As Business Continuity professionals, we see a lot of plans. One consistent concern across all plans, regardless of their size, is it a flexible BCP. At what point is your plan too rigid? How do you know if you have just enough – or too much – information? Do you need responses for every single type and depth of scenario out there? If you don’t know the answers to any of these questions, read on. Help is on the way.
What do we mean by flexible BCP?
For the purposes of this discussion, we are talking about how well your BCP allows you to adapt, and appropriately respond, to different types of incidents. You should be able to use the same BCP to respond to a fire, a train derailment, a power outage, or an active threat. This might seem a bit daunting; how can one plan possibly respond to all of these things? Simple! The answers are in your plan content and structure, and training.
Plan content and structure
Two key areas of a flexible BCP are in the response and recovery steps, and the supporting documentation. The response and recovery steps document exactly what steps you need to take when an incident occurs. But, these steps do not need to be so detailed that they are difficult to follow. For example, one of your steps might be “Inform vendors of the incident and provide temporary instructions.” You do not need to then list the name of every vendor you need to contact for every type of incident. Simply include a reference to your vendor database. That way, you select which vendors you contact depending on what has been impacted by the incident.
Streamlining this content allows you to have all of the information you need in one location, making for easier plan navigation and maintenance. This approach does require your plan to have the appropriate references to supporting information, hence the importance of your plan structure.
Training
The second part of making this fluid plan structure a success is to ensure all your staff are trained accordingly. It is absolutely critical to have response steps documented and supporting information referenced. But, your people also need to know how to execute this plan. Some instances may require you to skip over steps that don’t apply. Ensuring that there are people leading the team that know what those judgement calls are and training them to act accordingly will make your response much more efficient and effective.
Last thoughts…
We do recognize that there are some instances where specific details are required for you to carry out certain steps in your plan. By all means, include those pieces. Just remember it is possible to use a solid base plan and supporting documents to recover from any type of incident. You do not need separate response plans for separate scenarios. Core areas that will be impacted by any incident are your building, systems, people, and suppliers.
About KingsBridge: KingsBridgeBCP offers businesses of all sizes BCP Software Solutions and industry know-how based on best practices, helping to build, exercise, and maintain Business Continuity Plans.
