StreetVibes UK Business Continuity / Disaster Recovery Plan
Date: July 2014
Review: August 2021
Distribution List
Copy Number |
Name |
Location |
001 |
StreetVibes Office 1 |
SV main office, Eltham site |
002 |
StreetVibes Office 2 |
SV secondary office, Southwark site |
003 |
Sonia Ramanah |
Director’s home address |
Review and Change Control
Please detail all reviews made even if the document is not amended.
Version |
By |
Date |
Comments |
1.0 |
SR |
July 2013 |
Updated version from Oct 2011 |
2.0 |
SR |
July 2014 |
Updated version from July 2014 |
Test Record
Date |
Description of Test Exercise |
Parties Involved in Test |
Sept 14 |
Disaster Recovery, IT resources |
Orlando Clement, Head of Centre |
If you have any suggested changes to this plan, please notify
Sonia Ramanah – Managing Director
- Aim of the Business Continuity / Disaster Recovery Plan
This plan has been designed to prepare StreetVibes (SV) to cope with the effects of an emergency or crisis. It is intended that this document will provide the basis for a relatively quick and painless return to “business as usual” regardless of the cause.
The purpose of this document is to ensure there are plans in place to continue providing critical services in the event of disruption, for example flooding, fire or loss of IT systems.
- Objectives of the plan
-
Understand the critical functions and activities of the organisation.
-
Analyse and respond to the risks to the organisation.
-
Provide a detailed, prioritised and timetabled response to an emergency situation.
-
Identify the key roles, responsibilities and contacts to respond to an emergency.
- Roles and Responsibilities
The Response/ Recovery Team is made up of the following staff:
-
Managing Director: overall responsibility for Business Continuity/ Disaster Recovery
-
CEO/Head of Centre: secondary responsibility for Business Continuity/ Disaster Recovery
-
IT Manager: support for Business Continuity/ Disaster Recovery of IT systems
-
Role of the Managing Director:
-
Strategic owner of the Business Continuity / Disaster Recovery Plan
-
Takes ownership of all threats identified and ensures the Business Impact Analysis (see Section 6 below) is current
-
Participate in test and exercise planning and execution
-
Ensure plans are maintained, located and secured appropriately
-
Ensure employees are aware of the Business Continuity / Disaster Recovery Plan and their roles following an incident
-
Liaise with Response / Recovery Team to deliver Business Continuity / Disaster Recovery training to all employees
-
During any incidents - act as Incident Management Team Leader
-
Liaise with appropriate stakeholders
-
Roles and responsibilities of the Response/ Recovery Team:
-
Perform an initial risk assessment to determine current information system (all IT and data systems) vulnerabilities;
-
Perform an initial business impact analysis to determine and understand the inter‐dependencies among business processes and determine how the business would be affected by an information systems outage;
-
Take an inventory of information systems assets such as computer hardware, software, applications and data;
-
Identify single points of failure within the information systems infrastructure;
-
Identify critical applications systems and data;
-
Prioritise key business functions.
- Incident Management
The Response/ Recovery Team will form as soon as any of its members declare the need and informs the Managing Director. On forming, those present can take decisions to apply appropriate resources to deal with an event as it occurs (ideally to prevent it becoming a crisis). The team must be made up of individuals representing the whole organisation. Please refer to Appendix C: Key Contact Sheet for details.
- Meeting Locations
Location 1 |
Head Office |
Location 2 |
Southwark Centre |
Location 3 |
Director home address, if required |
Equipment Required |
Laptop, linked to network if possible, mobile phones, Business Continuity Plan, contact details for employees |
- Escalation
All employees have a responsibility to notify their line manager, or other appropriate manager, if they feel SVs’ ability to operate effectively may be in danger or there may be a need to invoke a Business Continuity / Disaster Recovery Plan. This should then be escalated to a member of the Response/ Recovery Team.
- Invocation
All members of the Response/ Recovery Team have a responsibility to meet as soon as is reasonable to discuss an incident, or the threat of an incident, which could force a Business Continuity / Disaster Recovery Plan to be invoked.
- Action Logs
All actions taken must be recorded – please refer to:
-
Appendix A: Critical Function Priority List
-
Appendix B: Emergency Response Checklist for use during an Emergency
-
Appendix D: Log Sheet for use in an Emergency
-
Appendix F: Actions and Expenses Log
- Response/ Recovery Team Checklist (Initial Actions)
In the first 24 hours following a major incident there will be a number of actions that will need to be completed in the short term.
No. |
Action Required |
Completed |
Person Responsible |
1 |
Decision taken to invoke Business Continuity/ Disaster Recovery Plan |
Managing Director |
|
2 |
Decide location of Control Centre |
Managing Director |
|
3 |
Is switchboard operational? |
IT Manager |
|
4 |
Is IT network operational? |
IT Manager |
|
5 |
Have all members of the Recovery Team been contacted? |
Managing Director |
|
6 |
Has the nature of the incident and the impact on services been assessed? |
Managing Director |
|
7 |
Have appropriate employees and key stakeholders been informed? |
Managing Director |
|
8 |
Establish means of communication e.g. website, telephones and post |
Project Manager |
|
9 |
Ensure any costs incurred are properly recorded |
Finance Manager |
|
10 |
Create action log |
Managing Director |
|
11 |
Set a target for the restoration of affected services |
Managing Director |
|
12 |
Contact all employees to inform if their attendance is required |
Project Manager |
- Business Impact Analysis 1
Critical Function: |
IT and Data Communications Services Failure |
Disaster and Failure Scenario:
One or more of the general applications could fail: Microsoft Suite, Windows, Mac OS, Cubase, Reason, Logic.
Servers, telephony services and internet connections could fail.
The Local Area Networks (LANs) comprise a range of components, including file servers, hubs, routers, switches, network interface cards and associated cabling. These LANs could fail or be destroyed, for example by fire.
In addition, Macs/PCs could also fail or be destroyed.
Time needed for recovery: 1-2 days maximum
Resource Requirements for Recovery:
Time |
No. of staff |
Relocation? |
Resources required |
Action required |
First 24 hours |
2 |
No |
· Access to server · MacBook Pro (stored offsite, which has access to SV data) · Contact details of warranty providers/ software · Contact details of telephony or internet services |
· Access to backup data stored off site · Contact necessary software manufacturer · manufacturers · Contact necessary service provider for telephony or internet services |
24 – 48 hours |
2 plus external IT company |
No |
· Access to building’s main server · Access to off site data storage facility |
· Make contact with Tiger Computing Systems · Make contact with other specialist IT company if Tiger Computing Systems are unavailable |
- Business Impact Analysis 2
Critical Function: |
Utility Failure/ Building Relocation due to Flooding, Fire etc |
Disaster and Failure Scenario:
If any utilities (electricity, gas, water) fail, affected buildings may have to close. For example, if there was no water a building may have to close on health grounds.
Access to buildings could be affected in the event of a flood, fire, natural disaster or if it had been closed by police. In these circumstances, it is likely (although not guaranteed) that temporary access would be possible to retrieve equipment and documentation.
When utilities fail, related effects include loss of lighting, heating and security systems, thus rendering the buildings unusable (although probably accessible temporarily).
Time needed for recovery: 1 week maximum
Resource Requirements for Recovery:
Time |
No. of staff |
Relocation? |
Resources required |
Action required |
First 24 hours |
2 |
No |
· SV emergency evacuation plans · Contact details of emergency services · Contact details of utility providers · Contact details of local authority |
· Evacuate staff and service users from building, if necessary · Contact emergency services, if necessary · Contact utility provider · Contact local authority |
24 – 48 hours |
2 |
Yes |
· Contact details of external building services company · Contact details of insurance company |
· Inform staff and service users not to come in, if necessary · Bring in external building services company to assist · Contact buildings insurance company |
Up to 1 week |
2 |
Yes |
· Use of company van · Building services contractor |
· Relocate staff and service users to alternate premises, e.g. if in Eltham relocate to Southwark, if in Southwark relocate to Eltham · Engage building services contractor to fix/ repair the problem |
APPENDIX A:
Critical Function Priority List
Priority |
Critical Function |
1 |
Ensure staff and service users are evacuated from any immediate danger |
2 |
Contact emergency services, if necessary |
3 |
Contact person in charge of business continuity - Managing Director (Sonia Ramanah) |
4 |
Contact secondary person in charge of business continuity (Orlando Clement) |
5 |
Contact local authorities |
6 |
Inform stakeholders (emergency contacts for service users and staff), if necessary |
7 |
Contact necessary service providers (internet, telephony, building services), as necessary |
8 |
Inform StreetVibes management team of any necessary actions to be taken |
This list can be used during an emergency to assist your decision making when compiling an Action Plan as to which function needs to be reinstated first.
APPENDIX B:
Emergency Response Checklist for use during an Emergency
· Start a log of actions taken: |
|
· Liaise with Emergency Services: |
|
· Identify any damage: |
|
· Identify business functions disrupted: |
|
· Convene your Response / Recovery Team: |
|
· Provide information to staff: |
|
· Decide on course of action: |
|
· Communicate decisions to staff and business partners: |
|
· Provide public information to maintain reputation and business: |
|
· Arrange a debrief: |
|
· Review Business Continuity Plan: |
APPENDIX C:
Key Contact Sheet
Contact |
Office Number |
Mobile / Alternative Number |
Useful information |
Sonia Ramanah |
0203 031 8247 |
07887 640 335 |
|
Orlando Clement |
0203 031 8252 |
07944 489 864 |
|
Tiger Computing Services |
01322 555 119 |
033 0088 1711 |
Contact name: Laurence Southon |
Greenwich Council |
020 8854 8888 |
||
Southwark Council |
020 7525 5000 |
||
EOS |
01273 900 900 |
Telephony services provider |
|
Virgin Media |
0800 052 0800 |
Broadband provider |
|
Eltham Safer Neighbourhoods Team |
020 8721 2636 |
Local police contact for Eltham non-emergencies |
|
Southwark Safer Neighbourhoods Team |
020 8721 2802 |
Local police contact for Southwark non-emergencies |
APPENDIX D:
Log Sheet for use in an Emergency
Date |
Time |
Information / Decisions / Actions |
Initials |
APPENDIX E:
Emergency Pack Contents
As part of the recovery plan for the organisation, key documents, records and equipment are held at SV Eltham and offsite at the managing director’s home in an emergency pack. This pack may be retrieved in an emergency to aid in the recovery process.
The contents of the emergency pack comprise the following:
Documents:
- A copy of this plan, including key contact details
- Insurance policy
Records:
- Computer backup tapes and / or disks
- Financial records
Equipment:
- Spare keys
- Torch and batteries
APPENDIX F:
Actions and Expenses Log
This form should be used to record decisions, actions and expenses incurred in the recovery process. This will provide information for the post-recovery debriefing, and help to provide evidence of costs incurred for any claim under an insurance policy.
Date/Time |
Decision / Action Taken |
By Whom |
Costs incurred |
_________________
* This policy will be reviewed annually. This policy was last reviewed 3rd September 2022.