If we lose a building or a large part of a team at once, how do we keep critical services running?

Start

We have lost a building, or much of a team, at once

A building is lost when people cannot work in it: fire, flood, a long power cut, a gas leak or a road closed by the police. People are lost when a large part of the team is absent at once, through illness, a transport strike or severe weather. The pack asks each site or business unit that a critical service needs for a continuity plan that covers both, so start with that plan.

• Then: The site lead takes the first steps at once, without waiting

Step

The site lead takes the first steps at once, without waiting

The lead, or the deputy, makes people safe, starts the call tree and calls the crisis lead, saying which loss it is, what still works and what is needed. If the crisis lead does not answer within 30 minutes (the pack's default), the lead calls the crisis lead's deputy. The crisis lead invokes the rest of the plan. A lead who must wait for permission to get people out is too slow.

• Then: Could a cyberattack be the cause?

Decision

Could a cyberattack be the cause?

A building or people loss usually has a plain cause, but the pack's first-steps card still asks whether it could be an attack. If it could be, the crisis lead is told so that the incident manager is called. If you cannot tell, answer yes.

• Yes, or not known: Tell the crisis lead; restart, reconnect and plug in nothing
• No: Check what the site or team carries, and what it shares

Step

Tell the crisis lead; restart, reconnect and plug in nothing

When a cyberattack is the cause, P09 runs the incident. The site works on the services' workarounds and reconnects only when the incident manager allows it, one part at a time. Nothing fails over or is restored until the incident manager confirms the copy or site can be trusted. P09 owns every decision right in an incident, so this flow points to P09 and changes none of them.

• Then: Check what the site or team carries, and what it shares

Step

Check what the site or team carries, and what it shares

List the critical services the site or team carries a part of, with their objectives, and the reduced level agreed with each business owner. In the dependency register a site or a group of people is a dependency, marked as a single point of failure if nothing could take its place. A dependency that several services share stops them all at once, so the crisis lead weighs it when setting the recovery order.

• Then: Ask the crisis lead to invoke the site plan

Step

Ask the crisis lead to invoke the site plan

The crisis lead invokes the plan when any one of the plan's conditions holds, for example a building unusable for longer than a set time (the pack's example is 2 hours) or more than a set number of people absent, such as a third. Keep each condition checkable at 3 a.m. The when and who of declaring is its own question.

• Then: Is the building lost?

Decision

Is the building lost?

If the building is lost, decide where the work goes, how much of it, and how people and vital records get there. If only people are lost, go straight to the minimum crew. If both, answer yes: the building loss brings the crew question with it.

• Yes: Can another site take the work?
• No, people only: Do you know the least crew each shift needs?

Decision

Can another site take the work?

Ask where the work could go, how much of it, and how people and vital records get there. The receiving site writes the work into its own plan with the space and people it needs. The dependency register records the alternative for a site. If you do not know whether another site can take it, answer no.

• Yes: Move the work, at the volume the other site can take
• No, or not known: No other place: the workaround covers the gap meanwhile

Step

Move the work, at the volume the other site can take

In the pack's worked example, two warehouses take the third warehouse's dispatch at reduced volume, perishable orders first, and staff who can travel move to them. Check who may enter the other place out of hours and how, when the access control system is down, and what power or cooling it needs. Take the vital records that can be reached safely.

• Then: Do you know the least crew each shift needs?

Step

No other place: the workaround covers the gap meanwhile

The plan's alternative place can be another site, a recovery site or working from home, with the volume it can take. A site with no alternative is marked in the dependency register as a single point of failure with none. Where that leaves a service outside its recovery time, it is an objective gap for its business owner to close. Meanwhile the service's workaround keeps the harm below Severe.

• Then: Do you know the least crew each shift needs?

Decision

Do you know the least crew each shift needs?

Count for the reduced level, not for a normal day. The pack's minimum resources table counts people a shift, with skills as well as heads: a crew with no forklift driver or no first-aider cannot work. If the minimum crew is not known, answer no.

• Yes: Can people from elsewhere fill the gap?
• No, or not known: Work it out from what each process needs, skills included

Step

Work it out from what each process needs, skills included

The business impact analysis gives, for each process the site runs, when it is busiest, the least it needs and its harm at each time point, including when it first reaches Severe. Agree the reduced level with the business owner. Then list the skills few people hold and who else holds them, such as licences, first aid or the only person who knows a process.

• Then: Can people from elsewhere fill the gap?

Decision

Can people from elsewhere fill the gap?

Cover can come from other sites, an agency or staff trained in a second role. Compare who is available with the minimum crew for each shift. Answer yes if there is no gap. If you cannot say who would come, answer no.

• Yes, or no gap: Run the minimum crew on every shift, with the cover
• No, or not known: Does the analysis show which work can wait, and for how long?

Step

Run the minimum crew on every shift, with the cover

The pack's target for a people loss is the minimum crew on every shift. The call tree tells the lead who is safe, who can work the next shift and who has not been reached, and it reaches the next shift as well as the current one. The lead leads the response and keeps the site log.

• Then: Is the target within each service's recovery time?

Decision

Does the analysis show which work can wait, and for how long?

When the crew cannot be filled, the work is cut to the reduced level. The point where each process's harm first reaches Severe shows what must be kept going first and what can wait. If the harm times are not known, answer no.

• Yes: Hold the work whose harm comes latest
• No, or not known: Ask the business owner which work waits, and agree it now

Step

Hold the work whose harm comes latest

In the pack's example, perishable orders go out on time and other orders up to a day later, while goods receiving and returns wait longer. That follows from the analysis of when harm reaches Severe. Tell the communications lead which work will be late so that customer messages can say so.

• Then: Is the target within each service's recovery time?

Step

Ask the business owner which work waits, and agree it now

The business owner of each service agrees the reduced level, in words the site can act on: which orders, which customers, how late. Without the analysis, ask the owner to decide now. Treat the pack's example of late orders as an illustration, not as your answer.

• Then: Is the target within each service's recovery time?

Decision

Is the target within each service's recovery time?

Compare each loss's target with the recovery time objective of every service the site carries. Where the target is longer, the plan says what keeps the service within its objective meanwhile. In the pack's example a 12-hour target is longer than an 8-hour objective, so the plan must say what keeps perishable orders on time or shorten the target with the business owner. If you cannot tell, answer no.

• Yes: Run at the reduced level, then switch back and review the plan
• No, or not known: Take the gap to the business owner of each service

Outcome

Run at the reduced level, then switch back and review the plan

The loss usually ends before the plan does. Switch back at a time the business owner agrees and the crisis lead approves, away from busy periods. Enter and reconcile what was done on paper, and collect the paper records. A plan never tried is a hypothesis, so try each loss in a walk-through or an exercise and review the plan after every use.

Outcome

Take the gap to the business owner of each service

The business owner of the service answers for closing an objective gap. The pack asks for the change that closes it, with a due date, within 10 working days by default. Until then, the service's workaround keeps the harm below Severe.