Back To Policies

StreetVibes UK Business Continuity / Disaster Recovery Plan

Date:     July 2014

Review:    August 2016

Distribution List

Copy Number

Name

Location

001

StreetVibes Office 1

SV main office, Eltham site

002

StreetVibes Office 2

SV secondary office, Southwark site

003

Sonia Ramanah

Director’s home address

Review and Change Control

Please detail all reviews made even if the document is not amended.

Version

By

Date

Comments

1.0

SR

July 2013

Updated version from Oct 2011

2.0

SR

July 2014

Updated version from July 2014

Test Record

 

 

Date

Description of Test Exercise

Parties Involved in Test

Sept 14

Disaster Recovery, IT resources

Orlando Clement, Head of Centre

If you have any suggested changes to this plan, please notify

 

Sonia Ramanah – Managing Director

  1. Aim of the Business Continuity / Disaster Recovery Plan

This plan has been designed to prepare StreetVibes (SV) to cope with the effects of an emergency or crisis. It is intended that this document will provide the basis for a relatively quick and painless return to “business as usual” regardless of the cause.

The purpose of this document is to ensure there are plans in place to continue providing critical services in the event of disruption, for example flooding, fire or loss of IT systems.

  1. Objectives of the plan

  • Understand the critical functions and activities of the organisation.
  • Analyse and respond to the risks to the organisation.
  • Provide a detailed, prioritised and timetabled response to an emergency situation.
  • Identify the key roles, responsibilities and contacts to respond to an emergency.

  1. Roles and Responsibilities

The Response/ Recovery Team is made up of the following staff:

  • Managing Director: overall responsibility for Business Continuity/ Disaster Recovery
  • CEO/Head of Centre: secondary responsibility for Business Continuity/ Disaster Recovery
  • IT Manager: support for Business Continuity/ Disaster Recovery of IT systems
  • Role of the Managing Director:
  • Strategic owner of the Business Continuity / Disaster Recovery Plan
  • Takes ownership of all threats identified and ensures the Business Impact Analysis (see Section 6 below) is current
  • Participate in test and exercise planning and execution
  • Ensure plans are maintained, located and secured appropriately
  • Ensure employees are aware of the Business Continuity / Disaster Recovery Plan and their roles following an incident
  • Liaise with Response / Recovery Team to deliver Business Continuity / Disaster Recovery training to all employees
  • During any incidents - act as Incident Management Team Leader
  • Liaise with appropriate stakeholders
  • Roles and responsibilities of the Response/ Recovery Team:
  • Perform an initial risk assessment to determine current information system (all IT and data systems) vulnerabilities;
  • Perform an initial business impact analysis to determine and understand the inter‐dependencies among business processes and determine how the business would be affected by an information systems outage;
  • Take an inventory of information systems assets such as computer hardware, software, applications and data;
  • Identify single points of failure within the information systems infrastructure;
  • Identify critical applications systems and data;
  • Prioritise key business functions.

 

  1. Incident Management

The Response/ Recovery Team will form as soon as any of its members declare the need and informs the Managing Director. On forming, those present can take decisions to apply appropriate resources to deal with an event as it occurs (ideally to prevent it becoming a crisis). The team must be made up of individuals representing the whole organisation. Please refer to Appendix C: Key Contact Sheet for details.

 

  • Meeting Locations

Location 1

Head Office

Location 2

Southwark Centre

Location 3

Director home address, if required

Equipment Required

Laptop, linked to network if possible, mobile phones, Business Continuity Plan, contact details for employees

  • Escalation

All employees have a responsibility to notify their line manager, or other appropriate manager, if they feel SVs’ ability to operate effectively may be in danger or there may be a need to invoke a Business Continuity / Disaster Recovery Plan. This should then be escalated to a member of the Response/ Recovery Team.

  • Invocation

All members of the Response/ Recovery Team have a responsibility to meet as soon as is reasonable to discuss an incident, or the threat of an incident, which could force a Business Continuity / Disaster Recovery Plan to be invoked.

  • Action Logs

All actions taken must be recorded – please refer to:

  • Appendix A: Critical Function Priority List
  • Appendix B: Emergency Response Checklist for use during an Emergency
  • Appendix D: Log Sheet for use in an Emergency
  • Appendix F: Actions and Expenses Log

  1. Response/ Recovery Team Checklist (Initial Actions)

In the first 24 hours following a major incident there will be a number of actions that will need to be completed in the short term.

No.

Action Required

Completed

Person Responsible

1

Decision taken to invoke Business Continuity/ Disaster Recovery Plan

Managing Director

2

Decide location of Control Centre

Managing Director

3

Is switchboard operational?

IT Manager  

4

Is IT network operational?

IT Manager  

5

Have all members of the Recovery Team been contacted?

Managing Director

6

Has the nature of the incident and the impact on services been assessed?

Managing Director

7

Have appropriate employees and key stakeholders been informed?

Managing Director

8

Establish means of communication e.g. website, telephones and post

Project Manager

9

Ensure any costs incurred are properly recorded

Finance Manager

10

Create action log

Managing Director

11

Set a target for the restoration of affected services

Managing Director

12

Contact all employees to inform if their attendance is required

Project Manager

  1. Business Impact Analysis 1

Critical Function:

IT and Data Communications Services Failure

Disaster and Failure Scenario:
One or more of the general applications could fail: Microsoft Suite, Windows, Mac OS, Cubase, Reason, Logic.
Servers, telephony services and internet connections could fail.

The Local Area Networks (LANs) comprise a range of components, including file servers, hubs, routers, switches, network interface cards and associated cabling. These LANs could fail or be destroyed, for example by fire.

In addition, Macs/PCs could also fail or be destroyed.

Time needed for recovery: 1-2 days maximum

Resource Requirements for Recovery:

Time

No. of staff

Relocation?

Resources required

Action required

First 24 hours

2

No

·    Access to server

·    MacBook Pro (stored offsite, which has access to SV data)

·    Contact details of warranty providers/ software

·    Contact details of telephony or internet services

·    Access to backup data stored off site

·    Contact necessary software manufacturer

·    manufacturers

·    Contact necessary service provider for telephony or internet services

24 – 48 hours

2 plus external IT company

No

·    Access to building’s main server

·    Access to off site data storage facility

·    Make contact with Tiger Computing Systems

·    Make contact with other specialist IT company if Tiger Computing Systems are unavailable

  1. Business Impact Analysis 2

Critical Function:

Utility Failure/ Building Relocation due to Flooding, Fire etc

Disaster and Failure Scenario:

If any utilities (electricity, gas, water) fail, affected buildings may have to close. For example, if there was no water a building may have to close on health grounds.

Access to buildings could be affected in the event of a flood, fire, natural disaster or if it had been closed by police. In these circumstances, it is likely (although not guaranteed) that temporary access would be possible to retrieve equipment and documentation.

When utilities fail, related effects include loss of lighting, heating and security systems, thus rendering the buildings unusable (although probably accessible temporarily).

Time needed for recovery: 1 week maximum

Resource Requirements for Recovery:

Time

No. of staff

Relocation?

Resources required

Action required

First 24 hours

2

No

·    SV emergency evacuation plans

·    Contact details of emergency services

·    Contact details of utility providers

·    Contact details of local authority

·    Evacuate staff and service users from building, if necessary

·    Contact emergency services, if necessary

·    Contact utility provider

·    Contact local authority

24 – 48 hours

2

Yes

·    Contact details of external building services company

·    Contact details of insurance company

·    Inform staff and service users not to come in, if necessary

·    Bring in external building services company to assist

·    Contact buildings insurance company

Up to 1 week

2

Yes

·    Use of company van

·    Building services contractor

·    Relocate staff and service users to alternate premises, e.g. if in Eltham relocate to Southwark, if in Southwark relocate to Eltham

·    Engage building services contractor to fix/ repair the problem

APPENDIX A:

 

Critical Function Priority List

Priority

Critical Function

1

Ensure staff and service users are evacuated from any immediate danger

2

Contact emergency services, if necessary

3

Contact person in charge of business continuity - Managing Director (Sonia Ramanah)

4

Contact secondary person in charge of business continuity (Orlando Clement)

5

Contact local authorities

6

Inform stakeholders (emergency contacts for service users and staff), if necessary

7

Contact necessary service providers (internet, telephony, building services), as necessary

8

Inform StreetVibes management team of any necessary actions to be taken

This list can be used during an emergency to assist your decision making when compiling an Action Plan as to which function needs to be reinstated first.
APPENDIX B:

 

Emergency Response Checklist for use during an Emergency

·       Start a log of actions taken:

·       Liaise with Emergency Services:

·       Identify any damage:

·       Identify business functions disrupted:

·       Convene your Response / Recovery Team:

·       Provide information to staff:

·       Decide on course of action:

·       Communicate decisions to staff and business partners:

·       Provide public information to maintain reputation and business:

·       Arrange a debrief:

·       Review Business Continuity Plan:

APPENDIX C:

 

Key Contact Sheet

Contact

Office Number

Mobile / Alternative Number

Useful information

Sonia Ramanah

0203 031 8247

07887 640 335

sonia@streetvibes.org

Orlando Clement

0203 031 8252

07944 489 864

orlando@streetvibes.org

Tiger Computing Services

01322 555 119

033 0088 1711

Contact name: Laurence Southon

Greenwich Council

020 8854 8888

Southwark Council

020 7525 5000

EOS

01273 900 900

Telephony services provider

Virgin Media

0800 052 0800

Broadband provider

Eltham Safer Neighbourhoods Team

020 8721 2636

Local police contact for Eltham non-emergencies

Southwark Safer Neighbourhoods Team

020 8721 2802

Local police contact for Southwark non-emergencies

APPENDIX D:

 

Log Sheet for use in an Emergency

Date

Time

Information / Decisions / Actions

Initials

APPENDIX E:

 

Emergency Pack Contents

As part of the recovery plan for the organisation, key documents, records and equipment are held at SV Eltham and offsite at the managing director’s home in an emergency pack. This pack may be retrieved in an emergency to aid in the recovery process.

The contents of the emergency pack comprise the following:

Documents:

  • A copy of this plan, including key contact details
  • Insurance policy

Records:

  • Computer backup tapes and / or disks
  • Financial records

Equipment:

  • Spare keys
  • Torch and batteries

APPENDIX F:

 

Actions and Expenses Log

This form should be used to record decisions, actions and expenses incurred in the recovery process. This will provide information for the post-recovery debriefing, and help to provide evidence of costs incurred for any claim under an insurance policy.

Date/Time

Decision / Action Taken

By Whom

Costs incurred

_________________
* This policy will be reviewed annually. This policy was last revised August 2018