If you need to invoke your Incident response plan there is a possibility that you’ll be doing so because you’ve lost some or all of your primary infrastructure.
If that’s the case this is likely to be a highly emotionally charged time when rational thinking and prioritisation are challenged by our inherent “fight, flight or freeze” response.
At the same time, your Business Continuity Team (BCT) will need to work with maximum clarity and effectiveness. They need to create reassurance and certainty for your stakeholders, be they customers, employees, suppliers, investors or regulators.
Anything that can be done to support this is only going to improve your incident response and how your organisation comes out of it. They will need to hit the ground running with everything at their disposal to carry out the critical initial steps.
This will include physical space and resources, including for the BCT’s welfare, business functionality, communication capability and data. The Incident Command Centre. Oh, and someone responsible for making this all happen.
Let’s call all of this your Recovery Resources.
Physical Space and Resources
Physical space to operate in; this might be a dedicated environment or a temporary location available to the business—one space for the initial activation and then as we move into the continuity and recovery phases.
Crisis Management Centre
This is the space your BCT will be working from initially and it will need all the necessary workplace equipment in that physical space; desks, chairs, laptops, printer, spare chargers. It also needs to include welfare facilities and in case your team are engaged for an extended period, kettle, tea and coffee, and snacks: a camp bed and sleeping bag wouldn’t be out of the question in case you activate your Incident Response Plan (IRP) in the middle of the night. You will need to consider accessibility, as your IRP could activate at any time.
Battle Box
It may make sense to store your Crisis Centre Resources to be stored in a Battle Box. This should be stored at a separate location from the business where it can be deployed to the crisis centre venue immediately. This may be supplemented by individual Grab Bags for the Team members.
Grab Bags
Individual Team members may also have personal grab bags which gives them a minimum level of resources at their disposal wherever they are.
Your grab bags contents may look like this:
- Pens, paper
- Wind-up Torch
- High energy snacks
- PPE
- Protective overalls
- Chargers for mobile devices
- Up-to-date copy of the BCP
- Laptop
- Up-to-date copy of the BCP
Communication and Connectivity
A critical component of the Incident Response is your Communication Plan. For this to be effective, you will need to execute it. Even if your business is in the cloud, you’ll need to be able to connect to whatever resources, applications and data you need, so your crisis centre will also need the necessary network connectivity.
You might also want to consider a set of telephone handsets so the BCT can communicate outside of their normal contact numbers, which may be inundated. And these devices will need to be pre-loaded with whatever apps you are going to use as part of your comms infrastructure (WhatsApp, Zoom, Teams, etc).
Data
Key business data is required immediately before any data backups are restored. Your data may be in the cloud, but how quickly can you access it? There may be a slice of your business data that you need immediately. A good example of this might be production or dispatch rosters. Suppose these aren’t immediately available through cloud resources. In that case, they could be provided as a weekly report sent by email or some other means whilst servers, applications and data are restored.
This “data” may also include backup information on your site for the Emergency Services; remember, the more information they have, the better they will be able to respond to your incident.
Ready to Go
These resources must be ready to go as and when required. This means that they will need to be checked, maintained and tested regularly to ensure they work, any updates are processed, or any consumables are in date.
Maintaining and Testing your BCP is not just about exercising the Incident Response, it's also about making sure that all of your business continuity arrangements are live, operational and deployable. So you will need a process for doing this. This maintaining and testing of the BCP is an inherent part of our Business Continuity Management System.
How do you work out what you need?
One of the best ways to identify your needs is to do a walk-through of your activation process to look at what you need to complete each stage and how it is accessed, given a full loss of infrastructure. It can be helpful to have this facilitated.
More information on Business Continuity Planning
If you’d like more advice on Recovery Resources and Business Continuity Planning, download our 9 Steps to Business Continuity Guide, which can help fast-track and focus your BC Planning with the minimum of jargon and practical tips on how to keep the process effective and productive. Or get in touch for a chat about how we may be able to help you move your business continuity planning forwards.
