Department - Business Continuity Plan Questionnaire
1.
List all business functions..
2.
List all computerized applications that support a critical/time-sensitive business function (that
cannot be done manually). NOTE: this list needs to be reviewed carefully by IS team since
some of the users may not know what systems support each critical function.
3.
Identify "interdependencies", what other department's do you depend on for critical functions?
4.
What impact would failure have on the applications listed above?
5.
How soon after a disaster would you need to restore the function listed above (for survival
mode not business as usual)? The time needed to restore the function of each application is
considered your Maximum Allowable Downtime (MAD). MAD is the period of time that a
function can be discontinued without major impact on customer service, revenue stream,
public credibility and contractual compliance.
6.
Please specify the MAD for each function listed above using one of the following:
Day 1 (within first 24 hours), 2 days, 3 days, 4 days, 5 days, one week, 2 weeks, 3 weeks, 4
weeks
7.
List all regulations or contractual obligations to clients that impact MAD (SAS70 compliance,
SEC Compliance, commitments made in proposals, Service Agreements, etc.).
8.
Please list the people in the department that you need to restore these functions within the
maximum allowable downtime (list names- attach another sheet if necessary):
9.
Do you have a manual work-around for any of the business functions listed?
If so, please document them?
10.
Have you ever tested your manual work-around procedures? When was the last time you
tested them?
11.
For each manual (work-around) system listed above, please indicate how long your
department could operate using these work-around procedures and if you will need more
personnel to do so. If you need more personnel, please indicate how many.
12.
Do you store critical or important information on local hard drives? If yes, please list what is
being stored locally and where it is being stored.
13.
When is the worst possible time for a disaster to occur for each critical function listed:
14.
Do you create your own reports?
If yes, list critical report names and where files are stored.
15.
Do you access the Internet or other networks outside of your company to support critical
functions?
2
If yes, please indicate the network you use and Internet addresses required.
16.
Does anyone in your department keep critical data at home?
If yes, who keeps it at home and what do they keep?
17.
Do your customers communicate with you over the Internet for your critical services?
If yes, what services?
18.
List all mission critical equipment (any devices, computers, fax machines, etc. that you need to
perform critical business functions).
19.
What is the location of all mission critical equipment?
VITAL RECORDS
How to identify Vital Records
- Any record needed to reconstruct the organization's critical business function.
-
Any record which outlines the organization's financial condition. It's debts, or receivables, which
cannot be reconstructed or which would be costly to reconstruct.
-
Any record which documents the legal position of the organization, including ownership, contracts,
etc.
-
Any record which documents significant or unique features of the organization's business/service.
Examples of Vital Records
*Any document with original signatures
*Inventory lists
Real property (furniture, etc.)
Assets
List of all IS equipment
*Manuals
Procedures
Instructions
Work-around documentation
Training manuals
*Invoice/Billing information
*Accounting records
A/P - accounts payable
A/R - accounts receivable
GL - general ledger
*HR Records
*Customer Databases
*Backup Media (tapes, USB drives, Zip Drives, etc.)
*Legal records (Corporate Documents, Articles of Incorporation, Wills, Trusts, Insurance policies, etc.)
*Safety Inspection records
*Trademark/Copyright records
*New design plans, prints or drawings
*Artwork
3
*Business Continuity Plan
*Software (media and licenses)
*Compliance records
1099, SEC records, etc.
*Succession Plan
*Pictures of entire site (focus on equipment). Pictures should be taken annually
*As Built Drawings (plans - electrical, building systems, etc.)
*Training materials (manuals, videos, slides, etc.)
*Employee certification records & licensing documents
*Checks
*Specialized Forms
How to prioritize Vital Records
- Highest priority - anything that cannot be replaced
-
Medium priority - records that can be replaced but would either cost too much to replace them or
would take too long.
-
Low priority - records that are useful, but not essential
20.
List all of your Vital Records (Please specify the legal retention requirements for all vital
records)
21.
List the location of all vital records (room numbers, description of file cabinet/safe/vault).
22.
List vault, safe combinations and locations of file cabinet, door or safe keys. Please don't
document this information here. Indicate that you have it. We will collect it later.
23.
Do you have a vital record retrieval plan?
If so, please outline.
CRITICAL VENDOR LIST
Examples of Critical Vendors
Mail services
Printing
Media Recovery
Off-site Storage (paper records, data)
Consultants (IS, architectural, etc.)
Event Management
Media Relations (public relations or crisis communications)
Trauma Counseling
Security
Financial/Accounting
Insurance (public adjusters, brokers)
Legal Counsel
Restoration (Service Master, Service Pro or BMS Cat, GC)
Hazardous materials/environmental
Temporary Help
Moving Company
4
Trash Removal
Product vendors
General Contractor
IS Supplies & Services
Transportation
Medical Specialists
Hot Site
Utilities
Hard Goods (furniture, fixtures)
Soft Goods (carpets, drapes)
Contract Caterers
Sanitation Facilities
Equipment Rental (generators, dehumidifiers, fulfillment)
Real Estate (temporary offices, new site location)
Water/Mildew Control
Office Supplies
Property Management
Telecom System Providers
Travel
Safety/Health (hard hats, shoes, clothing)
Payroll
Forensic Services
Environmental Health and Safety
Fire Protection
Special Accounting (claims management services, record assembly)
Landscaping
24.
Please list all of your critical vendors.
25.
What materials, supplies, files, etc. would you want to include in a "disaster kit" to be stored
off-site?