Business Continuity Management Guidance and Protocol

1 CUMBRIA FIRE &RESCUE SERVICEPREVENTING PROTECTING RESPONDINGB usiness Continuity Management Guidance and Protocol CUMBRIA FIRE AND RESCUE SERVICE Business Continuity Management Guidance and Protocol SUMMARYThe Civil Contingencies Act 2004 places a duty on Category 1 Responders to provide for and maintain plans to ensure they can continue to exercise their functions in the event of an emergency. Fire and Rescue Authorities (FRA s) are classified as Category 1 Responders and the duty relates to all functions and not just the emergency and civil protection duty applies only to those events or situations defined as an emergency in Section 1 of the Act events or situations that threaten serious damage to the human welfare, environment or security of a place in the United Kingdom.

2 This Guidance provides a framework and advice for managers across all departments and functions within Cumbria Fire and Rescue Service on developing Business Continuity Management (BCM) arrangements and plans within their own areas of work thus ensuring the Fire and Rescue Authority (FRA) fulfils and discharges its statutory Guidance is structured around the Business Continuity Institutes 5 Stage Life Cycle Model, effective project Management principles and the risk Management approaches outlined in the Australian / New Zealand Standard AS/NZS 4360 - 1999: Risk Management also includes an introduction to public sector BCM, the objectives, rationale, benefits and costs of such an approach and a detailed guide to the actual process to be followed.

3 Supporting information and suggested formats for documenting the on-going work and analysis are also is a Management responsibility and must be embedded as an organisational culture or ethos. The responsibility for its success rests with all managers across the Service and this Guidance will assist in meeting those Continuity Management Guidance & ProtocolVersion 12 of 49 PDRH/PP May 2006 CONTENTSSUMMARYSECTION 1 - INTRODUCTIONSECTION 2 - PUBLIC SECTOR Business Continuity Management (BCM) BCM a Management Links to other organisation Management A risk Management approach to Continuity Britain s hazardous Role of public sector organisations accountability and responsibilitySECTION 3 BENEFITS OF Business Continuity Management (BCM) Costs of Business Continuity Management (BCM)

4 SECTION 4 THE Business Continuity Management Initiation and project Raising awareness of Continuity Management among Gaining Management commitment and Establishing the BCM Raising staff awareness and supportSECTION 5 - DEVELOPMENT OF A RISK Management Establishing the context for BCM corporate Determining risk evaluation Identifying Conducting the impact Evaluating Identifying risk reduction optionsSECTION 6 - IMPLEMENTATION OF RISK REDUCTION Preparing a risk reduction Implementing risk reduction strategiesSECTION 7 - DEVELOPMENT OF CONTINGENCY Project Prepare Agree Implement Communicate plans to all TestingBusiness Continuity Management Guidance & ProtocolVersion 13 of 49 PDRH/PP May Activate plans as Maintaining contingency plansSECTION 8 DEVELOPING AN EMERGENCY RESPONSE Public relationsSECTION 9 DEVELOPING A RESUMPTION Specific steps in resumption Consolidate all sections of the plan into a resumption Consult with related organisation Obtain senior Management Communicate the plan to all Store and maintain back up copies of the plan in off-site storage Test the completed organisation Exercise the plan regularly.

5 Evaluate results and update as Train users in the operation of the Conduct audits of the resumption plans on a regular Ongoing maintenance and reviewSECTION 10 - Risk Risk matrix for determining level of Risk Continuity Management risk reduction Specific risk action Questions to ask Resumption plan Sample format for a resumption planBusiness Continuity Management Guidance & ProtocolVersion 14 of 49 PDRH/PP May 2006 SECTION 1 - INTRODUCTIONThis Guidance is designed to provide managers across all departments and functions within Cumbria Fire and Rescue Service with advice on developing BCM arrangements and plans. BCM is a process that helps manage the risks to the smooth running of an organisation or delivery of a service, ensuring it can continue to operate and function in the event of a disruption.

6 It provides the strategic framework for improving the organisation s resilience to interruption. Its purpose therefore is to facilitate and assist in the recovery of key Business systems and processes within agreed time scales whilst maintaining the organisations critical functions and delivery of vital services to the public. It is an ongoing iterative process that helps organisations anticipate, prepare for, prevent, respond to and recover from disruptions, whatever their source and whatever aspect of the Business they Business Continuity Institute has developed a BCM model and methodology which is broken down into a 5 Stage Life Cycle. These stages are outlined and summarised below and provide the framework for this 1 - Understanding your Business using Business impact analysis and risk assessment to identify critical functions/objectives, evaluate recovery priorities and assess the risk that could lead to a disruption to service delivery.

7 The Business Impact Analysis is the foundation work upon which the whole BCM process is built. It identifies, quantifies and qualifies the impacts of a loss, interruption or disruption of Business processes so Management can determine at what point in time these become Risk Assessment Process identifies the probability and impact of a variety of specific threats that could cause a Business 2 - BCM Strategies identifying the alternative strategies available to mitigate loss, assessing their potential effectiveness in maintaining the ability to deliver the organisations critical functions/objectives. BCM Strategies concern the selection of alternative operating methods and outline the organisations approach to managing the Continuity of their Business during disruptions.

8 Stage 3 - Developing and Implementing a BCM Response developing the response to Business Continuity challenges and the plans supporting and complementing this. Plans should have regard to the resources and actions which are required to maintain critical functions/objectives. Stage 4 - Establishing a BCM Culture this stage looks at the need to ensure that a Continuity culture is embedded in the organisation by educating and raising awareness with staff and other key stakeholders. It is also about providing appropriate BCM training for all Continuity Management Guidance & ProtocolVersion 15 of 49 PDRH/PP May 2006 Stage 5 - Maintaining, Exercising and Auditing BCM Plans ensuring plans are fit for purpose, kept up to date and are quality assured.

9 Exercising the plans can take various forms, from a test of the communication plan, a desk-top walk-through to a live exercise. Outcomes and lessons learned can then be processed and included in revisions or changes to the BCM Strategies and sector organisations in the United Kingdom are generally able to maintain a constant stream of quality services. Nevertheless, they operate in a range of environments and with risks which have the potential to affect their capacity to maintain these services. The broad discipline that enables organisations to manage risks to maintain and deliver services is called Business Continuity Management (BCM). BCM in the public sector is defined as Management and planning for the continued availability of services including all the functions and resources associated with the provision of these services.

10 The primary objective of BCM is therefore to reduce damage to staff, customers, the community, property and equipment. It is a manager s responsibility and a logical extension of the operational planning and risk Management processes. Successful BCM requires leadership, commitment and support from senior managers and participation of all staff throughout the should be proactive and seek ways of preventing events rather than accepting that disruptions are inevitable. By following this process, Cumbria Fire and Rescue Service can identify the risks, select appropriate cost-effective risk minimisation strategies and determine the level of emergency and resumption planning required to restore services after an interruption.