Business Recovery Plans

Business Recovery Plans are the plans used by the bronze or operational teams following an incident which affects their ability to operate normally. They provide the information for the ICT or IS teams to recover their processes in order for the IT Service Continuity Plan to be put into action. If necessary the critical business units affected by the incident and who are suffering a loss of critical technology or information will also activate their Business Recovery Plans.

The Business Recovery Plans should include:

• Background
• Scope and purpose of document
• Relationship to other plans
• Definition of the Business Unit Team
• Roles and responsibilities of the Business Unit Team. Only incident roles should be used throughout the document – not names
• Procedure for assessing the situation
• Incident Room contact information
• Invocation criteria
• Escalation criteria
• Invocation procedure including rendezvous points and responsible persons
• Action plans for implementing the Business Continuity response – it is helpful if these are included as a checklist and have a box for ticking that the action has been completed. Sometimes it is useful if action checklists are written for each member of the team separately so they can be printed off and handed to each individual. These action lists should cover the loss of each critical resource i.e. equipment, materials, technology and information, staff and buildings
• Recovery Profiles – these detail the critical activities to be recovered, the number of staff involved and their alternate location. The critical resource requirements for each critical activity will also be detailed and the timescale in which they are required
• Details of equipment storage
• Maps and directions to all locations mentioned in the Plan
• Incident Log
• Communications Matrix
• Contact information – this section can include the names of the staff in each role and should also include at least one deputy
  • Incident Management Team (silver)
  • Other Bronze Team Leaders
  • External suppliers
  • Internal contacts
  • Regulatory bodies
  • Useful local information (e.g. hospital, doctors, plumbers, electrician, local council)
• Recovery stand down procedures
  • Decision to stand down
  • Who to communicate with
  • Filing of paperwork
  • Post incident report