How do we write a continuity plan a site or department can use when the systems are down?

Start

You are writing the continuity plan for one site or unit

The plan keeps one site's or unit's part of the critical services running when it loses its building, its people, a supplier or its systems. It hands over to each service's own recovery plan for the recovery itself and never repeats those steps. The site or unit continuity lead writes and owns it.

• Then: Say what the site carries and the reduced level it keeps going

Step

Say what the site carries and the reduced level it keeps going

List the critical services the site carries a part of, with their objectives copied from the objectives matrix and never set in the plan. Copy the processes it runs and when each one's harm reaches Severe. Agree the reduced level with each service's business owner, in words the site can act on.

• Then: Does the plan answer all four losses?

Decision

Does the plan answer all four losses?

The four losses are the building, a large part of the people at once, a supplier the site relies on, and its systems. Plan for the loss, not its cause: a fire, a flood and a long power cut call for the same response. The usual mistake is a plan that covers systems but not the building, people or suppliers. If one is missing, or you cannot tell, answer no.

• Yes: For lost systems, run each service's own workaround
• No, or not known: Write the response, target and lead for each loss

Step

Write the response, target and lead for each loss

For each loss say what counts as the loss, what the site does once the crisis lead invokes the plan, a target it can measure, who leads and what it needs. Compare each target with the recovery time objective of every service the site carries; where it is longer, say what keeps the service going meanwhile. Where one loss brings another, the larger loss's response applies.

• Then: For lost systems, run each service's own workaround

Step

For lost systems, run each service's own workaround

The site does not plan its own way round each system. It runs the workaround of each service it carries, as that service's business owner wrote and accepted it, and leaves the recovery of systems to the IT disaster recovery procedure and each service's plan. A workaround never tried is recorded as untried until a trial is held.

• Then: If an attack is the cause, P09 runs the incident

Step

If an attack is the cause, P09 runs the incident

Where the systems are lost to a cyberattack, the incident is P09's. The site works on the workaround and reconnects only when the incident manager allows it, one part at a time. The plan quotes P09's rules and decisions by ID and changes none of them. Do not copy those decisions into your own plan.

• Then: Is the least the reduced level needs counted for this site?

Decision

Is the least the reduced level needs counted for this site?

Count people, space, equipment, systems, suppliers, records and communication for the reduced level, not for a normal day. The count tells a receiving site how much space to clear and an agency how many people to send. Count skills as well as heads. If the figures come from the whole service rather than this site, answer no.

• Yes: Are vital records listed, reachable without the systems, kept current?
• No, or not known: Count the minimum resources and where each comes from

Step

Count the minimum resources and where each comes from

Start from the least each process needs in the business impact analysis. A crew with no forklift driver or no first-aider cannot work, so name the skills. For each resource say where it comes from if the site loses its own. The analysis counts people across the service; the plan counts them for this site alone.

• Then: Are vital records listed, reachable without the systems, kept current?

Decision

Are vital records listed, reachable without the systems, kept current?

Vital records are those a process cannot run without, such as next day's pick lists. One that is out of date is not vital. Each needs a keeper, a place it can be reached when the systems and the building are down, and a rhythm for refreshing it. If any can be reached only through the systems that are down, or you cannot tell, answer no.

• Yes: Can the lead take the first steps without waiting for anyone?
• No, or not known: List each vital record, its keeper and how it is kept current

Step

List each vital record, its keeper and how it is kept current

Take the records from the business impact analysis. Give each a place reachable without the systems, a role who keeps it and how often it is refreshed. Paper copies that hold personal data are locked away, counted back and shredded after use. Add the records of processes that can wait longer if they must go on through a long loss.

• Then: Can the lead take the first steps without waiting for anyone?

Decision

Can the lead take the first steps without waiting for anyone?

The lead takes some steps at once, and the crisis lead invokes the rest. A lead who must wait for permission to get people out is too slow. A site that moves its work to another site on its own leaves the crisis lead blind. If the lead's steps are unwritten, or depend on a call that may not be answered, answer no.

• Yes: Can a copy of the plan be reached without the main systems?
• No, or not known: Put the first steps and the call tree on one printed page

Step

Put the first steps and the call tree on one printed page

The card names the lead's steps: make people safe, start the call tree, call the crisis lead, keep the vital records at hand, ask whether it could be an attack, start the site log and prepare the response. The template's default is the crisis lead's deputy if there is no answer within 30 minutes. List the conditions on which the crisis lead invokes the rest, each one checkable at night.

• Then: Can a copy of the plan be reached without the main systems?

Decision

Can a copy of the plan be reached without the main systems?

Keeping the only copy of the plan on the systems it recovers is the mistake to avoid. The pack asks that a copy of the plan and of the contact lists can be reached when the main systems are down. If the only copy is online, or you cannot tell, answer no.

• Yes: Have the plan approved, then try it and review it
• No, or not known: Keep printed copies at the site and home, and one outside

Step

Keep printed copies at the site and home, and one outside

The template's examples are a printed copy at the site, copies held at home by the lead and deputy, and a copy outside your own systems, in a store whose sign-in does not use the production directory. Each holds the whole plan, the first-steps card and the call tree at the current version. Check each copy on a set rhythm and after every review.

• Then: Have the plan approved, then try it and review it

Outcome

Have the plan approved, then try it and review it

The policy owner approves the plan after consulting each service's business owner and the resilience coordinator, and the crisis lead is told. Print it and put the copies where it says. Book the first trial of each untried workaround. The pack's default is review at least every 12 months, after the plan is used or tried and after a significant change.