base operator (FBO) and
• Adding natural disasters to table-top training third-party challenges in fuelling.
exercises. • Identifying pre-stage support facilities
• Distributing traffic information on specific (sleeping and shower facilities, etc.).
airport entry points.
Airside operations briefing. Courtesy of Houston Airport System

Case Study 3: Incheon International
Airport (ICN) – contingency measures to
cope with snowstorm and baggage-
handling-system delays
• Delays due to snowstorms
The following processes were extracted from

the ‘Contingency measures during peak season
at Incheon Airport’ report, specifically consider-
ing flight delays due to snowstorms.
1. Contingency measures for passengers:
• rapid displays on Flight Information

Display Systems (FIDS) communicating
information on delayed or cancelled
flights;
• status of airport operations and snow-
fall information communicated through
public announcement system, website
and/or airport app.
2. Support for stranded passengers:
• secure waiting areas and rooms for

stranded passengers;
• medical support and emergency shift
work to care for sick passengers;
• passenger emergency supplies, such
as mattresses, blankets, bottled water,
etc. (more than 2,000 mattresses and
blankets available).
3. Support for transportation

and convenience facilities:
• public transportation operating

hours extended;
• taxi, taxi-van and bus services available
for 24-hour operations;
• commercial and convenience facilities
operating hours extended (up to 24
hours if necessary).

• Baggage-Handling-System
Operational Disruptions
Maintaining major mechanical facilities such as

the baggage handling system (BHS) is critical
to airport operations. The interconnected nature
of the BHS (electrical, IT/network, mechanical
components) increases the likelihood that a mal-
function might occur. Regardless of the severity,
BHS malfunctions can inconvenience passen-
gers, making it critically important for airport
operators to develop contingency plans.
To facilitate rapid responses to operational dis-

ruptions caused by BHS failures, Incheon Airport
prepared not only correction measure manuals
but also a handbook for passenger management
during abnormal situations. The handbook lists
the names, locations and scope of responsibili-
ties of airport employees. Staff are dispatched to
correct and respond to situations based on the
scope of the disruption.
Depending on the severity of the BHS malfunc-

tion, specific measures and actions are initiated.
Additionally, each person in charge has respon-

sibility for managing related outsourcing needs.
All pictures courtesy of Incheon International Airport

Table 4: Incheon International Airport – Levels of Malfunction Severity and Remedial Actions
LEVEL 1 LEVEL 2 LEVEL 3

(Attention/Caution) (Warning) (Severe)
More than 20-minute non- Over one-hour

Over two-hour
responses in Baggage Source non-responses in Baggage
non-responses in Baggage
Status Message either from two Source Message from all carriers
Source Message from all carriers
flights of a foreign carrier or or fallback tagging in all check-
or BHS network down
one flight of the national carrier in counters
Initiate countermeasure
Head of Passenger Vice-president of Vice-president of
task force and contact
Management/planning team Passenger Service Passenger Service (or CEO)
stakeholders
Communicate with airlines

Head of Passenger Head of Passenger
and support check-in counter X
management/planning team management/planning team
normalization
Head of Passenger Head of Passenger

Management of field Service team A Service team A
X
(terminal) situation Head of Passenger Head of Passenger
Service team B Service team B
Passenger guidance and

monitoring for T1, T2
Landside - departure area
X X Person A, B, C, D
• Communicate with
passengers and manage
complaints
Passenger guidance and

monitoring for T1, T2
Landside - arrival area
X X Person E, F, G, H
• Communicate with
passengers and manage
complaints
Preparation of temporary
waiting station (place/hall/
room) and emergency goods X X Person I, J
(blankets, instant noodles,
water, etc.)
Passenger flow
management for T1, T2 and X X Person K, L, M
Concourse building
Operation of temporary
waiting station (A) including X X Person N, O
provision of emergency goods
waiting station (B) including X X Person P, Q
waiting station (C) including X X Person R, S

Case Study 4: Princess Juliana Following the destruction of the airport terminal
International Airport, Saint Martin/Sint infrastructure due to severe weather, the key
Maarten (SXM) – 2017 Hurricane Irma lessons learned are:
destruction
• ensure that terminal assets can be
easily adapted
Table 5: Timeline
• make certain that FBO facilities can be
easily repurposed for commercial flights
• Category 5 Hurricane Irma • provide for tent facilities to help with

strikes Caribbean islands.
• Winds in excess of 180 miles business continuity.
per hour hit Sint Maarten.
• Control of the airport turned
6 September over to Dutch military to help
2017 with disaster relief.
• Airport terminal sustains
severe wind, water and salt
damage from the hurricane.
• Terminal equipment destroyed.
• 80% of terminal roof damaged.
• Commercial services resume

at lightly damaged fixed-base
operator (FBO) facilities.
• Planning for full business
resumption starts, based on
a strategy of phasing in
temporary facilities.
9 October
• Airport to demolish the
2017 remains of the terminal and
reconstruct a new building in
a process that could take 9
to 12 months.
• Insurance and loans to
fund $100 million in repairs/
reconstruction.
• Departures area opens.

7 February
• Commercial traffic still at 70%
2018 below pre-hurricane volumes.
SXM airport after Hurricane Irma, September 2017.
Copyright Hector John @Negbawi via Twitter
26 March
2018 • Temporary arrivals area opens.
• Full reconstruction to be
Early 2019 completed.

APPENDIX A: RESOURCES
Airport Incident After-Action Reports US Transportation Research Board
Fort Lauderdale-Hollywood International ACRP Report 112: Airport Terminal Incident

Airport Active Shooter Incident and Post- Response Planning
Event Response January 6, 2017 After Action
Report ACRP Report 170: Guidebook for Preparing
Public Notification Programs at Airports
John F. Kennedy International Airport Multi-
Agency Security Review Team Report ACRP Report 175: Improving Intelligibility
of Airport Terminal Public Address Systems
US Department of Homeland Security ACRP Synthesis 73: Emergency

Communications Planning for Airports
National Incident Management System
National Infrastructure Protection Plan The US National Fire Protection Association
National Response Framework NFPA Standard 1600: Standard on Disaster/

Emergency Management and Business
Continuity Programs
US Federal Emergency
Management Agency Resources Emergency Management
Accreditation Program (EMAP)
Basic Guidance for Public
Information Officers Emergency Management Standard
Considerations for Fusion Center and

Emergency Operations Center Coordination International Civil
Aviation Organization (ICAO)
Developing and Maintaining Emergency
Operations Plans Safety Management Manual – Document 9859
Guidance on Planning for Functional

Integration Needs Support Services in
General Population Shelters
Homeland Security Exercise

and Evaluation Program
Integrated Public Alert and Warning

System (IPAWS) Toolkit
IPAWS Adoption Checklist for

Alerting Authorities

APPENDIX B: ABBREVIATIONS AND GLOSSARY
ABBREVIATIONS
ACI Airports Council International NIMS National Incident Management

System
ACRP Airport Cooperative Research
Program OLA Operational Level Agreements
AAHK Airport Authority Hong Kong PA Public Announcement
AEC Airport Emergency Centre PESTEL Political, Economic, Social,

Technological, Environmental, Legal
ATC Air Traffic Control
RTO Recovery Time Objective
BCM Business Continuity Management
SARS Severe Acute Respiratory Syndrome
BCP Business Continuity Plan
SCADA Supervisory control and data
BHS Baggage Handling System acquisition
BIA Business Impact Analysis SLA Service Level Agreements
CAA Civil Aviation Authority SWOT Strengths, Weaknesses,

Opportunities, Threats
COOP Continuity of Operations
EOC Emergency Operations Center
FBO Fixed-Base Operator
FIDS Flight Information Display Systems
FRCS Flight Rescheduling Control System
HKG Hong Kong International Airport

(airport code)
HR Human Resources
HSEEP Homeland Security Exercise and

Evaluation Program
ICS Incident Command System
IROPS Irregular Operations
LoS Level of Services

GLOSSARY
Business continuity management (BCM): Crisis or critical event: Any event requiring
An integrated, multi-layered, business‑driven, an immediate, proactive response in order to
process-based approach to plan for and manage minimize its negative impacts on the airport
business disruptions and crises. operator’s operations, reputation and profitabil-
ity. As a further explanation, an “incident” that
The term BCM used in this document refers to is not properly managed and resolved could give
a simple response-driven model that makes use rise to a “crisis”.
of business continuity first principles. As such,
it is very much compatible with other types of
BCM systems that are currently in vogue (e.g.
continuity of operations planning (COOP), disas-
ter management planning/programme (DMP),
enterprise risk management planning (ERMP),
etc.). The terms used may be different, and the
implementation progression may be dissimilar,
though the underlying business continuity prin-
ciples are the same.
Incident: An event which causes an impact or

has the potential to cause an impact or disrup-
tion to the normal operational flows at an airport.
“Incidents” occur every day in the course of
an airport’s operations and most have a limited
impact in terms of scope, scale and duration.
The concept of operational flows is important

because managing an airport is, in essence,
managing flows of aircraft, vehicles, people,
baggage, cargo, mail and information. Airports
manage these flows through processes, peo-
ple and systems. Therefore, an incident will
have a detrimental effect on the process output
or service delivered because of the impact on
these factors.

APPENDIX C: CHECKLIST FOR PHYSICAL SORTATION FAILURES IN THE
BAGGAGE HANDLING SYSTEM
Quick Reference Handbook
Courtesy of Hamad International Airport (OTHH)
Sortation Failure due to Physical Failure CALL SIGN:
Physical Sortation
Failure
CONDITION Any condition

FOLLOW THE INSTRUCTIONS OF YOUR COLOUR
HIA BH DM / SCHEDULING OPERATOR

ACTIVATE THROUGH - BHS CONTROL ROOM
O&M CONTRACTOR
ESS
1. INITIAL ASSESSMENT & INCIDENT REPORT
1.1 INCIDENT NOTIFICATION
O&M DUTY MANAGER / BHS SYSTEM OPERATOR

Physical Sortation Failure
Detect the alarm from MDS :
TO Report to the responsibles ASAP
Call O&M Contractor’s Technicians :
TO Investigate and report back on the problem urgently
Call BHS Duty Manager and Scheduling Operator :
TO Inform about the type of failure
Act and coordinate, if only ONE SORTER fail :
TO Disable the infeed lines for the affected sorter

TO Divert the bags according to
If SORTER 1 down:
- Divert the TX01, TX02, TX04 & BP06-025A Plow Diverters to Tilt
Tray Sorter 2 and Re-tract the plow diverter for BP01-23A
If SORTER 2 down:
Act and coordinate, if BOTH SORTER fail :
TO Disable all infeed lines

TO Activate RTF ACI World | Airport Business Continuity Management Handbook | 2019 53
HIA - BHS (DUTY MANAGER /SCHEDULING OPERATOR)
If SORTER 2 down:
Act and coordinate, if BOTH SORTER fail :
TO Disable all infeed lines

TO Activate RTF
Call QAS BCR Coordinator :
TO Inform about the type ofFailure

Sortation failuredue to Physical Failure CALL SIGN:
TO Inform QAS operation team to do NOT load bags at:
- Any TX in-feed, if both Sorters down Physical Sortation
- TX07 and TX08, if Sorter 1 down Failure
- TX09 and TX10, if Sorter 2 down
Call HIA ASOC, if BOTH SORTER fail :
TO Communicate to MOI Supervisor / Captain to:

- Inform BOTH SORTERS are down
- Deploy manpower at L5 in the RTF
- Using OOG and SOOG screening as contingency will require
more manpower
1.2 AFFECTED AREA/S IDENTIFICATION AND OPERATIONAL IMPACT

Physical Sortation Failure
If partial, indicate the Sorter affected :

Sorter 1 HIA BAGGAGEHANDLING_CHECK-IN FAILURE
Page Sorter 2 Version 1.0 Effective date
1/9 TO BE DEFINED
1.3 RECOVERY TIME ASSESSMENT
O&M DUTY MANAGER
Call BH Duty Manager :
Inform BH Duty Manager for the estimated time required to rectify

TO
the issue
Evaluate the Severity Matrix below :
TO Procced according to the respective item

Physical Sortation
Failure
2.3 MEDIUM SEVERITY
HIA - BHS SCHEDULING OPERATOR
Call HIA Operations Manager :
TO Inform ONE SORTER is down (Medium Severity)

TO Inform Check-in will have difficulties to process all the bags
TO Communicate to AOCC Duty Manager that:
- ONE SORTER is down
- Check-in will be have difficulties to process all the bags
Call HIA ASOC :
TO Communicate to MOI Supervisor / Captain that:

- ONE SORTER is down
- RTF will be used to support the operation
Call Check-in and Departure BH Supervisor :

Inform that RTF will start being used to support the operation, if
TO
needed
Call QR BCC Officer :

TO Prioritize Check-in Rush bags and quick connection bags
MEDIUM SEVERITY
TO
needed
Call QAS Check-in Duty Manager :

TO Prioritize Check-in Rush bags
TO Prioritize quick connection bags

TO
needed
Call ESS Supervisor :
TO Support the operation
Call HIA BHS and HBSS System Analyst :

Send HIA BH Notification: Start of Unplanned Service :
Interruption (E-mail)
Activate the Contingency Plan and Announcement notification of
TO
stoppage
HIA - HIA BHS AND HBSS SYSTEM ANALYST
Call BH Head :

O&M DUTY MANAGER
Call O&M Contractor’s staff :
TO Clear die back bags at conveyor lines

TO Send the bags to an alternative conveyor line | Airport Business Continuity Management Handbook | 2019
ACI World 55
TO Manually clear the bags from the affected sorter
TO Divert the bags to the available sorter
Send HIA BH Notification: Start of Unplanned Service :
Activate the Contingency Plan and Announcement notification of
TO
stoppage
Call BH Head :

O&M DUTY MANAGER
Call O&M Contractor’s staff :
TO Quicklines
Clear die back bags at conveyor Reference Handbook
TO Send the bags to an alternative conveyor line
TO Divert the bags to the available sorter
Deliver the bags to QAS to
Sortation be sent
Failure duetotonearest Stand
Physical Alone X-Ray
Failure CALL SIGN:
TO
machine
Physical Sortation
Failure
2.4 LOW SEVERITY HIA BAGGAGEHANDLING_CHECK-IN FAILURE

Page Version 1.0 Effective date
6/9 HIA - BHS SCHEDULING OPERATOR TO BE DEFINED
TO Inform the SORTER/S are down (Low Severity)
Call HIA ASOC :
Communicate to MOI Supervisor / Captain that the SORTER/S are

TO
down (Low Severity)
Call Check-in and Departure BH Supervisor :

LOW SEVERITY

HIA - BHS DUTY MANAGER
Send message to HIA BH Head :
TO Inform regarding to the incident

O&M DUTY MANAGER
Verify CSC Cart Table = hot bags less than 40 mins :


HIA - BHS DUTY MANAGER
Send message to HIA BH Head :
TO Inform regarding to the incident

O&M DUTY MANAGER
Verify CSC Cart Table = hot bags less than 40 mins :

TO Manually clearSortation
the bags Failure
from thedue to Physical
affected sorterFailure CALL SIGN:
Physical Sortation
Failure
3. RECOVERY
3.1 TESTING
O&M DUTY MANAGER
Call Staff deployed in the affected area :
TO Confirm the staff are in a safe location

TO Confirm the sorters are energised and can be put back into service
TO Perfom the test and confirm the availability of the system

TO Enable the affected transfer lines
Call O&M Duty Manager :
TO Confirm to perfom test

RECOVERY
3.2 CONFIRM SERVICE AVAILABILITY

HIA BAGGAGEHANDLING_CHECK-IN FAILURE
O&M DUTY MANAGER
Page Version 1.0 Effective date
7/9 TO BE DEFINED
TO Confirm service availability

TO Confirm service availability and proceed with normal operations

TO Inform to AOCC Duty Manager the system is back
Call HIA ASOC :
TO Inform to MOI Supervisor / Captain the system is back

TO Inform to AOCC Duty Manager the system is back
Call HIA ASOC :
TO Inform to MOI Supervisor /Quick Reference

Captain Handbook
the system is back

Physical Sortation
Failure
Call ESS Supervisor :

RECOVERY
Send HIA BH Notification: End of Unplanned Service :

TO Update announcement notification of stoppage
Call BH Head :
HIA BAGGAGEHANDLING_CHECK-IN FAILURE
Page Version
TO Confirm service availability and proceed with1.0
normal operations Effective date
8/9 TO BE DEFINED
Note:
Hamad International Airport Proprietary.

May be subject to export restriction under HIA and QCAA

APPENDIX D: BANGALORE AIRPORT BCM TEMPLATE
Bangalore International Airport Ltd has been a pioneer in BCM in South Asia, with a robust system
existing since 2010. The template was developed in-house for Bangalore Airport, has been tested
during disruptions and regularly kept updated.
DOCUMENT CONTROL SUMMARY

Document Name :
Document Owner :
Contacts :
Document Version :
Document Classification :
Document Approved By :
Document Approval Date :
Copyright © 2019 KJ Bangalore International Airport Ltd

RECORD OF AMENDMENTS
Version Revision Change Made Change Approved

Changes Made Approval Date
Number Number By By
INSTRUCTIONS
1. Fill up/replace/update only the red colored text/columns to customize it to your Process.
2. Do not format the pages.
3. Do not delete/merge cells in the table; however, if additional column required, you may insert
4. Do not change any Title or Sub Title or Serial Number.
5. Do not use track change mode
6. The BCP with any subsequent amendment SHALL be communicated/shared with the
bxxxxxr@bialairport.com and obtained approval prior to executing the changes

DISTRIBUTION LIST
Sl No Designation
1 BCM Steering Committee
2 BCM Core Group
3 Department Staff

INDEX
1. SCOPE ............................................................................................... 63
2. PURPOSE............................................................................................ 63
3. DEPARTMENT DETAILS ............................................................................ 63
3.1. DESCRIPTION ...............................................................................................................................................63
3.2. RECOVERY TIME OBJECTIVE ..................................................................................................................... 63
3.3. MAXIMUM ACCEPTABLE OUTAGE (MAO) ................................................................................................64
3.4. STAKEHOLDERS ........................................................................................................................................64
3.5. NODAL CONTACT POINTS ..........................................................................................................................64
4. DEPARTMENT REQUIREMENTS – BUSINESS AS USUAL SCENARIO.......................... 65
4.1. NORMAL BUT PEAK WORK HOURS ...........................................................................................................65
4.2. SKILL REQUIREMENTS ...............................................................................................................................66
4.3. WORKSPACE AND SYSTEM REQUIREMENTS............................................................................................. 66
4.4. VITAL RECORDS REQUIREMENTS.............................................................................................................66
5. DEPARTMENT RECOVERY ........................................................................ 67
5.1. INCIDENT MANAGEMENT ..........................................................................................................................67
5.2. BCP CALL TREE ........................................................................................................................................ 67
5.3. RECOVERY ACTIVITIES ............................................................................................................................. 67
5.3.1.Financial aspects...................................................................................................................................67
5.3.2. Technology
5.3.3. People
5.3.4. Equipment
5.4. NORMAL OPERATION RESUMPTION PROCEDURES..................................................................................... 68
5.5. STANDING DOWN PROCEDURE ...................................................................................................................68
6. BCM TRAINING AND TESTING ................................................................... 69
6.1. TRAINING NEEDS .......................................................................................................................................69
6.2. TEST PLANNING......................................................................................................................................... 69

1 SCOPE
Natural disasters, malicious intent, catastrophic accidents together with competitive pressures, market
demands, and increased dependence on technology for core business processes are redefining the need for
effective and risk-based continuity planning. In light of the above, Bangalore International Airport Limited
has implemented a Business Continuity Management System in order to ensure continuity of business for
its core business activities, albeit at a predefined reduced level. Essentially, Business Continuity Planning
provides a strategy to recover core services after an incident disrupts the Business-As-Usual scenario. The
interval immediately following a business disruption typically involves little or no business activity. At a
time parameter referred to as Recovery Time Objective (RTO), business slowly recovers to a level known
as the Minimum Business Continuity Objective (MBCO).
The scope of this document is limited to < PROCESS NAME > Department only.
2 PURPOSE
The purpose of maintaining a BCP is to ensure that all the requirements of the department
including process, procedures, people, technology and equipment are identified and
documented. This would help in evolving, implementing, testing and improving a strategy for
the continuity of the organization. The BCP will also help in:
 Identifying business requirements for the recovery of the critical functions (e.g. RTO)
 Prioritizing of recovery in the event of a major business disruption
 Deciding and documenting the degraded service levels to be met during the recovery process
3 DEPARTMENT DETAILS
3.1 Description
(please refer to the Process BIA Result)
Process Name < To be added by Process Owner >
Process Owner < To be added by Process Owner >
Process Owner Reports to < To be added by Process Owner >
Business as usual head count < To be added by Process Owner >
Short description of < To be added by Process Owner >

Processes Activities carried
out
Table 1: Department Description
3.2 Recovery Time Objective

(Please refer to the Process BIA result)
Activities as per BIA Activity RTO
< To be added by Process Owner > < RTO >
< To be
Appendix added by Process Owner >
D_BIAL_BCMS_Template.docxBCP/2019 < RTO >
Page 2 of 9
Table 2: Recovery Time Objective
3.3 Maximum Acceptable Outage (MAO)

Once the business is disrupted due to a major emergency, it is usually not possible to start
normal operations immediately following the time when the incident occurred. This may be
because of several factors such as attending to the welfare of personnel, containing the
contingency, unavailability of the facility and so on. The maximum period of time for which the
organization can remain non-operational without incurring irrevocable damage is referred to as
the Maximum Acceptable Outage (MAO)
The MAO for a specific Activity of a particular Process is mentioned in Table 3.
Activity as per BIA ACI World | Airport Business Continuity Management Handbook | 2019
Activity MAO 63
< To be added by Process Owner > < MAO >

Table 2: Recovery Time Objective
3.3. Maximum Acceptable Outage (MAO)

Once the business is disrupted due to a major emergency, it is usually not possible to start
normal operations immediately following the time when the incident occurred. This may be
because of several factors such as attending to the welfare of personnel, containing the
contingency, unavailability of the facility and so on. The maximum period of time for which the
organization can remain non-operational without incurring irrevocable damage is referred to as
the Maximum Acceptable Outage (MAO)
The MAO for a specific Activity of a particular Process is mentioned in Table 3.
Activity as per BIA Activity MAO

Table 3: MAO
3.4. Stakeholders
A stakeholder may be defined as a person/organization with a vested interest in the
performance of the organization. The stakeholders/Interested parties of the organization can
either be internal or external to BIAL. The stakeholders must be informed of any disruption
caused to the organization due to an untoward incident. A Sstakeholder may even be responsible
for taking critical decisions during the business disruption including invocation of the Business
Continuity Plan for the organization in order to recover the business operations of the
organization.
The contact details of the organization stakeholders are listed in the Table 4: Stakeholder List.
Company Nodal Person Email ID Contact-1 Contact-2
<To be added by the Process owner >

Table 4: Stakeholder List
3.5. Nodal Contact Points

These are the Single Points of Contacts (SPOC) for various requirements at XXX. These SPOCs
help in facilitating the department’s requests and the requirements at BIAL. All queries and
clarifications can be addressed to these SPOCs.
The contact details of the SPOCs are:
BCMS-ART-PLN-BCP/2019 Page 3 of 9

Functions/ Departments Primary Contact Contact Info Alternative Contact Info
Contact
Table 5: Nodal Contact Points
4 Department Requirements – Business as Usual Scenario
4.1 Normal but Peak Work Hours

This section describes the normal and critical workload of the department in terms of work items
completed per unit time, or number of people required for a particular activity (in a steady state
scenario) to be delivered within the turnaround time. The details of the normal and peak
workloads of the department are presented in Table 6
(Please refer to the Process BIA Result)

Activities Important Days of Important Time of
Month/Year Day (if applicable)
(if applicable)
< To be added by Process Owner >
< To beD_BIAL_BCMS_Template.docxBCP/2019
Appendix added by Process Owner >
Page
< To4beofadded
9 by Process Owner >
Appendix
< To beD_BIAL_BCMS_Template.docxBCP/2019
added by Process Owner >
Page 5 of 9
Table 6: Normal and Peak Work Times
4.2 Skill Requirements

This section captures the typical skills used in the department. The skills for the department are
to be identified and documented so as to facilitate the provision of adequately skilled personnel
for the operation of the department during the ACIinvocation
World | Airportof the BCP.
Business TheManagement
Continuity skill requirements of
Handbook | 2019 65
the department are mentioned in Table 7.
Table 6: Normal and Peak Work Times
4.2 Skill Requirements

This section captures the typical skills used in the department. The skills for the department are
to be identified and documented so as to facilitate the provision of adequately skilled personnel
for the operation of the department during the invocation of the BCP. The skill requirements of
the department are mentioned in Table 7.
Head Count
Staff
Skills Set Associated Process (critical
Designation
personnel)
Table 7: Skill Requirement
4.3 Workspace and System Requirements

This section contains the details of the workspace requirement for the department operations.
These requirements are to be identified and documented to aid the recovery of the department
in order to continue operations of the department when the BCP is invoked. These include the
space requirements as well as the technology requirements of the department. The workspace
requirements of the department are presented in Table 8.
Workspace and System Requirements
No. of Desktops/ Landlines Mobile Fax Printers Applicatio Others (Please
Seats Laptops (PBX/DC) ns Specify)
< Pl Add >
Table 8: Workspace and System Requirements
4.4 Vital Records Requirements

This section enlists the vital records needed for the department. The vital records may be in the
hard copy format or in the soft copy format. The vital records requirements typically include the
documents that are vital to the department. The vital records requirements of the department
are presented in Table 9.
Reason for the Location of the

Vital Records Owner Backup Owner
importance document
< Pl Add >
< Pl Add
Appendix >
D_BIAL_BCMS_Template.docxBCP/2019
Page 6 of 9
< Pl Add >
< Pl Add >
Table 9: Vital Records Requirements
5 Department Recovery
5.1 Incident Management

Any employee shall notify an incident which may have significant impact to Business Continuity.
After a preliminary verification, (to ensure this is not a false alarm) the XXXX shall be informed
immediately. The aavailable members of the ACMC should assemble at the Aerodrome Emergency
operations Centre as listed below for incident management as per the Incident Management Plan
The AEOC details are presented in Table 10
Location Address Email
< Pl Add >
< Pl Add >
Table 9: Vital Records Requirements
5 Department Recovery
5.1 Incident Management

Any employee shall notify an incident which may have significant impact to Business Continuity.
After a preliminary verification, (to ensure this is not a false alarm) the XXXX shall be informed
immediately. The aavailable members of the ACMC should assemble at the Aerodrome Emergency
operations Centre as listed below for incident management as per the Incident Management Plan
The AEOC details are presented in Table 10
Location Address Email
Table 10: AEOC Details
5.2 BCP Call Tree

The purpose of the BCP Call Tree is to define the communication flow from the department
owner to each member of the department team in the event of a disruption. All the critical
resources of the department are to be listed in the BCP Call Tree.
The BCP Call Tree is presented in Table 11.
Contact Number (Home/
Sl # Called By Called To
Cell Phone
< Pl Add >
< Pl Add >
< Pl Add >
< Pl Add >
< Pl Add >
Table 11: BCP Call Tree
5.3 Recovery Activities

This section contains the activities that are to be performed during recovery of the Process and
the associated priorities. Each activity of the Process is described in detail so that the steps to be
followed during the recovery of the department are clearly understood and documented.
Recovery activities of a department have three aspects of recovery: Technology, People and
Equipment. The details regarding the recovery activities of the department are presented in
Table 13; Technology Table 14; People in Table 15.
5.3.1 Financial aspects

Any cost incurred for planning, executing, maintaining, training & testing of the Departmental
Business Continuity Plan (BCP) will be met through the respective Departmental Cost Centre.
Appendix D_BIAL_BCMS_Template.docxBCP/2019
Page 7 of 9

5.3.2 Technology
Sl # Tasks Owner Backup Owner Time Line
< Pl Add >
< Pl Add >
< Pl Add >
Table 13: Technology
5.3.3 People
< Pl Add >
< Pl Add >
< Pl Add >
Table 14: People
5.3.4 Equipment
< Pl Add >
< Pl Add >
< Pl Add >
Table 15: Equipment
5.4 Normal Operation Resumption Procedures

Once the recovery activities of the department have been started and the department is
operating at MBCO, the next step involves scaling the operating levels up to the normal levels of
delivery. This phase includes the carrying out of the pending non-critical activities of the
department so as to clear backlog, identification of additional resources in order to support the
scaling up of operating levels. The details of the normal operation resumption procedures are
presented in Table 16.
Sl # Activity Carried Out By Timeline

< Pl Add >
< Pl Add >
< Pl Add >
Table 16: Normal Activities Tracker
5.5 Standing down procedure

On resumption of normal operations, the same will be communicated to the BCM coordinator to
obtain further instructions
6 BCM Training and Testing
6.1 Training Needs

The department team is to identify the critical department personnel and stakeholders including
clients and service providers who are to understand the Business Continuity Plan. Essentially, all
individuals who have a responsibility in the recovery phase of the department are to be identified
Page 8 of 9

5.5 Standing down procedure
On resumption of normal operations, the same will be communicated to the BCM coordinator to
obtain further instructions
6 BCM Training and Testing
6.1 Training Needs

The department team is to identify the critical department personnel and stakeholders including
clients and service providers who are to understand the Business Continuity Plan. Essentially, all
individuals who have a responsibility in the recovery phase of the department are to be identified
by the D_BIAL_BCMS_Template.docxBCP/2019
Appendix department team and trained regarding the plan, the recovery strategy of the
department,
Page 8 of 9 and their role in supporting the recovery of the department. The department team
is to specify a training program for communicating the aforementioned points and conducting
refresher sessions at appropriate intervals. The details regarding the training program are
presented in Table 17
Training Schedule (Mention MM/YY) Target Audience
< Pl Add >
< Pl Add >
< Pl Add >
< Pl Add >
Table 17: BCM Training Program
6.2 Test Planning

The department team is to plan the testing of the BCP of the department. The testing program is
to include details such as the personnel involved in the tests and the roles assigned to each
person, the scope of the tests, the mode of documenting the test results and the means of
incorporating the test feedback. The details of the test program are presented in Table 18
Approximate Mode of Incorporation
Testing In-Charge for the Scope of the
Testing Dates documentation of of Test
department Test
(MM/YY) the test results Feedback
< Pl Add >
< Pl Add >
< Pl Add >
< Pl Add >
Table 18: BCM Test Planning
NOTES
TOP 
Page 9 of 9

NOTES
TOP 
Page 9 of 9

APPENDIX E: EXAMPLE OF A BUSINESS CONTINUITY MANAGEMENT TEMPLATE
A. Purpose D. Objectives
The introduction to the BCM plan is used to List the airport’s continuity objectives (examples
explain the importance of business continuity. provided below):
This section presents background information
including referencing recent events that led to 1. Ensuring that the airport can perform its
the increased emphasis on the importance of a essential functions under all conditions.
continuity capability.
2. Reducing loss of life and minimizing
B. Scope property damage and loss.
The plan scope describes how the plan applies to 3. Executing an order of succession with
the airport, as well as subordinate activities (on- accompanying authority in the event a
and off-site), and to specific personnel groups in disruption renders the organization’s
the organization. The scope also describes the leadership unavailable or incapable of
range of disruptions that the scope is designed executing the responsibilities of office.
for. Ideally, continuity plans should address the
full spectrum of potential threats, crises and 4. Reducing or mitigating disruptions
emergencies (natural and man-made). to operations.
C. Situation Overview 5. Ensuring facilities are available for

continuing with essential functions.
This section characterizes the “planning environ-
ment”, making it clear why a continuity plan is 6. Protecting personnel, facilities, equipment,
necessary. Airports should reference their risk records and other assets critical to the
assessment to summarize the hazards faced by performance of essential functions.
their airport, their relative probability of occur-
rence and their impact. 7. Achieving timely and orderly recovery
and reconstitution following an emergency.
8. Ensuring and validating continuity readiness

through a dynamic and integrated continuity
test, training and exercise programme.

I. Assignment of Airport Continuity Responsibilities
This section should include defined continuity responsibilities for each key staff position (examples
provided below).
Name and # Title/Position Responsibilities
• Provide strategic leadership and overarching

policy direction for the continuity programme.
• Implement the continuity plan when necessary,
or when directed by a higher authority.
• Update and promulgate orders of succession
Director and delegations of authority.
• Ensure adequate funding is available for
emergency operations.
• Ensure all organization components participate
in continuity exercises.
• Update continuity plan annually.
Communications • Update telephone rosters monthly.

Manager • Conduct alert and notification tests.
• Review status of essential records, files

Records Manager
and databases.
Training Manager • Develop and lead continuity training and exercises.
• Be prepared to deploy and support organization’s

essential functions in the event of continuity plan
implementation.
• Provide current contact information to manager.
• Be familiar with continuity planning and know
Continuity Personnel individual roles and responsibilities in the event
of continuity plan activation.
• Participate in continuity training and exercises
as directed.
• Implement telework agreement for this position,
if applicable.

II. Employee Emergency Contact Information
The following is a list of airport employees and their individual emergency contact information:

III. Suppliers and Contractors
Company Name:
Street Address:
City: State: Zip Code:
Phone: Fax: E-mail:
Contact Name: Account Number:
Materials / Service Provided:
If this company experiences a disaster,

we will obtain supplies/materials from the following:
Company Name:
Street Address:
City: State: Zip Code:
Phone: Fax: E-mail:
Contact Name: Account Number:
Materials / Service Provided:

IV. Incident Command
The incident command post will be at the following location:
£ Airport police will activate and provide support and security for the command post.
£ The __________________________will assume management of the command post.
£ If the search location is changed, the airport police will coordinate with the other
parties involved to establish an alternate command post location.
The following diagram taken from the US Department of Homeland Security's National
Incident Management System (NIMS) shows an example of a command structure.
Incident Commander
Safety Information
Liaison
Operations Planning Logistics Finance &

Administration

V. Communication Plan
We will communicate our emergency plans with airport employees in the following ways:
In the event of an emergency, we will communicate with customers in the following ways:
is the Airport Public Information Officer responsible
for communicating to the media and general public.
VI. Airport Evacuation Plan
£ We have developed these plans in collaboration with neighbouring businesses and building
owners to avoid confusion or gridlock.
£ We have located, copied and posted building and site maps.
£ Exits are clearly marked.
£ We will practise evacuation procedures times a year.
If we must leave the workplace quickly:
1. Warning System:
We will test the warning system and record results times a year.
2. Assembly Site:
3. Assembly Site Manager and alternate:
Responsibilities include:

4. Shutdown Manager and alternate:
5. is responsible for issuing “all clear”.
VII. Airport Shelter-in-Place Plan
£ We have instructed airport employees in emergency supplies access and provision procedures
for the shelter location and have recommended supplies that individuals might consider keeping
in a portable, personalized kit for individual use.
£ We have located, copied and posted building and site maps.
£ We will practice shelter procedures times a year.
If we must take shelter quickly:
1. Warning System:
We will test the warning system and record results times a year.
2. “Seal the Room” Shelter Location:
3. Storm Shelter Location and alternate:
5. Shutdown Manager and alternate:
6. is responsible for issuing “all clear”.

VIII. Information Technology Security
To protect our computer hardware, we will:
To protect our computer software, we will:
If our computers are destroyed, we will use back-up computers at the following location:
IX. Records Back-Up
is responsible for backing up our critical records including payroll
and accounting systems.
Back-up records including a copy of this plan, site maps, insurance policies, bank account records and
computer backups are stored on site:
Another set of back-up records is stored at the following off-site location:
If our accounting and payroll records are destroyed, we will provide for continuity in the following
ways:

X. Annual Review
We will review and update this business continuity and disaster plan in
Record of changes:
Individual Description
Change Number Section Date of Change
Making Change of Change
Additional Notes:

Potential Threat and Hazard Scenarios
AIRCRAFT INCIDENTS AND ACCIDENTS
I. Definitions
i. Aircraft Incident:
ii. Aircraft Accident:
II. General
i. Method of Notification:
ii. Primary Responder Agency:
iii. Supporting Responder Organizations:
III. Operational Procedures (examples)
i. Airport Operations Responsibility:

a) Notify the following agencies…
b) Coordinate emergency response with…
c) Close damaged areas…
d) Request assistance as needed…
ii. Airport Police Responsibility:

a) Provide scene and traffic control…
b) Report any damage or injuries…
iii. Fire Department Responsibility:

a) Establish the incident command post…
b) Respond to fire and rescue calls as dispatched…
iv. Airport Staff Responsibility:
v. Airport Tenant Responsibility:
vi. Other Agency Responsibility:
IV. Required Personal Protective Equipment
V. Emergency Supplies Needed

Potential Threat and Hazard Scenarios (cont.)
T E R R O R I S T / B O M B T H R E AT S
I. Definitions
i. Aircraft Terrorist / Bomb Threat:
ii. Airport Terrorist / Bomb Threat:
II. General




N AT U R A L D I S A S T E R S
I. Definitions
i. Natural Disasters:
II. General
i.. Method of Notification:




R A D I O L O G I C A L / H A Z A R D O U S M AT E R I A L S E M E R G E N C I E S
I. Definitions
i. Radiological / Hazardous Materials Emergencies:
II. General




STRUCTURAL FIRES
I. Definitions
i. Structural Fire:
II. General




P OW E R FA I L U R E S
I. Definitions
i. Power Failure:
II. General




Appendix F
APPENDIX F: EXAMPLE OF A HIGH-LEVEL BUSINESS CONTINGENCY PLAN
Example of a High-Level Business Continuity Plan
Source: Business Continuity Planning, Guidelines & Workbook, Version 2.0, September
1999, ACI-IATA Joint Airport-Airline Year 2000 Liaison Programme
The purpose of this document was to help organizations within the aviation industry
prepare continuity plans for the potential problems resulting from failure or multiple
failures in automated systems linked to the new millennium (Y2K) throughout the
industry and to share relevant information with their business partners. Business
continuity planning was the overall exercise that ensured airports and their aviation
partners entered the new millennium with the minimum of disruption.
The following is an extract from the guidelines and illustrates the nine key elements
included in a business continuity plan (BCP):
1. Year 2000 remediation and workarounds

2. Process contingency and recovery plans
3. Staffing plan
4. Training plan
5. Crisis management and disaster recovery plans
6. Scenario testing
7. Logistics plan
8. Communications plan
9. Enhanced management and business as usual

Each of these elements is defined in detail in the following section.
1. Year 2000 remediation and workarounds
Definition
Systems and equipment are either fixed, or in the case of systems that may fail with
only minor, non-operational effects, there is a workaround.
Objective
To ensure that all elements of the business process (both systems and personnel
issues) that are affected by the millennium changeover are fixed and function normally
through the period. If there are known problems with any elements, they are fixed. If
they cannot be fixed, there is a working method put in place that bypasses the non-
functioning element.
Measures of success
• Minimal disruption of the business due to elements of the process failing.
• All critical business processes have a BCP in place, ratified and signed off by the
Task
Force.
Who’s involved in putting the plan together?

• business process owner (could be department head)
• technical owner/expert or system owner/manager
• main user(s) (airlines, fuel companies etc.)
• business partners
What needs to be done?

• Ensure the Year 2000 inventory of systems is up to date and the statuses of systems
are known. For reference:
➢ IATA Year 2000 data collection programme results
➢ IATA Database to compare status of systems to those held on the system
from other airports.
➢ Lead airline
➢ Internet and other information sources (suppliers, 3rd parties, etc.)
• Map the systems onto the business processes.
• From the process flows, determine weaknesses/failure spots
• Propose fixes and workarounds.
• Determine the resource requirements for each part.
• Document the plan.
Communicate the plan

• Distribute the plan to the other members of the Task Force.
• Disseminate the changed practices to all interested parties.

2. Contingency and recovery plans
Definition
A contingency plan enables the operation of a business process to continue in the event
of a failed system or piece of equipment. This may involve a degraded standard of
service. A recovery plan details the means by which systems or equipment are brought
back into service after failure or back into normal operation from contingency mode.
Objective
To ensure that, should an element of a process fail, action can be taken to reinstate the
function of the process and enable the business to bring those failed elements back into
service.
Measures of success
During the millennium period, any failure which does occur is dealt with adequately, and
causes little or no disruption. The element is brought back into operation in an effective,
efficient and economical manner.

For each process:
• The business process owner
• System owners/technical experts
• Main users/operators of the process
What needs to be done? What needs to be in the plan?

For each process:
Develop the contingency plan:
• Analyse the risk and the impact of failure on elements of the process.
Concentrate on the critical processes.
• Assess the current plans to ensure they adequately address the risks identified
including the Year 2000 risks (e.g. multiple- and common mode failures). If they
do, then an owner needs to be assigned, preferably one of the key stakeholders
in the Task Force.
• If the plan does not adequately address the risks, then a contingency plan needs
to be developed, trigger points identified and operational roles assigned.
Develop the recovery plans:

• For each contingency plan, assess the status of the process once it is in
operation (airport, airline and business partner operational status).
• Determine the impact going into contingency mode will have on the individual
elements within the process.
• Document the steps required to proceed from contingency mode to normal
operational mode.
Implement the contingency and recovery plans:

• Ensure staff are informed and trained for their roles in the contingency plan.

• Test the plan if possible (table-top exercises, walk-throughs, full simulations).

• Distribute the plan to all Task Force members.
• Ensure key staff involved in implementing the plan are adequately trained in the
new skills required.
• Ensure all key users are aware of potential changes to the operation as a result
of going to a contingency mode of operation.
• Ensure all airport personnel are aware of the ramifications of the plan.
3. Staffing plan
Definition
The number of staff required to maintain the operation at a predetermined standard over
the millennium period. This plan stems directly from the contingency and recovery
plans.
Objective
To ensure that adequate staff are available to be called upon to manage the operation
whatever the situation dictates.
Measures of success
During the millennium period, any failure which does occur is dealt with adequately and
causes little or no disruption. The element is brought back into operation in an effective,
efficient and economical manner.

• Airport Human Resources/Personnel department
• Business process owners
• Staffing representatives (unions)
• Airport operational management
• Input from airlines and business partners on their contingency plans and the
demands they may place upon the airport’s staffing plans.

Inputs
• Staffing levels from remediation and workaround plans and from contingency and
recovery plans. These include operational personnel, security staff, engineering
and maintenance operatives and contractors. Senior managers required for crisis
management roles.
• Remuneration levels for individuals and groups (specific to operating company).
Actions
• Collate total staff numbers required by function/department, eliminating
duplication and double counting.
• Review prioritisation of business processes and balance against staff numbers
required.

• Share staffing requirements with task force partners.
• Determine levels of remuneration and other schemes to guarantee required staff
numbers over the period.
Airport Lead Airline Airport Staff Other Airlines / 3rd Parties Press / Public
Management Handling Agents
Airport Staff levels, Staff rosters, Staff rosters Contractor staff

Management X staff rosters, pay details levels
pay deals
Lead Airline Staff levels

required, pay X
deals,
movements
Airport Staff
X
Other Airlines
X
3rd Parties
X
Press / Public
X
Outputs
• Staff rosters for the millennium
• Agreed levels of cover (airport, airlines, handling agents, contractors)
4. Training plan
Definition
A structured plan which details the training to be given to staff to enable them to carry
out their duties over the millennium. These duties will have changed due to the business
continuity plans and contingency plans put in place.
Objective
To ensure that all staff receive training required to allow them to fulfil the roles they have
been assigned through the adoption of Year 2000 contingency and continuity plans.
Measures of success
All staff involved in Year 2000 actions through the staffing plan (above), are
• registered as having been trained
• satisfied with the training

• confident in operating the contingency plans they will be required to be involved
with.

• Airport Human Resources/Personnel department
• Business process owners
• Staffing representatives (unions)
• Airport operational management
• Input from airlines and business partners on their contingency plans and the
demands they may place upon the airport’s staffing plans.

• All high-level business continuity plans, process continuity plans and contingency
plans need to be analysed for their staffing requirements (numbers) and for the
changes to working practices they require.
• Line management, Human Resources (Personnel) and process owners must
match staff numbers and capabilities to the roles required and draw up the
training requirements matched against the actual staff members. The timing of
the training must also be taken into account to ensure that the instruction
remains in the minds of the trainees as close to the operation time of the
continuity/contingency plans as possible.
• Organisations must negotiate with unions to agree to changes in working
practices for the millennium.

The plan should be communicated to:
• staff – on which training courses they will be on and the roles they will be filling
over the millennium.
• process owners – on which staff have been trained to fulfil which roles.
• unions – on which staff have been trained to fulfil which roles.
• airlines and other members of the airport community – indicating at a high level
what the new capabilities of the staff are.
This needs to be in the context of the overall Year 2000 business continuity plan
publicity that will be circulated to the airport community.
5. Crisis management and disaster recovery
Definition
The ability to quickly and efficiently minimize the disruption from any major problems
which may occur and to instigate the processes to restore a normal operating regime.
Objectives
• To assign roles and responsibilities to all relevant management and staff to
enable them to react quickly to any crisis situation that arises.
• To enable fast and effective communication between key parties within the airport
community to enable them to deal with any crisis.

• To ensure all relevant staff, airlines and business partners are prepared and able
to instigate the recovery of processes or systems that may fail due to the date
change or other millennium-related effects.
Measures of success
Recognised, documented crisis management strategy and disaster recovery plans,
accepted by airport, airline and business partners.
Clear lines of communication, detailed and documented, to be used in the event of a

major Year 2000 failure.

• airport/airlines senior management
• utilities
• process owners/systems managers
• key staff members

• Evaluate existing crisis management plans for Year 2000 compatibility. Update
where necessary. Ensure that the following are included:
o the process for making decisions
o the process for recording decisions taken
o the communications approach and mechanisms
o the escalation process
o the instigation process and trigger mechanism.
• Document the plans

o Determine if a crisis management centre (war room) or a communications
centre is necessary.
o Test the plans both for the effectiveness of the actions proposed and for
the clarity and efficiency of the communications channels between all
interested parties.

• airport/airlines senior management and business partners
• business process owners
• systems managers
• staff involved in the execution of the plans.
6. Scenario testing
Definition
The means by which any element of an overall continuity plan is tested to prove it is
able to protect the business. This is achieved through a series of levels, from desktop

exercises through process level testing through full, end-to-end testing with airlines,
business partners and third parties.
Objective
To ensure that plans are in place detailing testing that will give a sufficient level of
confidence that the business continuity plans are adequate for the main risk areas
identified.
Measures of success
Plans are in place, ratified by the Task Force, for all areas of the business and cover all
levels previously mentioned within the operation.

• utilities
• key staff members.

• It will be impossible to fully test every scenario. Main target areas to be tested
should be decided. These will come from risk and impact analysis of the airport’s
most vulnerable or critical processes.
• Test scenarios need to be developed and agreed. These include, for example,
single and multiple system failures within a process as well as combinations of
both these within multiple processes. Periodic review of plans and re-running of
scenario tests as appropriate.

7. Logistics plan
Definition
All operations need resources to implement them. Resources can include staff, food,
fuel,
etc. Over the millennium, with reduced staff numbers on all sides, it is imperative that
the resources that are required to support the operation or to implement any business
continuity measures are present at the correct times. A logistics plan defines the
procedures that help to get resources to and from the airport and in the case of staff, to
keep them comfortable while carrying out their duties.

Details the arrangements by which rostering, supply and transport arrangements will be
managed over the millennium period.
Objective
To ensure that, despite failures of the national, regional or local infrastructure (transport,
service provision etc.), sources of supply of all necessary resources are available to the
airport.
Measures of success
A tested, ratified plan that deals with all the highest-risk scenarios including failures of
public transport, traffic control, service provision (food) and utility failure (as it affects
staff at work, i.e. sewage systems failure, cooking facility failures etc.).

• senior airport, airline and business partner managers
• HR management
• staffing representatives
• input from utility suppliers, transportation infrastructure suppliers, service
suppliers.

• Risk analysis on potential failures of elements of the infrastructure which might
lead to resources and staff being unable to get to and from the airport. Risk
analysis on the ability of service providers to maintain the required standards of
supply and on the impact of other elements of staff support that are necessary.
• Depending on the results of the risk analysis, it may be prudent to put in place
alternative transport for staff, stockpile food (with long, compliant expiry dates)
and fuel and to provide or at least reserve portable toilet facilities.

8. Communications Plan
Definition
Details how communications, both internal, external and with the press and other media
are to be handled over the millennium period.
Objective

To provide a robust communications matrix that defines the content and level of
communications between all parties involved in the operation of the airport over the
millennium period.
Measures of success
Plans in place, tested against scenarios and ratified by all parties.

• public relations/media department
• business partners and airlines operational management
• utilities, government and/or regulatory authority(ies)
• key staff members

• A communications matrix needs to be drawn up detailing all the relevant parties
that may be involved in the operation, including senior management and public
relations, airlines and business partners, the press and public. It should be tested
in a variety of scenarios to ensure that relevant information is received at all
levels to enable swift management decisions to be made and action taken in
response.
• Consideration should be given to the establishment of a communications centre

to assist in the control and dissemination of information for the period.
• Alternative means of communication should be investigated to ensure back up

systems are available. Consideration should be given to the effect of electricity
loss as well as service provider loss.

• staff involved in the execution of the plans
• third parties involved in operations over the period.
9. Enhanced management and business as usual
Definition
An enhanced management plan details the management activities that need to take
place “over and above” normal to cope with the millennium. The business as usual
element reflects that the operation over the millennium period will be “as normal” with
the exception that traffic flows may be very different to what is normally expected.

Objective of the plan
To ensure that the organisation is in a position to cope with its operation over the
millennium period.
Measures of success
Crises are dealt with smoothly and efficiently. Minimal customer or passenger
complaints received.
• public relations/media department
• legal department
• business partners and airlines operational management
• key staff members.

• Consideration needs to be given to:
o setting up a control centre for the period
o setting up rapid response teams (both technical and operational)
o setting up a helpdesk specifically for Year 2000 related issues.
• Ensure that the legal aspects of the millennium are dealt with appropriately.
• Ensure senior management from all aspects of the airport community are on site
or available on call to make relevant decisions.

• airlines operations management
• staff involved in the execution of the plans
• third parties involved in operations over the period.
END

ACI World
Suite 1810
800 Rue du Square Victoria
Montreal, Quebec, H4Z 1G8
Canada
www.aci.aero
For more information or to access comprehensive

airport data analysis and reports, please visit
aci.aero/publications

Airport Business Continuity Handbook First Edition 2019

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Airport Business Continuity Handbook First Edition 2019

Uploaded by

Copyright:

Available Formats

Combatting Human Trafficking Handbook: 1st edition 2019

No subscriber or other reader should act on the basis of any information

No part of this publication may be reproduced, recast, translated,

Airport Business Continuity Management Handbook

Copies of this publication are available from:

ACI World | Airport Business Continuity Management Handbook | 2019 3

The idea of a guidance handbook on business

This handbook has been written and thoroughly

We sincerely hope that this handbook will

I commend the handbook to you and thank its

4 ACI World | Airport Business Continuity Management Handbook | 2019

ACI World would like to thank the following contributors and

• ACI World Facilitation

With special thanks to Seoul Incheon International

• ACI World Business Continuity Task Force, including:

• InterVISTAS Consulting Inc

• ACI World Environment Standing Committee

• ACI World Safety and Technical Team

• ACI EUROPE Aviation Security Team

• Lam Lha USA

ACI World | Airport Business Continuity Management Handbook | 2019 5

1.1 Statement of Purpose 12

1.2 Target Audience 13

1.3 Research and Publications 13

2.1 Setting the Scene – the Airport Context 16

2.2 Risk Assessments 18

2.3 Determining Impacts and Uncovering Vulnerabilities

2.3.1 Conducting a Business Impact Analysis (BIA) 23

2.3.2 Performing a Vulnerability Assessment 23

2.3.3 Identifying Business-Critical Processes

2.3.4 Mapping the Business Processes

2.3.5 Identifying the Criticality of Each of your Processes

2.4 Developing Response and Recovery Strategies 27

2.4.1 Assigning Roles and Responsibilities 27

2.4.2 Degraded Level of Services (LoS) 27

2.4.3 Quick Reference Handbooks 28

2.4.4 Incident Response Plan 28

2.5 Testing, Evaluating and Updating the BCM Plan 29

6 ACI World | Airport Business Continuity Management Handbook | 2019

3.1 Overview of the ISO 22301: 2012 Standard 30

3.2 Business Continuity Management Life Cycle 32

3.3 Business Continuity Management Team 34

4.1 Incident Management System 36

4.2 Operations Control Centre (OCC) 36

4.3 Public Communication 37

4.4 Post-Incident Debrief 38

5. CREATING AN AIRPORT ORGANIZATIONAL CULTURE

1. Business Continuity Management Organizational

2. BCM and Hong Kong International Airport

6. CASE STUDIES AND LESSONS LEARNED 42

Case Study 1: Hong Kong International Airport (HKIA)

Case Study 2: Houston Airports (HOU) – lessons learned

Case Study 3: Incheon International Airport (ICN)

Case Study 4: Princess Juliana International Airport,

ACI World | Airport Business Continuity Management Handbook | 2019 7

APPENDIX C: Checklist for Physical Sortation Failures

APPENDIX D: Bangalore Airport BCM Template 59

APPENDIX E: Example of a Business Continuity

APPENDIX F: Example of a High-Level Business Continuity Plan 88

TABLE 1: List of Potential Threats and Hazards

TABLE 2: Function Criticality and Recovery Time Objective 25

TABLE 3: List of Airport Business-Critical Processes 26

TABLE 4: Incheon International Airport Levels of Malfunction

TABLE 5: Princess Juliana International Airport – Post-Hurricane