BusinessContinuityTemplate：業(yè)務連續(xù)性的模板.docx

Organization LogoBusiness Continuity Plan TemplateVersion 1.0Month Day, Year Table of ContentsDOCUMENT CHANGE CONTROL6SECTION I: INTRODUCTION7A.How to Use This Plan7B.Objectives7C.Scope8D.Assumptions8E.Changes to the Plan/Maintenance Responsibilities9F.Plan Testing Procedures and Responsibilities10G.Plan Training Procedures and Responsibilities10H.Plan Distribution List11SECTION II: BUSINESS CONTINUITY STRATEGY12A.Introduction12B.Business Function Recovery Priorities12C.Relocation Strategy and Alternate Business Site12D.Recovery Plan Phases131.Disaster Occurrence132.Plan Activation133.Alternate Site Operations134.Transition to Primary Site13E.Vital Records Backup13F.Restoration of Hardcopy Files, Forms, and Supplies14G.On-line Access to Computer Systems14H.Mail and Report Distribution15SECTION III: RECOVERY TEAMS16A.Purpose and Objective16B.Recovery Team Descriptions16C.Recovery Team Assignments16D.Personnel Notification17E.Team Contacts17F.Team Responsibilities17Business Continuity Coordinator 19EOC Communications Team 19EOC Human Resources Team 20EOC Administration Team 20Emergency Response Team 21Information Technology Recovery Team (See also Disaster Recovery Plan) 21SECTION IV: RECOVERY PROCEDURES23A.Purpose and Objective23B.Recovery Activities and Tasks24PHASE I: Disaster Occurrence24PHASE II: Plan Activation28PHASE III: Alternate Site Operations33PHASE IV: Transition to Primary Operations35SECTION V: APPENDICES38Appendix A - Employee Telephone Lists39Appendix B - Recovery Priorities for Critical Business Functions40Appendix C - Alternate Site Recovery Resource Requirements41Appendix D - Emergency Operations Center (EOC) Locations43Appendix E - Vital Records44Appendix F - Forms and Supplies45Appendix G - Vendor Lists46Appendix H - Desktop Computer Configurations47Appendix I - Computer System Reports48Appendix J - Critical Software Resources49Appendix K - Alternate Site Transportation Information50Appendix L - Alternate Site Accommodations Information51Appendix M - Severity Impact Assessments52Appendix N - Business Impact Assessment53Appendix O - Recovery Tasks List54Appendix P - Recommended Office Recovery55CONFIDENTIAL Document for Internal Use by (Organization) Personnel OnlyVersion Number: 1.00Last Updated: Month Day, Year Printed: Month, YearPage 5 of 56 Department Business Continuity PlanIntroductionDOCUMENT CHANGE CONTROLDateVersionRequesterTech. WriterChange/ReviewModified by: _ _/_/_Reviewed by: _ _/_/_Approved by: _ _/_/_ CONFIDENTIAL Document for Internal Use by (Organization) Personnel OnlyVersion Number: 1.00Last Updated: Month Day, Year Printed: Month, YearPage 6 of 56 Department Business Continuity PlanIntroductionSection I: IntroductionA. How to Use This PlanIn the event of a disaster which interferes with s ability to conduct business from one of its offices, this plan is to be used by the responsible individuals to coordinate the business recovery of their respective areas and/or departments. The plan is designed to contain, or provide reference to, all of the information that might be needed at the time of a business recovery.This plan is not intended to cover the operations of s separately structured Emergency Response Team.Index of Acronyms: (EOC) Emergency Operations Center (EMT) Emergency Management Team (ERT) Emergency Response Team (BCP) Business Continuity Plan (IT) Information TechnologySection I, Introduction, contains general statements about the organization of the plan. It also establishes responsibilities for the testing (exercising), training, and maintenance activities that are necessary to guarantee the ongoing viability of the plan.Section II, Business Continuity Strategy, describes the strategy that the Department will control/implement to maintain business continuity in the event of a facility disruption. These decisions determine the content of the action plans, and if they change at any time, the plans should be changed accordingly.Section III, Recovery Teams, lists the Recovery Team functions, those individuals who are assigned specific responsibilities, and procedures on how each of the team members is to be notified.Section IV, Team Procedures, determines what activities and tasks are to be taken, in what order, and by whom in order to affect the recovery.Section V, Appendices, contains all of the other information needed to carry out the plan. Other sections refer the reader to one or more Appendices to locate the information needed to carry out the Team Procedures steps.B. ObjectivesThe objective of the Business Continuity Plan is to coordinate recovery of critical business functions in managing and supporting the business recovery in the event of a facilities (office building) disruption or disaster. This can include short or long-term disasters or other disruptions, such as fires, floods, earthquakes, explosions, terrorism, tornadoes, extended power interruptions, hazardous chemical spills, and other natural or man-made disasters.A disaster is defined as any event that renders a business facility inoperable or unusable so that it interferes with the organizations ability to deliver essential business services.The priorities in a disaster situation are to:1. Ensure the safety of employees and visitors in the office buildings. (Responsibility of the ERT)2. Mitigate threats or limit the damage that threats can cause. (Responsibility of the ERT)3. Have advanced preparations to ensure that critical business functions can continue.4. Have documented plans and procedures to ensure the quick, effective execution of recovery strategies for critical business functions.The Business Continuity Plan includes procedures for all phases of recovery as defined in the Business Continuity Strategy section of this document.C. ScopeThe Business Continuity Plan is limited in scope to recovery and business continuance from a serious disruption in activities due to non-availability of s facilities. The Business Continuity Plan includes procedures for all phases of recovery as defined in the Business Continuity Strategy of this document. This plan is separate from s Disaster Recovery Plan, which focuses on the recovery of technology facilities and platforms, such as critical applications, databases, servers or other required technology infrastructure (see Assumption #1 below). Unless otherwise modified, this plan does not address temporary interruptions of duration less than the time frames determined to be critical to business operations.The scope of this plan is focused on localized disasters such as fires, floods, and other localized natural or man-made disasters. This plan is not intended to cover major regional or national disasters such as regional earthquakes, war, or nuclear holocaust. However, it can provide some guidance in the event of such a large scale disaster.D. AssumptionsThe viability of this Business Continuity Plan is based on the following assumptions:1. That a viable and tested IT Disaster Recovery Plan exists and will be put into operation to restore data center service at a backup site within five to seven days.2. That the Organizations facilities management department has identified available space for relocation of departments which can be occupied and used normally within two to five days of a facilities emergency.3. That this plan has been properly maintained and updated as required.4. That each department has their own Business Continuity Plan.5. The functions and roles referenced in this plan do not have to previously exist within an organization; they can be assigned to one or more individuals as new responsibilities, or delegated to an external third party if funding for such services can be arranged and allocated.E. Changes to the Plan/Maintenance ResponsibilitiesMaintenance of the Business Continuity Plan is the joint responsibility of the management, the Facilities Management Department, and the Business Continuity Coordinator. management is responsible for:1.Periodically reviewing the adequacy and appropriateness of its Business Continuity strategy.2.Assessing the impact on the Business Continuity Plan of additions or changes to existing business functions, procedures, equipment, and facilities requirements.3.Keeping recovery team personnel assignments current, taking into account promotions, transfers, and terminations.4.Communicating all plan changes to the Business Continuity Coordinator so that the organizations IT master Disaster Recovery Plan can be updated.Facilities Management Department management is responsible for:1.Maintaining and/or monitoring offsite office space sufficient for critical functions and to meet the facility recovery time frames.2.Communicating changes in the “Organization IT Disaster Recovery Plan” plan that would affect groups/departments to those groups/departments in a timely manner so they can make any necessary changes in their plan.3.Communicating all plan changes to the Business Continuity Coordinator so that the master plan can be updated.The Business Continuity Coordinator is responsible for:1.Keeping the organizations IT Recovery Plan updated with changes made to facilities plans.2.Coordinating changes among plans and communicating to management when other changes require them to update their plans.F. Plan Testing Procedures and Responsibilities management is responsible for ensuring the workability of their Business Continuity Plan. This should be periodically verified by active or passive testing.G. Plan Training Procedures and Responsibilities management is responsible for ensuring that the personnel who would carry out the Business Continuity Plan are sufficiently aware of the plans details. This may be accomplished in a number of ways including; practice exercises, participation in tests, and awareness programs conducted by the Business Continuity Coordinator.H. Plan Distribution ListThe Business Continuity Plan will be distributed to the following departments and/or individuals, and will be numbered in the following manner:Plan ID NoLocationPerson ResponsibleCONFIDENTIAL Document for Internal Use by (Organization) Personnel OnlyVersion Number: 1.00Last Updated: Month Day, Year Printed: Month, YearPage 55 of 56 Department Business Continuity PlanBusiness Continuity StrategySection II: Business Continuity StrategyA. IntroductionThis section of the Business Continuity Plan describes the strategy devised to maintain business continuity in the event of a facilities disruption. This strategy would be invoked should the primary facility somehow be damaged or inaccessible. It is assumed that each critical business function at your location also has their own group/department Business Continuity Plan, which is similar to this plan except the recovery procedures and appendices have been customized for each respective group/department based on size, and complexity.B. Business Function Recovery PrioritiesThe strategy is to recover critical business functions at the alternate site location. This can be possible if an offsite strategy has been put into effect by Office Services and Disaster Recovery/IT Teams to provide the recovery service. Information Systems will recover IT functions based on the critical departmental business functions and defined strategies.Business Functions by Location are listed in Appendix B (Recovery Priorities for Critical Business Functions). “Time Critical Business Functions,” i.e., those of which are of the most critical for immediate recovery at the secondary location are: Reference: Appendix B Recovery Priorities for Critical Business FunctionsC. Relocation Strategy and Alternate Business SiteIn the event of a disaster or disruption to the office facilities, the strategy is to recover operations by relocating to an alternate business site. The short-term strategies (for disruptions lasting two weeks or less), which have been selected, include:Primary LocationAlternate Business SiteTBDFor all locations, if a long-term disruption occurs (i.e. major building destruction, etc.); the above strategies will be used in the short-term (less than two weeks). The long-term strategies will be to acquire/lease and equip new office space in another building in the same metropolitan area.D. Recovery Plan PhasesThe activities necessary to recover from a facilities disaster or disruption will be divided into four phases. These phases will follow each other sequentially in time.1. Disaster OccurrenceThis phase begins with the occurrence of the disaster event and continues until a decision is made to activate the recovery plans. The major activities that take place in this phase includes: emergency response measures, notification of management, damage assessment activities, and declaration of the disaster.2. Plan ActivationIn this phase, the Business Continuity Plans are put into effect. This phase continues until the alternate facility is occupied, critical business functions reestablished, and computer system service restored to s Departments. The major activities in this phase include: notification and assembly of the recovery teams, implementation of interim procedures, and relocation to the secondary facility/backup site, and re-establishment of data communications.3. Alternate Site OperationsThis phase begins after secondary facility operations are established and continues until the primary facility is restored. The primary recovery activities during this phase are backlog reduction and alternate facility processing procedures.4. Transition to Primary SiteThis phase consists of any and all activities necessary to make the transition back to a primary facility location. E. Vital Records BackupAll vital records for that would be affected by a facilities disruption are maintained and controlled by either or Disaster Recovery/IT. Some of these files are periodically backed up and stored at an offsite location as part of normal operations.When requires on-site file rooms, scanning, and organization offsite storage locations, best practices advise using one near-by Records Warehouse and another secure site for vital records and data back-up. All vital documents are typically located in files within the office complex and the most current back-up copies are in a secure off-site storage facility.F. Restoration of Hardcopy Files, Forms, and SuppliesIn the event of a facilities disruption, critical records located in the Department may be destroyed or inaccessible. In this case, the last backup of critical records in the secure warehouse would be transported to the secondary facility. The amount of critical records, which would have to be reconstructed, will depend on when the last shipment of critical records to the offsite storage location occurred. management will arrange the frequency of rotation of critical records to the offsite storage site.The following categories of information can be exposed to loss:1. Any files stored on-site in file cabinets and control file rooms.2. Information stored on local PC hard drives.3. Any work in progress.4. Received and un-opened mail.5. Documents in offices, work cubes and files.6. Off-site records stored in the Records Warehouse (if this is not a secure, hardened facility).G. On-line Access to Computer SystemsIn the event of a facilities disruption, the IT Disaster Recovery Plan strategy should be to assist in re-establishing connectivity to the departments and to establish remote communications to any alternate business site location. If the data center is affected by a disaster or disruption, the IT Disaster Recovery Plan should include recovering processing at a pre-determined alternate site. Services covered would include; phones, cellular phones, pagers, communications, and all other services required for restoring limited emergency service to the organization.In this case, data communications will be rerouted from the data processing hot or cold site to the respective alternate business site locations.*BCP Representatives - It will be necessary t