BUSINESS CONTINUITY STRATEGY
Business Continuity is defined as the capability of an organization to continue to conduct its normal activities at acceptable levels following a disruptive incident.
For the protection of the College’s Mission, Vision and Themes the College is committed to
Business Continuity Management. This involves:
- Prior planning and preparation to maintain an appropriate degree of organisational resilience to minimise the impact of and aid recovery from an incident
- Response procedures to manage an incident when it occurs
- Recovery processes to restore normal activity after a disruption of normal College activity
In order to deliver this the College will maintain and exercise procedures allowing it to:
- Identify and implement appropriate measures to minimise the impact of and recover from a disruption to normal activity
- Respond to a disruptive incident when it occurs
- Recover from the kinds of incident that may typically disrupt our ability to continue normal activity
The range of incidents that may befall the College are wide and diverse and these procedures are scoped to address events that may reasonably be anticipated to affect the College’s ability to operate normally. Consequently, the procedures are primarily targeted at the type of events that typically require an ICT and/or Estates Facilities response. However, there is scope within these procedures for senior management to form different groups to address particular issues as they arise and nothing in these procedures precludes management from exercising their professional judgement in initiating or modifying procedures to meet circumstances as they occur.
In order to satisfy themselves that, in the event of an incident, they have an appropriate level of resilience all academic and non-academic departments should complete and maintain an Activity Impact Analysis (AIA). These documents highlight core activities, the impact if those activities are disrupted, how quickly normal operations need to be restored in the event of a disruption and whether appropriate measures are in place to allow this to be achieved. (For more detail see Activity Impact Analysis)
As noted in the College’s Business Continuity Policy “A key element of the above philosophy is the ability to assemble the people most appropriate to the management of the incident or crisis and this requires robust call out procedures.” It is thus essential that both academic and non-academic departments maintain and regularly (at least twice a year) update lists of those people to be called in the event of an incident in their area of responsibility (see Callout Lists).
In the event of an incident escalation will normally be (see Escalation) via security or the appropriate help desk. If the incident cannot be managed at the local level, both ICT and Estates maintain core Crisis Management Groups (CMG) and, if required, the appropriate elements of the extended CMG will be called. Communications will also be informed, at an early stage, in order to monitor and manage social media. If the incident continues to escalate then additional people will be called in to assist the CMG as required (See CMG)
In the event of the incident becoming more serious it will be appropriate to inform the Senior Emergency Response Group (SERG). SERG consists of the President’s executive group and, if required, they will give strategic guidance to the CMG. (See SERG)
Recovery from less serious incidents may be achieved by those on site during response to the incident. However, more serious incidents may require a more prolonged recovery phase which may start whilst the incident is still in progress. Recovery from a significant incident would typically be academically led (appointed by the CMG, SERG, Faculty or Department as appropriate) and comprise a group with the appropriate professional skills to understand the impact of the loss and the measures necessary to achieve recovery. This group could include advisors from outside the College (e.g. assistance provided by our insurers). (See Recovery)
Response to an emergency can place extraordinary demands on staff so it is also important we continue to inform and train relevant staff with regard to emergency plans and roles & responsibilities. A training plan will be maintained. (See Training Plan)
Monitoring and reviewing of plans and procedures is a continual process (see BCM Lifecycle below). Details of review periodicity are identified in the relevant sections.
Next Review May 2017