Make a plan

To ensure that you are able to produce a Business Continuity Plan, key team members should be identified along with the structure, team membership, any external customers, partners, suppliers and internal support.  Other information such as where you would intend to manager your company's response from (the 'command centre'), and other information such as staff contact details, supplier contact details, etc. will be needed.  An incident box is always a good idea as it can contain all of the relevant information for you to manage your business from a remote location should it be necessary.

What a plan will look like

The business continuity plan should aim to include:

• Introduction - Identify the key functions that support your business and the scope to which you wish the plan to be restricted.
• Objectives - Identify the objectives you wish to cover specifically tailored to your organisation.  As the plan will be a generic plan, which can be used to cover most emergency situations, you will need to make assumptions that will be recorded within the plan.
• Plan Owner - It is always worthwhile identifying the plan owner who takes responsibility with your organisation to ensure that the plan is regularly reviewed, tested and updated.
• Structure of the Business Recovery Team - As a result of many major emergency, key staff that will be paramount to the recovery of your business will need to be identified and their roles and responsibilities known.  A common term for this group is the 'Business Recovery Team'.  Other areas that need to be identified for the team will include their accountability and the authority to which they can act.
• Critical Business Activities (Recovery Action Plan) - Your Business Continuity Planning team will need to review your critical business activities to identify where any risk to your business continuing after an emergency will occur.  These activities can then have a risk assessment undertaken with the resultant action to mitigate the risks.  A recovery action plan can then be produced and. for ease, can cover such items as power failure, loss of fresh water supplies, burst pipes, unplanned staff absences, emergency evacuation procedures, emergency procedures to be followed by a manager in the event of emergency relocation, fire damage and other contamination issues, and in this case, the loss of communications and information technology.
• Recovery Site Location - Identify a location from which you are able to run your business should your main site be lost due to the emergency.  You will need to review the type of location that you can work from during a phased approach to your business recovery.  For instance, during the first twenty-four hours, the site may be considerably smaller to that which is required after say one week.

To aid this recovery, a resource profile can be produced identifying the facilities and equipment you require as your business recovers over the recovery period.

Be aware of the types of emergencies that might effect your company both internally and externally.  Find out if there are any natural disasters that may put your businesses at risk.  These can be found in the community Risk Register, held by Hertfordshire County Council on their website.

In extreme circumstances, identify what to do during a CBRN attack (chemical, biological, radiological or nuclear attack).

• Supporting Information - You will already hold a considerable amount of information regarding your business.  This will include information around Health and Safety issues, communications (call-out list), emergency service liaison, financial and insurance details, any legal issues and important documents such as contracts, etc.  These should be held in a secure and accessible location should an incident or emergency occur.