APPENDIX E
Continuity Plan Samples
The first of the following three sample documents is a table of contents for a corporate business continuity plan. The second is an example of one that might be used for a department or other business unit plan. The final document is a sample basic plan for a department or other business unit.
Sample Table of Contents for a Corporate Business Continuity Plan
Foreword (and Board of Directors Approval Page, if applicable) Plan Distribution List Record of Plan Changes and Revisions Glossary of Terms and Acronyms
PART I: INTRODUCTION
1.1 Purpose and Objectives
1.2 Authorities and References
1.3 Planning Assumptions
1.4 Business Continuity Policies and Standards
1.5 Legal, Regulatory, and Audit Compliance
1.6 Statement of Confidentiality
1.7 Plan Development and Updates
1.8 Corporate Business Continuity
1.8.1 Business Continuity Policies
1.8.2 Corporate Business Continuity Plan
1.8.3 Corporate Business Continuity Priorities
1.8.4 Disaster Declaration Criteria and Authority
1.8.5 Succession Plan
1.9 Corporate-Level Continuity Roles and Responsibilities
1.10 Department/Business Unit Continuity Roles and Responsibilities
1.11 Business Continuity Training, Exercise, and Test Requirements
1.12 Employee Preparedness
1.13 Emergency Exercise and Evacuation Drill Requirements
PART 2: BUSINESS CONTINUITY TEAM
2.1 Time Requirements
2.2 Continuity Activities
2.2.1 First 8 Hours
2.2.2 First 24 Hours
2.2.3 24–72 Hours
2.2.4 Days 3–7
2.3 Corporate Business Continuity Team
2.3.1 Primary and Backup Team Assignments
2.3.2 Roles and Responsibilities
2.4 Corporate Business Continuity Team Locations
2.5 Coordination of Business Continuity Teams
2.6 Coordination with Public Agencies
2.7 Public Information and Media Relations Procedures
PART 3: PROCEDURES
3.1 Initial Notifications
3.1.1 Internal Notifications
3.1.2 External Notifications
3.2 Damage and Situation Assessment Procedures
3.3 Activating the Corporate Business Continuity Team
3.4 Business Continuity Team Initial Briefing
3.5 Business Continuity Center Activation and Operation
3.6 Restoration Time Frames
3.7 Continuity Strategies
3.7.1 Employee Notification and Recall
3.7.2 Relocation Criteria and Procedures
3.7.3 Temporary Suspension Criteria and Procedures
3.7.4 Contracting and Outsourcing Criteria and Guidelines
3.7.5 Briefings and Status Reports
3.7.6 Business Continuity IT Support: Disaster Recovery— Essential Systems, Applications, and Data
3.7.7 Business Continuity Expense Tracking Procedure
4.1 Deactivation Criteria
4.2 Deactivation Notifications
4.2.1 Internal Notifications
4.2.2 External Notifications
4.3 Deactivation Procedures
4.3.1 Employee Notifications
4.3.2 Initial Debriefing
4.3.3 Deactivation Notifications
4.4 Post-Deactivation
4.4.1 Full Debriefing and Evaluation
4.4.2 Identifying and Assigning Corrective Actions
4.4.3 Business Continuity Expense Accounting
4.4.4 Report to Board
4.4.5 Plan Review and Revision
PART 5: ATTACHMENTS
A. Corporate Business Continuity Team Members and Contact Information
B. Board of Directors Contact Information
C. Business Continuity Organization and Contact Information
D. Relocation Logistics
D.1 Relocation Site Contact Information
D.2 Directions and Map
D.3 Reporting Procedures
D.4 Alternate Work Area Set-Up Instructions
D.5 Approved Area Hotels
D.6 Area Restaurants
E. Corporate Business Continuity Operations Center
F. Detailed Business Continuity Procedures
G. Sample Status Report Form
H. Sample Expense Reporting Form
I. Resource List
J. Contact List for Financial Institutions, Legal Counsel, and Insurance Broker
K. Media Contact List
L. Action Checklists
Sample Table of Contents for a Department or Business Unit Continuity Plan
Plan Distribution List Record of Plan Changes and Revisions Glossary
PART I: INTRODUCTION
1.1 Compliance with Corporate Business Continuity Policies and Standards
1.2 Time Requirements
1.3 Continuity Activities
1.3.1 First 8 Hours
1.3.2 First 24 Hours
1.3.3 24–72 Hours
1.3.4 Days 3–7
1.4 Department/Business Unit Business Continuity Team
1.5 Business Continuity Team Location
1.6 Coordination with Business Continuity Organization
PART 2: POLICIES AND PROCEDURES
2.1 Activation and Notification
2.2 Situation Assessment
2.3 Business Continuity Team Initial Briefing
2.4 Continuity Priorities
2.5 Restoration Time Frames
2.6 Continuity Strategies and Procedures
2.6.1 Relocation
2.6.2 Temporary Suspension
2.6.3 Contracted and Outsourced Services
2.7 Situation Tracking
2.8 Employee Information
2.9 Long-Term Recovery
2.10 Tracking Continuity Costs
2.11 Department Continuity Strategies
2.11.1 Asset Protection
2.11.2 Vital Records Protection and Reconstruction
2.11.3 Essential Systems and Applications
2.11.4 Resource Needs
2.11.5 Staffing and Scheduling
2.11.6 Notification and Recall
2.11.7 Business Continuity Procedures
2.13 Training and Testing
2.14 Plan Review and Revision
PART 3: ATTACHMENTS
A. Department Business Continuity Team Members and Contact Information
B. Relocation Logistics
B.1 Directions and Map
B.2 Relocation Site Contact Information
B.3 Reporting Procedures
B.4 Alternate Work Area Set-Up Instructions
B.5 Approved Area Hotels
B.6 Area Restaurants
C. Business Continuity Organization and Contact Information
D. Department Detailed Business Continuity Procedures
E. Alternate Communications Procedures
F. Sample Status Report Form
G. Sample Regulatory Compliance Form
H. Department Employee Contact List
I. Sample Expense Reporting Form
J. Department Resource Needs List
K. Supplier/Vendor/Contractor Contact List
L. Business Continuity Action Checklists
NOTE: Other attachments may include but are not limited to:
Product Flow Charts
Process Flow Charts
Work-Around Procedures
Floor and Site Layouts
Alternate Shipping Routes, Maps, and Directions
Organization Charts (such as other departments, divisions, supply chain business partners)
Sample Basic Plan for a Department or Business Unit Continuity Plan
[NAME OF DEPARTMENT/BUSINESS UNIT] Business Continuity Plan
1.0 INTRODUCTION
With a goal of minimizing the impact of possible business disasters, the XYZ Corporation has developed and implemented an enterprise-wide Business Continuity Program. The goal of the program is to ensure the company’s capability to continue or restore essential business operations following a natural, technological, or incited disaster.
Under the executive sponsorship of our Executive Vice President and the leadership of the Business Continuity Manager, a Business Continuity Program has been developed and tested that will allow continuation or restoration of all identified time-critical business functions.
The purpose of the department/business unit’s Business Continuity Plan (BCP) is to provide guidance and instructions for restoring the department’s time-critical business functions following any major disruption. The goal of this plan in coordination with the Corporate Business Continuity Program is resumption of normal business operations and services as soon as possible following any disaster. Business Continuity Plans will be activated following events of any type that interrupt normal business operations.
This plan is in full compliance with all Corporate business continuity policies, standards, and guidelines and applicable legal and regulatory requirements.
A separate Disaster Recovery Plan developed by the Information Technology (IT) Department provides for restoration of essential data systems and applications needed to support time-critical business functions following a disruption.
Business Continuity Plan staffing takes into account that some department employees may not be available at the time a disaster occurs and to the extent possible provides for backups for all Business Continuity Team members and employees assigned continuity responsibilities.
1.1 COMPLIANCE WITH CORPORATE BUSINESS CONTINUITY POLICIES AND STANDARDS
This plan complies fully with XYZ Corporation’s business continuity standards and is in compliance with all related policies. This plan coordinates with the Corporate Business Continuity Plan’s all business unit/department Business Continuity Plans.
In implementing and carrying out this plan, personal safety will always be the first priority. While our company’s business continuity plans are developed and maintained in accordance with current best practices, nothing in this plan should preclude or override the exercise of prudent judgment and common sense based on the specific situation and conditions during disaster conditions.
XYZ Corporation’s Business Continuity Program and all Business Continuity Plans are designed to prepare for significant business disruptions and to enable XYZ Corporation to rapidly resume our business operations as quickly as possible if an event does occur. As this plan and all related plans are applicable to many different emergency and disaster situations and as these events are unpredictable by their very nature, it is not possible to anticipate every possible situation that can impact our ability to conduct business, nor is it possible to foretell the actual conditions we may experience in an actual disaster situation. As a result, business continuity teams will have to be flexible in responding to actual events as they occur.
1.2 TIME REQUIREMENTS
The IT Department’s Disaster Recovery Plan includes a goal of restoration of time-critical data and communications systems within not more than 72 hours of the declaration of a disaster. To synchronize with this goal, the department/business unit’s Business Continuity Plan will enable the department to continue its time-critical business functions without IT support for up to 72 hours.
1.3 CONTINUITY ACTIVITIES
The specific restoration activities to be undertaken will be dictated by the presenting situation and its impact on employees, facilities, utilities, and normal business operations. Generally speaking, the focus of business continuity activities will center on the following priorities and time frames.
1.3.1 First 8 Hours
Personnel—life safety
All notifications (internal and external)
Damage assessment and containment
Security issues
Communications (internal and external)
Activation of all department/business unit Business Continuity Teams
Evolving and changing situation
Ongoing situation assessment
1.3.2 First 24 Hours
Full implementation of all business continuity plans and procedures
Review all restoration priorities and strategies and adjust as required
Restore and repair voice and data networks
Based on business cycles, identify most immediate recovery objectives for time-sensitive functions and adjust priorities as required
Obtain resources needed to restore time-critical business functions
Communications (internal and external)
Update department/business unit’s employees on status
1.3.3 24–72 Hours
Relocate to and configure alternate location, if required
Restore time-critical business functions
Delay/suspend nonessential business functions
Communications (internal and external)
Update department/business unit’s employees on status
1.3.4 Days 3–7
Reassess the disaster’s impact and current status
Determine estimated duration of any disruptions
Identify restoration strategies and schedule for long-term restoration of non–time-critical business functions
Establish personnel schedules
Communications (internal and external)
Update department/business unit’s employees on status
1.4 (DEPARTMENT/BUSINESS UNIT) BUSINESS CONTINUITY TEAM
The title of person will serve as the department/business unit’s Business Continuity Team Leader (BCT Leader) unless she or he is unavailable or delegates that responsibility. Should the Team Leader’s title be unavailable, the responsibilities of BCT Leader will be assumed by the title of alternate person.
The department/business unit’s BCT leader will have leadership responsibility for implementing the department/business unit’s Business Continuity Plan with a goal of continuation of the department’s time-critical business functions and restoration of normal business activities. To ensure required business continuity staffing, the department/business unit’s Business Continuity Team is comprised of a primary and two backups for each team position. To the extent possible all department personnel are trained to carry out all critical business functions.
All Business Continuity Team members will participate in two training sessions, two tabletop exercises, and one functional exercise annually.
Department/business unit’s BCT members are encouraged to maintain some basic personal supplies at the workplace to include toilet articles such as toothpaste, toothbrush, and any medications they might need. BCT members should have a plan for contacting their family and relatives in the event that they are unable to return home on schedule. It is also recommended that they designate an out-of-state relative or friend that they and their family members can contact to coordinate messages.
Department/business unit’s BCT members and their contact information are listed in Attachment A to this plan. The BCT
Team Leader is responsible for a quarterly update of Attachment A.
1.5 BUSINESS CONTINUITY TEAM LOCATION
Upon notification of a significant disruption to operations, the Business Continuity Team (BCT) will convene at the (primary work location such as office, distribution center, warehouse) if feasible. If the building is damaged or inaccessible, the BCT will convene at either (alternate location such as another company facility or contracted alternate work area site).
Should any BCT member not be at his/her usual workplace or unable to reach the alternate location, he/she will attempt to communicate status and location via preestablished communications methods.
Attachment B contains relocation logistics such as basic information about the alternate work area sites, addresses, maps, and access process.
1.6 COORDINATION WITH BC ORGANIZATION
As an integral part of the company’s Business Continuity organization, the department/business unit’s Business Continuity Plan is in compliance with all XYZ Corporation’s Business Continuity policies and standards. The department/business unit’s BCT will coordinate with the Corporate Business Continuity Team and all other company Department Business Continuity Teams and participate in all planning activities, training, exercises, and tests as required. Attachment C details the company’s business continuity organization.
2.1 ACTIVATION AND NOTIFICATION
All BC Teams will be notified and activated following a disaster that interrupts normal business operations.
Some situations may require additional assessment to determine the need to activate business continuity plans. In such cases, the BCT may be put on alert. In an alert situation, all BCT members will be notified of the situation, begin preparations for possible activation of the department/business unit’s Business Continuity Plan, and wait for further information.
For obvious emergencies that interrupt power and/or communications or are otherwise likely to interrupt normal business operations for an extended period, the BCT Leader will report to his/her usual work location as soon as safely possible following the event.
In the event that the usual work location is unusable or inaccessible, the (Corporate Business Continuity Manager or other designated position) or his or her designee or alternate will contact all department/business unit’s BCT Leaders to advise them of the current status and actions to be taken, such as report to the alternate company location or contracted alternate work area facility, or wait for further instructions.
For non-obvious emergencies, the (Corporate Business Continuity Manager or other designated position) or his or her designee or alternate will assign available staff to notify all department/business unit BCT Leaders by telephone or other available means of where and when to report.
For either obvious or non-obvious events, the department/business unit BCT Leader or his or her designee will contact all department/business units’ BCT Team members to advise them:
That the Business Continuity Plan has been activated
Where and when to report
The department/business unit maintains an up-to-date roster of all business unit/department employees and their home phone numbers, cell phone numbers, work and personal e-mail addresses, and other contact information such as PDA and pager numbers to assist in the notification process. The department/business unit Manager will review and update the list not less than quarterly and as any changes in contact information and/or staffing occur. A copy of the current list is Attachment H to this plan.
While not intended as a method of activating business continuity teams, another source of emergency information is XYZ’s designated toll-free emergency phone lines where employees can call to hear emergency information following a major emergency or disaster. A recorded message will provide current, accurate information and also include a time to call the line again for updated information. The numbers are:
Primary emergency number for employees: (area code/number)
Backup emergency number for employees: (area code/number)
All employees are provided with a laminated card containing these numbers.
Include information and procedures for any other emergency contact systems used by the organization or the business unit/department such as a calling tree or an electronic notification system.
2.2 SITUATION ASSESSMENT
The BCT Leader will assess the impacts of the event on the department/business unit’s most time-critical business functions. Based on the situation and, if applicable, the time in the business cycle, specific restoration strategies will be implemented. As requested, the BCT Leader will provide the Corporate Business Continuity Team with damage/status information. As requested, the BCT Leader will continue to provide situation updates to the Corporate Business Continuity Team.
2.3 BCT INITIAL BRIEFING
Upon arrival at the usual work location or alternate work area location, department/business unit BCT Leaders will advise the Corporate Business Continuity Team (liaison) of their arrival. Each BCT Leader should immediately begin a log of actions taken; this log will be maintained during the course of the disaster.
A representative of the Corporate BCT will review with department/business unit BCT Leaders the status of facilities, utilities, computer systems, communications systems, and operations. To the maximum extent possible, the anticipated duration of any utility outages, computer systems downtime, or other disruptions will also be reported. Any available information on restoration alternatives and strategies will also be presented to the BCT Leaders.
Each department/business unit’s BCT Leader will assess the impact of the disruption(s) on business activities, focusing initially on preestablished time-critical business functions. Short-and long-term impacts of the disruption to operations will be determined and assessments will be reported at an initial briefing with a representative of the Corporate BCT. Based on the existing situation, the department/business unit BCT will develop a plan of immediate actions to begin restoring time-critical functions within designated time frames.
2.4 CONTINUITY PRIORITIES
Recovery time objectives (RTOs) have been designated for all business functions based on completion of XYZ Corporation’s most recent Business Impact Analysis (BIA). As identified by the BIA, this department/business unit’s most time-critical business functions are:
Maximum allowable downtime for some of the listed functions is determined in part by the business cycle requirements as noted below.
(1) End of each business day
(2) End of each business day
(3) Quarterly reports to regulators due within 5 days of quarter end
(4) No downtime in September
(5) Must be completed by 1st Thursday of month
2.5 RESTORATION TIME FRAMES
In XYZ’s Business Continuity Plan, the most time-critical business functions are assigned a recovery time objective of 72 hours or less. The department/business unit’s BCT will initiate restoration activities in accordance with the Business Continuity Plan, focusing initially on the most time-critical functions.
2.6 CONTINUITY STRATEGIES AND PROCEDURES
It must be recognized that a significant disruption to normal business activities will require extraordinary measures to ensure that predesignated time-critical business functions are continued or restored at a minimal acceptable level. This may necessitate temporary suspension of nonessential functions, relocation of designated personnel to another company location or a contracted alternate work area, and/or establishing shift schedules for performing the time-critical business functions.
Strategies to be employed will be based upon the status of utilities, network systems, communications, facilities, and all external supply chain links as well as the anticipated duration of any outages. The preferred strategy would be to restore essential business functions at the normal work location, provided that restoration can be accomplished safely within the designated restoration time frames.
Other strategies may need to be implemented when the time required to regain access and complete restoration of the normal work location will exceed designated restoration time frames, or if extensive recovery activities are required.
This Business Continuity Plan is in coordination with the company’s Disaster Recovery Plan, which details restoration strategies for essential support systems such as voice and data communications, network servers, and applications, and for retrieval of off-site electronic records.
2.6.1 Relocation
Relocation is the primary strategy to be employed when the (office, distribution center, warehouse) location is rendered unusable or inaccessible and cannot be restored within the target restoration time frames.
When a disaster declaration—a formal announcement by preauthorized personnel that a disaster or severe outage is predicted or has occurred—is made, employees designated to continue the most time-critical business functions will be relocated to the contracted alternate work area site. In the event a widespread disaster impacts the primary alternate work area site as well as the usual work location, operations will be relocated to the second alternate work area.
2.6.2 Temporary Suspension
Nonessential business functions may be temporarily suspended if normal work sites are unusable.
2.6.3 Temporary Contracting and Outsourcing
In the event of a long-term disaster-caused disruption to operations or significant damage to facilities, strategies can include temporarily contracting or outsourcing some preidentified time-critical functions. This can include services, processes, warehousing, or distribution. When contracting and outsourcing is identified as a possible strategy, the company’s standard procurement process applies and is completed as part of strategy development.
Attachment D contains detailed strategies and procedures for continuing each of the department/business unit’s identified time-critical business functions.
2.7 SITUATION TRACKING
The department/business unit BCT Leader will track the progress of the department/business unit’s continuation or restoration of its time-critical business functions and will report current status information in writing to the (Corporate liaison) on a schedule determined by the Corporate Business Continuity Team. A Business Continuity Status Report Form is included in Attachment F.
2.8 EMPLOYEE INFORMATION
In the event of a potential or actual disaster event, information will be disseminated to all department employees by the Business Continuity Team Leader.
A complete, current contact list for all department/business unit employees will be maintained in this plan as Attachment H. The list will be reviewed and revised not less than quarterly and more often as required by any changes in personnel.
2.9 LONG-TERM RECOVERY
A major disaster may cause damages to facilities requiring major repair or reconstruction lasting months or possibly even years. The Corporate Business Continuity Team will coordinate the long-term recovery effort to restore operations and services to pre-disaster levels and to adapt services to changed conditions brought about by the disaster with department/business unit Business Continuity Team Leaders.
2.10 TRACKING CONTINUITY COSTS
For insurance purposes, it is essential to keep detailed records of damages and expenditures. Each department/business unit BCT will implement procedures for tracking the number of disaster-related hours worked and any other related costs and expenditures.
The department/business unit’s BCT Leader must ensure that all insurance-required expense records are fully and accurately maintained. These records will be provided to the (Corporate BCT liaison) as requested. A sample Business Continuity Expense Tracking Form is included in this plan as Attachment I.
2.11 DEPARTMENT CONTINUITY STRATEGIES
2.11.1 Asset Protection
Describe actions that will be taken to protect assets in your department such as preassigning employees to remove and/or secure identified assets such as petty cash, check stock, confidential records, and inventory in the event that the work location must be evacuated. (Include a caveat that these actions are to be taken only if doing so in no way endangers the safety of employees.)
2.11.2 Vital Records Protection & Reconstruction
Identify the vital records needed to perform time-critical business functions, including alternate sources for such records. Develop and implement procedures for secur ing, off-site storage, retrieval and reconstruction of vital records—electronic and non-electronic, as necessary.
2.11.3 Essential Systems and Applications
The following systems and applications are required to continue or restore department/business unit’s identified critical functions. The recovery time objective (RTO) listed for each is based on the IT Department’s Disaster Recovery Plan.
2.11.4 Resource Needs
Individual alternate work area site workstations are equipped with a standard PC, basic telephone, a shared printer, and basic office supplies. Unless required due to confidentiality requirements, all copy machines and facsimile machines will be shared.
In addition to the standard equipment, the department/business unit will require special equipment, nonstandard hardware or printers, forms, manuals, directories, and phones listed in Attachment J.
(As applicable) The department has gathered and stored off-site at (location) certain essential forms, manuals, procedures, directories, resource lists, etc., required by the department’s time-critical functions. Attachment J includes an inventory list of the contents. Contents are inventoried and updated following every test, exercise, and actual disaster but not less than annually or as needed, and the inventory list is updated accordingly.
A list of all critical suppliers, outsourcing companies, shippers, vendors, contractors, and other business partners necessary to fulfill the identified time-critical functions, and where applicable alternates for each with complete contact information, is provided in Attachment K. This list includes company names, contact names, and all available contact information. The department/business unit BCT Leader is responsible for ensuring that the list is reviewed and updated not less than quarterly.
2.11.5 Staffing and Scheduling
The minimum acceptable level of staffing needed to perform time-critical business functions has been identified and is found in Attachment A. Staffing includes one primary and two backup persons for each continuity assignment.
In addition, all BCT members will assist and back up one another as required to continue or restore the identified critical functions.
In the event of an extended BC time frame, the department/business unit BC Leader will identify and assign staff and designate shift work schedules if necessary and feasible. All scheduling will take into account the current point in related business cycles.
2.11.6 Notification and Recall
The department/business unit’s Team Leader will notify all department/business unit BC Team members in the event of a disaster. Information provided will be a brief description of the type of disaster; its impact on facilities, services, and operations; when and where Team members are to report; current contact information for the department/business unit Business Continuity Leader; and other pertinent information. If Team members are not to immediately report to the alternate work area, an estimated time for an updated status will be provided.
When Team members report to the alternate work area, they should be prepared to present picture identification (insert necessary instructions for entry into alternate work locations). Entry into the work area is not permitted without valid picture identification.
2.11.7 Business Continuity Procedures
Attachment D contains detailed specific procedures for each employee who has a business continuity assignment. In addition, an action checklist for each assignment is included in Attachment L.
The department/business unit’s Business Continuity Team will continue operations at the usual workplace or (alternate company location or the contracted alternate work area location) until a decision to deactivate the Business Continuity Plan is made by the Corporate Business Continuity Team. Department/business unit BCT Leaders will be notified of the decision and date(s) of deactivation and specific deactivation instructions.
Deactivation procedures for all departments will be scheduled and coordinated by the Corporate Business Continuity Team. The detailed business continuity procedures for each time-critical function include the deactivation process.
Immediately following deactivation of Business Continuity Plans, each Business Continuity Team Leader will conduct a full debrief with all team members to capture the lessons learned and submit a written report to the Corporate Business Continuity Team or Corporate Business Continuity Manager. A full debrief with all department/business unit Business Continuity Team Leaders will be conducted by the Corporate Business Continuity Team. The purpose of the debriefing process is to identify areas for improvement to ensure that necessary corrective actions are taken.
2.13 TRAINING AND TESTING
To provide training to all Business Continuity Team members, the department/business unit’s BCP will be tested twice annually: one tabletop exercise and one scheduled alternate work area test. The tabletop exercise will be conducted by the department/business unit BC Leader; the alternate work area test will be coordinated by (Corporate Business Continuity Manager or owner of Corporate BCP). Business Continuity Plans will be revised and updated as necessary based on lessons learned during each test and exercise.
Each department/business unit Manager will review plan basics with all employees at least annually and document the review in writing to the (Corporate Business Continuity Manager or owner of Corporate BCP).
2.14 PLAN REVIEW AND REVISION
At the direction of the Department Manager, the department/business unit’s BC Leader will be responsible for the maintenance and update of this plan. The plan will be reviewed and updated not less than annually and by not later than (date) of each year. In addition, interim review and revisions will be completed when needed as a result of changes that may impact continuity procedures such as department/business unit processes, staffing, location, and suppliers. The date of the most recent revision will be printed in the bottom right-hand corner of each page of the document.
To assist with the annual review and update, a planning session for all department/business unit BCT Leaders will be conducted by the (Corporate Business Continuity Manager or owner of Corporate BCP).
Additional revisions will be made as required by changes in the department necessitating revisions in the basic plan or any of its attachments. A copy of all plan updates will be sent to the (Corporate Business Continuity Manager or owner of Corporate BCP) via e-mail. An audit record of all plan revisions and updates will be maintained on the Plan Review and Revisions form found at the front of this plan, and all existing copies of the plan (hard copies and electronic files) will be updated.
To ensure that all holders of the plan receive all updates and revisions, each hard copy of the department/business unit’s Business Continuity Plan will be numbered. The plan distribution record found at the front of this plan will be maintained to accurately identify those who hold copies of the plan.
In addition to the copies maintained at the department level, hard and soft copies will be maintained by the (Corporate Business Continuity Manager or owner of the Corporate BCP), and a hard copy will be maintained at (alternate company location, contracted alternate work area site, or other off-site location).