I guess I could start with some sort of situation or scenario telling you what should be in the BCP’s. Or I could just provide a long list that goes on forever based on what information and categories should be in the plan. A continuity plan should be action based and activity driven. Within the first three (3) pages there should be information that tells the reader what to do; not necessarily the ‘how’ of doing it but definitely ‘what’ needs to be done. Anything more than that and you’ve got too much “fluff” in your documentation.
One thing a BCP plan isn’t is a management reporting tool full of maps and information better kept in a program overview document – unless part of an activity. Too many plans satisfy the ego of management and contain nothing but irrelevant material that can’t be used in a real incident situation. You plough through pages and pages of material of how the continuity (or disaster) program was developed and what its goals are and never come across a single action item that tells you what you need to do. That’s not a continuity plan for anyone – it’s a management “feel good” document. It’s there to satisfy some manager who needs to feel as though they have a plan or to satisfy and audit requirement (either internal or external) because they found they didn’t have some sort of document they could call a contingency plan.
Let’s be honest, all areas of the organization needs to have a contingency plan; yes, that includes technology teams too. Let’s get something very clear here; technology and non-technology teams make up the ‘business’ or the ‘organization’ and they all contain people that work in a facility (or multiple locations) and utilize various tools and resources to get things accomplished. So, every department needs to have a documented contingency plan; how are they going to keep going when something occurs? Technology people aren’t immune to flu’s, transit strikes and other disruptions (if they are I want to know their secret!).
Have you caught what the three things are that should be in a contingency plan? I mentioned them in the last paragraph. No? OK, here they are:
1 – People,
2 – Places,
3 – Things.
Yes, it’s that simple…or is it. Let me explain why I have these three categories in every Business Continuity Plan (BCP) I’ve ever written.
First, people are in every department and located in every facility (or office) in which your company performs activities. Now, what happens when you start taking people away from those activities? Does it keep going? Maybe but at a degraded level of service I bet. Do you stop? No, you have to have a plan to keep the critical items continue so you don’t ‘go under.’ So you’ve got to address what to do when people start becoming unavailable and this means in a pandemic situation as well as other causes.
Secondly, there’s places, or to use a more common term, facilities. Every department should know what to do if they can’t get into their facility. All the equipment may be running just hunky-dory and everyone needed to work that day is available and ready to go but they can’t get into the building for whatever reason. Maybe there was a robbery in another tenant’s office (or worse) or a small fire in the cafeteria. No matter the cause, what does a department do when you take away their place of operations?
Third and last, what does a department do when you take away their things? When you take away all the toys they use to execute their activities. What do they do now? This can be technology related with such things as a particular application becoming unavailable or a system suddenly hiccups and doesn’t feel well or you take away printers or fax machines. It can mean anything that isn’t a person or a place.
I also want to note that “Things” can be external to a corporation and can include a combination of people (vendors & suppliers), places (distribution centres, manufacturing plans) and the things they use. As soon as you start to build up all the categories once more people begin to get confused and fall into the scenario trap but if you can keep things simple and related to People, Places and Things, contingencies will be much easily understood by everyone within the corporation.
All Business Continuity Plan (BCP) should address these. Of course, there may be other items you want to include (as long as it’s not fluff material that strokes management ego) but if these three things aren’t in the plan, you won’t have a comprehensive response. The positive of having people, places and things addressed in your plans means you can now throw all sort of situations and scenarios at it. You can investigate to see if you have the bases covered; tornadoes that cause facility damage but people are OK; hurricane’s that don’t cause facility damage but keep people away from the office; flu’s that keep people home but facilities and technology resources (and other resources) aren’t touched and are operating fine. You can go on and on but at least now, you can begin to address all those wonderful “what if” scenarios people ask you. If you have plans that address, people places and things, they can then answer their own questions.