For an organisation is large and diverse as the College it is usual for, every year, a number of department activities to experience some disruption for a plethora of reasons.  Normally these disruptions are of limited scope and duration but occasionally they can be extensive and/or prolonged. In extreme cases the disruption may affect substantial areas of College activity and persist for several months or even years; typically in the UK, one or two universities experience such an event every year.

The purpose of Business Continuity Planning is to assist departments protect their activities against such disruptions. Whilst, generally the impact of these incidents on the overall College are small, for the activity disrupted the impact can be large.  To protect against this the College has response and recovery processes to manage an incident should it occur.  However, the impact of an incident can often be significantly reduced and recovery significantly enhanced by prior application of simple resilience measures.  These may be identified by completion of an Activity Impact Analysis which will assist Heads of Department, Principle Investigators, Project Directors and others responsible for department activities or projects identify appropriate measures to provide resilience to those activities, in the event of disruption.

In order to assist recovery from an incident those responsible for department activities should complete the form at Annex A.  This identifies the critical activities[1] undertaken by the department and the impact if they were to be disrupted.  The reason for the disruption does not need to be considered, only the impact if the disruption was significant in extent and/or duration.

It is then necessary to consider the maximum tolerable period of disruption (known as the Recovery Time Objective) or how long before the impact of the disruption becomes intolerable. e.g. within 24hrs; a week; a month or longer.  The point to which the activity should be recovered is then identified (known as the Recovery Point Objective).  Ideally the activity would be recovered to the condition it was at when it was disrupted but in some cases this may not be necessary.

Once the Recovery Time and Recovery Point objectives have been quantified it is for consideration that the addition of some simple mitigation might significantly improve one or both of these, sometimes at minimal cost (e.g. back up of records, exam databases, or other necessary data; dispersed storage of essential supplies; cross training of staff).  These risk mitigations should be recorded and an agreed owner assigned to ensure timely implementation.  It is also for consideration that the recovery time and point could be considerably improved if a temporary lower level of service was accepted.  It may thus be possible to achieve a more rapid recovery if a minimum service level can be agreed and appropriate measures put in place to allow this to occur.  This minimum service level should be recorded, for future reference.  In some instances Recovery time and Point objectives may vary through the academic year and this may influence what mitigations are considered appropriate e.g. Staff availability and/or call out at certain times of year

Finally, it may be worth considering the priority in which services and activities are restored, after a disruption.  In the early stages of an incident service providers will use their own judgement in the restoration of services and activities.  However, during a prolonged disruption, an early assessment of the priority which the user would wish services and activities to be restored may be helpful and this is best assessed before any disruption occurs, although that view may be modified in the light of an actual event.

[1] Critical Activities: Vital functions without which an organization or group will either not survive or will lose the capability to effectively achieve its critical objectives.

Activity Impact Analysis Template

Activity Impact Analysis template image:

Annex A Activity Impact Analysis image