Business Continuity Planning
Departmental Business Continuity Plan Template
Departmental Business Continuity Plan Template (DOCX)
- Introduction
- Mission
- Goal
- Plan Structure and Operation
- Crisis Communication Plan
- Critical Operations
- Determining Your Critical Operations
- Risk Assessment of Threats
- Business Impact Analysis (BIA)
- Policy and Objectives
- Review and Maintenance
Introduction
The safety and security of students, faculty, staff and the entire Pace Community is a top priority of the University’s leadership, and is an integral part of our commitment to excellence. Recognizing the increased risks of the world today, Pace University has enhanced its preparedness to respond to emergencies of all hazards by upgrading and integrating the various emergency response and disaster recovery plans that have been in place for the University’s critical operations, and by developing a comprehensive pre- through post-emergency response plan covering all campuses and operations of the University.
A business continuity plan (BCP) is a collection of resources, actions, procedures, and information that is developed, tested, and held in readiness for use in the event of a disaster or major disruption of operations. The objective of the Business Continuity Plan is to establish policies, procedures, and coordinate recovery of critical University functions. This plan will increase the University’s ability to respond to and recover from emergencies that may threaten the health and safety of the Pace Community or inhibit the University’s ability to continue its operations.
A comprehensive business continuity plan will help you maintain your central business activities while limiting the economic impact and allowing you to return to normal operations as quickly as possible. Each division and/or department responsible for performing one or more critical functions will develop a departmental business continuity plan and establish a structure to administer, update, and implement the plan. The intent is to minimize the amount of disruption any future emergency may cause to the department’s critical functions. This is accomplished by:
- Establishing an administrative structure within the department to deal with future emergencies.
- Investigating and preplanning appropriate responses to various types of potential emergencies.
- Identifying and implementing changes to current operating procedures that will reduce the department’s susceptibility to disruption from certain types of emergencies.
- Coordinating the department’s Business Continuity Plan with the plans of other departments that either provide services to or require services from the department.
- Formalizing the department’s Business Continuity Plan in written form.
- Maintaining a high level of knowledge and preparedness within the department’s plans for continuing operations during emergencies.
Mission
The mission and priorities of the University are protection of life, stabilization of the event, protection of the University environment, protection of University property, and restoration of critical services, including education and research programs.
The mission of every department is different. In order to accomplish their mission, each department must ensure operations can be performed with minimal disruptions during an emergency incident. The Business Continuity Plan ensures that the department has the capabilities to execute the mission’s essential functions as well as implement emergency support functions.
Goal
The overall goal is to ensure that all departments and business units of the University are prepared to rapidly restore critical functions in the aftermath of any emergency or disaster. Critical functions are those required to enable, support, and implement the safekeeping of our students, staff, and visitors and facilitate the resumption of academic, research, and administrative programs at Pace after an incident.
Departmental BCP Goals:
- Prepare the department for recovery
- Determine your critical functions
- Facilitate communications at all levels
- Identify your resource and personnel needs for normal operations
- Reduce vulnerabilities
Plan Structure and Operation
Each department's Business Continuity Plan has three main components, each of which deals with separate but inter-related aspects of any emergency situation. These components are:
- Business Continuity Policy and Procedure | Activities, including substantial pre-planning and recovery efforts, aimed primarily at assuring that all critical functions and operations continue to be performed during and after any emergency situation.
- Risk Assessment and Business Impact Analysis | Assessments based on worst-case scenarios to determine impacts of critical functions caused by disaster situations.
- Testing and Review | Instructing all personnel on plan basics (communication, meeting place, priorities, etc), and evaluating competencies through tabletop exercises, drills, and simulations as part of campus testing initiatives.
The following objective of this plan are to:
- Undertake risk management assessment
- Identify and prioritize critical business functions
- Detail immediate response to critical incident
- Detail strategies and actions to be taken to ensure the continuance of operations
Crisis Communication Plan
The Department of Emergency Management works with other University departments to ensure that the right people are notified at the right time in times of emergencies, disasters, and crises. The internal crisis communication plan should provide procedures for the coordination of communications within the department and among other University partners, while the external crisis communications plan should provide procedures for the coordination of communications with media and other outside organizations (including vendors) in the event of an emergency or other critical event
Internal Communication Plan
Describe how your department’s faculty, staff, student workers, and other workers will communicate with one another in the event of a disaster. Methods used include a ‘phone tree’ (include information or link to file with details); email; instant messaging; web pages; telephones; among others. All faculty and staff should update their personal information (address, phone numbers, etc.) on Pace Directory.
External Communication Plan
Describe how your department’s faculty and staff will communicate with external stakeholders (students, customers, parents, state officials, contractors, etc.) in the event of a disaster. Methods used include; email; instant messaging; web pages; telephones; among others. Please remember that all contact with the media will be coordinated by the Public Affairs office within University Relations.
Critical Operations
Critical operations of each department can be severely impacted during emergency incidences. In order to become resilient, the risk management planning section outlines threats that may affect the overall operations of the department. The identification and analysis of the risks that may have an adverse effect on departmental functions are important to reduce or eliminate potential hazards.
The Business Continuity Plan outlines what the department believes are critical functions, how impaired functions can impact the department and in what ways, and lists preventive and contingency plans for each.
Determining Your Critical Operations
A major part of business continuity planning is identifying functions that define your operations. These are called critical operations. Critical operations are those services, programs, or activities that are necessary to on-going business of your department and would directly affect the success of your department if they were to stop for an extended period of time. The success of your department and the support you provide to the University rely on these functions. Stopping them for an extended period of time would cause an unacceptable disruption to your operations and possibly other departments or units as well.
Your essential operations will serve as your guide for how to restart your operations following a disaster or major disruption. They help answer the question “What is the minimum level of service or activity my department must offer to still be in business?” By identifying and prioritizing your essential functions, you can determine which personnel, facilities, equipment, and materials are absolutely necessary to keep your department functioning following a disaster or major disruption. One way to determine your essential operations is to look at your department table of organization. This should help your identify the general functions that you preform.
Asking each staff member to make a list of their essential duties and responsibilities is another way to determine your essential operations. In general you should be able to organize your functions into four to six essential operations, more if you are a highly complex department or unit. If your list of functions is long, consider grouping similar activities into a single function. Example: General Office Management can include all administrative tasks. Manage ITS can include all IT tasks such as updating your website and troubleshooting computer issues.
Priority Rating: Critical
Importance: Operation directly impacts the life, health, safety, or security of the Pace community and stopping would have significant consequences.
Max. Allowed Recovery Time: < 4 hours
Priority Rating: High
Importance: Operation must continue at normal or increased level. Pausing for more than 24 hours may cause significant consequences or serious harm to business operations, upstream and downstream dependent organizations or units, revenue and finances, reputation, or other core mission services
Max. Allowed Recovery Time: < 24 hours
Priority Rating: Medium
Importance: Operation must be continued if at all possible, perhaps in reduced mode. Stopping for more than one week may cause major disruption to business operations, upstream and downstream dependent organizations or units, revenue and finances, or other core mission services.
Max. Allowed Recovery Time: < 1 week
Priority Rating: Low
Importance: Operation could be suspended for up to one month without causing significant disruption to business operations, upstream and downstream dependent organizations or units, revenue and finances, or other core mission services
Max. Allowed Recovery Time: < 1 month
Priority Rating: Deferable
Importance: Operation may pause and resume when conditions permit. Deferring this function for more than one month may cause slight disruption to business operations, upstream and downstream dependent organizations or units, revenue and finances, or other core mission services
Max. Allowed Recovery Time: > 1 month
Critical Operations General Examples:
- Academic Records/Transcripts
- Registration
- Athletic Game Operations
- Course Instruction
- Payroll
- Dining Operations
- Housekeeping and Utilities
- Critical Research
Business Impact Analysis
Business impact analysis (BIA) assist management in identifying critical functions that are essential to the survival of the department. BIA evaluates how quickly a department can return to full operation following a disaster situation. BIA also looks at the type of resources required to resume business.
BIA assumes the worst-case scenario such as infrastructure damage, destruction of records and equipment, absenteeism of essential employees, the inaccessibility of the site for weeks or months. The objective of the BIA is to help departments estimate financial impacts, intangible operational impact, and estimates the recovery time frame.
Risk Assessment of Threats
Risk assessment of threats involves evaluating hazards relating to man-made and natural disasters and recognizing their potential effects. This can assist the department in taking measures necessary to ensure the continuity of business.
Four overall risks to address:
- Loss of infrastructure including power and communications
- Loss of a building
- Loss of personnel
- Loss of location – you can’t access a portion of, or the entire campus
Policy and Objectives
The purpose of the each department's policy and procedure is to formalize a plan that establishes policies, procedures, and an organizational structure for response to emergencies. The plan identifies clear strategies and roles and responsibilities of various staff members during the initial response and throughout the emergency. Nothing in this plan shall be construed in a manner that limits the use of good judgment and common sense in matters not foreseen or covered by the elements of the plan. The plan and organization shall be subordinate to State and Federal plans during a disaster declaration by those authorities.
Review and Maintenance
Maintenance is always required to ensure plans work. It is suggested that you do the following tasks to make sure your department's BCP is always current:
- Update communication lists quarterly
- Update overall plan annually
- Update BCP after a test (drill, tabletop, etc.) or emergency
- Update BCP when external or internal factors change
Testing
Departments should train all personnel on plan basics, such as communication plans, meeting places, priorities, etc. Different ways to train employees include meetings, tabletops, drills, seminars, workshops, and simulations. These trainings should all be recorded in the department's BCP.
Seminar
A seminar is an informal discussion, designed to orient participants to new or updated plans, policies, or procedures (e.g., a seminar to review a new emergency communication procedure).
Workshop
A workshop resembles a seminar, but is employed to build specific products, such as a draft plan or policy (e.g., a Training and Exercise Plan Workshop is used to develop a Multi-year Training and Exercise Plan).
Tabletop
A tabletop exercise involves key personnel discussing simulated scenarios in an informal setting. TTXs can be used to assess plans, policies, and procedures.
Drill
A drill is a coordinated, supervised activity usually employed to test a single, specific operation or function within a single entity (e.g., a fire department conducts a decontamination drill).
Simulation
A simulation is a practice activity that places participants in a simulated situation requiring them to function in the capacity expected of them in a real event