Business Continuity Management for Small and

Medium Sized Enterprises

How to Survive a Major Disaster or Failure
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Business Continuity Management
for Small and Medium Sized
Enterprises
How to Survive a Major Disaster or Failure
David Lacey
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
First published in the UK in 2012
by
BSI
389 Chiswick High Road
London W4 4AL
British Standards Institution 2012
All rights reserved. Except as permitted under the Copyright, Designs and Patents
Act 1988, no part of this publication may be reproduced, stored in a retrieval
system or transmitted in any form or by any means electronic, photocopying,
recording or otherwise without prior permission in writing from the publisher.
Whilst every care has been taken in developing and compiling this publication, BSI
accepts no liability for any loss or damage caused, arising directly or indirectly in
connection with reliance on its contents except to the extent that such liability
may not be excluded in law.
The rights of David Lacey to be identified as the author of this Work have been
asserted by him in accordance with sections 77 and 78 of the Copyright, Designs
and Patents Act 1988.
Typeset in Frutiger by Letterpart Limited, [Link]
Printed in Great Britain by Berforts Group, [Link]
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
ISBN 978-0-580-74108-1
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Contents
Foreword viii
Introduction ix
How to use this book xi
1 Making the business case 1
How much risk should you bear? 1
Safeguarding business interests 2
How much work is involved? 3
2 Key concepts and principles 7
What, how and who 7
Be selective and keep it simple 8
A process, not just a plan 9
The business continuity management cycle 9
The language of risk 11
3 Deciding what to protect 15
Assessing business criticality 15
Assessing the impacts of incidents 16
Conducting a business impact analysis 17
4 Assessing risk 21
The nature of risks 21
The risk management process 22
The lifecycle of risk management 23
Identifying critical assets 24
Assessing threats and risks 24
Building a heat map 25
Capturing further detail with a heat map 27
Building a risk register 27
Risk treatment 29
Communicating risk appetite 33
5 Identifying hazards and threats 37
Fire and Flood 38
Earthquakes 38
Terrorist attacks 39
Sabotage and vandalism 39
Equipment and supply chain failures 40
BCM for SMEs v
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Accidents 40
Strikes and transport failures 41
Environmental pollution 42
Pandemic 42
Space weather 43
6 Preventing and responding to fire 45
A continuous process 45
Identifying fire hazards 46
Identifying people and assets at risk 47
Assessing and reducing fire risks 47
Installing fire safety measures 47
Training and drilling staff 48
Maintenance considerations 49
Documentation 49
7 Preparing and planning for floods 51
Preparing for a flood 51
Establishing your level of risk 51
Identifying people and assets at risk 52
Implementing flood precautions 53
Arranging appropriate insurance 54
Drawing up an emergency flood plan 55
Training employees to deal with flooding 55
What to do after a flood 55
8 Physical security measures 59
Key principles and measures 60
Safeguarding premises 60
Protecting valuables and assets 62
9 Information security measures 65
Information security standards for SMEs 66
10 Back-up and fallback arrangements 75
Making back-up copies 75
Fallback options 77
Building resilience in computer systems 80
11 Preparing the plans 85
Types of plan and their relationship 85
Emergency plans 86
Contingency plans 87
Drafting your business continuity plan 88
Limitations of plans 89
vi BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
12 Organizing your response team 91
Fundamental goals and skills 91
When does an incident become a crisis? 93
The art of crisis management 94
Response team structure and roles 95
13 Training and exercises 99
Designing and equipping a crisis room 101
14 Learning from incidents 105
Why learning is important 105
Conducting a root cause analysis 106
15 Reviewing business continuity plans 111
Reviewing the business process 111
Reviewing the recovery process 112
16 Summary of this book 115
17 Sources of further advice 121
Glossary 125
Index 130
BCM for SMEs vii
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Foreword
In 1996, I was Chief Executive of the Radiocommunications Agency, an
Executive Agency of what was then the Department of Trade and
Industry. At 19:02 on the evening of Friday 9 February, our agency
headquarters building was destroyed in the Provisional IRA London
Docklands South Quay bombing. The Agency had a good
continuity/disaster recovery plan and, largely, it worked well. This has
given me a life-long respect for the importance of continuity planning.
Subsequently, my work with the Institute of Directors back in 2006
illustrated the weaknesses in many small and medium sized enterprises
understanding of business continuity management. Highlights from one
BCM survey included:
92% of survey respondents agreed that they had business critical
data stored in their ICT systems. I wonder what the others had stored
in their systems?
28% of respondents admitted to having no ICT business continuity or
disaster recovery plans in place. This was worst amongst the smallest
companies (1-25 employees) at 43% and in the Distribution and
Hotels sector at 42%.
For those with business critical data stored, 11% admitted to
backing-up less than once per week (if at all!), with Distribution and
Hotels the worst sector with 29% backing-up less than once per
week.
For those that did back-up at least once per week, 51% kept their
back-ups on-site, with Government, Education, Health and Personal
Services the worst sector at 72%.
Of those with Business Continuity plans in place, 90% felt that they
were well positioned to survive a disaster (despite the lack of off-site
back-ups by many).
Im not convinced that the passing of five years has entirely resolved
these problems.
I very much welcome the publication of David Laceys straightforward
and practical book. I commend this book to you. It provides exactly the
kind of clear guidance sorely needed.
Professor Jim Norton, President 2011-12, BCS - The Chartered Institute for
IT
viii BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Introduction
This book is a simple, practical guide on how to go about implementing
business continuity management. It is written primarily for business
directors and managers in small and medium sized enterprises (SMEs), but
it is also a useful guide for consultants or managers working in large
organizations with small business units or outlets.
Disasters such as fires, floods and terrorist attacks often strike
indiscriminately and without warning. Their impact on business
operations can be substantial, regardless of the size of the enterprise.
Experience has shown that advanced planning is crucial to preventing
and minimizing business damage.
Business continuity management is a simple management process that
helps identify potential hazards to your business operations, and equips
you with the information, plans and facilities to manage a major disaster
or failure. It operates through a combination of techniques, including risk
management, contingency planning and crisis management.
In recent years, most large organizations have developed business
continuity plans and incident response processes to safeguard their
business operations. This is not just in response to regulatory compliance
demands, but also because it is a good business practice. Many small
companies, however, have yet to catch up with this trend.
One reason for this is that business continuity management has
traditionally been a big company practice, requiring specialist consultants,
project teams and full time managers. Big organizations need large
programmes because of the sheer complexity and scale of planning
needed to respond to a major incident across a large enterprise.
The task is much simpler, however, for a smaller business unit. It need not
demand a big budget and a large team of people.
This book sets out how business continuity management can be tackled
by any small- or medium-sized enterprise, and with a minimum of
budget, time and manpower. The objective is to present the key
principles and learning points in a form that is digestible, appropriate
and, hopefully, compelling.
BCM for SMEs ix
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Both the approach and the content of this book are designed to be
suitable for SMEs of any size, ranging from a micro company of less than
ten people to a medium sized enterprise with hundreds of staff.
The guidance is aimed at ordinary business managers, and it assumes no
specialist knowledge or skills. It is designed to enable managers to
identify risks to business continuity, and to take simple, affordable steps
to minimize their impact. It includes some useful tips of the trade for
assessing risks, drawing up contingency plans and managing incidents.
The material draws on the real-life experience of the author in
developing business continuity strategies and plans for business units of
all sizes, ranging from small retail outlets to large global enterprises. It
also builds on research carried out on behalf of the UK Information
Commissioners Office (ICO) and the UK Chapter of the Information
Systems Security Association (ISSA) into the requirements of SMEs for
security advice and standards.
This book is published at a time of increasing awareness of hazards to
business continuity presented by all manner of disruption to normal
running, including floods, malware, cyber attacks and even the effects of
space weather. These concerns also come at a time when large corporate
customers and regulators are beginning to set their sights on tackling
weaknesses in supply chains.
With growing dependence on small contractors, big organizations will
increasingly expect, and demand, that their SME suppliers raise their
game in business continuity planning. This book shows how SMEs can rise
to this challenge.
David Lacey
Introduction
x BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
How to use this book
This book provides a logical, step-by-step sequence to understanding
business continuity management. You can read it from cover to cover, or
dip into selected chapters to find key recommendations on particular
topics.
Chapters 1 and 2 explain the benefits and principles of business
continuity management, and include the life-cycle for developing and
implementing a business continuity plan.
Figure 1 Step-by-step sequence to understanding business continuity
management
BCM for SMEs xi
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Chapters 3, 4 and 5 take you through the planning activities of
identifying what to protect - and from what or whom - including how to
carry out a risk assessment and how to develop a simple register of risks.
Chapters 69 set out practical guidance for common risks such as fire,
flood and security incidents. Every enterprise faces a slightly different set
of risks, but some threats and countermeasures are universal, and this
chapter aims to provide helpful, prescriptive advice based on well
established principles and practices.
Chapters 10 and 11 cover essential tasks to prepare you for a disaster,
including back-up and fallback arrangements, as well as how to develop
and structure the business continuity plan itself.
Chapters 12 and 13 provide advice on how to organize and train an
incident response team.
Chapters 14 and 15 discuss techniques for improving business continuity
plans and arrangements, including how to learn from incidents, and how
to carry out a review of processes and plans.
Chapter 16 provides a concise summary of the contents of this book for
readers who would like a reminder of the key learning points, as well as
for those who lack the patience to read it from cover to cover.
Finally, Chapter 17 lists some useful sources of further advice.
There are also helpful summaries of key points at the end of each
chapter.
How to use this book
xii BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
1 Making the business case
This chapter aims to set out the case for business continuity
management, and to persuade you that it is a necessary and smart use of
your time.
How much risk should you bear?
An important question that will no doubt be going through your mind is,
Why should I bother to invest valuable time and money in drawing up a
plan for something that might never happen?
The simple answer is that it will reduce the operational risks to your
business, and ensure your survival in the event of a major disaster.
Each business director has a different appetite for accepting risk. Some
like to gamble in the hope of gaining a higher return, while others
prefer to keep their heads down and play it safe. But whatever your
outlook, it is better to have as many of these risks under your control as
possible.
Small businesses face enormous risks in todays highly competitive
environment; it comes with the territory of running a small or medium
enterprise. You might not be able to do much about the commercial risks
you face, but you can certainly take steps to minimize your operational
risks. Keep in mind that these risks are often related. A bad operational
performance, for example, can affect customer confidence and future
sales.
Not all of the risks we face are within our sphere of influence. Economic
risks, for example, are part and parcel of the surrounding business
environment. Disasters such as floods and earthquakes are the results of
circumstances far beyond our control.
Yet many types of risks are created by our own actions. They arise from
bad decisions, unconscious oversights or human errors. We can take steps
to reduce these risks, though it might not be physically possible to
eliminate every last one of them.
Disasters and equipment failures, however, remain inescapable risks, and
their impact on business operations is growing with our increasing
BCM for SMEs 1
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
dependence on technology, communications and transport. Every business
needs to be prepared to tackle such major incidents as and when they
arise.
Nearly one in five UK businesses suffers a major disruption every year.
Your enterprise could very well be next. In fact, given these odds it is
likely you will encounter some form of damaging incident at some point
in the future.
Business continuity management will help you to ensure that your key
business activities (such as sales, manufacturing, deliveries and
purchasing) can be reliably carried out with minimal risk of interruption.
It will also help to reduce the level of potential business damage from
any form of disruption or outage, limiting your losses as well as
safeguarding your reputation.
Developing the capability to continue to deliver products and customer
services throughout environmental hazards will help you to retain your
customers and win new business. A speedy response to a disaster helps
safeguard your bottom line.
Business continuity management protects your business interests. It is a
cornerstone of good corporate governance, as well as a smart business
investment.
Safeguarding business interests
If you have already invested in an insurance plan to cover your premises
and their contents, then it will also make sense to invest in a set of
contingency plans to ensure business continuity. It is all part of the same
concept: the need to plan for the worst to safeguard your longer term
interests.
You should also consider investing in some form of business interruption
insurance. This will compensate you for lost income, based on your
financial records, though it is unlikely to provide cover for other possible
consequential losses such as lost future business. Minimizing lost future
sales will rely primarily on your ability to continue to satisfy your
customers both during and immediately after a disaster.
If your clients include large organizations, it is likely that they will at
some point ask you about your business continuity arrangements. The
need to ensure business continuity across essential supply chains is
increasingly being recognized by government agencies, supervisory
bodies and large companies. The need for a business continuity plan
might also be raised at some point by your bank manager, insurance
company or investors.
1 Making the business case
2 BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Business continuity management is a vital element in maintaining your
safety and security from hostile acts, such as terrorist attacks. In todays
world of heightened terrorist threats, which can strike at any time
without warning, business continuity planning is your best defence.
This point is acknowledged by security agencies such as MI5. In the words
of Eliza Manningham-Buller, a former MI5 Director General:
I am often asked what single piece of advice I can recommend that
would be most helpful to the business community. My answer is a
simple, but effective, business continuity plan that is regularly
reviewed and tested.
Even if you judge that you are unlikely to be a victim of a terrorist
attack, you can still be affected by the consequences of such an event.
Major incidents can result in damage to critical infrastructure, such as
electricity supplies, transport and communications, which are vital to
many business services.
Business continuity management is an essential process for any
organization that is required to deliver services without interruption.
That is why MI5 takes it very seriously. It is also why the UK Civil
Contingencies Act 2004 mandates it for frontline responders, such as fire
and rescue services. And it is why business continuity is a mandatory
policy for all UK public sector organizations.
1
How much work is involved?
How much preparation is needed to create a business continuity plan?
The truthful answer is that it is likely to be quite a bit more than you
expect, though the effort should be easily within your capabilities.
Reading this, you might be tempted to do as little as possible and hope
that in the event of a major disaster, you will find an easy way of
salvaging your assets and continuing your business. But experience has
shown that managing your way through a major incident is far from
simple. An effective crisis response demands smart planning, detailed
preparation and regular rehearsal.
Incidents can of course vary enormously in their impact. Recovering from
some hazards, such as an equipment failure or power outage, might be
relatively easy. But disasters such as a major fire or flood are likely to
cause major damage and upheaval. In such cases it is vital to respond
quickly and effectively to contain the damage, establish alternative
business facilities, and get back to business as quickly as possible. Ask
1
Business Continuity is one of the seven policies set out in the UK Government Security
Policy Framework.
How much work is involved?
BCM for SMEs 3
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
yourself what immediate action you would now take if you suddenly
discovered that your premises had been seriously damaged by a major
fire or flood. If your answer is Im not sure then you need to start
thinking about the precise steps you and your staff will need to take to
keep your business going, as well as the type of advance arrangements
you will need to have in place in order to support these actions.
Contingency plans cannot be conjured up overnight. They take time to
conceive, debug, refine and put into place. So you need to start thinking
now about the shape of the plans, facilities and services you will require
to protect and maintain or restart your business activities during a major
disaster.
Do not be put off by the size, cost and complexity of arrangements you
might have seen in bigger companies. Implementing business continuity
management in a large organization is a major undertaking. There are
numerous systems, services and people to take into account.
But for a small enterprise, the task is much simpler. It should not require
a large investment of time or money. And it should not be difficult,
because it is largely applied common sense.
In fact experience shows that in a real disaster, smart strategies, advance
thinking and a good understanding of roles and priorities will count for
much more than complicated plans and sophisticated technology. As in
many areas of business, simplicity is the key to a fast, smooth recovery.
1 Making the business case
4 BCM for SMEs
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution
Learning points from this chapter
This brief chapter was intended to set out the arguments for developing
a business continuity plan. Here are the key learning points to be taken
from this chapter:
Business continuity management reduces the risks to your business
and might ensure your survival in a disaster.
Regardless of your own appetite for risk, it is better to have as many
risks as possible under control.
Nearly one in five businesses suffers a major disruption every year.
Yours could be next.
Business continuity is a cornerstone of good corporate governance,
and a smart business investment.
If you invest in insurance cover, it also makes sense to invest in
business continuity planning.
If your clients include large organizations, it is likely they will at
some point ask you about your business continuity arrangements.
Business continuity management is your business best defence
against terrorist threats.
An effective response demands careful planning, advance
preparations and regular rehearsal.
Business continuity management is not a difficult or expensive task
for a small enterprise.
Simplicity is the key to a fast, smooth recovery.
How much work is involved?
BCM for SMEs 5
This is a sample chapter from Business Continuity Management for Small and
Medium Sized Enterprises.
To read more and buy, visit [Link]
BSI British Standards Institution