Developing and Implementing a BCM Response

Home

BS25999

BS25999 Part 1 - Code of Practice

Developing and Implementing a BCM Response

In line with the business continuity management strategies, developing the BCM response is about getting on, creating plans and making arrangements to ensure the continuity of identified activities. It also deals with procedures for handling an incident.

Incident Response Structure and Plan

In responding to an incident, that may or may not require a BCM response, there are 4 key objectives

Confirm; what is happening?
Control; take control of the situation
Contain; make sure the incident does not escalate
Communicate, make sure all key stakeholders know what is happening and what to or not to do

The response mechanism is called the crisis or incident management team. This team should have the resources and plans to enable this response.

There are three broad stages to an incident;

BS25999.COM Sample Incident Diagram

Plans should have a clear scope, definition of purpose, invocation/activation procedures, ownership, roles and responsibilities, maintenance and relevant contact details.

The Incident Management Plan (IMP)

The incident management plan describes what to do in the early stages of an incident and should be structured so it is clearly legible and easy to understand.

Responders are likely to experience heightened stress levels during this phase so the plan should be as simple as possible, perhaps even split into an immediate actions card and a more detailed plan for the latter stages of the incident response

Action lists and task lists are very effective in the incident response and may be stored as physical documents, wallet cards, USB memory sticks or online etc.

Full contact lists including out of hours contact information for staff, suppliers, customers and other stakeholders should be maintained in the incident plan together with details of how to contact them. This may also include procedures for using automated contact systems.

People activities should details of evacuation procedures, safety teams, how to account for staff and ongoing communication and other welfare processes. People activities should take note of social, disability and cultural considerations.

An organisations media response may be vital to the protection of its reputation. There are many examples of how relatively minor incidents turned into high impact failures because of a lack of or poor media response. The incident management plan should detail all relevant media contacts and procedures including pre built statements to assist the incident management team in the very early stages before media professionals can be activated.

Where incident management activities are to be held should be detailed and this may include physical or virtual locations, access details should be included.

Supporting information such as maps, plans, charts, contracts and insurance documentation may be included

The Business Continuity Plan (BCP)

Following on from the incident management plan the business continuity plan should enable the organisation to recover its activities and achieve restoration to normality.

The BCP will detail responsibilities, resource requirements, procedures, facilities, information and third parties to enable recovery.