To create an effective business continuity plan, a firm should take these five steps:
Step 1: Risk Assessment
This phase includes:
Evaluation of the company's risks and exposures
Assessment of the potential impact of various business disruption scenarios
Determination of the most likely threat scenarios
Assessment of telecommunication recovery options and communication plans
Prioritization of findings and development of a roadmap
Step 2: Business Impact Analysis (BIA)
During this phase we collect information on:
Recovery assumptions, including Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO)
Critical business processes and workflows as well as the supporting production applications
Interdependencies, both internal and external
Critical staff including backups, skill sets, primary and secondary contacts
Future endeavors that may impact recovery
Special circumstances
Pro tip: Compiling your BIA into a master list can be helpful from a wholistic standpoint, as well as helpful in identifying pain points throughout the organization.
Step 3: Business Continuity Plan Development
This phase includes:
Obtaining executive sign-off of Business Impact Analysis
Synthesizing the Risk Assessment and BIA findings to create an actionable and thorough plan
Developing department, division and site level plans
Reviewing plan with key stakeholders to finalize and distribute
Step 4: Strategy and Plan Development
Validate that the recovery times that you have stated in your plan are obtainable and meet the objectives that are stated in the BIA. They should easily be available and readily accessible to staff, especially if and when a disaster were to happen. In the development phase, it's important to incorporate many perspectives from various staff and all departments to help map the overall company feel and organizational focus. Once the plan is developed, we recommend that you have an executive or management team review and sign off on the overall plan.
Step 5: Plan Testing & Maintenance
The final critical element of a business continuity plan is to ensure that it is tested and maintained on a regular basis. This includes:
Conducting periodic table top and simulation exercises to ensure key stakeholders are comfortable with the plan steps
Executing bi-annual plan reviews
Performing annual Business Impact Assessments