Name of Committee
Date of Committee
Audit
18-06-12
Agenda Item No________13_____
Business Continuity
Summary:
Six monthly update on business continuity planning, the
progress made to date, ability to respond to any disruptive
events that have recently occurred and the outline of future
objectives.
Conclusions:
Recommendations:
That members note the contents of the report.
Cabinet member(s):
Ward(s) affected:
All
All
Contact Officer, telephone number, Richard Cook
01263 516269
and e-mail:
richard.cook@north-norfolk.gov.uk
1.
Introduction
Part of the Civil Contingencies team’s (CCT) role is to ensure that the Authority has a
robust and effective business continuity plan (BCP) in place. As reported previously
CCT are working with Service Managers to ensure that all relevant plans are up to date
and appropriate.
1.
Team Business Continuity Plans
Of the 25 teams that require BC plans I have now received 10. Many other managers
have their plans is various levels in draft form. I have made appointments available with
Service Managers to give support and guidance to help them complete their plans. The
completion of the team plans has been delayed due to the SMT re-structuring and I will
be starting a new drive to ensure all BC plans are completed once this process is
complete.
2.
Business Continuity Working Group (BCWG)
To ensure that business continuity is embedded within the organisation there is a
business continuity working group (BCWG). Cllr John Lee sits on the group and
provides valuable member input. The BCWG meets on a monthly basis and have
Name of Committee
Date of Committee
Audit
18-06-12
produced some good ideas. These meetings improves the groups understand and
value to drive BC to become a main stream activity within the Authority.
3.
Disruptive Events
No disruptive events to report at NNDC however, the Olympic Torch Relay planning has
had a large effect upon my day to day work load and it is envisaged this will continue
until after the torch event.
4.
Standby Power
An agreement now exists with Stuart Power and a call out procedure has been initiated
in the revised corporate BCP. The resilience of this procedure has been further
enhanced by having a mirrored agreement with 2 further companies, namely Kings and
Barnham and Agreeko.
5.
Corporate BC Plan
The NNDC Corporate BC plan and Policy is still on track to be revised and peered
reviewed by the BCWG before passing to CLT for confirmation and adoption. It is
anticipated that this will be completed within 3 months.
6.
Annex Disaster Recovery (DR) and Victory Housing Trust (VHT) Reciprocal
ICT Service Agreement
The planning relocation of the DR and WAR sites to the Fakenham Connect Building
are still on-going. IT has requested that BT install a fast broadband line to connect
Cromer offices to Fakenham. Once this is completed the servers and additional
equipment will be installed. The DR and WAR capability available at the annex will not
be removed until the new facility is complete and fully tested. The Facilities will be
shared with Kings Lynn and West Norfolk Borough Councils and this will give greater
resilience as they will be two dedicated high speed broadband lines into the building.
Name of Committee
Date of Committee
Audit
18-06-12
7.
Response to Limited assurance given in the Internal Business Continuity
Report Apr 2012
Recommendation
Action
The senior management statement
contained within the foreword section of
the top level plan should be updated to
reflect the changed senior management
team.
Senior Management Structure changed on
the 1st February 2012. The Top Level BCP
is currently being reviewed. The change of
forward will form part of the review and the
action has been completed but will not be
live until all team plans have been fed into it.
This should be completed within 3 months.
Target date Aug 2012
Management should ensure that a plan is
developed and put in place to ensure that
Business Continuity is well promoted on
an on-going basis and does not fall by the
wayside following the recent push for
development and review.
This will be delivered from the BCWG and
forms part of the further embedding of BC
across the Authority. The BCWG has
monthly meetings. The intranet and the
briefing have been used to pass on BC
information to all staff. The BC week was
used to display literature around the
building.
This on- going and will be maintained
The BCP development process should be
updated to ensure that adequate This process is being incorporated into BC
inventories are kept for each relevant planning process for teams.
team and/or department as appropriate
Target Date 31 Jul 2012
within their own 'grab bags' or similar,
covering:
•
Software, Hardware;
•
Utilities (power, lighting and other
related services);
•
Procedure/system manuals; and
•
Stationery.
Also, the review and update process
should ensure that regular reviews of
these inventories are carried out by each
team to ensure that their own inventories
are adequate for their changing needs.
Reviews should specifically be conducted
following major change, for example,
where a department has changed service
applications and any related business
processes.
Name of Committee
Date of Committee
Audit
18-06-12
The Business Continuity Plan should
include a current Communications and
Network topology diagram included as
part of the systems inventory, which
should be updated on a regular basis.
The ICT team will display a Network
Diagram in their team BC plan and all other
teams will list the IT team as a critical
supplier.
On-going requirement
Management should ensure that all
relevant team Business Continuity plans
undergo immediate review. Each plan
should also undergo regular review,
coordinated by the Civil Contingencies
Manager, or as delegated.
This is on-going all team managers have
been asked to complete team plans. Please
see Para 2 above.
Management should ensure that all team
plans use a consistent template style.
Any new plans will use the new template.
Plans that have been reviewed and agreed
within the last few months will be amended
to any new template as part of their next
review cycle.
Management should ensure that the list
that resulted from the 2009 Mexican
Wave exercise is updated to reflect the
current "Critical Functions List".
Recovery timescales for each of the listed
systems should also be included.
The BCWG have already reviewed the list
and have updated this. This list will also be
crossed checked against the returned team
BCP and will be feed back into the BCWG
to review the critical list before going in to
corporate plan via CLT and PRMB
A formal Business Continuity training
programme should be drafted, agreed
and implemented such that relevant
internal staff, external suppliers, etc. are
trained to understand the part they may
be required to play during a disaster.
This is being developed as part of BCWG
work plan.
Management should draft, agree and
implement a rolling Business Continuity
Testing programme that considers the
following areas as a minimum:
•
Availability of resources;
•
A test of every Council service on a
rolling basis;
•
Consideration of a full Council test
later on; and
•
The inclusion of external
This will be covered in the top level plan and
a rolling program will be implemented to
cover at least all critical areas.
Name of Committee
Date of Committee
Audit
18-06-12
suppliers/emergency services.
All tests should be measured against
expected outcomes and formally reported
to senior management.
Management should implement
processes that update the top level and
team plans following any testing. Agreed
formal change control processes should
be adopted to help ensure that only
approved changes are made to the plans.
The BC policy has the BC life cycle diagram
incorporated within it, this details how the
process will follow, i.e. write plans then train
the plans and the exercise the plans. Any
findings or recommendation found during
this process will be fed back in to improve
and continually develop the plan going
forward.
Management should ensure that suitable
Business Continuity related insurance is
in place and that the Corporate Business
Continuity Plan contains detailed
procedures for dealing with insurance
claims in the event of a Business
Continuity Plan invocation.
The Civil Contingencies Manager will
discuss the requirements with the Insurance
Team based on the outcomes of the BC
Review process to ensure that the
Authorities cover level remains appropriate.
In addition to the above actions the delivery of these business continuity objectives form
part of my appraisal objectives to timescales that reflect the target dates in the
management responses to the audit report.