LSE Local Business Continuity Plan Template – revised December 2011 THE LONDON SCHOOL OF ECONOMICS & POLITICAL SCIENCE LOCAL BUSINESS CONTINUITY PLAN UNIT/FUNCTION COVERED BY PLAN <insert unit or function> CONTENTS OF PLAN PART I: PRE-INCIDENT PLANNING 2 PART II: ACTION TO BE TAKEN WHEN DISRUPTION OCCURS 8 FORM 1: SUMMARY OF BUSINESS RECOVERY PRIORITIES AND RESOURCES REQUIRED FOR RECOVERY FROM BUSINESS IMPACT ANALYSIS 11 FORM 2: AREA-SPECIFIC BUSINESS RECOVERY TEAM TASKS 12 FORM 3: BUSINESS RECOVERY TEAM LEADERS INITIAL ASSESSMENT FORM 14 FORM 4: INCIDENT LOG 15 1/17 LSE Local Business Continuity Plan Template – revised December 2011 THE LONDON SCHOOL OF ECONOMICS AND POLITICAL SCIENCE LOCAL BUSINESS CONTINUITY PLAN Activity/function/procedure covered by this Plan .<insert activity, function or procedure> Planning Scenario (common to all areas) This plan framework is intended to be flexible enou to help plan for the recovery of the activity/function/procedure named above in an incident with one of the following 3 " generic" impacts: the loss of the availability of the building and infrastructure from which the activity/function/procedure is normally delivered for a period of up to 15 working days ( arising from for example, a fire, an explosion, utility failure, or the failure of an element of the infrastructure making the building unusable eg fire detection and alarm equipment. In some incidents of this kind some staff may also be unavailable ) the loss of availability of staff, but continued availability, of the building and infrastructure from which the activity/function/procedure is normally delivered for a period of up to 15 working days (arising from example, a flu pandemic, extreme weather conditions and travel difficulties, industrial action) the loss of the infrastructure, but continued availability of the building and staff normally delivering the activity/function/procedure for a period of up to 15 working days (arising from, for example, a major IT outage) Time/period of maximum disruption The plan should be focused on the time(s) at which an incident would be most disruptive in terms of the key dates and periods of time for the activity/function/process covered by the plan is <insert dates/periods, referring to the Calendar of key dates for business critical acitivities> PART I: PRE-INCIDENT PLANNING PURPOSE OF PART I Part I of the Plan identifies: the issues that will be addressed in advance so that, should disruption occur, there will be a framework in place to keep the impact within acceptable limits the pre-incident actions that will be taken to address these issues and the responsibility for taking the actions; and provides a record of confirmation that the actions have been taken Action 1. ESTABLISH THE BUSINESS RECOVERY TEAM The primary task of the Team is to keep the impact of the disruption within acceptable limits rather than restore full service Issue to be considered Person(s) responsible for ensuring issue is actioned Output of consideration of issue (a) Identify the key staff needed to manage recovery operations who will form the local Business Recovery Team (BRT) <Name of person responsible for actioning> (a) The members of the BRT are: <Insert Names> <Name of person responsible for actioning > (b) BRT has met to discuss completion of Part I of this plan <Record dates of meetings held and those who attended> . (b) Engage BRT members in discussion of the detail of implementing preincident planning actions (c) Assign a member of the BRT to liaise with the School’s Emergency Management Team (EMT) <Name of person responsible for actioning > 2/17 (c) The member of BRT assigned to liaise with the EMT is: <Insert Name> Action Completed ? LSE Local Business Continuity Plan Template – revised December 2011 (d) Assign BRT members specific tasks for the recovery of the activity, function or procedures covered by this plan (e) Assign a member of the BRT to compile and maintain a list of the contact details of BRT members to be kept offsite in an easily accessible offsite location Action Issues to be considered 2. APPOINT SUBSTITUTE MEMBERS OF THE BUSINESS RECOVERY TEAM (a) Identify substitute members of the recovery team to ensure that, if one or more members of the BRT are unavailable, recovery can continue: <Name of person responsible for actioning > <Name of person responsible for actioning > Person(s) responsible for ensuring issue is actioned <Name of person responsible for actioning> (d) The specific recovery tasks assigned to BRT members are recorded on Form 2 attached (e1) The person assigned to compile and maintain the list is: <Insert Name> (e2)The offsite location(s) where contact lists will be stored are: <Insert location and means of access> Output of consideration of issue (a) The substitute members of the recovery team are: <Insert names> (b)Obtain the agreement of substitutes to stand in for BRT members and confirmation of their willingness to be available during the critical period of disruption <Name of person responsible for actioning> (b) Agreements of substitutes to stand in and be available have been obtained from: <Insert names of alternates from whom agreements obtained> (c) Keep details of BRT substitutes off site with details of the main team <Name of person responsible for actioning> (c) <insert location identified at 1(e2) above> Action Issue to be considered Person(s) responsible for ensuring issue is actioned Output of consideration of issue 3. (a) Arrange familiarisation session for all members of the BRT to talk through the local Business Recovery Plan at the earliest opportunity Who will substitute if key members of the BRT are not available? TRAIN THE BUSINESS RECOVERY TEAM Do all BRT members know what to do in the event of a major disruption to usual service? Action (b) Arrange Regular refresher sessions for regular and substitute BRT members Issue to be considered <Name of person responsible for actioning > <Name of person responsible for actioning> Person(s) responsible for ensuring issue is actioned 3/17 Action Completed ? Action Completed (a) Introductory sessions to discuss of the local BRP have been held <Record details of session held and those attending> (b) Arrangements for refresher sessions are established and sessions arranged and held <Record details of refresher sessions held and those attending> Output of consideration of issue Action Completed LSE Local Business Continuity Plan Template – revised December 2011 4. ENSURE ACCESS TO PROCEDURES AND EQUIPMENT How will it be ensured that procedures and any vital equipment be accessible? (a) Assign responsibility for ensuring that up-to-date copies of critical office procedures are made available at all times in the LSE Emergency Management Centres in Tower 1 and Rosebery Avenue and that all BRT members are be aware of their location (b) Store the procedures on USBs (data sticks) to ensure electronic access <Name of person responsible for actioning> (a1) Responsibility for ensuring office procedures are kept in the EMCs and kept up to date is assigned to <insert name> (a2) Keep record of when revised procedures last sent to EMC: <Record the last date on which procedures sent> <Name of person responsible for actioning> (a3) Notify all BRT members of that procedures are located in the EMCs: <Insert names of members notified> (b1) Responsibility for maintaining up to date information on procedures on USBs is assigned to: <insert name> (b2) Keep record of when procedures on USBs in EMCs last revised <insert date of last revision> (c) Make arrangements with ITS to save key procedural documents in an offsite critical data repository allowing easy access even in the event of a major disruption to IT services <Name of person responsible for actioning (c) Responsibility for making arrangements with ITS to save key procedural documents in the critical data repository is assigned to <insert name> <Name of person responsible for actioning (d) Record date on which notification sent and to which members of DMT <insert name and date of notification> Issue to be considered Person(s) responsible for ensuring issue is actioned Output of consideration of issue (a) Identify recovery priorities, recovery times and the resources required for recovery. Resource issues include:- <Name of person responsible for actioning> (a1) BRT to agree and record the recovery priorities for the process, function, office or division covered by this plan on Form 1 (attached) (d) Make sure all BRT members are aware that equipment that may be necessary in an emergency is kept in centrally maintained “battle bags” stored in the Emergency Management Centre Action 5. IDENTIFY PRIORITIES FOR THE RESUMPTION OF BUSINESS CRITICAL OPERATIONS <insert name of person responsible for completing Form 1 and recording the decisions on matters below on it> What are the priorities for recovery, how soon must they be 4/17 Action Completed LSE Local Business Continuity Plan Template – revised December 2011 recovered, what resources are needed for recovery? <insert date of last revision to Form 1> <Name of person responsible for actioning> (a2) BRT to agree and record the recovery times for the recovery priorities on Form 1 (attached) <insert date of last revision to Form 1> (i) STAFF Identify the staff needed to carry out business recovery operations ensure that their contact details are kept outside the office at all times on USB sticks and in hard copy ensure that any contractual issues with them being called to work longer hours, out of hours or at weekends are discussed and resolved with Human Resources <Name of person responsible for actioning> (i) STAFF (a3) BRT to agree and record the staff needed to recover priorities within recovery times on Form 1 (attached) <insert date of last revision to Form 1> (a4) Assign responsibility for keeping recovery staff contact details are kept in an agreed offsite location and updating them as necessary <insert name of person responsible > (a5) Assign responsibility for dealing with any contractual issues in relation to business recovery staff; the person responsible person will record any contractual arrangements and ensure they are kept in a location agreed with the BRT <insert name of person responsible > <insert name of any member of staff for whom contractual arrangements made> <insert location of agreement covering contractual issues> (ii) IT Ensure that recovery times in the local business recovery plan are compatible with the recovery times shown in the ICT Statement of Recovery for the relevant applications <Name of person responsible for actioning> (ii) IT (a6) Assign responsibility for maintaining the integrity of the information relating to IT resources on Form 1 <insert name of person responsible > appoint a Member of BRT to be the contact with IT Services in the event of a disruption (a7) Assign responsibility for contact with IT Services in an incident 5/17 LSE Local Business Continuity Plan Template – revised December 2011 <insert name of person responsible > All BRT members should be familiar with the recovery times for systems , taking note that the ICT Statement of Recovery provides for the restoration of readonly availability of all centrally supported systems within 4 hrs (a8) Assign responsibility for ensuring that all BRT members are familiar with the ICT Statement of Recovery <insert name of person responsible > <insert details of action taken to ensure familiarity> If applicable, make MIS aware rapid recovery times apply at weekends and other out-of-hours times at certain business-critical times of year Identify and incorporate workarounds to manage the non-availability of IT systems into plans for handling the first 4 hrs of a disruption (iii) SPACE (a9) If applicable : ensure MIS are notified rapid recovery times apply at weekends and out of hours at business critical times <insert name of person responsible > > (a10) ensure workrounds are identified and included in plans to manage the first 4 hours an outage without IT <insert name of person responsible <Name of person responsible for actioning> Establish space requirements for recovery (iii) SPACE (a11) BRT to agree and record the number of networked workplaces needed for recovery and phasing of requirement <insert date of last revision to Form 1> BRT to be aware that the School’s Emergency Management Team will endeavour to provide the number of seats in replacement accommodation identified within 4 hrs (a12) Record action taken to make BRT aware BRT to be aware that the precise location of the alternative location will be notified by the EMT to the BRT Manager (see Part II) BRT to be aware that EMT will also notify the BRT Manager where the team may temporarily assemble before moving (a13) Record action taken to make BRT aware <insert name of person responsible > <insert details of action taken to ensure familiarity> <insert name of person responsible > <insert details of action taken to ensure familiarity> (a14) Record action taken to make BRT aware 6/17 LSE Local Business Continuity Plan Template – revised December 2011 <insert name of person responsible > to the replacement accommodation (iv) OTHER DEPENDENCIES Identify other internal organisational units and external entities which will be needed to contribute to the delivery of your operations BRT to be aware in an incident the School’s EMT will inform them of the extent to which their internal dependencies are able to maintain their contribution to the recovery of their operations 10. ISSUES SPECIFIC TO OFFICE/FUNCTION <Name of person responsible for actioning> <insert details of action taken to ensure familiarity (iv) OTHER DEPENDENCIES (a15) BRT to agree and record other dependencies for recovery <insert date of last revision to Form 1> (a16) BRT to be made aware <insert details of action taken to ensure familiarity 1. Sub-Board meetings Sub-Boards must consider setting contingency meeting dates in case of disruption Issues 1-9 are common to all BRTs IB/TM/RE 2. Systems necessary The Issues and suggested actions in 10 are specific to this function. They have been identified in discussion with the Director of Business Continuity and will be addressed by the BCT for the function and incorporated into the Office Procedures and Schedule of Recovery Tasks (Form 2) Recovery at 12 hrs will need OPERA, HALLPAD and access to the P:Drive. The P:Drive may be subject subject to 3 days recovery (?). Opera and Hallpad to be confirmed. Solutions: Daily backup of information will be stored in the critical data repository and on USB so that it will quickly be available in a recovery situation The ability to process information from saved report will be tested TM/IB TM/IB 3. Application deadlines and deadlines to respond to offers of accommodation extension The Head of Residential Live will be asked to consider extending the period to apply and respond to offers of accommodation to allow a buffer as there is already a lot of pressure to meet deadlines in the event of a crisis happening at this 7/17 LSE Local Business Continuity Plan Template – revised December 2011 time stress levels could increase significantly A situation causing more than 12 hrs disruption could have a significant impact in recruitment and credibility for the School. 8/17 LSE Local Business Continuity Plan Template – revised December 2011 PART II: ACTION TO BE TAKEN WHEN A DISRUPTION TO SERVICE OCCURS Purpose Part II of the Plan provides a complete set of instructions for the BRT when an incident and disruption occur. The actions assume that the pre-incident actions in Part I of the Plan have been implemented. STEPS TO BE TAKEN WITHIN FIRST 48 HOURS OF DISRUPTION ISSUE ACTIONS NEEDED 11. MOBILISE BUSINESS RECOVERY TEAM The EMT will communicate with the BRT Manager to advise them of the current situation and offer guidance on how they should proceed. RESPONSIBILITY RE The situation will be appraised using Form 3 and as appropriate the BRT members will be contacted to set up a meeting at a convenient location. 12. INITIATE INCIDENT LOG The BRT Manager will appoint a “scribe” to record all events and decisions made, including when and by whom actions are taken using Form 4. RE IB The scribe will also maintain information on expenses incurred as a result of the disruption (food, accommodation etc.). 13. OBTAIN EMERGENCY PROCEDURE FOLDER AND “BATTLE BAG” The BRT members will obtain the procedure folder and ‘’battle bag’’ from the EMC as soon as the team has been contacted to meet and take them to team location. IB/TM 14. ASSESS SITUATION The BRT will discuss and agree how the situation affects the function. RE/IB/TM The BRT will refer to the Recovery Requirements on Form 1 and Specific Task Table on Form 2 and assess whether the priorities and information on Forms 1 and 2 are appropriate to respond to the situation. 15. ASSESS IMPACT OF DATA LOSS Once the position regarding any loss of recent data from systems is clarified through restoring data from backups taken from a point in time prior to the incident, it will be determined whether or not it is advisable, practical and cost-effective to recreate the lost data. Form 2 contains information regarding manual data recovery. 9/17 RE/IB/TM Action Taken? LSE Local Business Continuity Plan Template – revised December 2011 16. COMMENCE RECOVERY AND IMPLEMENT BUSINESS CONTINUITY PLAN The EMT will keep the BRT informed of the chosen recovery location(s) and the current situation regarding the availability of seats, IT systems, communications and other resources. EMT The BRT will ensure continuity is managed in a way that is appropriate to the recovery resources provided. RE/IB/TM It is essential to focus only on business critical activities. THE FOLLOWING ACTIONS SHOULD INITIALLY BE TAKEN WITHIN THE FIRST 48 HOURS AND WILL CONTINUE DURING THE RECOVERY STAGE UNTIL THE “BUSINESS AS USUAL” STAGE STARTS AFTER 7 DAYS 17. CONTACT AND COORDINATE STAFF With direction from the EMT, a method(s) will be agreed for contacting staff and the information and guidance that should be provided. Key staff needed to carry out a role during the early stages of business continuity will be agreed. It will also be agreed which staff will not be required for a while. The task of contacting staff will be allocated to one, or more, team members and provide information and guidance, as required. Staff recovery will be co-ordinated, making best use of designated recovery locations, and provide assistance in areas such as arranging transport, authorising expenses costs and sourcing mobile phones or other requirements. EMT IB/TM IB/TM IB/TM 18. RESCHEDULE APPOINTMENTS 19. COMMUNICATE WITH EMERGENCY MANAGEMENT TEAM Staff will review imminent appointments and ensure these are rescheduled accordingly. IB/TM BRT will communicate with the EMT to ensure that the most up to date information on the situation is made available and that the timescales identified within the Plan for resource recovery are being met. The EMT will be informed of any problems or issues, as they arise, and provide regular status reports. EMT/RE 20. USE AVAILABLE COMMUNICATION METHODS EFFECTIVELY If the usual phone capability has been reduced, use will be made of alternative methods to ensure communication continues (e.g. mobiles, home phones, sat phones, home email accounts etc.). 21. DETERMINE SCOPE If possible, working from home or another remote location will be implemented to 10/17 TM/RE as they both have school’s phones. Home numbers and home email accounts available in the contacts list. See contacts lists LSE Local Business Continuity Plan Template – revised December 2011 FOR WORKING FROM HOME OR OTHER REMOTE LOCATION maintain continuity of critical activities, using personal email addresses and mobile phones to communicate. for alternative contact details. (Worth having a gmail account live?) THE FOLLOWING ACTIONS SHOULD BE TAKEN AFTER 7 DAYS 22. RECOVER TO BUSINESS AS USUAL STATUS Under direction from the EMT, there will be a recovery back to “business as usual” status once resources allow, using plans created by the EMT. EMT/RE 23. POST-RECOVERY ASSESS PAPER LOSS IMPACT Once the position regarding paper loss is clarified, it will be determined whether or not it is advisable, practical and cost-effective to recreate the lost paperwork. IB/TM 24. POST-RECOVERY REASSESS IMPACT Once recovery is complete, the BRT will ask staff to reassess the impact on their work and reprioritise accordingly, considering overtime/use of temporary staff as appropriate to manage any backlogs to return to “business as usual” status. IB/TM 11/17 LSE Local Business Continuity Plan Template – revised December 2011 FORM 1 SUMMARY OF BUSINESS RECOVERY PRIORITIES AND RESOURCES REQUIRED FOR RECOVERY FROM BUSINESS IMPACT ANALYSIS Purpose: This form provides a summary of the business recovery priorities for the office or function and the resources identified as necessary to enable recovery. OFFICE/FUNCTION: Accommodation Office BUSINESS RECOVERY PRIORITIES FOR OFFICE/FUNCTION Objective Recovery Time Ability to process applications of Maximum 4 Hours accommodation, to meet original deadlines and achieving occupancy level targets. MINIMUM SEATING REQUIREMENTS IN ALTERNATIVE LOCATION No of seats at recovery location (desk, PC, phone, printer, photocopier) In 4 hrs In 24 hrs In 3 days In 1 week In 2 weeks 8 8 3 5 8 Notes Communicate applicants alternative ways of apply for accommodation. Ability to know who has accepted spaces and where. Ability to assess the level and location of vacancies. Notes If space is not available, work from home may be enabled. MIS RESOURCE RECOVERY First point at which a resource will be required. Assumes incident occurs at a critical time Item In 4 hrs In 24 hrs In 3 In 1 wk In 2wks In 1 mth Notes days Access to Hallpad Access to Opera Access to P drive Access to email Access to SITS Not necessary for Summer School NON- MIS RESOURCE RECOVERY First point at which a resource will be required. Assumes incident occurs at a critical time Item In 4 hrs In 24 hrs In 3 In 1 wk In 2wks In 1 mth Notes days Please see section 9 in Part I OTHER INFORMATION Please see section 10 in Part I 12/17 LSE Local Business Continuity Plan Template – revised December 2011 FORM 2 AREA-SPECIFIC BUSINESS RECOVERY TEAM TASKS OFFICE/FUNCTION: Accommodation Office Purpose: This form is designed to summarise detailed actions the Recovery Team needs to take during an incident to achieve business recovery No. 1 2 Tasks and Procedures The actions defined below have been written assuming that the maximum outage of Hallpad and Opera will be up to a maximum of 24 hrs, which should be achievable. Pending this the BRT will: Take appropriate risk mitigation and contingency action throughout the 2 week period Save key data within critical data repository or on memory stick Maintain additional copies of key documentation Respon sibility of: BRT – same for 2 to 12 Phase () 0 to 48 hrs 3 to 6 days Stage of Procedure – Restore operations Applications can only be received if both the website and Hallpad are working, which should be restored in 24 hours. On the assumption the maximum unavailability of systems will be 24 hrs, suspend sending or receiving any offers until systems are available. Post information on website if available. Advise staff and contacts accordingly. 3 Once resources become available, advise staff accordingly, making them aware of any alternative office arrangements. If required, ask staff whether they are available to work overtime (Sundays, evenings, etc.) or from home. Offer incentives if appropriate. 4 If delivery of offers or communications with students is behind schedule Consider supplementing staff with residences and other RCSD staff, making effective use of overtime Reschedule activity in priority order, focusing on maintaining communication with students at all times and achieve occupancy levels. Communicate with residences that they may not receive the required information in time or in the expected format. Stage of Procedure - Communicate with students and residences 13/17 Over 7 days When Complete LSE Local Business Continuity Plan Template – revised December 2011 No. Tasks and Procedures Respon sibility of: Phase () 0 to 48 hrs 3 to 6 days 5 Continue to provide advice, support and information to Students via email and phone. Communicate new deadlines if necessary. 6 Coordinate staff to ensure that they can provide students support service at a satisfactory level. 7 Take into account that residences may require up to date information very often at key times and we may need to provide manual updates to avoid major disruption. Stage of Procedure - Restoring offer and acceptance processes Contact Residences Fees Await information of how best to process payments if systems are not restored prior making new offers Effectively manage staff and overtime to ensure that any time lost can be caught up quickly 8 9 Focus upon receiving applications and processing offers (24 hrs suspension of activity should still enable deadline to be met) 10 Put staff resources in place to deal manually with last minute changes and queries (change of dates, updates from DWO, residences updates in availability, requests for changes from students, etc). 11 If required, consider extending deadlines and postpone payments 12 Should Hallpad/Opera be unavailable consider utilising paper lists for residences. Available from backups and manual updates. Communicate with different departments and service providers (CRM, Sanctuary, UL), advising of alternative communication methods and/or implications of disruption. Request their assistance with student communication, if appropriate. 14/17 Over 7 days When Complete LSE Local Business Continuity Plan Template – revised December 2011 FORM 3 BUSINESS RECOVERY TEAM LEADERS INITIAL ASSESSMENT FORM Purpose: This form is to be used to determine the impact of an incident on individual departments. OFFICE/FUNCTION: DATE AND NATURE OF INCIDENT Note: No action should be taken to recover without agreement from the Emergency Management Team. Assessment Question Which key staff from your team are unavailable? For how long? Logged Responses Which of your normal work areas are inaccessible but intact? Which of your normal work areas have been destroyed, damaged or made unusable? Which systems and other resources are unavailable (systems, telecomms, utilities)? Which of your area’s critical work-in-progress is lost? Which of your area’s critical assets and information have been lost? What are your team’s priorities and critical activities? What deadlines are imminent? Which recovery site/location would best satisfy your team’s immediate requirements (designated recovery site, hotel, home working etc.)? Which contingency agreements may need to be invoked to support your team’s recovery? How many people can work productively at home or mobile for the next few days? END OF FORM 3 15/17 LSE Local Business Continuity Plan Template – revised December 2011 FORM 4 INCIDENT LOG Purpose: The Incident Log on the following page is designed to be used by the Business Recovery Teams to record any events that occur or decisions taken. The completion of this log is important for post-incident review. OFFICE/FUNCTION: DATE AND NATURE OF INCIDENT Use the sheets as follows: make at least 2 copies of the Incident Log sheet make an entry for each significant action, decision or event, noting the date and time The team leader will sign off each entry made ensure that all staff involved in the recovery use the sheets. 16/17 LSE Local Business Continuity Plan Template – revised December 2011 INCIDENT LOG Team __________________________ Date Start Time End Time Sheet No. ______ By Whom Action Taken 17/17