Templates

A business continuity policy sets out the intentions and direction of your business continuity programme and communicates the scope and requirements to your employees. This helps your employees understand their roles and responsibilities for delivering the programme so they can meet the expectations. A policy can also explain the legal and regulatory requirements that need to be met. If you include a short statement from your leadership team that explains the importance of the programme, this will show your employees that business continuity is taken seriously and is essential to your organization.

A business impact analysis helps you better understand how you operate and is used to prioritize which parts of your business you want to protect. This template can help you identify the processes and activities that support your products and/or services; understand the internal and external dependencies between your processes and activities; determine the maximum time the processes and activities can be disrupted before you have an unacceptable impact; Identify the time following an incident within which each process and activity must be resumed (known as a recovery time objective).

A threat and risk assessment template is used to record the internal and external threats to your organization so you can assess the risk of disruption to your prioritized processes and activities. The template also helps you better understand how much a control has reduced the likelihood and impact of a risk. This template can be used to support a consistent approach towards risk assessment across your organization. There are three tabs in the threat and risk assessment template. The Threat Profile tab is used to record the known and anticipated internal and external threats to your organization. You can prioritize the threats based on a score.

A business continuity plan is used to document how employees will implement the agreed business continuity solutions for your processes and activities during a disruptive incident. This will help you resume your prioritized processes and activities within the agreed recovery time objectives, which will help keep impact to an acceptable level. All the information you need should be stored in the business continuity plan so it is ready to hand and you do not have to search different folders and files for information during an incident. This includes all the relevant contacts, their roles and responsibilities and any supporting information to help them fulfill their roles.

An IT Disaster Recovery Plan can help you better understand existing fault detection, fault notification and escalation routes; document your team roles and responsibilities for recovering systems and data within the agreed recovery time and recovery point objectives; centralize all the information you need to help determine the root cause of a fault and how to recover. The plan can also include communication templates so you can send messages quickly during a disruptive incident.

A phone tree can be used to communicate with employees during an unplanned disruptive incident. Most importantly, this can help you check employee welfare during an incident so incident management teams can work with senior management to protect your employees. You may also want to contact employees to notify them of the disruption, to ask relevant teams to implement the agreed business continuity plans or to provide general guidance on what employees should do. The phone tree template is useful for organizations that cannot afford or have decided for other reasons not to purchase an enterprise notification system.

A phone tree test report can be completed after a phone tree test so you can monitor progress and improvement over time. A phone tree test helps familiarize members of your team with how to implement the phone tree. A test will also familiarize your employees with how they will be contacted during a disruptive incident and/or civil emergency. The phone tree test will help validate your contacts and their contact details. You may also decide to restructure your phone tree if contacts cannot be reached in a timely manner.

Business continuity exercises do not have to be lengthy or complex to drive value. This simple business continuity exercise report form is great for short table-top exercises that last ~30 minutes. The template should be completed after the exercise to help determine whether the exercise objectives have been met, whether there were any issues during the exercise and what improvement actions need to be implemented. Exercises help you validate the business continuity solutions for your prioritized processes and activities. Exercises also help familiarize members of your team with their roles and responsibilities in the business continuity plan.

A supplier business continuity schedule with appropriate clauses will help clarify your expectations of the supplier’s roles and responsibilities before, during and after a disruptive incident. Clauses can also be used to make sure your time critical suppliers continue to maintain their business continuity solutions. For example, if you identified particularly good solutions during the supplier due diligence process, you may want to make sure these are continued for the duration of your contract. Clauses could also be added to make sure your time critical suppliers have an exercise and/or test schedule in place to validate their business continuity solutions.