drcv business continuity planning guide

7/29/2019 DRCV Business Continuity Planning Guide

1/22

BUSINESSCONTINUITY

PLANNINGGUIDE


2/22


3/22


4/22


5/22

ACKNOWLEDGEMENTS

Disaster Ready Chippewa Valley (DRCV) Steering CommitteeThe DRCV Steering Committee directed the development of this planning guide and theDRCVBusiness Continuity Plan Template. As of October 2009, the DRCV Steering Committeemembers were:

Tom Gillett, President, Indianhead Foodservice Distributor (co-chair)Hal Swanstom, Director, Eau Claire County Emergency Management (co-chair)John Baltes, Director of Loss Prevention & Safety, UW-Eau ClaireRandy Beck, Executive V.P./Risk & Facility Management, Royal Credit UnionRichard Kelly, Manager, Safety & Loss Control, Eau Claire Energy CooperativeGerald Leff, Dunn County ARES/RACESJenny Legaspi, Emergency Services Director, American Red CrossDan Liddell, Safety Engineer, Hutchinson Technology

Derrick Longdo, President, IRIS Technology, LLCMarge McFarlane, Superior Performance, LLCColleen Schian, Risk Manager, City of Eau Claire

Funding SupportThe compilation of this guide and the DRCV template were supported with grantassistance from the State of Wisconsin Office of Justice Assistance to Eau ClaireCounty Emergency Management. This support enabled West Central WisconsinRegional Planning Commission to develop this guide under the direction ofDRCV.

Other ResourcesElements of the following business continuity models and materials in particular were adaptedfor this planning guide and the DRCV template:

Ready Your Business: 12 Point Program for Success to Business Continuity Planning. Private-Public Partnership of Dane County. (www.countyofdane.com/ems)

Business Continuity Guideline. ASIS International. (www.asisonline.org)

Sample Business Continuity and Disaster Preparedness Plan. FEMA.(www.ready.gov/business)

Florida Business Continuity Plan Template (www.fldisasterkit.com). Various Partners.

Various assessment and planning forms. School of Criminal Justice, Michigan State University Critical Incident Protocol Program (www.cip.msu.edu)


6/22


7/22


8/22


9/22

1

Business Continuity Plan

An ongoing process supported by seniormanagement and funded to ensure that thenecessary steps are taken to indentify the

impact of potential losses, maintain viablerecovery strategies and plans, and ensure

the continuity of operations throughpersonnel training, plan testing, and

maintenance. ASIS International

I. INTRODUCTION

a. What is a Business Continuity Plan?Business continuity planning is the processes of identifying actions so that your

organization can manage and survive a crisis. In order to identify actions, theorganization must assess its hazard risksand threats. Depending on theorganization, these risks may be naturalhazards, man-made, technological,economic, or regulatory.

Since mitigating the impacts of crisissituation or disaster event is an importantfactor in your businesss survival, yourbusiness continuity plan may refer to and

encompass other emergency plans foryour organization.

Within this guide, the terms business and organization are used interchangeably. Theapproach is reasonably generalized so that the example template can be adapted for useby private sector businesses, non-profit organizations, and public sector agencies.

b. Why Plan?Using a formal planning process requires an organization to consider existing conditionsand risks, then identify strategies to address these risks based on available resources andcircumstances specific to the business. Without such a process, an organization is not

fully prepared to meet changing conditions, protect its critical business functions, andsecure its assets (e.g., facility, equipment, data, personnel).

Consider the following statistics:

25+% of businesses do not reopen following a major disaster1

75% of companies without a business continuity plan fail within 3 years of adisaster2

43% of businesses experiencing catastrophic data loss never reopen3

Also keep in mind that you are an important part of the community and your success isimportant to the Chippewa Valley. And many organizations may be called upon toprovide resources during or after a disaster event in the area. For example, followingHurricanes Katrina and Rita, the private sector often was far more nimble at providingmanpower, materials, and logistics than many parts of the federal government.

1 The Institute for Business & Home Safety2 Crisis Management International3 University of Texas Center for Research on Information Systems


10/22

2

II. DEVELOPING YOUR PLAN

a. Getting StartedThe following is a suggested approach to getting started on a business continuity plan for

your organization:

1) Obtain a commitment from management (see Section III.a.)

2) Identify your planning team and team leader.

3) Review the DRCV Business Continuity Plan Template. Modify and addadditional sections if necessary. Use the template as a starting point.

4) Collect copies of existing emergency plans, procedures, etc.

5) Collect copies of organizational charts, business plans, system processes, etc.

6) Collect information on past hazard risks or disaster events which have impactedyour organization or business.

7) Establish a schedule for completion of the plan. Management should assignaccountability.

8) Obtain planning assistance if needed. As you review the plan template and begincollecting information, it may become apparent that the assistance of a consultantis needed for portions or all of your plan. For many organizations, planning forcomputer data protection, storage, and recovery is sufficiently complex thatspecialized expertise is needed and a stand-alone plan on this topic warranted.

What is most important is that you begin planning for your organization. Dont let thepotential scope of the project deter you from starting. Complete those portions of the

plan that time and resources allow. You can continue to amend your plan and providegreater details in the future.

b. Identifying Your Planning TeamCreate the planning team which best suits your organization. While one or two keypersons may sufficiently plan for smaller organizations and businesses, largerorganizations may require a larger planning team representing different aspects of thebusiness such as management, finance, security, information management, humanresources and safety. A planning team leader should be identified, along with who willbe responsible for compiling the business continuity plan document.

You may also need to contact additional resources during the development of your plan,such as those list below and in the next sub-section:

your insurance agent and accountant utilities and communications providers trade associations and other area

businesses property management, if applicable

key suppliers, clients, or contractedfirms

public sector planning or emergencypersonnel


11/22

3

c. Helpful Resources

Local Resources Public SectorChippewa County Emergency Management:http://www.co.chippewa.wi.us/emergency_management/

Dunn County Emergency Management:http://dunncountywi.govoffice2.com/Eau Claire County Emergency Management:http://www.co.eau-claire.wi.us/CountyDepartments/planning_and_development/emergency_management.htm

Chippewa Valley Technical College Emergency Service Education Center:http://www.cvtc.edu/pages/556.asp

Chippewa Valley Technical College Business & Industry Services:http://www.pwebcluster1.cvtc.edu/pages/366.asp

UW-Eau Claire Safety Reference Guides: http://www.uwec.edu/LPS/references/index.htm

City of Eau Claire Emergency Preparedness Information & Guides:http://www.eauclaire.wi.gov/government/emergency-preparedess

Local Resources Public HealthWestern Region Partnership for Public Health Preparedness: http://www.wrpphp.org

Chippewa County Department of Public Health: http://www.co.chippewa.wi.us/CCDPH

Dunn County Public Health: http://dunncountywi.govoffice2.com/

Eau Claire City-County Health Department: http://www.ci.eau-claire.wi.us/health-department-home

Local Resources NonprofitDisaster Ready Chippewa Valley: http://www.disasterreadychippewavalley.org

American Red Cross Chippewa Valley Chapter: http://www.redcrossww.org

SCORE (general business counseling): http://www.score-eauclaire.org

Other Nonprofit and Professional Associations:Institute for Business & Home Safety: http://www.ibhs.org

National Emergency Management Association: http://www.nemaweb.org

National Fire Protection Association: http://firewise.org

Public Entity Risk Institute: http://www.riskinstitute.org

U.S. Chamber of Commerce: http://www.uschamber.com

Other Government Resources:U.S. Department of Homeland Security Emergency Preparedness: http://www.ready.gov

OSHA Emergency Preparedness: http://www.osha.gov/SLTC/emergencypreparedness/index.html

Small Business Administration Disaster Assistance:http://www.sba.gov/services/disasterassistance/index.html

Wisconsin Emergency Management: http://emergencymanagement.wi.gov/


12/22

4

Business Continuity Planning Organizations:Business Continuity Planners Association: http://www.bcpa.org

Disaster Recovery Institute International: http://www.drii.org

The Business Continuity Institute: http://www.thebci.org

Business Continuity Planning Publications and Materials:Contingency Planning & Management: http://www.contingencyplanning.com

Disaster Recovery Journal: http://www.drj.com

Disaster Resource Guide: http://www.disaster-resource.com

On-line Business Continuity Planning Course: http://nonprofitrisk.org/tools/buinsess-continuity/intro/1-htm

Glossary of Business Continuity Terms: http://en.bcmpedia.org/wiki/Main_Page

Private-Public Partnership of Dane County: http://www.countyofdane.com/ems

ASIS International Business Continuity Guideline. http://www.asisonline.org

FEMA. Sample Business Continuity and Disaster Preparedness Plan.http://www.ready.gov/business

Florida Partnership Business Continuity Plan Template http://www.fldisasterkit.com

Michigan State University Critical Incident Protocol Program http://www.cip.msu.edu

Cyber Security Sites:Department of Homeland Security National Cyber Alert System:www.us-cert.gov

National Cyber Security Partnership: Small Business Cyber Security Guidebook:

http://www.cyberpartnership.org/CommonSenseGuideBus.pdf

National Cyber Security Alliance: Stay Safe Online: http://www.staysafeonline.info/

Pandemic/Avian Flu Preparedness:

City of Eau Claire Emergency Preparedness Information & Guides:http://www.eauclaire.wi.gov/government/emergency-preparedess

Western Region Partnership for Public Health Preparedness: http://www.wrpphp.org

Wisconsin Pandemic Flu Resource: http://pandemic.wisconsin.gov

Centers for Disease Control: http://cdc.gov

U.S. Government Pandemic Flu: http://pandemicflu.gov

Critical Infrastructure: Pandemic Planninghttp://pandemicflu.gov/plan/pdf/CIKRpandemicInfluenzaGuide.pdf

Also contact your county health department.

Emergency Evacuation Preparedness:Guide for People with Disabilities and Other Activity Limitations: http://www.cdihp.org/training

American Red Cross http://www.prepare.org/disabilities

Family PreparednessCity of Eau Claire Emergency Preparedness Information & Guides:http://www.eauclaire.wi.gov/government/emergency-preparedess


13/22

5

Eau Claire Flooding, 1905

d. Overview of Hazard Risks in the Chippewa Valley

Natural HazardsNatural hazards have a long history in the Chippewa Valley and surrounding area:

Recent area tornado history includes 1958 Colfax, 1994 Foster, 2001 Siren, and 2002Ladysmith.

Since 1983, approximately $10 million in property damage has been due to lightning-created fires in Eau Clare County. High straight-line winds and/or hail can causesignificant damage to windows, outside inventory, and storage structures.

Expect 3 to 4 winter storms each year. Temperatures dipped to -45F in January1951. Serious ice storms or freezing rain events every 2.4 years.

A serious flooding event occurs everytwo to three years on average, withgrowing stormwater flooding concerns

in the area. The 1993 floods causedover $10 million in damage, includingdamages to more than 50 businesses,in Eau Claire County alone. In 2000,about 8 of rain fell within 24 hourscausing stormwater flooding damagein the area. Many structures not withina 100-year floodplain do not haveflood insurance.

Swine Flu (H1N1) has raised awareness of potential pandemic threats with new casescontinuing to be reported. To date, Avian Flu (H5N1) has not been confirmed in the

U.S., though it has a much higher death rate than the Swine Flu.

Technological DisastersChemical spills and infrastructure failure (power outages, bridge collapse, dam failure)are types of technological disaster, which may be induced by a natural hazard event.Some example threats:

In 1996, the City of Weyauwega was evacuated for 16 days to due to a hazardousmaterials spill related to a train derailment; this same rail line runs through our area.

In the Winter of 1998, over 4 million persons in the Montreal area were withoutpower (some for over 3 weeks) due to an ice storm.

Large portions of the cities of Chippewa Falls and Eau Claire lie within a damshadow.

Designer DisastersDesigner disasters include acts of domestic or international terrorism, including bio-terrorism, cyber-terrorism, eco-terrorism, bomb threats, sabotage, and other purposelyinduced natural or technological hazards. Such acts have been uncommon and largelylimited in the Chippewa Valley to pipe bombs, arson, or vandalism.


14/22

6

Siren Tornado,2001

WRR Environmental

Services

Weyauwega TrainDerailment, 1996

Organizational HazardsSome organizations may be drastically impacted by the loss of a key employee, a piece ofcritical equipment, a key supplier, or a large customer. Product recalls, certain regulatorychanges, or labor relations can also impact certain businesses. Not all business continuityplans encompass such threats which are often specific to an organization, though such

hazards can be as devastating to operations as a natural disaster event. Each organizationshould individually assess the need to encompass organizational hazards within theirplans scope.

e. DRCV Business Continuity Plan TemplateDisaster Ready Chippewa Valley developed a companion document to this guidetheDRCV Business Continuity Plan Template. The template was compiled from a review ofa numerous different planning models, offering local businesses and organizations aneasy to understand fill-in-the-blank style template.

The DRCV template includes ten sections encompassing existing conditions (businessinformation, key responsibilities, critical resources), assessment, and recommendations(action plan, human resources, sheltering/evacuation, vital records).

The DRCV template should be considered a starting point. You may need to modify andamend the document to best address the circumstance of your organization. For somebusinesses, certain sections of the plan template may already be complete and can bereferenced or attached (e.g., emergency contact information, data management plan).


15/22

7

f. Action Plan IdeasThe action plan is an important part of your business continuity plan (see Section 6 of theDRCV Business Continuity Plan Template). The following is a list of action plan ideastaken from the Private-Public Partnership of Dane Countys Ready Your Business: 12Point Program for Success to Business Continuity Planning.

No Cost Identify two or three contractors or supply sources for emergency items. Pre-qualify with alternate suppliers/vendors for emergency accounts Calculate the cost of business interruptions for one week, one month and six months. Ask your insurance company or agent about policy coverage and costs. Write a short checklist of recovery action items for your firm. Maintain a current emergency contact list for employees and emergency services,

such as police, fire and utilities. Contact your city or county building department to determine the Base Flood

Elevation (BFE) and the Design in Flood Elevation

(DFE) at your location and your buildings susceptibility to flooding. Keep your buildings flood vents clear of debris or other blockage. Conduct a fire drill and check with your local fire department to determine FIRE risk

at your location. Talk to your people about the companys disaster plans. Two-way communication

before, during and after a disaster. Set up a telephone call tree and alternate employee communication procedures. Keep some cash and an ATM card or credit card on hand. Identify an alternate location if your building becomes unusable Talk to utility service providers about potential alternatives and identify back-up

options.

Promote family and individual preparedness among your co-workers; includeemergency preparedness information during staff

meetings, in newsletters, in company intranet, in periodic employee e-mails, andother internal communications tools.

Request no-cost publications from FEMA (800) 480-2520 for individual, family andworkplace preparedness

Under $100 Purchase a First Aid Kit. Purchase and store bottled water for emergency use (two days minimum). Stock a supply of non-perishable foods, paper plates, napkins and plastic utensils.

Purchase a NOAA Weather Alert Radio with S.A.M.E. technology to program foryour specific area. Buy a stock of flashlights, batteries, pens, paper, paper towels, packing tape, etc. for

disaster supply kit. Keep supplies of items such as duct tape, waterproof plastic, shut-off wrench for

water and gas, whistle, compass, plastic bucket with tight lid, work gloves, pliers, hammer, plastic garbage bags and ties. Purchase/maintain camera and film.


16/22

8

Purchase an AM/FM radio, battery operated, or hand crank radio. Restrain/secure desktop computers, compressed gas cylinders and other small items

from earthquake shaking. Elevate valuable contents on shelves above base flood level. Apply asphalt cement under tabs of loose shingles.

Caulk/insulate around openings in outside walls, roof and attic. Purchase fire extinguishers and smoke alarms Attend annual Ready Your Business Conferences (Utah Division of Homeland

Security)

$100 - $499 Provide C.E.R.T./ First Aid and CPR training for employees. Purchase all items from the workplace supply list. Purchase a small back-up generator and maintain fuel. Purchase and maintain fuel for a sump pump. Brace major appliances, such as water heaters, and furnaces to the floor or wall.

More than $500 Purchase and install a multi-KV generator, pre-wired to the buildings essential

electrical circuits. Purchase removable shutters/ install permanent shutters for wind-borne debris

protection. Re-roof with an impact resistant roof covering. Install high wind connectors in roof systems. Re-roof with Class A fire resistant roof covering in wildfire prone areas. Hire an engineer to evaluate the buildings wind or seismic resistance. Conduct a one-hour drill simulating the occurrence of a flood, earthquake or other

hazard.

Send the key safety/emergency response employee to several days training orconference.

Purchase additional insurance (business interruptions, loss of income, extra expense,flood, earthquake).

Store duplicate records off site at a secure facility. Purchase a removable computer storage device, store data off-site. Establish a voice communications system to meet your emergency needs e.g. voice-

mail conference call capability, Private Branch Exchange (PBX), Automatic Call Distribution (ACD) system. Install a monitored smoke alarm system. Install lightning protection system.

Given current concerns with pandemics due to the H1N1 (Swine Flu) virus,information on small business planning for pandemics has been included as an

attachment at the end of this guide.


17/22

9

III. PUTTING YOUR PLAN INTO ACTION

a. Management CommitmentBusiness continuity planning should not just be an exercise. It takes a commitment of

time to fully develop a plan and a completed plan may include recommended actionswhich change policies or require an investment to protect critical business functions.

Top down leadership is vital to ensuring accountability in plan development,implementation, and maintenance. The senior leadership of your organization should becommitted to undertaking a business continuity planning effort from the start and, ifpossible, have an active role as part of the planning team. Once the plan is completed,management approval is also needed, as well as a commitment to periodically review andupdate the plan. The roles of management will vary by organization.

b. General ImplementationThe action plan section of the DRCV Business Continuity Plan Template prompts theplanning team to identify needed resources and a key responsible party for each strategy.When possible, add a completion date for each strategy and ensure that the keyresponsible parties are aware of management expectations. Communicate your planrecommendations and emergency procedures to employees and supervisors.

Go that extra step. Some business continuity models suggest detailed forms becompleted for each employee, key supplier/vendor, key clients, essential equipment, andeach vital record. One such source for such forms is the Institute for Business & HomeSafety.4 Though the DRCV template does not include such detailed forms, we encourageyou to take your plan to the next level and incorporate such documents.

c. Testing and TrainingExercises, drills, and training are important parts of plan implementation. Sections 7 and8 of the DRCV template prompt you to identify a training approach. It may be helpful toattach a calendar or list of key dates for testing and training.

d. Plan Evaluation and UpdatesYour business continuity plan is a living document, and should reflect the dynamic worldin which we live. It is recommended that you evaluate and update your plan at leastannually. As part of your evaluation, also review progress on the implementation of your

action plan and other plan recommendations. Consider scheduling your plan evaluationand update to immediately following testing and training; strengthen your plan based onthe lessons learned during your training exercises. Changing conditions or a new riskmay require a plan update between your normally scheduled evaluation dates. Section 10of the DRCV Business Continuity Plan Template addresses plan evaluation and updates.

4Open for Business: A Disaster Planning Toolkit for the Small to Mid-Sized Business Owner.www.ibhs.org/business_protection. Also includes a property protection checklist.


18/22

10

Special Addendum: Small BusinessPlanning for Pandemics

The following information was taken from the Private-Public Partnership of DaneCountys Ready Your Business: 12 Point Program for Success to Business ContinuityPlanning.

The CDC checklist, www.pandemicflu.gov/plan/businesschecklist.html is a greatresource for large companies, but may be difficult to read or follow for small businesses.We have collected information that may be useful for small businesses that are trying toprepare for a pandemic. This document may be changed as new information becomesavailable, so check back for updated versions.

All businesses, even small ones, need to prepare for a pandemic. Small businesses have

fewer workers and less capital, and are more likely to have difficulty operating undertrying times. Spend some time planning now to save your business later.

First thing to do: Find your important documents (such as business licenses, accounts, etc.) and be

sure you have backup copies. Make paper copies of essential documents. If yourpower goes out for a long period, what papers would you need to continue runningyour business?

Providing food (grocery, farmers), water (public utilities), commerce (banks),

energy (electricity, gas), transportation (mass transit, repair, cargo transport),

healthcare (doctors, nurses, hospitals), public safety (police, fire, EMS,), andcommunications (phone service) are examples of critical or essential services. Doyou sell essential products or provide any essential services?

Communicate with your workers: Talk to your workers NOW and work together to plan for an emergency. If your

workers are part of a union or labor group, involve them as well.

Keep a current list of phone numbers for your employees so that you can contact

them during an emergency.

Encourage workers to get an annual influenza vaccination (flu shot).

Help your workers prepare emergency kits for themselves and their families. Educate Workers on the importance of:

o Hand washing

o Respiratory etiquette (cover coughs and sneezes, using disposable tissueswhen possible)

o Healthy diet

o Exercise


19/22

11

o How to recognize the difference between influenza (flu) and a cold(influenza is much more severe, it hits you very suddenly, you have fever andaches)

o The difference between seasonal flu and pandemic flu (seasonal flucomes every year, pandemic flu is when the flu strain changes and people may

become much sicker than usual, and some may die).

Reduced number of workers:You may only have half of your workers during a pandemic. Some will be sick, and somemay stay home to take care of sick family members or care for children. Here are someideas on how you can keep your business open during a pandemic or other emergency.

Limit some of your services. At a minimum, try to provide essential services during

a pandemic or emergency situation.

Reduce the hours you are open for business.

Cross-train your employees. Make sure that you dont have only one or two

workers that know how to do a critical part of your work. If they become ill, youwould have difficulty keeping your business open.

Recall and retrain retired workers. Keep home numbers and addresses of workers

who have retired. You may need to ask them to help during a pandemic or otheremergency.

Plan on selling, servicing, and making products with fewer workers.

If you are out sick, will your business continue to operate? Identify workers who

can make key decisions in the absence of owners/managers.

Social distancing:If a pandemic occurs, you may be asked to have your business participate in socialdistancing. This means that people should stay at least 3 feet apart from each other. Hereare some ideas that can help:

Encourage frequent hand washing.

Limit face-to-face contact.

o Try to reduce people standing in lines or crowds.

o Ask customers to stand further away from workers and each other.

o Install plexiglass panels between workers and customers.

o

Use telephones to communicate with customers or internal staff.o Stop hand shaking

o Spread out seating in meetings, or meet via teleconference.

o Stop sharing of workstations.

o Avoid unnecessary meetings.

o Limit the number of people on elevators, and encourage people to use thestairs.


20/22

12

o Have your business work additional shifts or stagger shifts, with fewerworkers per shift, to increase the distance between employees.

o Have your employees work from home.

Plan ahead:

Keeping your workers healthy is one of your biggest priorities. Sick workers much notcome to work, or stay at work, because they can infect your other healthy workers.

Review your sick leave policies. During a public health emergency, sick workers

must not come to work, even if you are short-staffed. Do not allow sick employeesto stay at work. You must not punish employees if they are sick during anemergency. Establish clear policies and guidelines not that will help employeesunderstand options and expectations for when they are ill.

What will your business do if a worker becomes ill while at work?

Provide soap and hot water or alcohol-based hand sanitizers to your employees.

Provide disposable tissues.

Mass transit (such as crowded buses) may be suspended during a pandemic.

Gasoline may become very expensive and/or difficult to get. How will youremployees get to work?

Develop infection control practices, such as decontaminating office surfaces, such

as phones, keyboards, etc. daily.

Other things to consider: Long distance travel may be temporarily stopped. Try to avoid travel (especially to

affected areas) by using teleconferencing or video conferencing. See if there arelocal suppliers available to your business.

Do you have employees with special needs, such as disabled workers or those

unable to read/write, etc? How will they be cared for?

If a pandemic occurs, your suppliers may be cut off. Can you increase your

inventory of raw materials?

How will you communicate with your customers, suppliers, and general public

during an emergency? Do you have a website? Use password-protected websites tocommunicate sensitive information with employees.

Make sure that you can access TV, radio, and/or the internet at work to followdevelopments as they occur.

How will your business be affected by a pandemic? For example, if mass gatherings

are cancelled, would your business be affected? Some businesses may be very busyduring a pandemic, such as gas stations, grocery stores, etc.


21/22

13


22/22

drcv business continuity planning guide

Documents