Chapter 6 Business continuity management

1 Chapter 6 Business continuity management74 Chapter 6 Business continuity MANAGEMENTS ummary The Act requires Category 1 responders to maintain plans to ensure that they can continue to exercisetheir functions in the event of an emergency so far as is reasonably practicable. The duty relates to allfunctions, not just their emergency response functions (paragraphs ). Category 1 responders must have regard to assessments of both internal and external risks whendeveloping and reviewing Business continuity plans (BCPs) (paragraphs ).

2 Business continuity plans may take the form of generic plans which set out the core of a Category 1responder s response to any BCM event or specific plans dealing with particular risks, sites or services(paragraphs ). There must be a clear procedure for invoking the Business continuity plan (paragraph ). BCPs must include arrangements for exercises for the purpose of ensuring the plan is effective, andarrangements for the provision of training to those involved in implementing the plan. Plans must bereviewed and kept up to date (paragraphs ).

3 Category 1 responders are required to publish aspects of their BCPs insofar as making this informationavailable is necessary or desirable for the purposes of dealing with emergencies (paragraphs ). The Business continuity institute s five-stage Business continuity management cycle provides a usefulframework to help Category 1 responders to fulfil their duties. However, responders may adopt othermodels to deliver the legal requirements where there is a compelling case for doing so ( ). Examples of good practice drawn from Category 1 responders already active in Business continuitymanagement may help others with developing and reviewing their own BCPs (paragraphs ).

4 75 EMERGENCY PREPAREDNESSWhat the Act and the Regulations requireScope of the Act requires Category 1 responders tomaintain plans to ensure that they can continue toperform their functions in the event of an emergency,so far as is reasonably duty relates to all the functions of aCategory 1 responder, not just its civil protectionfunctions. For Category 1 responders to help othersin the event of an emergency, they first need to beable to keep their own crisis response capabilitiesgoing. However, Category 1 responders also need tobe able to continue to deliver critical aspects of theirday-to-day functions (eg law enforcement, lookingafter vulnerable people, attending minor fires) in theevent of an emergency, if the impact on thecommunity is to be kept to a minimum.

5 May, therefore, be helpful to think of thebusiness continuity management (BCM) duty in theAct as being separated into two strands. In practice,the Act requires Category 1 responders to maintainplans to ensure that they can: Continue to exercise their civil protectionfunctions:The legislation requires Category 1responders to maintain plans to deal withemergencies (see Chapter 5) and put in placearrangements to warn and inform the public inthe event of an emergency (see Chapter 7). TheBCM duty requires Category 1 responders tomaintain plans to ensure that they can deliverthese capabilities when they are required.

6 Continue to perform their ordinary functions:Category 1 responders perform a range offunctions that are important to the human welfareand security of the community and its environment(eg provision of health care, detection of crime,fighting fires). This is particularly true in anemergency situation, where operational demandsoften increase and the operating environment canbecome more challenging. The legislation requiresCategory 1 responders to make provision forensuring that their ordinary functions can becontinued to the extent is an established tenet of BCM thatorganisations should not only look at the resilienceof internal structures and processes, but also thoseof organisations they rely on, or deliverservices through.

7 Act requires Category 1 responders to put inplace plans to ensure that they can continue theirfunctions in the event of an requiresthem to ensure that those organisations deliveringservices on their behalf (eg contracted-out services) orcapabilities which underpin service provision (eginformation technology and telecommunicationsproviders) can deliver to the extent required in theevent of an emergency. This is because servicesremain part of an organisation s functions even ifthey do not directly provide on the dutyDefinition of is a flexible framework designed to helporganisations to continue operating in the face of awide range of different types of disruptions right theway along the spectrum of , the BCM duty is determined by thedefinition of emergency in the Act.

8 The Act thereforeimposes a duty on Category 1 responders to put inplace plans to ensure that they can continue toexercise their functions in the event of a muchnarrower range of disruptive duty applies only to those events orsituations defined as an emergency in section 1 ofthe Act events or situations that threaten seriousdamage to the human welfare, environment orsecurity of a place in the United Kingdom. Thisshould be read in conjunction with section 2(2) of theAct, which provides that an event or situation is onlyan emergency when it overwhelms existing responsearrangements, and cannot be dealt with withinexisting resources or procedures (see Chapter 1 for anin-depth description of the definition of emergency underpinning Part 1 of the Act).

9 The duty focuses on the most challengingsituations, it is likely that plans put in place to fulfiltheir duty under the Act will help Category 11s. 2(1)(c)2s. 2(1)(c)3s. 2(1)(c)76 Chapter 6 Business continuity management responders to prepare for a much wider range ofday-to-day (ie non-emergency) interruptions. Byputting in place plans to keep themselves going inthe event of an emergency, Category 1 responderswill build resilience to a wider range of less seriousevents. Practicability , Category 1 responders would be able to continue all of their functions at ordinary servicelevels in the event of an emergency.

10 In practice, this may not prove possible, and therefore the duty is Act requires Category 1 responders to putin place arrangements to ensure that they continueto exercise their functions in the event of anemergency so far as is reasonably The qualification so far as is reasonablypracticable has three elements to it: Criticality:Category 1 responders should focuson ensuring that they can deliver criticalfunctions. Which of its functions are critical is amatter that can be determined only by theorganisation itself, and may depend on the natureof the emergency in question.