BCM000 - BCP Handbook Sample NOV2020

Business Continuity Management Handbook

Table of How to Use This Handbook …………………………………………………. 3 Contents Incident, Crisis and Business Continuity Invocation Criteria ... 4 Business Continuity Response Flow …………………………………….. 5 Business Continuity Recovery Phase Checklist Summaries ….. 6 Loss of People Scenario …………………………..………………………………………. 7 Loss of Building Scenario …………………………………………………………………. 8 Loss of IT Scenario …………………………………………………………………………… 9 Loss of Key Suppliers Scenario …………………………………………………………. 10 Communications and Escalation Matrices …………………………… 11 Roles and Responsibilities …..…………………..………………………………………. 11 BC Comms Matrix ……………………………………………………………………………. 12 Post Incident Review Phase Checklist ………………………………….. 13 Critical Internal and External Contact Lists ………………………….. 14 Glossary of Terms ………………………………………………………………… 16 COPYRIGHT OPSCENTRE PTY LTD © 2020 2

How to Use This handbook is designed to be used by CLIENT’s Business Continuity This Command Team to respond to major business continuity disruptions. Handbook The scope of this handbook is limited to the key actions undertaken by the Command Team Members which support and centrally coordinate individual business continuity procedures during a major business continuity disruption. This handbook should be used in conjunction with CLIENT’s Command Team BCP. Note: the icon throughout the handbook indicates the relevant section(s) in the Command Team BCP The executive (the Business Continuity “Command Team” or CMT) has the following core responsibilities: • Determining if an incident/disaster impact is severe enough to activate the CMT Business Continuity Plan. The declaration team consists of the CEO, CLIENT- International Group along with selected members of the Command Team Business Continuity Plans are activated when a disruption occurs that adversely impacts on CLIENT-International normal business operations, and breaches, or has the potential to breach, the maximum acceptable outages, as defined by the CLIENT-International business units. • Overall control during a major disruption to key business activities. This Command Team BCP covers the activities of the CMT and is an overarching document to each of the individual CLI business unit Business Continuity Plans (BCPs). Refer ‘Critical Internal and External Contact Lists’ section in this handbook for contact numbers of the Command Team. COPYRIGHT OPSCENTRE PTY LTD © 2020 3

Incident, The criteria to be applied in determining whether this Plan should be activated, shall be Crisis and based on whether estimated timeframes for the recovery and reinstitution of affected Business resources (such as loss of building, loss of key people, loss of functional Infrastructure Continuity systems or loss of access to key suppliers) are expected to exceed predefined Recovery Invocation Time Objectives (RTO) for key business activities. Key business activities and their associated RTOs are to be listed in the Command Team BCP Section x can be used to Criteria determine whether a business continuity disruption should be declared. BCP Section x What do we know about the incident at this point in time? What is the Origin or Cause of the Crisis? What is the Current Level of Severity? What are the Probable Outcomes? What will Trigger further Damage? What Actions are Needed? Activate the CMT and Plan? COPYRIGHT OPSCENTRE PTY LTD © 2020 4

Business Continuity Response Flow BCP Introduction COPYRIGHT OPSCENTRE PTY LTD © 2020 5

Business The following sections include key considerations of Business Continuity Continuity Recovery Checklist for the following four (4) scenarios: Recovery Detailed checklists can be found in Section x to x of the Command Team BCP. Phase Loss of People Scenario …………………………..…………………………. 7 Checklist Loss of Building Scenario ……………………………………………………. 8 Summaries Loss of IT Scenario ……………………………………………………………… 9 Loss of Key Suppliers Scenario ……………………………………………. 10 BCP Sections x-x COPYRIGHT OPSCENTRE PTY LTD © 2020 6

Loss of People Scenario Major loss or absence of key staff, disruption impacting multiple critical business activity process or systems BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 7

Loss of Building Scenario Internal or external fire, internal or external flooding, storm damage, bomb threat, power or utilities failure, neighbouring event, health and safety violation, natural event BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 8

Loss of IT Scenario Hardware/software failure. Failure of communications (phone, fax, email), security breach (virus, hacking) BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 9

Loss of Key Supplier Scenario A key CLIENT-International Supplier is impacted by a crisis and is unable to supply products and services to CLIENT-International which will then impact CLIENT-International Customers BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 10

Communica Managing communications during an incident or crisis is a complex task and -tions and spans multiple channels, tools and methods. The following team has been Escalation assembled to manage multi-audience messaging and communications. Matrices Further, the Comms Matrix provides a visual representation of the Command Team and their communications responsibilities BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 11

Business Continuity Comms Matrix BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 12

Emergency Comms Set-up BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 13

Post Incident Review Phase Checklist BCP Section x COPYRIGHT OPSCENTRE PTY LTD © 2020 14

Critical Internal and External Contact Lists BCP Section 2.1 COPYRIGHT OPSCENTRE PTY LTD © 2020 15

Glossary of Incident Terms • Incident - An event that has the potential to cause interruption, disruption, loss, emergency, crisis, disaster, or catastrophe. • Incident Management - The process by which an organization responds to and controls an incident using emergency response procedures or plans. Business Continuity • Business Continuity - Capability of an organisation to continue delivery of products and services at acceptable predefined levels following a disruptive incident • Business Continuity Management - Holistic management process that identifies potential threats to CLIENT-International and the impacts to business operations those threats, if realised, might cause, and which provides a framework for building CLIENT-International’s resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities. Crisis • Crisis - A situation with a high level of uncertainty that disrupts the core activities and/or credibility of CLIENT-International and requires urgent action. • Crisis Management - The overall coordination of a CLIENT-International’s response to a crisis, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization’s profitability, reputation, and ability to operate. COPYRIGHT OPSCENTRE PTY LTD © 2020 16

CLIENT 17 BUSINESS CONTINUITY MANAGEMENT HANDBOOK FOR COMMAND TEAM COPYRIGHT OPSCENTRE PTY LTD © 2020