StreetVibes Academy Policies

StreetVibes UK Business Continuity / Disaster Recovery Plan

Date:     July 2014

Review:    August 2021

Distribution List

Copy Number	Name	Location
001	StreetVibes Office 1	SV main office, Eltham site
002	StreetVibes Office 2	SV secondary office, Southwark site
003	Sonia Ramanah	Director’s home address

Review and Change Control

Please detail all reviews made even if the document is not amended.

Version	By	Date	Comments
1.0	SR	July 2013	Updated version from Oct 2011
2.0	SR	July 2014	Updated version from July 2014

Test Record

 

 

Date	Description of Test Exercise	Parties Involved in Test
Sept 14	Disaster Recovery, IT resources	Orlando Clement, Head of Centre

If you have any suggested changes to this plan, please notify

 

Sonia Ramanah – Managing Director

1. Aim of the Business Continuity / Disaster Recovery Plan

This plan has been designed to prepare StreetVibes (SV) to cope with the effects of an emergency or crisis. It is intended that this document will provide the basis for a relatively quick and painless return to “business as usual” regardless of the cause.

The purpose of this document is to ensure there are plans in place to continue providing critical services in the event of disruption, for example flooding, fire or loss of IT systems.

2. Objectives of the plan

• Understand the critical functions and activities of the organisation.
• Analyse and respond to the risks to the organisation.
• Provide a detailed, prioritised and timetabled response to an emergency situation.
• Identify the key roles, responsibilities and contacts to respond to an emergency.

3. Roles and Responsibilities

The Response/ Recovery Team is made up of the following staff:

• Managing Director: overall responsibility for Business Continuity/ Disaster Recovery
• CEO/Head of Centre: secondary responsibility for Business Continuity/ Disaster Recovery
• IT Manager: support for Business Continuity/ Disaster Recovery of IT systems
• Role of the Managing Director:
• Strategic owner of the Business Continuity / Disaster Recovery Plan
• Takes ownership of all threats identified and ensures the Business Impact Analysis (see Section 6 below) is current
• Participate in test and exercise planning and execution
• Ensure plans are maintained, located and secured appropriately
• Ensure employees are aware of the Business Continuity / Disaster Recovery Plan and their roles following an incident
• Liaise with Response / Recovery Team to deliver Business Continuity / Disaster Recovery training to all employees
• During any incidents - act as Incident Management Team Leader
• Liaise with appropriate stakeholders
• Roles and responsibilities of the Response/ Recovery Team:
• Perform an initial risk assessment to determine current information system (all IT and data systems) vulnerabilities;
• Perform an initial business impact analysis to determine and understand the inter‐dependencies among business processes and determine how the business would be affected by an information systems outage;
• Take an inventory of information systems assets such as computer hardware, software, applications and data;
• Identify single points of failure within the information systems infrastructure;
• Identify critical applications systems and data;
• Prioritise key business functions.

 

4. Incident Management

The Response/ Recovery Team will form as soon as any of its members declare the need and informs the Managing Director. On forming, those present can take decisions to apply appropriate resources to deal with an event as it occurs (ideally to prevent it becoming a crisis). The team must be made up of individuals representing the whole organisation. Please refer to Appendix C: Key Contact Sheet for details.

 

• Meeting Locations

Location 1	Head Office
Location 2	Southwark Centre
Location 3	Director home address, if required
Equipment Required	Laptop, linked to network if possible, mobile phones, Business Continuity Plan, contact details for employees

• Escalation

All employees have a responsibility to notify their line manager, or other appropriate manager, if they feel SVs’ ability to operate effectively may be in danger or there may be a need to invoke a Business Continuity / Disaster Recovery Plan. This should then be escalated to a member of the Response/ Recovery Team.

• Invocation

All members of the Response/ Recovery Team have a responsibility to meet as soon as is reasonable to discuss an incident, or the threat of an incident, which could force a Business Continuity / Disaster Recovery Plan to be invoked.

• Action Logs

All actions taken must be recorded – please refer to:

• Appendix A: Critical Function Priority List
• Appendix B: Emergency Response Checklist for use during an Emergency
• Appendix D: Log Sheet for use in an Emergency
• Appendix F: Actions and Expenses Log

5. Response/ Recovery Team Checklist (Initial Actions)

In the first 24 hours following a major incident there will be a number of actions that will need to be completed in the short term.

No.	Action Required	Completed	Person Responsible
1	Decision taken to invoke Business Continuity/ Disaster Recovery Plan		Managing Director
2	Decide location of Control Centre		Managing Director
3	Is switchboard operational?		IT Manager
4	Is IT network operational?		IT Manager
5	Have all members of the Recovery Team been contacted?		Managing Director
6	Has the nature of the incident and the impact on services been assessed?		Managing Director
7	Have appropriate employees and key stakeholders been informed?		Managing Director
8	Establish means of communication e.g. website, telephones and post		Project Manager
9	Ensure any costs incurred are properly recorded		Finance Manager
10	Create action log		Managing Director
11	Set a target for the restoration of affected services		Managing Director
12	Contact all employees to inform if their attendance is required		Project Manager

6. Business Impact Analysis 1

Critical Function:

IT and Data Communications Services Failure

Disaster and Failure Scenario:

One or more of the general applications could fail: Microsoft Suite, Windows, Mac OS, Cubase, Reason, Logic.

Servers, telephony services and internet connections could fail.

The Local Area Networks (LANs) comprise a range of components, including file servers, hubs, routers, switches, network interface cards and associated cabling. These LANs could fail or be destroyed, for example by fire.

In addition, Macs/PCs could also fail or be destroyed.

Time needed for recovery: 1-2 days maximum

Resource Requirements for Recovery:

Time	No. of staff	Relocation?	Resources required	Action required
First 24 hours	2	No	·    Access to server ·    MacBook Pro (stored offsite, which has access to SV data) ·    Contact details of warranty providers/ software ·    Contact details of telephony or internet services	·    Access to backup data stored off site ·    Contact necessary software manufacturer ·    manufacturers ·    Contact necessary service provider for telephony or internet services
24 – 48 hours	2 plus external IT company	No	·    Access to building’s main server ·    Access to off site data storage facility	·    Make contact with Tiger Computing Systems ·    Make contact with other specialist IT company if Tiger Computing Systems are unavailable

7. Business Impact Analysis 2

Critical Function:

Utility Failure/ Building Relocation due to Flooding, Fire etc

Disaster and Failure Scenario:

If any utilities (electricity, gas, water) fail, affected buildings may have to close. For example, if there was no water a building may have to close on health grounds.

Access to buildings could be affected in the event of a flood, fire, natural disaster or if it had been closed by police. In these circumstances, it is likely (although not guaranteed) that temporary access would be possible to retrieve equipment and documentation.

When utilities fail, related effects include loss of lighting, heating and security systems, thus rendering the buildings unusable (although probably accessible temporarily).

Time needed for recovery: 1 week maximum

Resource Requirements for Recovery:

Time	No. of staff	Relocation?	Resources required	Action required
First 24 hours	2	No	·    SV emergency evacuation plans ·    Contact details of emergency services ·    Contact details of utility providers ·    Contact details of local authority	·    Evacuate staff and service users from building, if necessary ·    Contact emergency services, if necessary ·    Contact utility provider ·    Contact local authority
24 – 48 hours	2	Yes	·    Contact details of external building services company ·    Contact details of insurance company	·    Inform staff and service users not to come in, if necessary ·    Bring in external building services company to assist ·    Contact buildings insurance company
Up to 1 week	2	Yes	·    Use of company van ·    Building services contractor	·    Relocate staff and service users to alternate premises, e.g. if in Eltham relocate to Southwark, if in Southwark relocate to Eltham ·    Engage building services contractor to fix/ repair the problem

APPENDIX A:

 

Critical Function Priority List

Priority	Critical Function
1	Ensure staff and service users are evacuated from any immediate danger
2	Contact emergency services, if necessary
3	Contact person in charge of business continuity - Managing Director (Sonia Ramanah)
4	Contact secondary person in charge of business continuity (Orlando Clement)
5	Contact local authorities
6	Inform stakeholders (emergency contacts for service users and staff), if necessary
7	Contact necessary service providers (internet, telephony, building services), as necessary
8	Inform StreetVibes management team of any necessary actions to be taken

This list can be used during an emergency to assist your decision making when compiling an Action Plan as to which function needs to be reinstated first.
APPENDIX B:

 

Emergency Response Checklist for use during an Emergency

·       Start a log of actions taken:
·       Liaise with Emergency Services:
·       Identify any damage:
·       Identify business functions disrupted:
·       Convene your Response / Recovery Team:
·       Provide information to staff:
·       Decide on course of action:
·       Communicate decisions to staff and business partners:
·       Provide public information to maintain reputation and business:
·       Arrange a debrief:
·       Review Business Continuity Plan:

APPENDIX C:

 

Key Contact Sheet

Contact	Office Number	Mobile / Alternative Number	Useful information
Sonia Ramanah	0203 031 8247	07887 640 335	sonia@streetvibes.org
Orlando Clement	0203 031 8252	07944 489 864	orlando@streetvibes.org
Tiger Computing Services	01322 555 119	033 0088 1711	Contact name: Laurence Southon
Greenwich Council	020 8854 8888
Southwark Council	020 7525 5000
EOS	01273 900 900		Telephony services provider
Virgin Media	0800 052 0800		Broadband provider
Eltham Safer Neighbourhoods Team	020 8721 2636		Local police contact for Eltham non-emergencies
Southwark Safer Neighbourhoods Team	020 8721 2802		Local police contact for Southwark non-emergencies

APPENDIX D:

 

Log Sheet for use in an Emergency

Date	Time	Information / Decisions / Actions	Initials

APPENDIX E:

 

Emergency Pack Contents

As part of the recovery plan for the organisation, key documents, records and equipment are held at SV Eltham and offsite at the managing director’s home in an emergency pack. This pack may be retrieved in an emergency to aid in the recovery process.

The contents of the emergency pack comprise the following:

Documents:

• A copy of this plan, including key contact details
• Insurance policy

Records:

• Computer backup tapes and / or disks
• Financial records

Equipment:

• Spare keys
• Torch and batteries

APPENDIX F:

 

Actions and Expenses Log

This form should be used to record decisions, actions and expenses incurred in the recovery process. This will provide information for the post-recovery debriefing, and help to provide evidence of costs incurred for any claim under an insurance policy.

Date/Time	Decision / Action Taken	By Whom	Costs incurred

_________________
* This policy will be reviewed annually. This policy was last reviewed 3rd September 2022.