Non-Profit Business
Continuity Management
Plan Toolkit
Completed: 2021 | This document has been adapted from the BCMP Toolkit.
Contents
NONPROFIT BCMP TOOLKIT  INTRODUCTION ........................................................................................................ 1
Background — Calgary’s INBCP ............................................................................................................................................ 2
Toolkit Purpose ........................................................................................................................................................................ 3
Toolkit & Supporting Information ........................................................................................................................................4
Acknowledgments ..................................................................................................................................................................5
NONPROFIT BCMP TOOLKIT  OVERVIEW ........................................................................................................................... 6
Business Continuity Overview ...................................................................................................................................................... 7
Why is Business Continuity Important ................................................................................................................................8
Business Continuity – Program vs. Plan .............................................................................................................................9
Business Continuity Standards ........................................................................................................................................... 11
Business Continuity Management Program Objectives ................................................................................................12
Business Continuity Phases .................................................................................................................................................13
Business Continuity Plans ....................................................................................................................................................14
Business Continuity Management Steps .................................................................................................................................... 15
1. Initial Planning ...................................................................................................................................................................17
2. Secure Resources..............................................................................................................................................................18
3. Develop Material ...............................................................................................................................................................19
4. Delivery – BCMP Lifecycle and Components ............................................................................................................ 20
Additional activities for INBCP .................................................................................................................................................... 25
NONPROFIT BCMP WORKBOOK, “HOW TO” GUIDE .................................................................................................26
Acknowledgments ......................................................................................................................................................................... 27
Introduction ....................................................................................................................................................................................28
Component 1 – Governance ........................................................................................................................................................ 30
Policy ...................................................................................................................................................................................... 30
Structure and Management ................................................................................................................................................31
Component 2 – Risk Assessment & BIA .....................................................................................................................................32
STEP 1: Analyze your business .......................................................................................................................................... 32
STEP 2: Assess the risks ...................................................................................................................................................... 32
STEP 3: BIA – Identify time-sensitive services / functions .......................................................................................... 34
Component 3 – Plans and Procedures ...................................................................................................................................... 35
BCMP Document Summary Table ......................................................................................................................................35
Situation Descriptions ......................................................................................................................................................... 36
Roles and Responsibilities ...................................................................................................................................................37
Emergency Response Plan (ERP) ...................................................................................................................................... 38
Crisis Management Plan (CMP) ......................................................................................................................................... 40
Crisis Communications Plan (CCP) ....................................................................................................................................41
Business Continuity Plan (BCP) ......................................................................................................................................... 42
IT Disaster Recovery Plan (IT DRP) ................................................................................................................................... 44
Scenario Based Plans ........................................................................................................................................................... 46
Component 4 – Sustainment .......................................................................................................................................................47
Training & Awareness .......................................................................................................................................................... 47
Exercises ................................................................................................................................................................................ 47
Maintenance.......................................................................................................................................................................... 50
Program Audit and Review ................................................................................................................................................. 50
Post Disruption Reviews ......................................................................................................................................................51
Appendices ...................................................................................................................................................................................... 52
Appendix: Component 1 – Governance .................................................................................................................................... 52
A1.1 Business Continuity Management Program (BCMP) Policy – Template ........................................................... 52
Appendix: Component 2 – Risk Assessment & BIA ..................................................................................................................54
A2.1 Agency Overview Worksheet .................................................................................................................................... 54
A2.2 Agency Risk Assessment Worksheet ........................................................................................................................55
A2.3. Business Impact Analysis (BIA) ..................................................................................................................................57
A2.4 Memorandum of Agreement (MOU) Template ...................................................................................................... 58
Appendix: Component 3 – Plans and Procedures ...................................................................................................................60
A3.1 Emergency Response Plan ........................................................................................................................................ 60
A3.2 Crisis Management Plan (CMP), Crisis Communications Plan (CCP), Business Continuity Plan (BCP) ...... 60
A3.4 IT Disaster Recovery Plan – Table of Contents ......................................................................................................61
A3.4 Scenario Based Plan .................................................................................................................................................... 62
Appendix: Component 4 – Sustainment ...................................................................................................................................63
A4.1 Business Continuity Training and Awareness Template ....................................................................................... 63
A4.2 Scenario Event List – Example.................................................................................................................................. 64
A4.3 BCP Exercise – Example Questions......................................................................................................................... 65
A4.4 BCMP Review Summary Sheet template ................................................................................................................ 66
A4.5 Post Disruption Review Topics ..................................................................................................................................67
Appendix: Glossary.........................................................................................................................................................................68
TEMPLATE & EXAMPLE ................................................................................................................................................... 71
1. Document Control ..................................................................................................................................................................... 72
1.1. Vital Business Information ............................................................................................................................................73
1.2. Document Objective .....................................................................................................................................................73
2. Agency Overview........................................................................................................................................................................ 74
2.1. Agency Overview ...........................................................................................................................................................74
2.1. Crisis Management / Business Continuity Team & Contact Information ............................................................74
3. Governance – BCMP Policy ..................................................................................................................................................... 75
3.1. Policy Purpose ................................................................................................................................................................75
3.2. Business Continuity Program Objectives ..................................................................................................................75
3.3. Roles and Responsibilities ............................................................................................................................................75
3.4. Plan Approvals ................................................................................................................................................................76
3.5. Scope – BCMP Document Summary Table ..............................................................................................................76
3.6. Sustainment ....................................................................................................................................................................77
4. Risk Assessment and High-Level Strategy ............................................................................................................................ 78
5. Activation Assessment ..............................................................................................................................................................80
6. Business Impact Analysis (BIA) – Service / Function Summary ......................................................................................... 81
7. Crisis Management Plan (CMP) ................................................................................................................................................83
7.1. Objective ......................................................................................................................................................................... 83
7.2. Crisis Management – Action Checklist ..................................................................................................................... 83
8. Crisis Communications Plan (CCP) ......................................................................................................................................... 86
8.1. Objective ........................................................................................................................................................................ 86
8.2. Stakeholders .................................................................................................................................................................. 86
8.3. Media and Social Media Strategy ............................................................................................................................... 86
8.4. Messaging ...................................................................................................................................................................... 87
8.5. Media Holding Statement ........................................................................................................................................... 87
8.6. Develop Communications Plan ................................................................................................................................. 87
9. Business Continuity Plan (BCP) ...............................................................................................................................................88
9.1. Overview ......................................................................................................................................................................... 88
9.2. BCP General Action Checklist .................................................................................................................................... 89
9.3. Specific Essential and Necessary Service/Function Checklists ............................................................................. 91
9.4. Business Continuity Resource Requirements ......................................................................................................... 93
10. Psychosocial Considerations during a Business Continuity Response .........................................................................97
10.1. Five Essential Elements of Psychological First Aid ................................................................................................97
Appendices ......................................................................................................................................................................................98
A1 – Contact Information – Sta and Volunteers ......................................................................................................... 98
A2 – Activation Assessment Worksheet .......................................................................................................................... 99
A3 – Disruption Status Summary and Actions .............................................................................................................. 100
A4 – CCP – Communications Plan and Log ..................................................................................................................101
A5 – Post-Disruption Review ........................................................................................................................................... 102
A5 – Lessons Learned ....................................................................................................................................................... 103
A6 – Scenario Based Plans ............................................................................................................................................... 104
A7 – Psychosocial Sta Support Checklist ................................................................................................................... 104
A8 – Local Emergency Information Reference Sites .................................................................................................. 107
SIMPLIFIED BCMP TEMPLATE ......................................................................................................................................108
Document Control .......................................................................................................................................................................109
1. Key Contact Information ........................................................................................................................................................109
2. Document Objective ...............................................................................................................................................................109
3. Organization Overview ........................................................................................................................................................... 110
4. Vital Business Information ......................................................................................................................................................110
5. BCP Team ....................................................................................................................................................................................111
5.1. Structure ........................................................................................................................................................................ 111
5.2. Responsibilities .............................................................................................................................................................112
6. Risk Assessment and High-Level Strategy ........................................................................................................................... 114
7. Business Impact Analysis (BIA) – Process Priority and Summary .................................................................................... 115
8. Business Continuity Requirements & Strategy – Essential Processes Only .................................................................. 116
8.1. Essential Process 1 ......................................................................................................................................................116
8.2. Essential Process 2 ......................................................................................................................................................116
9. APPENDIX .................................................................................................................................................................................. 117
9.1. Quick Reference – BCP Phases and Actions .......................................................................................................... 117
9.2. BCP Activation Triggers and Assessment ................................................................................................................118
9.3. Psychosocial Considerations during a Business Continuity Response .............................................................119
CALGARY’S INTEGRATED NONPROFIT BCMP  PROJECT MATERIAL .................................................................. 120
Purpose........................................................................................................................................................................................... 121
INBCP Background in Calgary ................................................................................................................................................... 122
Timeline for Calgary’s INBCP .....................................................................................................................................................123
Project Scope ................................................................................................................................................................................124
Project Phases and Timelines ..................................................................................................................................................... 125
Project Workshop Agenda’s .......................................................................................................................................................132
Workshop Materials .....................................................................................................................................................................133
INBCP Kick-O ....................................................................................................................................................................133
Training, Risk Assessment & BIA ...................................................................................................................................... 149
BCP Development .............................................................................................................................................................. 183
Exercise ................................................................................................................................................................................203
1
Non-Profit BCMP Toolkit | Introduction
Non-Profit Business Continuity
Planning — Introduction
2
Non-Profit BCMP Toolkit | Introduction
Background – Calgary’s INBCP
u Following the 2016 Wood Buffalo Wildfire response, using funds allocated by The Canadian Red
Cross Society, The United Way of Calgary & Area released a call for proposal to identify
organizations to provide emergency preparedness and business continuity support to Calgary
non-profit organizations individually and as part of a network to respond to an emergency
u carya was selected to act as lead organization and was awarded funding from this call for
proposal beginning April 1, 2018
u The concept was to provide coordinated business continuity planning support and resources for
non-profit organizations and to collaborate with participating members to build capacity for
business continuity through an integrated, inter-sectoral approach
u The project was titled: Integrated Non-Profit Business Continuity Project (INBCP)
u The project was a pilot with the intention to establish a sustainable program and expand the
scope to support additional non-profit organizations
3
Non-Profit BCMP Toolkit | Introduction
Toolkit Purpose
u Based on Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) that was
completed in 2019, the project team wanted to share learnings and provide this
toolkit and the materials used in the project
u The intent is to provide a starting point for non-profit organizations to create and
implement a Business Continuity Management Program (BCMP)
u This information is meant to be a guide, based on your organization’s resourcing,
program objectives and maturity. Utilize and customize the information and material
to best suit your organization’s needs
u Additional information is provided in this toolkit as a separate component to support
the development of an Integrated Non-Profit Business Continuity Project (INBCP)
across multiple organizations
4
Non-Profit BCMP Toolkit | Introduction
Toolkit & Supporting Information
The components of the toolkit are outlined below:
Document Name Purpose When to use it
Toolkit Outlines the approach to create and implement a
Business Continuity Management Program (BCMP)
for non-profit organizations
Refer to this toolkit as you consider developing a BCMP
to help guide your program approach.
1. Non-Profit Business
Continuity Planning Overview
Materials to guide your organization in developing a
Business Continuity Management Program (BCMP)
To be used by any organization throughout the
implementation and development of a BCMP
2. BCMP Workbook
(How to Guide)
This is a supporting document providing detail to
refer to as required when building a BCMP
Refer to this document as a guide to support the
completion of the BCMP templates (for both the long
and simplified BCMP templates)
3. BCP Template and Example This is a BCP template along with example content. Utilize the template when developing your BCP. This is a
more comprehensive version of the BCP, that includes a
crisis management and communications plan.
4. Simplified BCP Template and
Example
A simplified version of the BCP template. Utilize this template to develop your BCP, it is a good
starting point for a BCP for small to mid sized
organizations. Customize as required to meet the needs
of your organization.
5. Calgary’s Integrated Non-
Profit Business Continuity
Project Material (INBCP)
Share the materials created for Calgary’s INBCP
Pilot Project - 2019
The material is meant to be a reference and guide to be
customized and fit for purpose for your non-profit
organization(s)
5
Non-Profit BCMP Toolkit | Introduction
Acknowledgments
This material was created via a collaborative approach by the following organizations:
• Carya
• Program Managers: Shelagh Dunlop and Kim Savard
• The City of Calgary
• Calgary Emergency Management Agency: Ellen Campbell
• Calgary Neighbourhoods: Brett Whittingham
• Tara Tobler – Business Continuity Specialist
• Sarah Jackson – Document Formatting Services
Questions can be directed to: info@caryacalgary.ca Non-Profit BCMP Toolkit completed: 2021
6
Non-Profit BCMP Toolkit | Update this
6
Non-Profit BCMP Toolkit | Overview
Non-Profit Business Continuity
Planning — Overview
7
Non-Profit BCMP Toolkit | Overview
Business Continuity Overview
-
What is it and why is it important
8
Non-Profit BCMP Toolkit | Overview
Why is Business Continuity Important?
• Service disruptions occur in a variety of forms from small, routine disruptions (e.g. elevator
malfunction), to mid-size disruptions (e.g. fire or flood in your building), to world-wide crisis
(e.g. COVID-19)
• You can’t plan for every possible disruption, but you can develop a structure and framework to
guide your leadership and employees on how to come together and make decisions to keep
your organization running and supporting clients during any type of event => this is business
continuity
• During times of constraint, your organization may be more vulnerable, with reduced budget
and resources, which may make it more challenging for your organization to effectivel
y
respond to a disruption. Maintaining a business continuity management program can support
your organization’s preparedness and response capabilities.
• A community-wide disaster can result in increased demand for your organization’s services
• Develop partnerships and relationships in advance of a disruption to increase efficiency during
response and recovery e.g. collaborate to leverage functional services and resources such as
facilities, employees, volunteers, etc.
• Help meet Government of Alberta Disaster Recovery Program financial assistance
requirements
9
Non-Profit BCMP Toolkit | Overview
Business Continuity – Program vs. Plan
The Business Continuity Management PROGRAM (BCMP) provides the framework and strategic
direction for the establishment, maintenance, and exercising of business continuity planning within the
organization. It outlines the key components required to build an effective series of activities, and
program, each of which are outlined in more detail as part of the BCMP Lifecycle and components:
• Governance – resources, leadership commitment and accountability
• Risk Assessment & Business Impact Analysis (BIA) – assess risk and determine priorities
• Plan Development – documentation of critical resources, information, etc. that will support a
response to a service disruption (Business Continuity Plan)
• Sustainment – training, exercise, maintenance
A Business Continuity PLAN is a component within the program. It is a document that outlines key
information to guide an organization in responding to a disruption, such as the BCP Team structure
and responsibilities, and prioritization of services and processes for your organization.
10
Non-Profit BCMP Toolkit | Overview
Definitions - Program vs. Plan
There are a variety of business continuity standards that include definitions, below are some common
ones:
• Business Continuity Management Program (BCMP) “Ongoing management and governance
process supported by top management and appropriately resourced to ensure that the necessary
steps are taken to identify the impact of potential losses, maintain viable recovery strategies and
plans, and ensure continuity of products and services through training, exercising, maintenance and
review.”
BCI Good Practice Guidelines – 2018
o This can be referred to as different things across the standards including BCMS (business continuity
management system), BCM (business continuity management)
• Business Continuity Plan (BCP) “Documented collection of procedures and information that is
developed, compiled, and maintained in readiness for use in an incident to enable an organization
to continue to deliver its critical activities at an acceptable pre-defined level.”
Canadian Standards
Association Z1600
11
Non-Profit BCMP Toolkit | Overview
Business Continuity Standards
• There are various Business Continuity standards that can be
utilized to develop your own business continuity management:
o Canadian Standards Association (CSA) CSA Z1600
o Disaster Recovery Institute (DRI) International – Professional Practices
o Business Continuity Institute (BCI) – Good Practice Guidelines
o International Organization for Standardization (ISO) 22301 – Business
continuity management systems
• There is no one right or wrong standard, select one or mix and
match to best suit the needs of your organization
12
Non-Profit BCMP Toolkit | Overview
Business Continuity Management Program
Objectives
• Identify and prioritize time-sensitive essential services/processes so that you can quickly resume what is critical
to your organization’s operations
• Identify requirements and resources for your essential services/processes – people, technology, third parties,
etc.
• Reduce the impact of a service disruption
• Clarify roles and responsibilities
• Enhance rapid decision-making capabilities
• Preparedness - identify risks and implement mitigation strategies in advance of disruption
• Ensure timely and effective communication – internal and external
• Preserve and possibly enhance organizational reputation
• Mitigate risk and financial exposure/reduce costs associated with a disruption
• Monitor, manage and support your employee’s wellbeing throughout a disruption
• Support internal and external confidence in your organization
Ø Keep employees safe and services operational
13
Non-Profit BCMP Toolkit | Overview
Business Continuity Phases
Continuously, during disruption:
• Validate priorities during
disruption
• Confirm requirements e.g. work
location
• Confirm critical and essential
processes / services
• Execute BCP and other plans
• Communicate with stakeholders –
internal and external
At time of disruption
• Assess to determine
BCP activation
• Determine immediate
(<24 hours) priorities
and actions
• Confirm critical
processes / services
• Communicate with
stakeholders –
internal and external
Pre-disruption:
Mitigate, Prepare
• Program governance
• Develop plans
• Sustainment -
awareness, training
& exercise,
maintenance,
program review
Post disruption - New
normal, re-imagine
• Response debrief
• Document lessons learned
• Update plans
• Ongoing program
governance
• Ongoing sustainment
activities
Disruption has ended:
• Define “new normal”
• Procedures for
transition to “New
Normal” operations
• Communicate with
stakeholders –
internal and external
Normal
Operations
Response
Recovery
Normal
Operations
Restoration
Service disruption
14
Non-Profit BCMP Toolkit | Overview
Business Continuity Plans
• Below are the common plans that can make up a comprehensive business continuity
management program in mid to large size organizations
• Creating a simple BCP for small to mid-size organizations is the focus of this toolkit
• The other plans require specific expertise to complete
Business Continuity Plan (BCP)
• Documented collection of procedures and
information that is developed, compiled, and
maintained in readiness for use in an incident
that enables an organization to continue to
deliver its critical activities at an acceptable
pre-defined level
The ability to continue after a business disruption
Crisis Management Plan (CMP)
• The ability of an organization to manage incidents
that have the potential to cause significant
security, financial, or reputational impacts
An identified senior management team that comes
together to manage a crisis
Crisis Communications Plan (CCP)
• A document that outlines the processes an
organization will use to respond to a critical
situation that would negatively affect its profitability,
reputation or ability to operate
Internal and external Communication processes
Emergency Response and
Management Plan (ERP)
• A documented plan usually addressing the
immediate reaction and response to an
emergency situation
Initial safety and evacuation
IT Disaster Recovery Plan (DRP)
• Document that defines the resources, actions,
tasks, and data required to manage the
technology recovery effort
Getting IT back up and available
Scenario Based Plans
• Built for a specific purpose / type of disruption
• i.e. Pandemic, Labour Disruption, Cyber Security
Psychosocial Plan
• Plan to support employees well-being during a
disruption
15
Non-Profit BCMP Toolkit | Overview
Business Continuity Management
Program (BCMP) Steps
16
Non-Profit BCMP Toolkit | Overview
Steps to Establish a BCMP
1. Initial
Planning
2. Secure
Resources
3. Develop
Material
4. Delivery
• Below are the recommended steps to establish a BCMP for your
organization
BCMP Lifecycle
Components
1. Governance
2. Risk Assessment &
BIA
3. Plan Development
4. Sustainment
17
Non-Profit BCMP Toolkit | Overview
Step 1: Initial Planning
• Confirm executive sponsorship, accountability, and support for a BCMP for
your organization
• Identify resources to develop and deliver the program
o An employee/employees, familiar with the organization’s structure and operations,
should be assigned to lead the development and sustainment of a BCMP
o An employee/employees may not be required to be dedicated to business continuity
planning only – the role may be combined with other responsibilities (such as
occupational health and safety, business planning, etc.)
o External resources/consultants can provide business continuity planning expertise to
help ensure an effective program is developed
o It is critical that the employee/employees leading a BCMP have a link to the executive
team for input and support
• Create a project plan with key objectives, deliverables and timelines
• Establish a project team that includes organizational leadership
1. Initial Planning
18
Non-Profit BCMP Toolkit | Overview
Step 2: Secure Resources
• If organizations do not have internal resources or expertise available to
develop an effective BCMP, external BCP expertise may be retained
• If you have the option, external resources may help with BCMP delivery
including
o Create / customize material for your organization
o Facilitate workshops to provide training, collect information to populate the
documents, conduct an exercise
o Provide consultation to complete documents
• Suggested steps to engage external resources if required:
o Develop and issue an RFP for an experienced BCP Consultant(s)
o Review the proposals
o Short-list presentation if required
o Select BCP consultant(s)
o Complete contracting process
2. Secure
Resources
19
Non-Profit BCMP Toolkit | Overview
Step 3. Develop Material
• Develop material to align with the project objectives outlined in the Project
Plan
• Reference the material in the BCP Template and Example, How To Guide, and
Project Material slide deck as a started point and adjust as required
• There are a variety of business continuity resources and templates available:
o CEMA: https://www.calgary.ca/readybusiness
o AEMA: https://www.alberta.ca/business-continuity.aspx
§ Government of Alberta Business Continuity Guide: (https://open.alberta.ca/dataset/d00124ba-8ac7-
49b1-b1a6-83f4cad1e77f/resource/e6a1198a-309b-4eb4-a6d7-45a631d2fab2/download/business-
continuity-guide-2017.pdf)
3. Develop
Material
20
Non-Profit BCMP Toolkit | Overview
Step 4: Delivery - BCMP Lifecycle and
Components
1. Governance
• Develop enacting policy
•Define program structure & management
• Set goals and objectives
2. Risk Assessment & BIA
• Analyze your business
• Assess the risks
• Complete a Business Impact Analysis
(BIA)
3. Plan Development
• Emergency Procedures and Plans
• Crisis Management Plan
• Crisis Communications Plan
• Business Continuity Plan
• IT Disaster Recovery Plan
4. Sustainment
• Training and Awareness
• Exercise
• Maintenance
• Program Audit & Review
• Post-Incident Review
Based on
CSA-Z1600
Standards
BCMP is comprised of
four main components
which have to be in
place to ensure an
effective program.
The following slides
outline the deliverables
and what you need to
do for each
component.
Additional detail on
each component can
be found in the “How to
Guide”
4. Delivery
21
Non-Profit BCMP Toolkit | Overview
1. Governance
What it is
• Governance sets direction for the Business Continuity Management (BCMP)
• Align with your organization’s mission and objectives
Main deliverable
• BCMP Policy - outlines the authority, structure, accountability, leadership, oversight,
direction and control over the BCMP
o This can be a separate document or part of your BCP document
o Align to your standard policy approach and format
What you need to do?
• Meet with the organization’s leadership to determine what the objectives for the program
and assign accountability for establishment and maintenance of the program
• Document this in a BCMP Policy which includes
o Policy statement, objectives, scope, roles, responsibilities and enabling authority, plan approvals,
sustainment, budget and financial management
1.
Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4. Sustainment
22
Non-Profit BCMP Toolkit | Overview
2. Risk Assessment &
Business Impact Analysis (BIA)
What it is
• Analyze your business – clearly understand what you do
• Assess risks that face your organization and how they could affect your ability to continue operating
• BIA - determine which processes are time-sensitive and identify prioritized recovery of these processes
Main deliverables
• Risk Assessment – identify your organization’s main risks and high-level mitigation strategies
• BIA - Identify your time-sensitive processe
s
• These can be separate documents or part of your BCP document
o Refer to the Simplified BCP Template as a starting point
What you need to do?
• Develop a BIA approach that is customized for your organization
• Collect the required information via facilitated workshop(s)
1. Governance
2. Risk
Assessment
& BIA
3. Plan
Development
4. Sustainment
23
Non-Profit BCMP Toolkit | Overview
3. Plan Development
What it is
• Develop the Plans within your BCMP
Main deliverable
• BCP document – actionable, simple
o Refer to the simplified BCP Template as a starting point
What you need to do?
• Develop a BCP document that is customized for your organization
• Determine what workshop(s) and participants are required and schedule
accordingly
• Collect the required information via facilitated workshop(s)
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4. Sustainment
24
Non-Profit BCMP Toolkit | Overview
4. Sustainment
What it is
• Ensures the program is current, complete and continuously improved
Main deliverables
• Sustainment guidelines and schedule documented in the BCMP Policy
• Annual BCP exercise and maintenance
What you need to do?
• Training and orientation of business continuity roles and responsibilities for leaders and employees
• Conduct exercises to increase plan familiarity, ensure people understand their roles, and identify any gaps
o Identify objectives of exercise, create a scenario and exercise to achieve the objectives
• Plan maintenance
o Review and update plan, often occurs in conjunction with exercise
• Conduct awareness activities
o Organization-wide initiatives to promote BCP awareness and staff wide expectations during a disruption
• Review and continuous improvement
o Determine how often you want to conduct a thorough program review
• Post-Incident Review
o Debrief with organizational leadership and employees
o Incorporate learnings from the disruption/event
o Evaluate how effective a plan is and how well-prepared teams are
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4.
Sustainment
25
Non-Profit BCMP Toolkit | Overview
If you are undertaking a project across multiple organizations, there are additional activities to consider:
• Select a lead organization to secure funding if available and lead the project
• Assess status of BCMP(s) of participating organizations - determine status of their BCMP via a survey
• Select a cross section of representatives across organizations to develop a steering committee
• Create an overall framework, workbook and templates to provide a basis for organizations to develop or update
their individual BCMPs
• If available, secure consultant expertise to assist in the program development and provide one-on-one coaching to
support individual organizations to assess, review or create their program and plans
• Allow for program integration across organizations - explore opportunities for resource sharing and collaboration in
case of a disruption e.g. shared workspace, combined resources
• For multi organization workshop(s)
o Book a central location
o Provide a sign in sheet to document and track attendees, invites will often get forwarded to multiple people within an organization
o Group participants from similar type of organizations together
o Complete survey following each workshop, adjust approach and material as required
Additional activities for an Integrated Non-
Profit Business Continuity Project (INBCP)
Non-Profit BCMP Toolkit | Workbook “How to” Guide
26
BCMP Workbook
“How to” Guide
Integrated non-profit business continuity project
27
Non-Profit BCMP Toolkit | Workbook “How to” Guide
This Workbook was originally developed by BCP Consultants (through MNP LLP) as part of the
Integrated Non-Profit Business Continuity Project funded by Canadian Red Cross and United Way of
Calgary and Area in 2019. Feedback on the workbook was provided by the project steering committee
and members of the Critical Service Provider (CSP) group. Project steering committee members:
• Carya Society of Calgary (Project Lead)
• Boys & Girls Clubs of Calgary
• The City of Calgary, Calgary Emergency Management Agency and Calgary Neighbourhoods
• Distress Centre
• Federation of Calgary Communities
• Wood’s Homes
• United Way of Calgary and Area
Updates to the workbook and supporting materials were made by a BCP Consultant in 2020 based on
feedback following the original project and responses to a survey conducted in June 2020 of CSPs
following COVID-19 response.
28
Non-Profit BCMP Toolkit | Workbook “How to” Guide
1 | Page
Introduction
Purpose of this Workbook
This Workbook represents a leading practice approach for the development, implementation and ongoing
maintenance of a comprehensive Business Continuity Management Program (BCMP). The material in
this workbook is based on several standards and best practices, but the main guiding standard used is
the Canadian Standards Association - Emergency and Continuity Management Program (CSA Z1600-
17). The Workbook is intended to guide agencies of all sizes and complexities through the creation of a
comprehensive BCMP, following the BCMP Lifecycle components below.
How to use this Workbook
This document provides guidance on how to complete all components of a comprehensive Business
Continuity Management Program (BCMP), tailored to address the characteristics of the not-for-profit
sector.
Use this workbook in conjunction with the plan template information (provided in the Appendix or as a
separate template document) to assist you in documenting your plans. The templates suggest a format
and topics to be included and provide some sample wording. However, the contents and wording must be
customized to meet the needs of your Agency.
Business Continuity Phases
This Workbook follows the business continuity phases outlined below.
29
Non-Profit BCMP Toolkit | Workbook “How to” Guide
BCMP Lifecycle and Components
The BCMP is comprised of 4 main components outlined below. Each component has to be in place to
ensure an effective program.
1. Governance
•Develop enacting policy
•Set program structure & management
•Set goals and objectives
2. Risk Assessment & BIA
•Analyze your business
•Assess the risks
•Complete a Business Impact Analysis
(BIA)
3. Plan Development
•Emergency Response
•Crisis Management
•Crisis Communications
•Business Continuity
•IT Disaster Recovery
•Scenario Based
4. Sustainment
•Training and Awareness
•Exercise
•Maintenance
•Program Audit & Review
•Post-Incident Review
30
Non-Profit BCMP Toolkit | Workbook “How to” Guide
1 | Page
Component 1 - Governance
The Governance Component sets direction for the
Business Continuity Management Program (BCMP).
Governance includes the authority, accountability,
leadership, oversight, direction and control over the
BCMP. It includes overall program structure as well as
the structure to integrate plans and procedures.
Governance consists of the following Elements:
• Policy
• Program Structure and Management
The specifics of governance and the structure of programs and plans will differ for each agency and is
impacted by culture, other existing policies, agency size, and resources. The overall approach and
desired outcomes are outlined in the table below.
Policy
To support the development, implementation and ongoing management of the BCMP a formalized
policy should be developed. The aim of the policy is to identify requirements and provide direction
regarding roles, responsibilities and accountabilities. The policy is intended to ensure that Business
Continuity Management is given the appropriate organizational support and its elements are
integrated, coordinated, effective and sustainable, while at the same time appropriate for the nature,
scale and complexity of your agency.
The comprehensiveness of the policy can vary depending on your agency’s size, internal policy
systems and guidelines. Although the format, and the documents used to articulate the structure,
should be customised to meet your agency’s specific needs, an effective policy should consider and
include the following basic elements:
Policy Content
Policy Statement
• Vision, mission statement linked to your agency’s overall strategic
objectives and goals
Objectives
• Program aim and objectives including milestones if applicable
Scope
• Outline all aspects of the program (governance, risk assessments and
analysis, procedures, plans and sustainment)
• Outline what is not included in the Policy
Roles, Responsibilities
and Enabling Authority
• Overall program roles and responsibilities as well as individual
responsibilities of each Component if applicable
• Include senior management approval
Plan Approvals
• Process for obtaining approval of plans as developed or updated
Sustainment
• Requirements regarding maintenance, training and awareness, and
exercises
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4. Sustainment
31
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Policy Content
Budget and Financial
Management
• Information regarding budget (source and amounts) if applicable
• Description of any changes to financial processes, e.g. approval
levels, post-disruption expenditure review related
[See Appendix A1.1 – for a sample BCMP policy template. The sample policy must be customized to
meet the specific needs of your agency.]
Structure and Management
The BCMP is more than a series of procedures and plans – it is an agency-wide program that requires
structure and ongoing management. It is therefore important that your agency has a permanent
structure in place that manages the program on an on-going basis, as well as a structure for response
and recovery.
The agency will decide on the emphasis and format of plans to be developed. This decision will be
based on what plans and procedures you currently have, the size and complexity of your organization
and your capacity to build and maintain the plans. When describing development of each type of plan,
options include the following:
• Stand-alone Plans - Develop each element as a stand-alone plan; for instance, separate
documents for Crisis Management Plan, Emergency Procedures, Business Continuity, IT
Disaster Recovery plans
o More applicable for large, complex organizations
o Advantage: each can be developed independently of other plans; smaller documents
for use by individuals filling roles related to the plan
o Disadvantage: involves more formal document format (table of contents, document
revision history) for each plan and some duplication of information that will need to be
kept in sync when any plan is updated
• One Consolidated Plan - Create one document that includes the full set of Business
Continuity Management Program (BCMP) plans;
o More applicable for small to medium organizations
o Advantage: consistency of format of all plans; unified table of contents, document
revision history; all plans available in one place
o Disadvantage: larger effort at one time to build and maintain all plans; bigger
document that may be intimidating to read or update
• Hybrid - Combine some elements together into one document; this approach is
recommended for most medium-sized organizations, combining the Crisis Management,
Crisis Communication and Business Continuity Plans into one document. This is the format
used in the Business Continuity Plan template provided.
o More applicable for small to medium organizations
o Advantage: fewer documents to reference and maintain without loss of content
o Disadvantage: more difficult to split out information to people who do not need or
should not access the plan it is appended to
The order to build these plans is dependent on the needs of your Agency. For instance, if you already
have well-developed emergency response procedures, formalizing them into an Emergency Response
Plan document is less critical than building your Business Continuity Plan if you don’t have one yet.
32
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Component 2 - Risk Assessment & BIA
This section provides a description of the initial
steps in preparing a Business Continuity Plan (BCP)
for your agency:
1. Analyze your business
2. Assess the risks
3. Complete a Business Impact Analysis (BIA)
identifying your time-sensitive
services/functions
All templates for Component 2 – Risk Assessment
are embedded into the combined Business Continuity Plan template described in Appendices: Section
3 – Plans and Procedures.
STEP 1: Analyze your business
It is important to understand your business and the services you provide when developing a
successful business continuity plan. Consider the following:
• What is your agency’s purpose or mandate?
• What services do you provide?
• Who are your clients? Who are the recipients of your services?
• Where is the primary location your organization works out of?
• What type of community support would you provide during a disaster?
• How long could you suspend your services in an emergency?
[See Appendix A2.1 – Agency Overview Worksheet is embedded into the combined Business
Continuity Plan template described in Appendices: Section 3 – Plans and Procedures.]
STEP 2: Assess the risks
Calgary is exposed to a variety of threats or hazards which can be natural (e.g. weather), human-
caused (e.g. theft, vandalism), and technological hazards (e.g. cyber attack). These threats can arise
from the external environment as well as from internal sources.
These threats can pose a risk and impact on your service delivery in several ways. In this step, you
will assess these risks and how they could affect your ability to continue operating.
The following chart shows the common risks to non-profit agencies, and potential strategies to mitigate
these risks. Adjust risks to reflect the realistic risks to your Agency. In cases where the strategy
involves support from another agency, a Memorandum of Understanding (MOU) should be developed.
[See Appendix A2.2 and A2.4 – for template for Risk Assessment and a Memorandum of
Understanding (MOU)]
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4. Sustainment
33
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Obtain agreement from senior management on definitions of low/medium/high impact for your agency,
adjust impact level wording to fit your needs.
Determine the level of impact to your agency of each of the risks above.
Impact Levels to Agency (Example):
Low
Agency operations could
continue within acceptable
timeframes
Medium
Clients would be impacted by
degraded service levels, but no
injury or loss of life as a result
High
Serious client impact from service
disruption, potential for injury or
loss of life, significant financial or
reputational impact
Risk to Agency Examples of Mitigation Strategies
Facilities:
Loss of work location for an extended period
(up to 30 days)
• MOU - Memorandum of understanding or
Mutual Aid Agreement with XYZ
• Alternate work location
• Work from home capability
Technology:
Loss of IT systems, applications and data
(up to 5 days)
• Reliable off-site data backup
• Fail-over to alternate data centre
• Cloud applications or storage of data
• Alternate phone systems
Personnel:
Loss of key staff or a large percentage of staff and/or
volunteers
(up to 50%)
• Identified trained alternates for key roles
• MOU - Memorandum of understanding
with XYZ Agency
External Third Parties:
Disruption affecting external provider needed to
provide your service
(up to 30 days)
• Require supplier to have BCP
• Identify alternate suppliers
Community:
Disaster impacting your municipality or client group
which may change or increase the services your
agency provides
(up to 30 days)
• Communication with other agencies or
groups to get early notice of situation that
potentially requires service changes
34
Non-Profit BCMP Toolkit | Workbook “How to” Guide
STEP 3: BIA - Identify time-sensitive services / functions
A business impact analysis (“BIA”) is the process of analyzing your services and functions and the
impacts that a disruption might have on them. The BIA is the basis for business continuity planning. A
BIA is a structured review of an agency’s services and functions with the aim of determining which are
time-sensitive and whose recovery should be prioritized following a disruption.
This process also identifies which services/functions can be put on hold during a disruption and
reallocate resources to better support the organization and community.
Based on agency size, level of complexity and resource allocation, agencies can choose to build out
their BIA at a service or function level.
• Service – high level process with internal and/or external users
• Business Function – high-level process or operation that is performed routinely to carry out a
part of the mission of an organization
Below is an example of time categories along with service definitions, review with your agency and
adjust timeframes and terminology to fit your needs.
Maximum
Downtime
Service Definitions
< 2
days
Essential
Service
Services/functions must be maintained or there would be extreme consequences for
the agency
e.g. imminent threat to, or loss of life, major/multiple injuries, major facility damage
or destruction, extreme brand and reputation impact, or extreme monetary losses to
the agency
3-5
days
Necessary
Service
Disruption would have moderate consequences to the agency and would not
threaten the provision of essential services/functions
e.g. no loss of life or injuries, moderate but recoverable brand and reputation impact
and moderate monetary losses
> 5
days
Valued
Service
The consequences are dealt with by routine operations and would have negligible
consequence to the agency
e.g. no loss of life or injuries, minimal or no reputational impact or monetary losses
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result of not
providing a service or performing an activity, to become unacceptable.
[See Appendix A2.3 – BIA template]
35
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Component 3 – Plan Development
This component deals with the steps to develop all plans and procedures that make up an agency’s
Business Continuity Management Program
As outlined in the Governance and Structure
component, the agency will decide on the emphasis
and format of plans to be developed. For not-for-
profit agencies, the following structure of plans is
suggested to simplify plan creation and maintenance
and to group related elements. Each of these would
be a separate document:
1. Emergency Response Plan (ERP)
2. Business Continuity Plan (BCP) – including
elements for Crisis Management, Crisis Communications and Business Continuity
3. IT Disaster Recovery Plan (IT DRP)
BCMP Document Summary Table
A comprehensive BCMP includes components of the following plans or procedures. This Workbook
provides a more detailed description, objective and steps on how to develop procedures or plans for
each. Note: combining the CMP, CCP and BCP into one document called a “Business
Continuity Plan” is recommended for small to medium sized organizations.
Acronym Plan or Procedure
Document Name
Document /Section
Owned By
Description
ERP
Emergency
Response Plan
Crisis Management
Lead
Details the Agency’s immediate
response to various emergencies.
CMP
Crisis Management
Plan
Crisis Management
Lead / BCMP Sponsor
Outlines decision-making and actions
to manage the agency during and after
a disruption. This includes coordination
with teams involved in response and
recovery efforts.
CCP
Crisis
Communications
Plan
Communicator
Governs internal and external
communication during each phase of a
crisis, disruption and emergency.
BCP
Business Continuity
Plan
BCP Lead
Procedures and information to enable
the agency to continue to deliver its
Essential Services (continue within 2
days) or Necessary Services (continue
within 5 days) at an acceptable, pre-
defined level during a business
disruption or emergency.
IT DRP
IT Disaster
Recovery Plan
Technology Advisor
Defines the resources, actions, tasks,
and data required to manage a
technology recovery effort.
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Devleopment
4. Sustainment
36
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Situation Descriptions
Below are descriptions for the different types of situations that can impact your Agency. When a
situation occurs, prioritize your Agency’s business operations and service to your clients in relation to
providing emergency or disaster support to the external community.
Situation Description BCMP Plan(s) that
may be activated
Incident Day-to-day situations that may arise and are
typically resolved within 2-4 hours - use emergency
response plan or procedures to respond. They may
or may not lead to a disruption, emergency or
disaster
e.g. fire alarm, unruly client
ERP
Business
Disruption
An event that interrupts your normal business,
functions, operations, or processes, whether
anticipated or not.
e.g. fire in your building, power outage, technology
failure
BCP, CMP, IT DRP,
Scenario-Based
Crisis A crisis is defined as a situation of sufficient
magnitude that it could substantially threaten
Agency operations or reputation. Generally, a crisis
is an event that originates from a disruption or
community emergency that has widespread
reputational and financial impacts to your Agency.
e.g. employee behaviour impacting reputation
BCP, CMP, IT DRP,
Scenario-Based
External
Community
Emergency or
Disaster
Emergency: an event that requires prompt
coordination of action or special regulation of
persons or property to protect the safety, heath or
welfare of people or to limit damage to property.
e.g. community fire
Disaster: an event that results in serious harm to
the safety, health or welfare of people or in
widespread damage to property.
e.g. widespread area flooding
BCP, CMP (CCP),
Scenario-Based
37
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Roles and Responsibilities
Following is a description of common roles and responsibilities that are referenced in this document.
Role Usually filled by Responsibilities
BCMP Sponsor
/ Crisis
Management
Lead
An Agency
Executive
• Represent the interests of the BCMP at the
Executive/Board level e.g. obtain approval and funding
• Provide executive direction to the BCP Lead and others
involved in development or execution of the Program
• Unless a separate Crisis Management Lead is appointed,
this role will:
o lead execution of the Crisis Management Plan
o continuously assess priorities of strategic issues
o formulate, in consultation with others on the Crisis
Management Team (CMT) a strategy for handling the
situation
o facilitate CMT meetings
o act as the ultimate decision-maker during the crisis
o could be the BCMP Sponsor, BCP Lead or other
• Authorize extraordinary expenses incurred during a major
disruption or emergency
Crisis
Management
Team
Small group of
Agency Executive
and/or
Management
• Manage affairs on behalf of the Agency during a business
disruption
• Minimum membership would include the Crisis
Management Lead, BCP Lead, Communicator
• Depending on the nature of the disruption, other people
may be added to the team, e.g. Technology Advisor if
there is an impact on IT services, HR Advisor
Communicator
Agency
Communications
Lead
• Designated lead for emergency/crisis communications
• Develop specific communication plan for a disruption -
including messaging, media to be used for the target
audience, using the Crisis Communications Plan as a
guide
• This role can be split with one Internal Communicator to
deal with Agency staff, management, volunteers and an
External Communicator to deal with other stakeholders
(media, clients, donors, general public, suppliers, etc.)
BCP Lead Senior Manager
or Director
• Ensure BCP is developed, updated and exercised
• Direct response and recovery efforts during a major
disruption or emergency
• Conduct post-disruption reviews and adjust BCP based on
learnings
Technology
Advisor
Senior technical
staff or manager,
or outsourced
• Provide expert IT advice to BCP Lead related to:
assessment of technical disruption, best approach to
restoration of technical services, whether IT Disaster
Recovery Plan should be activated
Critical Staff Regular staff roles
from various
departments
• Implement Essential and Necessary services/functions
recovery procedures and manual contingencies, as
required
38
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Emergency Response Plan (ERP)
Objective
• The main objective of an ERP is to ensure that all required people
automatically respond to various incidents in a specific and predetermined
manner.
Description
• An Emergency Response Plan is a compilation of emergency procedures to
react to a disruption or emergency that could have a significant impact on
operations. Each set of procedures are actions which support immediate
response to a specific type of disruption (e.g. fire evacuation, bomb threat,
etc.). The plan also includes descriptions of the roles that need to be assumed
in the first minutes/hour of an emergency. It elaborates on and complements
information shown on emergency response procedures posters that are
targeted to building occupants.
• The executive leadership roles related to an emergency are included in the
Crisis Management Plan.
• Plans and procedures are often workplace-specific, so an Agency may have
several emergency response procedures manuals. They are typically related
to health and life safety incidents or emergencies and the target audience is
staff, volunteers and clients in the impacted location. If you are a tenant in a
building, some procedures may be provided by your building manager.
• Developing the ERP builds on the risks identified in the Risk Assessment
phase.
• The document may be developed as a stand-alone plan or as a section of a
comprehensive BCMP document.
• Emergency response plans may include but are not limited to: fire and
evacuation, active threats of violence, bomb threats and suspicious package/
device, protests, demonstrations, disturbances, medical emergency,
hazardous materials, severe weather.
Development of Emergency Response Plan
Step 1:
Establish
context and
structure
• Gather available existing emergency procedures and plans and match these
against the risks with medium or high impact to your Agency to identify any
additional emergency response procedures that are required
• Determine the level at which the Emergency Response Plan should be
developed – either one comprising procedures for all emergency types for all
Agency work locations or separate plans for different locations
• Establish a shell or template for your ERP
o A checklist format for the procedures, using simple, action-oriented
language is recommended.
o An ERP format which includes role descriptions and procedure
checklists is enough for most Agencies
• The activities should be detailed in chronological order; incident discovery,
notification, containment, response and escalation, and reporting. The
procedure format should include, as a minimum:
o Disruption or emergency identification – naming and type of disruption
or emergency must be clearly visible and consistent across other
similar procedures
o Reporting – plans must include phone numbers and any directions for
reporting a disruption or emergency
o Actions – action items must be clear, succinct and easily understood
39
Non-Profit BCMP Toolkit | Workbook “How to” Guide
o Special considerations – procedures should take into consideration
those who may have mobility, hearing or visual limitations
o
[See Appendix A3.1 for a sample ERP]
Step 2:
Organize plan
completion
• Identify who will develop or update the ERP and procedures, referencing
available material
• Coordinate completion of ERP with participants as either workshops or
individual sessions
• Review the completed ERP for consistency and accuracy
Step 3:
Obtain
approval and
distribute
plan
• Obtain formal approval from Agency executive
• Decide where to store the completed ERP. Ensure it is available and easily
accessible in both hard and electronic copy. Consider storing on a shared
drive with restricted access.
• Communicate the ERP to Agency staff and management to ensure they know
the plan exists, how and when it should be used and their roles
40
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Crisis Management Plan (CMP)
Objective
• The main objective of a Crisis Management Plan is to ensure those providing
executive oversight and coordination during a disruption or emergency can do
so in a structured manner.
Description
• The Crisis Management Plan is the guiding document for those who are
providing executive oversight and coordination of the Agency’s response to
disruptions or emergencies that have a high impact to the Agency. This
document operationalizes some aspects of the BCMP Policy developed in the
Governance and Structure phase. The CMP clarifies when an emergency or
disruption is significant enough to activate the Business Continuity Plan.
Development of Crisis Management Plan
Step 1:
Establish
context and
structure
• Establish a template for your Crisis Management Plan
• The plan should be succinct and easy for executives to use as a reference.
This is included as a section of the combined Business Continuity, Crisis
Management and Communications Plan template provided. It can be used as-
is or customized to meet the needs of your Agency.
Step 2:
Organize plan
completion
• Identify appropriate participants. Confirm who the Crisis Management Lead
would normally be (this will not always be the CEO or administrative head of
the Agency as they may be more valuable as Crisis Communicator or
Business Continuity Manager in response to the disruption or emergency).
• Coordinate completion of the Crisis Management Plan template through
individual sessions or workshops
• Conduct regular plan exercises to ensure participants are aware of the plan
details and their responsibilities
• Review the completed Crisis Management Plan for accuracy, completeness
and actionability
Step 3:
Obtain
approval and
distribute
plan
• Obtain formal approval from Agency executive.
• Decide where to store the completed plan. Ensure the plan is available and
easily accessible in both hard and electronic copy. Consider storing the plan
on a shared drive with restricted access.
• Communicate the plan to Agency management to ensure they know the plan
exists, how and when it should be used and their roles
41
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Crisis Communications Plan (CCP)
Objective
• The main objective of a Crisis Communication Plan is to ensure consistent
and appropriate communication with both internal and external stakeholders.
Description
• A Crisis Communication Plan is a set of processes that should be used by the
Agency to communicate with internal and external stakeholders.
• The Crisis Communication Plan establishes structure and procedures that can
quickly and effectively report on a disruption or emergency and manage the
reputation impacts and perceptions of the Agency.
• This document is closely tied to the Crisis Management Plan and may form a
section of that plan rather than a separate document.
Crisis Communication Plan Development
Step 1:
Establish
context and
structure
• Establish a template for your Crisis Communication Plan
• The plan should be succinct and easy for executives to use as a reference.
This is included as a section of the combined Business Continuity, Crisis
Management and Communications Plan template provided. It can be used as-
is or customized to meet the needs of your Agency.
Step 2:
Organize plan
completion
• Identify appropriate participants. Confirm who the Crisis Communicator would
normally be. This would generally be the CEO or another executive member;
separate Crisis Communicators could be used for internal vs. external
communication.
• Coordinate completion of the Crisis Communication Plan template through
individual sessions or workshops.
• Review the completed Crisis Communication Plan for accuracy, completeness
and actionability.
Step 3:
Obtain
approval and
distribute
plan
• Decide where to store the completed plan. Ensure the plan is available and
easily accessible. in both hard and electronic copy. Consider storing the plan
on a shared drive with restricted access.
• Obtain formal approval from Agency executive.
• Communicate the plan to Agency management to ensure they know the plan
exists, how and when it should be used and their role.
42
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Business Continuity Plan (BCP)
Objective
• The main objective of a Business Continuity Plan is to guide the recovery
process after a disruption or emergency and ensure the business continues
essential and necessary functions as quickly and efficiently as possible.
Description
• A BCP is designed to enable an organization to achieve an acceptable
predetermined level of operations following a business disruption or
community emergency.
• Depending on the size of your Agency, you may have one corporate BCP or
separate BCPs for selected departments.
• The BCP may be a stand-alone document or combined with all other BCMP
plans into one BCMP document.
• The BCP(s) – which are based on data collected during the Business Impact
Analysis (BIA) – provide the organization with practical actions and direction
for prompt response and recovery of services / functions along with
restoration following the disruption or emergency. Developing the BCP builds
on decisions and materials gathered and documented in the Risk Assessment
phase, primarily the BIA.
• The focus of the BCP is to ensure that the organization is reasonably
protected against operational interruption and able to recover critical
functions, processes, and/or services within an acceptable timeframe.
Development of Business Continuity Plan
Step 1:
Establish
context and
structure
• Gather available existing plans and procedural related documents. Consider
previous pandemic planning, strike planning, process manuals etc.
• Determine the level at which plans should be developed. If you decide to
develop multiple BCP documents (e.g. one per service or separate ones for
different sections of your organization).
• Establish a template for your BCP(s). This is included as a section of the
combined Business Continuity, Crisis Management and Communications Plan
template provided. This sample template should be customized to meet the
needs of your Agency.
Step 2:
Organize plan
completion
• Identify appropriate participants. Confirm who the Business Continuity
Manager and BCP Owner will be. Managers and key staff involved in
delivering the Essential or Necessary service / function should be consulted in
developing the BCP.
• Coordinate scheduling of plan development initiatives with participants as
either workshops or individual sessions
• Coordinate completion of the BCP templates through one of the above
identified methods
• Review the completed BCPs for consistency of data and accuracy
Step 3:
Obtain
approval and
distribute
plan
• Ensure approval, making sure that appropriate personnel have reviewed BCP
and are comfortable with strategies, actions and level of detail
• Decide where to store the completed plans. Ensure plans are available and
easily accessible in both hard and electronic copy. Consider storing plans on
a shared drive with restricted access.
• Obtain formal approval from Agency executive
• Communicate the plan to Agency staff and management to ensure they know
the plan exists, how and when it should be used and their role.
43
Non-Profit BCMP Toolkit | Workbook “How to” Guide
• Once rolled out, the plan will be subject to the exercise schedule identified in
the sustainment program. Staff and management involvement in these
exercises is valuable to build understanding of the plan
44
Non-Profit BCMP Toolkit | Workbook “How to” Guide
IT Disaster Recovery Plan (IT DRP)
Objective
• The main objective of an IT Disaster Recovery Plan is to ensure the
expeditious and efficient recovery of necessary IT functions as prioritized by
the organization.
Description
• An Information Technology (IT) Disaster Recovery Plan (DRP) documents the
activities and procedures to recover functionality of the Agency’s most critical
IT services and applications (as determined through its Business Continuity
Plan) after a business disruption or community emergency.
• The IT DRP describes the preparation and actions required to effectively
respond to a disruption or emergency that affects IT services and applications,
outlines roles and responsibilities and describes procedures for testing and
maintaining the plan. The IT DRP may be activated independent of BCP
activation in cases where the disruption has a major effect on technology
capabilities, but not office facilities, people or community.
• All applications and IT services whose outage creates a Medium or High risk
to the Agency (as documented in the BCP) are to be addressed in the IT
DRP.
• Development of a DRP is highly technical and must be done in close
consultation with the Agency’s IT provider. Engagement of a qualified and
experienced DRP consultant can be highly beneficial to either build the plan or
provide templates and advice to agency staff tasked with building the
Agency’s DRP.
Development of IT Disaster Recovery Plan
Step 1:
Establish
context and
structure
• Establish a template for your IT DRP. Topics should include:
o Strategies to mitigate IT risks
o How and when the DRP should be activated
o Roles during DRP activation
o Prioritization of recovery IT infrastructure, applications and services
required for Essential and Necessary services / functions considering
dependencies between these elements as well as the recovery timing
needed to support agency services
o Response, Recovery and Restoration procedures
o Contact lists for key IT staff, suppliers and service providers
o Equipment lists
o Guidance for regular exercising of the plan
• As this document should be created by your IT provider, with input from your
BCP, a template has NOT been provided [see Appendix A3.4 for a sample
table of contents]
Step 2:
Organize plan
completion
• Identify appropriate participants. Confirm who would generally lead and
manage the activation of the IT DRP (often the Agency’s technology
manager).
• Coordinate completion of the IT DRP template through individual sessions or
workshops.
• Review the completed Disaster Recovery Plan for accuracy, completeness
and actionability.
Step 3:
• Obtain formal approval from Agency executive.
45
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Obtain
approval and
distribute
plan
• Decide where to store the completed plan. Ensure the plan is available and
easily accessible. in both hard and electronic copy. Consider storing the plan
on a shared drive with restricted access.
• Communicate the plan to Agency management and Information Technology
staff to ensure they know the plan exists, how and when it should be used and
their role.
46
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Scenario Based Plans
Objective
• The main objective of Scenario Based plans is to provide guidance and
uniformity in the response to specific and unique disruptions and
emergencies.
Description
• Scenario Based Plans are designed for specific risks with potential of high
impact, anticipated to be frequent or likely to occur. Agencies may choose to
build scenario-specific plans tailored for that risk. Examples are floods,
infectious disease, or wildfire events.
Development of Scenario Based Plan(s)
Step 1:
Establish
context and
structure
• Identify the name and characteristics of the risk scenario related to Facilities,
Technology, Personnel, External Service of Product and Community (refer to
Risk Assessment Worksheet in Risk Assessment workbook).
• Review the Business Impact Analysis (BIA) developed as part of the Risk
Assessment phase to confirm or modify the services / functions identified as
Essential or Necessary as well as new or higher volume services in the case
of a Community event.
• Establish a template for this Scenario Based plan
• It can mirror the template used for your Business Continuity Plans, conform to
a template provided by another agency involved in the plan (e.g. CEMA) or
can be created as an appendix to the BCP only highlighting differences from
the BCP for that scenario.
Step 2:
Organize plan
completion
• Identify appropriate participants; include all BCP Owners.
• Access the current version of all Business Continuity Plans (BCPs).
• Coordinate completion of the specialty templates through individual sessions
or workshops to add, remove or modify details of the BCPs to reflect the
scenario’s characteristics.
• If additional services / functions have been deemed Essential or Necessary in
this scenario (through the BIA review done in Step 1), new BCPs may need to
be developed from scratch.
• Compile the scenario description and modified BIA (from Step 1) and all
tailored BCPs into one document or folder labelled as (Scenario Name)
Business Continuity Plan
Step 3:
Obtain
approval and
distribute
plan
• Obtain formal approval from Agency executive.
• Decide where to store the completed plan. Ensure the plan is available and
easily accessible. in both hard and electronic copy. Consider storing the plan
on a shared drive with restricted access.
• Communicate the plan to Agency management to ensure they know the plan
exists, how and when it should be used and their role.
47
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Component 4 - Sustainment
Sustainment ensures the program is maintained
and continuously improved. It consists of the
following elements:
• Training and Awareness
• Exercises
• Maintenance
• Program Audit & Review
• Post-Incident Review
Training & Awareness
Training and awareness are essential components of a comprehensive program. The main purposes
of training and awareness are:
• For agency staff - create awareness regarding the Business Continuity Management Program
(BCMP), how the program functions, and the various roles and responsibilities
• For those staff with designated responsibilities within a plan or in the program – training,
awareness and exercises will enhance the skills required to develop, implement, maintain and
execute when required
Following are steps for developing and delivering training and awareness.
1. Set annual goals and objectives for training and awareness activities, objectives should be
specific as to purpose, audience and timing
2. Plan and design training and awareness activities, selecting the appropriate method to
support the training objectives, build off momentum of previous communication or training
activities and align with your agency’s protocols
3. Coordinate and track training and awareness activities. [See Appendix A4.1 for a Business
Continuity Training and Awareness Planning Matrix template]
4. Deliver planned training and awareness sessions and record this on the Business Continuity
Training and Awareness Planning Matrix
Business Continuity training is offered by outside institutions. This training would be valuable to
agency staff with leadership roles within the BCMP. Membership in professional organizations related
to emergency management and business continuity, such as DRI Canada, Disaster Recovery
Information Exchange (DRIE), Business Continuity Institute provide inexpensive opportunities to share
and obtain knowledge from other organizations. This specialized training can also be included in the
Planning Matrix.
Exercises
A formalised exercise program provides an overview of the activities and expected standards that will
be followed for exercising the plans to ensure they are current, relevant, functional, and continuously
improving. Plans and procedures cannot be considered complete and fully functional until they have
been exercised. Undertaking an exercise for an entire agency and all plans at one time may have an
impact on daily operations, and an exercise program provides the necessary structure to ensure that
all plans and procedures within the program are exercised over a designated period of time (e.g.
annually). Exercises can also be conducted with other agencies or emergency organizations such as
1. Governance
2. Risk
Assessment &
BIA
3. Plan
Development
4. Sustainment
48
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Calgary Emergency Management Agency (CEMA). It is recommended that agencies conduct and/or
participate in at least one exercise per year.
Types of exercises
Exercise
Type
Description Strengths Weaknesses
Tabletop
•
Narrative walkthrough and
confirmation of the plan, where a
facilitator explains a scenario and
asks participants to discuss their
response.
• Meeting room format: can be
achieved through a slideshow,
panel discussion, or a facilitated
walkthrough of a scenario.
•
Small time
commitment for
planning and
executing
• Very few resources
required
• Simpler preparation
• Basic teaching tool,
good for an
introduction to a
BCP
•
Artificial approach
• Measures
process, but not
necessarily
capability
• Does not highlight
the decision-
making process
Simulation
• More intensive and involved form
of exercise
• Attempts to replicate real world
conditions (e.g. making phone calls
or sending messages, activating
alternate work sites, testing IT
workarounds, and involving other
stakeholders required to execute
continuity strategies).
• More care and attention must be
made to ensure that anyone
contacted realizes that this is only
a test.
• Immersive; places
participants in near
real-world setting
• Can test not only
procedures but also
participant
capability
• Large time
commitment, for
planning and
executing
• Resource
intensive
• Can be safety and
logistical issues
Hybrid
• Combination Tabletop and
Simulation
• Meeting room format, but includes
some simple simulations (e.g.
phone calls, emails, access to
computer systems)
• Combines
strengths of
Tabletop and
Simulation
• Medium time
commitment for
planning and
executing
• No in-depth
capability testing
Work from
Home day
• This can be pre-announced or
unannounced
• Assume primary work location is
not available and all staff will work
from home for the day
• Test all systems and access to
required information
• Builds and tests
remote-working
ability
• This only tests the
loss of facility risk
49
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Steps for developing and conducting exercises are:
1. Define exercise objectives. This is based on what part of your plan you want to exercise.
This could be specific recovery strategies, roles and/or resource losses. Typically, objectives
will be some, or all, of the following:
a. Recovery strategies are validated
b. Information in the plans is complete, detailed and verified
c. Plans are validated
d. Staff, and their alternates, are trained in their specific role and are aware of, and
comfortable with, their responsibilities
2. Design the exercise. Depending on the exercise objective, design the actual exercise by
selecting a scenario and determine the hypothetical impacts that event would have on the
services you wish to exercise and document this. [See Appendix A4.2 for a template and
example for a Scenario Event List] which can be used to document the exercise design and
results. Exercise design includes:
a. Appoint an Exercise Facilitator to build out the details of the exercise (e.g.
inputs/prompts to participants, location set up and facilities) and lead the exercise
b. Determine type of exercise: Tabletop, Simulation, Hybrid
c. Decide on a scenario that can produce results to meet all exercise objectives (e.g.
power outage, IT outage, pandemic)
d. Determine the impact: Refer to your Business Impact Analysis (in your Business
Continuity Plan) to determine which processes or critical resources may be impacted
by your selected scenario and the severity of the impact
e. Establish Expected Actions: These actions should align with the protocols and
procedures in your Crisis Management and/or Business Continuity Plan and be
aligned with the objectives of the exercise
3. Conduct exercise
a. Select/book a location with enough space and facilities to meet the needs of the
exercise
b. Invite exercise participants who will fill roles in the exercise
c. The Exercise Facilitator will lead the exercise
d. Conduct exercise, documenting results on the Scenario Events List
4. Evaluate results
a. During and immediately after the exercise, the exercise facilitator and participants
should review the results of the exercise against its objectives and identify what went
well and what could be improved for future exercises.
b. Identify areas in the BCP or CMP where gaps were found or where improvements
could be made
c. Document these gaps and schedule follow-up actions and owners
The following information provides additional advice to be considered during exercise planning and
conduct:
• Scenarios should change from exercise to exercise and should be related to incidents
identified in the Risk Assessment
• Consider increasing exercise complexity year over year as plans mature and participants are
more knowledgeable
• Consider involving key external partners and service providers in some exercises
50
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Maintenance
To ensure all plans remain valuable and relevant, they must be regularly reviewed and updated.
Unless they reflect current information and agency priorities, all the work that went into building the
initial plans will go to waste.
In addition to scheduled maintenance, all affected documents should be updated:
• After a business disruption or ‘near-miss’ event (e.g. small office fire that could have been
more severe, power outage that affected another agency) based on results of Post Disruption
review
• After an exercise, based on any gaps or improvements identified in the exercise review
• When there is a change in personnel or business functions
Program Audit and Review
Occasionally the Agency’s whole Business Continuity Management Program should be reviewed to
ensure it is all functional and current. This may be a requirement of an outside agency (e.g. funding
body, insurance). Program reviews can also be conducted by agency staff, but a more objective
review can be done by someone outside the organization.
A formal program audit could be done by a qualified outside agency for a cost. A more informal review
could be done by a knowledgeable Business Continuity person in another agency or from internal
agency staff. [See Appendix A4.4 for the Business Continuity Review Summary Sheet and Detail
Review sheet used to evaluate agency BCMP’s as part of this project as an example template]
The results of the audit or review should be documented and provided to the BCMP Sponsor who will
address the findings and recommendations by ensuring updates are done. The audit/review findings
and planned remediation should be presented to the agency Executive team for their information.
51
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Post Disruption Reviews
After any activation of the Crisis Management Plan (CMP), Business Continuity Plan (BCP) or IT
Disaster Recovery Plan (DRP), information must be gathered and analyzed to record what happened,
when, the impacts it had, what went right, what could have been improved, then identify follow-up
actions to improve the plan(s) and related documents or processes to apply the lessons learned.
Ideally, someone not directly involved in the activation should conduct this work for more objectivity,
but this is not a requirement. All key people involved in the response and recovery should participate
in providing information needed on what happened. Documentation contained on the various Checklist
forms should be gathered to help develop a chronology of what was done. This effort should be
undertaken as soon as possible after normal business activities have resumed, while memories are
still fresh. An update should be presented to the Executive Team.
[See Appendix A4.5 for Post Disruption Review Topics]
52
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Appendix: Component 1 – Governance
A1.1 Business Continuity Management Program (BCMP) Policy - Template
Note: All information in italics provides instructions or examples to assist in policy development –
these must be replaced or removed when building your agency’s policy. The format should follow any
other existing policies your organization has in place.
Policy Statement
(Agency name) recognizes the potential strategic, operational, financial, safety and reputational risks
associated with a business disruption or community emergency and the importance of emergency
management and business continuity.
The ability to continue essential services when faced with a disruption or community disruption is a
critical aspect of our agency’s strategy and vision to (insert applicable strategy and vision statements).
The aim of the Business Continuity Management Program (BCMP) is to ensure that the prevention
and mitigation of threats, preparedness, response and recovery is integrated, coordinated, effective
and sustainable, while at the same time appropriate for the nature, scale and complexity of our
agency.
Objectives
The overall program objectives are:
• Insert objectives e.g. protect health and life safety, enable timely response to a disruption or
community emergency along with ability to resume Essential and Necessary services /
functions, Define the authorities and accountabilities within the BCMP, Maintain the Agency’s
reputation with all stakeholders
Scope
Example wording:
The following plans are to be developed or refined and maintained as part of the BCMP. Development
of these plans will start immediately and be done in the following order:
This BCMP policy covers all aspects of the BCMP and includes the following components:
• Emergency Response Plan
• Crisis Management Plan
• Crisis Communications Plan
• Business Continuity Plan
The following response plans are Out of Scope for this Policy:
• IT Disaster Recovery Plan – this is handled by the Agency’s outsourced IT Service Provider
Roles and Responsibilities
The BCMP will be structured as follows: (all wording is subject to customization to meet the needs of
your agency, can utilize roles and responsibilities table in the Overview section)
Role
Usually filled by
Responsibilities
•
53
Non-Profit BCMP Toolkit | Workbook “How to” Guide
•
•
Plan Approvals
All plans and their revisions will be approved by the BCP Lead then forwarded to the BCMP Sponsor
for executive approval.
Sustainment
For the program to remain effective and relevant all plans and procedures must be maintained and
exercised. After a business disruption, all plans must be reviewed and updated as needed based on
learnings from the event, as documented in the Post-Disruption Review.
An exercise and training program will be developed and conducted annually. At a minimum the
procedures and plans will be exercised at least once annually. The scope and scale of each exercise
will be governed by the annual exercise and training plan. All personnel who have been identified as
having a role in a plan will participate in training.
Plan
Review Frequency
Responsibility
Last Done
Training & Awareness
Annually
BCP Lead
BCP Exercise
Annually
BCP Lead
Work from Home Day
Annually
BCP Lead
BCP Maintenance
Annually
BCP Lead
IT Disaster Recovery Plan
Annually
Technology Advisor
Emergency Response Plan
Annually
BCP Lead
Program Audit and Review
Every 3-5 years
BCP Lead
Budget and Financial Management
(Insert details regarding BCMP budget for ongoing program management and funding for projects)
Example wording:
Once a disruption is declared a Crisis by the Crisis Management Lead (based on definition included in
the Crisis Management Plan), the BCMP Sponsor has authority to approve any expenditures deemed
required, as recommended by the Crisis Management Lead, for the duration of the disruption. Once
the Crisis is over and the decision made to stand-down the BCP and/or CMP, financial authority
reverts to normal practice. A review of expenditures during the time of the disruption will be done as
part of the Look-back Review presented to the Executive Team.
•
•
Plan Approvals
All plans and their revisions will be approved by the BCP Lead then forwarded to the BCMP Sponsor
for executive approval.
Sustainment
For the program to remain effective and relevant all plans and procedures must be maintained and
exercised. After a business disruption, all plans must be reviewed and updated as needed based on
learnings from the event, as documented in the Post-Disruption Review.
An exercise and training program will be developed and conducted annually. At a minimum the
procedures and plans will be exercised at least once annually. The scope and scale of each exercise
will be governed by the annual exercise and training plan. All personnel who have been identified as
having a role in a plan will participate in training.
Plan
Review Frequency
Responsibility
Last Done
Training & Awareness
Annually
BCP Lead
BCP Exercise
Annually
BCP Lead
Work from Home Day
Annually
BCP Lead
BCP Maintenance
Annually
BCP Lead
IT Disaster Recovery Plan
Annually
Technology Advisor
Emergency Response Plan
Annually
BCP Lead
Program Audit and Review
Every 3-5 years
BCP Lead
Budget and Financial Management
(Insert details regarding BCMP budget for ongoing program management and funding for projects)
Example wording:
Once a disruption is declared a Crisis by the Crisis Management Lead (based on definition included in
the Crisis Management Plan), the BCMP Sponsor has authority to approve any expenditures deemed
required, as recommended by the Crisis Management Lead, for the duration of the disruption. Once
the Crisis is over and the decision made to stand-down the BCP and/or CMP, financial authority
reverts to normal practice. A review of expenditures during the time of the disruption will be done as
part of the Look-back Review presented to the Executive Team.
Appendix: Component 1 – Governance
A1.1 Business Continuity Management Program (BCMP) Policy - Template
Note: All information in italics provides instructions or examples to assist in policy development –
these must be replaced or removed when building your agency’s policy. The format should follow any
other existing policies your organization has in place.
Policy Statement
(Agency name) recognizes the potential strategic, operational, financial, safety and reputational risks
associated with a business disruption or community emergency and the importance of emergency
management and business continuity.
The ability to continue essential services when faced with a disruption or community disruption is a
critical aspect of our agency’s strategy and vision to (insert applicable strategy and vision statements).
The aim of the Business Continuity Management Program (BCMP) is to ensure that the prevention
and mitigation of threats, preparedness, response and recovery is integrated, coordinated, effective
and sustainable, while at the same time appropriate for the nature, scale and complexity of our
agency.
Objectives
The overall program objectives are:
• Insert objectives e.g. protect health and life safety, enable timely response to a disruption or
community emergency along with ability to resume Essential and Necessary services /
functions, Define the authorities and accountabilities within the BCMP, Maintain the Agency’s
reputation with all stakeholders
Scope
Example wording:
The following plans are to be developed or refined and maintained as part of the BCMP. Development
of these plans will start immediately and be done in the following order:
This BCMP policy covers all aspects of the BCMP and includes the following components:
• Emergency Response Plan
• Crisis Management Plan
• Crisis Communications Plan
• Business Continuity Plan
The following response plans are Out of Scope for this Policy:
• IT Disaster Recovery Plan – this is handled by the Agency’s outsourced IT Service Provider
Roles and Responsibilities
The BCMP will be structured as follows: (all wording is subject to customization to meet the needs of
your agency, can utilize roles and responsibilities table in the Overview section)
Role Usually filled by Responsibilities
•
54
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Appendix: Component 2 – Risk Assessment & BIA
All templates for Component 2 – Risk Assessment are embedded into the combined Business
Continuity Plan template [Appendix].
A2.1 Agency Overview Worksheet
What is your agency’s
purpose / mandate?
What services do you
provide?
Who are the clients of
this service?
55
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A2.2 Agency Risk Assessment Worksheet
Below are potential risks that have been used in developing this plan including mitigation strategies for each risk. When an actual disruption or
emergency occurs, the parameters of the disruption or emergency should be compared to the risk description below so that the BCP Lead can
adjust the plan appropriately.
For each Risk, rate the impact it would have on your agency if it were to occur, along with rationale and mitigating strategies you have in place.
(Adjust the Risks and Impact Level definitions to fit the realistic risks to your Agency, and replace with your Agency’s risk mitigation strategy)
Impact to Agency
Risk to Agency
Description
Low
Med
High
Rationale for Risk Impact
Risk Mitigation Strategy
Facilities: Loss of
work location for an
extended period
(up to 30 days)
Primary work location will not
be available for up to 30 days
• MOU - Memorandum of understanding
or Mutual Aid Agreement with XYZ
• Alternate work location
• Work from home capability (ensure
policies and capabilities are in place)
Technology: Loss
of IT systems,
applications and
data (up to 5 days)
Agency IT applications are
not available for at least 3
days
Cloud-based services are not
impacted (including Google)
• Reliable off-site data backup
• Fail-over to alternate data centre
• Cloud applications or storage of data
• Alternate phone systems
• Paper copies of client and staff lists
Personnel: Loss of
a large percentage
of staff and/or
volunteers (up to
50%)
Up to 50% of staff and/or
volunteers are not available
to report to work
• Identified trained alternates for key roles
• MOU - Memorandum of understanding
with XYZ Agency
• Ensure that staff are supported related
to emergency preparedness and
immunization
• Ensure agency has a succession plan
for key roles
External Third
Parties: Disruption
affecting external
provider needed to
provide your
Disruption affecting external
provider needed to provide
service for up to 30 days
• Require supplier to have BCP
• Identify alternate suppliers
• Have a reserve fund
• Educate staff on alternate processes
56
Non-Profit BCMP Toolkit | Workbook “How to” Guide
service (up to 30
days)
Community:
Disaster impacting
your municipality or
client group which
may change or
increase the
services your
Agency provides
(up to 30 days)
Support required to support
other Agencies in our or
other municipalities during an
emergency
• Communication with other agencies or
groups to get early notice of situation
that potentially requires service changes
• Continue to collaborate with other
agencies to maintain strong
relationships outside out of emergency
and disasters e.g. Emergency Wellness
Response Team and Critical Service
Provider Group
• Ensure staff are trained in Emergency
Preparedness, Psychological First Aid
and First Aid
External
Logistical or
Major Issue(s)
External events such as
severe weather (floods, fires,
snow), power outage, public
transit strikes, road closures,
school closures
Extended, large scale
external events such as
earthquakes, pandemics that
result in multiple risks
• Depending on the issue, any of the
above strategies can be applied
• Overall response and actions are the
same, just over an extended period of
time
• Scenario specific plans e.g. COVID-19
pandemic response
Legend - Impact
Level to Agency
Low
Agency operations could continue within acceptable timeframes
Medium
Clients would be impacted by degraded service levels, but no injury or loss of life
High
Potential for injury or loss of life, or significant reputational or financial impact
57
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A2.3. Business Impact Analysis (BIA)
(You can adjust the maximum downtime timeframes for Essential/Necessary/Valued services to better match the needs of your agency)
Below is a listing of Services or Functions within the Agency, in priority order, along with the Maximum Downtime. This plan supports
Essential (Maximum Downtime <2 days) and Necessary (Maximum Downtime 3-5 days) services / functions. Valued Services can be
postponed, and business continuity efforts for these services are not required or documented in this plan.
Service or Function Name
Busy/ Peak
Timeframe
Maximum Downtime (how long
can service be down for?)
Rationale (for maximum downtime)
Consider impacts to: People, Operations,
Reputation, Financial, Community Support
< 2 days
Essential
3-5 days
Necessary
> 5 days
Valued
1.
2.
3.
4.
5.
6.
7.
Maximum Downtime
Service Definitions
< 2 days
Essential
Service
Service / function must be maintained or there would be extreme consequences for the agency
(e.g. imminent threat to, or loss of life or major/multiple injuries, major facility damage or destruction, extreme brand and
reputation impact, or extreme monetary losses to the Agency)
3-5 days
Necessary
Service
Disruption would have moderate consequences to the Agency and would not threaten the provision of essential services /
functions
(e.g. no loss of life or injuries, moderate but recoverable brand and reputation impact and moderate monetary losses)
> 5 days
Valued
Service
The consequences are dealt with by routine operations and would have negligible consequence to the Agency
(e.g. no loss of life or injuries, minimal or no reputational impact or monetary losses)
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result of not providing a service or performing an
activity, to become unacceptable
58
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A2.4 Memorandum of Agreement (MOU) Template
A Memorandum of Understanding (MOU) is a less formal method of documenting an agreement
between two parties than using a legal contract. It has no legal binding but is a way to clarify
expectations for all parties when an agreement has been made between two entities, and can be used
to between agencies to record agreements to offer aid or resources in the case of a business
disruption affecting one of the parties.
Following is a template that could be used; it is just a format and wording should be adjusted to reflect
the actual agreement between the agencies:
---------------------------------------------------------------------------------------------------------------------------------------
Memorandum of Understanding (MOU) between
(Agency 1) and (Agency 2)
Covering the period from ______________ to _____________________
Purpose:
This MOU is created to clarify the support to be provided by (Agency 1) when a major business
disruption occurs affecting (Agency 2).
Support to be provided:
(Agency 1) will provide the following (facilities or other resources) up to (specific capacity) for up to (xx
days) for use of (Agency 2) on a best-efforts basis, on the request from an authorized representative
of (Agency 2) when an event causes the Business Continuity Plan of (Agency 2) to be activated.
Exceptions:
(example) These resources will not be provided if (Agency 1) is also experiencing a business
disruption.
Expectations of (Agency 1):
•
•
•
Expectations of (Agency 2):
•
•
•
Compensation:
(example) After the business disruption, (Agency 1) will invoice (Agency 2) an amount to cover
additional costs incurred through provision of the facilities and services as well as any lost revenue.
Amendments:
This agreement may be amended at any time with the mutual consent of the parties.
This agreement has been made by the following authorized representatives of the agencies
59
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Date: _______________
(Agency 1)
(Agency 2)
Name
Title
Contact info
(phone/email)
Signature
60
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Appendix: Component 3 – Plans and Procedures
A3.1 Emergency Response Plan
Due to its size, a template for Emergency Response Plan is included as a separate document:
• Emergency Response Plan
The template includes example wording for common types of incident response. Customize the
wording to fit your agency’s situation and needs.
A3.2 Crisis Management Plan (CMP), Crisis Communications Plan (CCP),
Business Continuity Plan (BCP)
Due to its size, a Business Continuity Plan (BCP) template is included as a separate document. It
includes the following elements:
• Crisis Management Plan (CMP)
• Crisis Communications Plan (CCP)
• Business Continuity Plan (BCP)
The format is one that can by used by agencies of various sizes. Instructions are included in italics.
Wording of all sections of the plan should be adjusted to reflect your Agency’s situation.
61
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A3.4 IT Disaster Recovery Plan – Table of Contents
Following is a sample Table of Contents for an IT Disaster Recovery Plan. A brief description of
information to include in each section is shown in italics. This will generally be a stand-alone document
but could form a section of a comprehensive BCMP document. This document should be created and
maintained by your Technical Advisor and/or outsourced IT Service Provider, so a full template has
NOT been provided.
1. Overview
• Background (when DRP first developed, most recent updates)
• Purpose of document
• Scope of plan (e.g. applications and services whose outage would pose a moderate
or major risk to agency operations)
• Disaster Recovery Strategy (e.g. multiple data centres, work-from-home technology,
pre-determined timing for restoration of applications based on impact on Essential and
Necessary services)
• Disaster Recovery Plan coordination (who will manage the DRP program and lead
efforts when the IT DRP is activated)
• Disaster definition (e.g. Any unplanned event that severely impacts the provision of
technology services. Situations that could be declared a disaster include: loss of a
data centre; loss of a customer-facing application for more than 4 hours; or BCP
activated and technology loss is involved)
2. Threats and Mitigation Measures
• Threats that could cause a major outage
• Mitigation measures to reduce likelihood or impact of IT outage
3. Disaster Recovery Action Plan
• Detection of a major outage (how detected, who communicated to)
• Response, Recovery and Restoration Procedures (checklist format)
4. Disaster Recovery Org Chart and Responsibilities
5. Disaster Recovery Plan Exercises
• Purpose
• Approach (types of exercise, frequency, objectives)
• Requirements for Plan Exercises
• Post-exercise wrap-up (follow-up actions to address findings from exercises)
6. Maintaining the Plan (triggers for updating the plan)
7. Distribution of the Plan (where the plan is stored and who is to be provided access to it)
8. Appendices
• List of Priority Applications and Services
• Recovery Team Contact Info
• Vendor / 3
rd
Party Contact List
• Data Centre Equipment List
• Recovery Checklists (list of applications / IT services showing order to be restored
based on criticality and dependencies)
• Post-Incident Reporting template
• Exercise Plans (compilation of plans from past DRP exercises)
62
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A3.4 Scenario Based Plan
The Agency’s Business Continuity Plan reflects an all-hazards approach indicating actions to be taken
based on the results of an event, addressing the impact of the event e.g. loss of facilities, loss of IT,
loss of personnel. Scenario based plans can be developed to address specific events causing the
impact, e.g. flood, power outage, pandemic. If prepared as a stand-alone plan, the Scenario Based
Plan should mirror the format and content of the main BCP with the addition of a description of the
assumptions used for the scenario the plan is for. Alternatively, the plan could be an appendix to the
main BCP, describing the scenario and assumptions and outlining only the differences from the main
BCP (e.g. changes in priority of service restoration, activation of specific MOU’s).
Following is an example of a scenario and assumptions for a Scenario Based plan. This format is
included as an appendix in the combined Business Continuity Plan template [Appendix]
Scenario Planning Assumptions Location of Plan
Flood
• Xxx facility will be unavailable for 5 days
• Yyy and zzz facilities will be unaffected
• Transportation disrupted due to road and rail
closures for 5 days affecting delivery of supplies
and personnel attendance at work
• Additional requirements for xxxx service
• Increased access of agency services by phone
or internet; reduced access by in-person clients
(Insert location of plan)
63
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Appendix: Component 4 - Sustainment
A4.1 Business Continuity Training and Awareness Template
1. Training & Awareness Goals for 20XX
Insert the overarching training and awareness goal that has been established for each year.
2. Awareness Objectives for 20XX
Identify objectives that support achievement of the annual goal. Ideally objective setting should be completed during the annual business
planning process and must align with business strategy and budget allocation.
Objective Audience Method
Scheduled
Delivery Date
Prepared By Delivered By
Training &
Awareness
Planning
Worksheet
Date
Completed
64
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A4.2 Scenario Event List - Example
Scenario Event List - BCP Exercise X - Date:
Seq.
#
Time From To Description
Expected
Actions
Actual Actions
Gaps
(Yes/No)
Notes Owner
1 900
Exercise
Facilitator
Exercise
Participants
Participants gather in
designated exercise area.
Exercise briefing provided.
Consensus Consensus No None n/a
2 930
Exercise
Facilitator
Exercise
Participants
Exercise Kick Off. Scenario -
Tornado touchdown in SE
Calgary.
Consensus Consensus No None n/a
3 935
CMT
Member
Crisis Mgmt
Team, BCP
Lead,
Communicator
CMT Member(s) or delegates
conduct assessment to
determine impact to Agency,
determine BCP Activation is
required
Activate BCP
Activation of BCP,
unclear roles
Yes
Confusion
regarding who
was responsible
for this, review in
BCP
Joanne
Black
4 945
Communi
cator
Exercise
Participants
Communicate to all required
stakeholders
Comms lead
to identify
and contact
stakeholders
Wasn’t able to
identify who needed
to be contacted and
their contact info
Yes
Ensure contact
lists are up to
date, and key
stakeholders
identified
Autumn
Red
65
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A4.3 BCP Exercise – Example Questions
After initial input:
• Are you notified?
• What do you do in the next 30 minutes?
• Who do you contact and how?
As exercise progresses, after each input, use a few of the following questions:
• How will you react to this?
• Do you activate your BCP?
• What is your role?
• Who do you contact and how?
• Do you contact your City of Calgary non-profit organization liaison?
• Do you have everything you need with you?
• Who fills the roles? (Crisis Management Lead and Team, Communicator, BCP Lead,
Technology Advisor, other)
• Who do you need to communicate to? (Executive, clients, other agencies, staff, volunteers)
• How will your plans be communicated and to whom?
• Have your essential and necessary services been impacted?
• How are you prioritizing what you need to resume?
• What services will you be suspending?
• What actions do you need to take to resume your essential and necessary services?
• Who and what do you need for those services (staff, facilities, IT, Phone re-routing, Vital
Records, Other)?
• What are your Response and Recovery efforts?
As exercise ends:
• What are your next steps to stand-down your activated BCMP plans?
• What do you need to do to restore normal service?
During exercise debrief to evaluate results:
• Were the tabletop exercise objectives met?
• Were the expected actions taken?
• What improvements could be made to the conduct of the exercise?
• What changes should be made to your plans based on this exercise?
– What information is missing?
– Were people clear on roles and responsibilities?
• When you return to your agency:
– Schedule and complete follow-up actions
66
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A4.4 BCMP Review Summary Sheet template
Agency Name: Review Date:
Documents Reviewed:
Summary Comments:
Overall Business Continuity Management Program Criticality of Update:
Rating Assessment & Explanation
Good
• Comprehensive content and plan is executable
Improvement possibilities
• Fairly comprehensive and executable, with some areas where
improvements could be made
Gap
• Significant gaps in content or ability to execute the plan
Business Continuity Management Program Review Worksheet
BCP
Section /
Page #
Component / Element Complete/thorough?
Assessment
- Criticality
of Update
Overall Plan
Functionality and
Ability to Execute
Access
Governance &
Structure
Risk Assessment
Business Impact
Analysis
Emergency Plan /
Procedures
Crisis Management
Crisis Communications
Business Continuity
IT Disaster Recovery
Scenario-based Plans
(optional)
Sustainment and
Continuous
Improvement
Other
Other
67
Non-Profit BCMP Toolkit | Workbook “How to” Guide
A4.5 Post Disruption Review Topics
The Post Disruption Review Report should cover the following topics:
• A consolidated event timeline, including communications, technical activities, crisis and team
leadership changes (this information can be collected from the “Disruption Status Summary
and Actions” sheets completed during the event, as well as BCP Checklists)
• Cause of the disruption
• Recommendations on how to avoid a similar event in the future
• Summary of communications during the event (this information can be collected from the
“Communications Plans and Logs” created and updated during the disruption)
o What was communicated
o To whom
o When
o By whom
o Through what method (e.g. phone, email, face-to-face)
• Activation of Crisis Management, Emergency, Business Continuity and/or IT Disaster
Recovery Plan
o Effectiveness of the plans
o Strengths, weaknesses, issues with the plans
• Management of the event (this information can be collected from the “Disruption Status
Summary and Actions” sheets completed during the event)
o Escalation, de-escalation/stand-down
o Resource management
o Strengths, weaknesses, issues
• Impact of the event on the Agency, for instance:
o Lost productivity (in estimated staff hours, extended to approximate dollar value)
o Reputational impact (positive or negative)
o Staff morale
• Lessons learned
• List of follow-up actions to avoid a similar event and to improve performance in future
situations
68
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Appendix: Glossary
Term / Acronym
Definition
BCMP
Business Continuity Management Program
BCMP Sponsor An agency executive who represents the interests of the BCMP at the
Executive / Board level, provides Executive direction to those involved
in development or execution of the Program and authorizes
extraordinary expenses incurred during a major disruption or
emergency
BCP
Business Continuity Plan
BCP Lead Role often filled by a senior manager or director. Responsible to
ensure a BCP is developed, updated and exercised. Directs response
and recovery efforts during a major disruption or emergency.
Conducts post-disruption reviews and adjusts BCP based on learnings
BIA
Business Impact Analysis
Business Continuity
Management Program
A business program that integrates plans and resources to reduce the
impact of business disruptions
Business Continuity
Plan
Procedures and information to enable the agency to continue to deliver
its Essential Services (continue within 2 days) or Necessary Services
(continue within 5 days) at an acceptable, pre-defined level during a
business disruption or emergency.
Business Disruption An event that interrupts your normal business, functions, operations, or
processes, whether anticipated or not. e.g. fire in your building, power
outage, technology failure
Business Impact
Analysis
The process of analyzing services and functions and the impacts that a
disruption might have on them. The aim is to determine are time-
sensitive and whose recovery should be prioritized following a
disruption.
Calgary Emergency
Management Agency
An agency of The City of Calgary, responsible for planning and
coordinating emergency services and resources during major
emergencies and disasters.
CCP
Crisis Communications Plan
CEMA
Calgary Emergency Management Agency
CMP
Crisis Management Plan
Communicator Designated lead for emergency/crisis communications; the role may be
split between two people with separate focus on internal and external
communications
Crisis A situation that could substantially threaten Agency operations or
reputation. Generally, a crisis is an event that originates from a
disruption or community emergency that has widespread reputational
and financial impacts to your Agency. e.g. employee behaviour
impacting reputation
Crisis Communications
Plan
Governs internal and external communication during each phase of a
crisis, disruption and emergency.
Crisis Management
Lead
Usually an agency executive, often the BCMP Sponsor, who leads
execution of the Crisis Management Plan
69
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Term / Acronym Definition
Crisis Management Plan Outlines decision-making and actions to manage the agency during
and after a disruption. This includes coordination with teams involved
in response and recovery efforts.
Crisis Management
Team
A small group of agency executive and/or management who manage
affairs on behalf of the Agency during a business disruption
Critical Staff Staff from various departments who implement Essential and
Necessary services / functions recovery procedures and manual
contingencies, as required
Disaster Event that results in serious harm to the safety, health or welfare of
people or in widespread damage to property. e.g. widespread area
flooding
Emergency Event that requires prompt coordination of action or special regulation
of persons or property to protect the safety, heath or welfare of people
or to limit damage to property. e.g. community fire
Emergency Response
Plan (ERP)
Details the Agency’s immediate response to various emergencies.
ERP Emergency Response Plan
Essential Service Service / function must be maintained or there would be extreme
consequences for the agency (e.g. imminent threat to, or loss of life or
major/multiple injuries, major facility damage or destruction, extreme
brand and reputation impact, or extreme monetary losses to the
Agency)
Hybrid Exercise Combination Tabletop and Simulation; Boardroom format, but includes
some simple simulations (e.g. phone calls, emails, access to computer
systems)
Incident Day-to-day situations that may arise and are typically resolved within
2-4 hours - use emergency response plan or procedures to respond.
They may or may not lead to a disruption, emergency or disaster. e.g.
fire alarm, unruly client
Integrated Non-Profit
Business Continuity
Project
A project undertaken in 2018/19 to facilitate the development of
Business Continuity Plans for non-profit agencies designated as
Critical Service Providers by Calgary Emergency Management Agency
IT Disaster Recovery
Plan
Defines the resources, actions, tasks, and data required to manage a
technology recovery effort.
IT DRP IT Disaster Recovery Plan
Maximum Downtime The time it would take for adverse impacts, which might arise as a
result of not providing a service or performing an activity, to become
unacceptable
Memorandum of
Understanding
A less formal method of documenting an agreement between two
parties than using a legal contract.
MOU
Memorandum of Understanding
Near-miss An event that could have disrupted business if it had been more
severe, or an event that happened to another organization that could
happen to you in the future.
70
Non-Profit BCMP Toolkit | Workbook “How to” Guide
Term / Acronym Definition
Necessary Service Disruption of this service for longer than the indicated maximum
downtime would have moderate consequences to the Agency and
would not threaten the provision of essential services / functions (e.g.
no loss of life or injuries, moderate but recoverable brand and
reputation impact and moderate monetary losses)
Post Disruption Review Formal review of events and outcomes after any activation of the CMP,
BCP or IT DRP to identify what went well, what didn't and
improvements that should be made based on these learnings
Risk Mitigation A strategy to prepare for or lessen the negative effects of threats to
your agency
Scenario-based Plans Business Continuity Plans that are designed for specific risks with
potential of high impact, anticipated to be frequent or likely to occur.
Examples are floods, infectious disease, or wildfire events.
Simulation Exercise More intensive and involved form of exercise that attempts to replicate
real world conditions. This can include making phone calls or sending
messages, activating alternate work sites, testing IT workarounds, and
involving other stakeholders required to execute continuity strategies.
Tabletop Exercise Narrative walkthrough and confirmation of the BCP, where a facilitator
explains a scenario and asks participants to discuss their response.
Technology Advisor Role usually filled by a senior technical staff member or manager (or
technical consultant) who provides expert IT advice to BCP Lead
related to: assessment of technical disruption, best approach to
restoration of technical services, whether IT Disaster Recovery Plan
should be activated
Valued Service The consequences of disruption of the service can be dealt with by
routine operations and would have negligible consequence to the
Agency (e.g. no loss of life or injuries, minimal or no reputational
impact or monetary losses)
71
Non-Profit BCMP Toolkit | Template & Example
Template & Example
Business Continuity Plan (BCP) XYZ Organization
Note: Example content is provided in purple text,
update with your specific information
Location of Electronic Document Cloud storage: \xyz\bcmp\bcp2020
Location of Paper Copy(s) All area oces, reception desk
Document Owner Brad Green, Projects Manager
72
Non-Profit BCMP Toolkit | Template & Example
Document Control
Revision List
Revision Date Revised By Details (changes made)
July 2020
Brad Green
Original draft
Document Distribution
This document and all revisions are to be provided to the Crisis Management Team and Business
Continuity Team outlined in Section 2.3 on July 2020.
73
Non-Profit BCMP Toolkit | Template & Example
1.1. Vital Business Information
Business License Number 12345678
Registered Charity Number 123456789RR0001
Insurance Provider and Policy Number Insurance Provider 000000
Location of Critical Paper Records 123 4 Street, Calgary AB A1A 1A1
Backup Computer Records Location Site
Primary Work Location and Phone 123 4 Street, Calgary AB A1A 1A1
Phone: 403-222-3333
Alternate Work Location(s) and Phone 123 4 Street, Calgary AB A1A 1A1
Phone: 403-222-3333
Conference Bridge Call-In Number: 1-800-222-3333
Participant Number: 403-222-4444 | PIN: 1234
1.2. Document Objective
This document combines information needed to manage and act to address an emergency or business
disruption before, during and after. Three elements of this are included as separate sections:
• Crisis Management Plan – identifies Crisis Management Team (CMT) members and describes
their responsibilities, priorities and activities before, during and after an emergency or business
disruption. The Crisis Management Plan may be activated for situations that do not require
activation of the Business Continuity Plan – for instance a major financial problem or negative
media reports.
• Crisis Communications Plan – describes the procedures and actions to communicate to the
community, internal and external stakeholders and to the public, in the event of a business
disruption or community emergency. This supports the Crisis Management Plan.
• Business Continuity Plan – describes procedures and actions for staff and other stakeholders
to provide Essential (Maximum Downtime <2 days) and Necessary (Maximum Downtime 3-5
days) services/functions during a business disruption or emergency within the community.
Generally, this plan will only be activated if there is a business disruption resulting in significantly
reduced availability of staff, facilities or IT services.
Agency overview information, mitigation strategies as a result of risk analysis and a chart summarizing
the Business Impact Analysis are also included to provide background and context to the plans.
74
Non-Profit BCMP Toolkit | Template & Example
Agency Overview
2.1. Agency Overview
What is your agency’s
purpose / mandate?
Engaging individuals, families and communities to realize their potential.
We help individuals, families and support networks build the skills they
need to develop stable and responsive relationships
What services do you
provide?
Counselling, Homemaking, Childcare, Community Engagement,
Outreach.
Who are the clients of
this service?
• Citizens of Calgary
• Collaborating partners
2.1. Crisis Management / Business Continuity Team & Contact Information
The actual team composition will be determined based on nature of the disruption. Typical approach is to
“go big” and bring in anyone you think may be impacted, and scale back as you assess the situation.
BCMP Role Name, Regular Role Work # Cell # Email
BCMP Sponsor /
Crisis
Management
Lead
Primary: Joanne
Black, CEO
403.123.1111 [email protected]
Alternate: George
Grey, CFO
403.123.2222 ggre[email protected]
BCP Lead Primary: Brad Green,
Projects Manager
403.123.3333 bgreen@xyz.ca
Alternate: Kim White,
Project Manager
403.123.4444 [email protected]
Communicator Primary: Autumn
Red, Communications
Lead
403.123.5555 ared@xyz.ca
Alternate: Summer
Blue, Communications
Specialist
403.123.6666 [email protected]
Technology
Advisor
Primary: Joe Tech,
Consultant
403.123.7777 jtech@ITconsultant.ca
Alternate: Jane
James, Consultant
403.123.8888 jjames@ITconsultant.ca
HR Director Primary: Amy Pink 403.123.9999 [email protected]
Alternate: Sue
Orange
403.321.1111 sorange@xyz.ca
75
Non-Profit BCMP Toolkit | Template & Example
Governance – BCMP Policy
3.1.Policy Purpose
• XYZ Agency recognizes the potential strategic, operational, financial, safety and reputational risks
associated with a business disruption or community emergency and the importance of emergency
management and business continuity.
• The ability to continue essential services when faced with a disruption or community disruption is
a critical aspect of our agency’s strategy and vision to (insert applicable strategy and vision
statements)
• The aim of the Business Continuity Management Program (BCMP) is to ensure that the
prevention and mitigation of threats, preparedness, response and recovery is integrated,
coordinated, effective and sustainable, while at the same time appropriate for the nature, scale
and complexity of our agency.
3.2.Business Continuity Program Objectives
• Ensure the health and safety and staff, volunteers, clients
• Facilitate ongoing and effective communications with internal and external stakeholders
• Align with industry standards and best practices e.g. align to the CSA-Z1600 standard & DRI
• Define authorities and roles and responsibilities with the BCMP
• Maintain reputation, operations and financial viability during a disruption
• Identify essential services and assess requirements for those processes
• Ensure plans are sustained
3.3.Roles and Responsibilities
Following is a description of common roles and responsibilities that are referenced in this document.
Role Responsibilities
BCMP Sponsor
/ Crisis
Management
Lead
• Represent the interests of the BCMP at the Executive/Board level e.g. obtain
approval and funding
• Provide Executive direction to the BCP Lead and others involved in
development or execution of the Program
• Unless a separate Crisis Management Lead is appointed, this role will:
o lead execution of the Crisis Management Plan
o continuously assess priorities of strategic issues
o formulate, in consultation with others on the Crisis Management Team
(CMT), a strategy for handling the situation
o facilitate CMT meetings
o act as the ultimate decision maker during the crisis
o could be the BCMP Sponsor, BCP Lead or other
• Authorize extraordinary expenses incurred during a major disruption or
emergency
Crisis
Management
Team
• Manage affairs on behalf of the Agency during a business disruption
• Minimum membership would include the Crisis Management Lead, BCP Lead,
Communicator
• Depending on the nature of the disruption, other people may be added to the
team, e.g. Technology Advisor, Facilities Lead, HR Advisor
76
Non-Profit BCMP Toolkit | Template & Example
Communicator
• Designated lead for emergency/crisis communications
• Develop specific communication plan for a disruption - including messaging,
media to be used for the target audience, using the Crisis Communications
Plan as a guide
• Monitor social media and post information on social media as needed
• This role can be split with one Internal Communicator to deal with Agency
staff, management, volunteers and an External Communicator to deal with
other stakeholders (media, clients, donors, general public, suppliers, etc.)
BCP Lead
• Ensure BCP is developed, updated and exercised
• Direct response and recovery efforts during a major disruption or emergency
• Conduct post-disruption reviews and adjust BCP based on learnings
Technology
Advisor
• Provide expert IT advice to BCP Lead related to: assessment of technical
disruption, best approach to restoration of technical services, whether IT
Disaster Recovery Plan should be activated
Critical Staff
• Implement Essential and Necessary services/functions recovery procedures
and manual contingencies as required
3.4.Plan Approvals
All plans and their revisions will be approved by the BCP Lead then forwarded to the BCMP Sponsor for
executive approval.
3.5.Scope - BCMP Document Summary Table
Following is a list of related documents that have been developed and may be useful to reference in
dealing with a business disruption or emergency:
Document Name Document /
Section Owned By
Description
ERP - Emergency
Response Procedures
Crisis Management
Lead
Details the Agency’s immediate response to various
emergencies.
Available at: Cloud storage: \xyz\bcmp\erp2020
BCP - Business Continuity Plan (combined plan containing CMP, CCP and BCP elements),
Available at: Cloud storage: \xyz\bcmp\bcp2019 and reception at all area offices
CMP - Crisis
Management Plan
Section
Crisis Management
Lead / BCMP
Sponsor
The CMP outlines decision making and actions to
manage the agency during and after a disruption.
This includes coordination with teams involved in
response and recovery efforts.
CCP - Crisis
Communications Plan
Section
Communicator
Governs internal and external communication during
each phase of a crisis, disruption and emergency.
BCP - Business
Continuity Plan
Section
BCP Lead
Procedures and information to enable the Agency to
continue to deliver its Essential Services (continue
within 2 days) or Necessary Services (continue within
77
Non-Profit BCMP Toolkit | Template & Example
5 days) at an acceptable, pre-defined level during a
business disruption or emergency.
IT DRP - IT Disaster
Recovery Plan
Technology Advisor
Defines the resources, actions, tasks, and data
required to manage a technology recovery effort.
Available at: Cloud storage: \xyz\bcmp\drp2020
3.6.Sustainment
For the program to remain effective and relevant all plans and procedures must be maintained and
exercised. After a business disruption, all plans must be reviewed and updated as needed based on
learnings from the event, as documented in the Post-Disruption Review.
An exercise and training program will be developed and conducted annually. At a minimum the
procedures and plans will be exercised at least once annually. The scope and scale of each exercise will
be governed by the annual exercise and training plan. All personnel who have been identified as having
a role in a plan will participate in training.
Plan
Review Frequency
Responsibility
Last Done
Training & Awareness
Annually
BCP Lead
BCP Exercise
Annually
BCP Lead
Work from Home Day
Annually
BCP Lead
BCP Maintenance
Annually
BCP Lead
IT Disaster Recovery Plan
Annually
Technology Advisor
Emergency Response Plan
Annually
BCP Lead
Program Audit and Review
Every 3-5 years
BCP Lead
78
Non-Profit BCMP Toolkit | Template & Example
Risk Assessment and High-Level Strategy
This BCP is based on an all hazards approach which means the focus is on the structure and approach for a broad range of risks and
disruptions. Below are potential risks that have been used in developing this plan including mitigation strategies for each risk. When an actual
disruption or emergency occurs, the parameters of the disruption or emergency should be compared to the risk description below so that the
BCP Lead can adjust the plan appropriately.
For each risk, rate the impact it would have on your organization if it were to occur, along with rationale and mitigating strategies you have in
place. (Adjust the Risks and Impact Level definitions to fit the realistic risks and replace with your risk mitigation strategy)
Impact
Risk to Agency
Low
Med
High
Rationale for Risk Impact
Risk Mitigation Strategy
Loss of Facilities
Primary work location will not be
available for up to 30 days
X
Have multiple sites
Not essential services
• MOU - Memorandum of understanding or Mutual Aid
Agreement with XYZ
• Alternate work location
• Work from home capability (ensure policies and
capabilities are in place)
Loss of Technology
Agency IT applications and data
are not available for at least 3 days
Cloud-based services are not
impacted (including Google)
X
All current data is stored in
the cloud
If all phone systems are
inoperable communication
with staff and clients is
affected
• Reliable off-site data backup
• Activate IT DRP - fail-over to alternate data centre
• Cloud applications or storage of data
• Alternate phone systems
• Paper copies of client and staff lists
Loss of Personnel
Large portion of staff and/or
volunteers are not available to
report to work
X
Large staff teams with cross
training amongst roles
• Identified trained alternates for key roles
• MOU - Memorandum of understanding with XYZ
• Ensure that staff are aware and supported during a
disruption
•
Ensure agency has a succession plan for key roles
Loss of External Third Parties
Disruption affecting external
provider needed to provide service
for up to 30 days
X
Have back up supplies on site;
have work around process for
some of these services;
• Require supplier to have BCP
• Identify alternate suppliers
• Have a reserve fund
• Educate staff on alternate processes
79
Non-Profit BCMP Toolkit | Template & Example
Community
Disaster impacting your
municipality or client group which
may change or increase the
demands on your organization
Support required to support other
Agencies in our or other
municipalities during an emergency
X
This would depend on the
size, location, and impact of
the disaster or emergency
• Communication with other agencies or groups to get
early notice of situation that potentially requires
service changes
• Continue to collaborate with other agencies to
maintain strong relationships outside out of emergency
and disasters e.g. Emergency Wellness Response
Team and Critical Service Provider Group
• Ensure staff are trained in Emergency Preparedness,
Psychological First Aid and First Aid
External Logistical or Major
Issue(s)
External events such as severe
weather (floods, fires, snow), power
outage, public transit strikes, road
closures, school closures,
extended, large scale external
events e.g. earthquakes,
pandemics
X
• Depending on the issue, any of the above strategies
can be applied
• Overall response and actions are the same, just over
an extended period of time
• Scenario specific plans e.g. COVID-19 pandemic
response
Legend - Impact Level to Agency
Low
Organizations operations could continue within acceptable timeframes
Med
Clients would be impacted by degraded service levels, but no injury or loss of life
High
Potential for injury or loss of life, or significant reputational or financial impact
80
Non-Profit BCMP Toolkit | Template & Example
Activation Assessment
A business disruption does not necessarily require activation of the business continuity plan if it does not pose a threat to the operations of
essential or necessary processes beyond their Maximum Downtime. Identifying the level of impact that a disruption can have is intended to help
in determining the extent of effort required for the response. This is not an exhaustive list and each situation will require assessment and
adjustment. Refer to “Appendix A2 - Activation Assessment Worksheet”.
Risk Level Level 1– Low Risk (Monitor) Level 2 – Medium Risk Level 3 – High Risk
Description
• Aware of possible or pending
disruption
• Minor/routine event
• Limited or short-term impact to
operations or singular department
• Significant or long term impact to
operations or reputation
• Corporate wide impact to services
Length of
Disruption
• Short term impact, 0-24 hours
• Short term impact expected, 1-5
days
• Long-term impact expected, > 5
days
Response Action
• Maintain all services with minimal
impact to employees and clients
• Maintain most services with modest
impact to employees and clients
• Maintain essential services remotely
where possible
• Protect employees and clients
Activation
• NO - Status quo
• POSSIBLY YES
• YES
Approach
• Maintain all services with minimal
impact to employees and clients
• Handled by normal operating
procedures
• Handled by normal operating
procedures
• Maintain most services with modest
impact to employees and clients
• Maintain core services remotely
where possible and protect
employees and clients
Communications
• No Communications required
• Targeted Comms to required internal
and external stakeholders
• Organization wide comms
• Broad external comms
81
Non-Profit BCMP Toolkit | Template & Example
Business Impact Analysis (BIA) - Service / Function Summary
Below is a listing of Services or Functions within the Agency, in priority order, along with the Maximum Downtime. This plan supports
Essential (Maximum Downtime <2 days) and Necessary (Maximum Downtime 2-5 days) services/functions. Valued Services can be postponed,
and business continuity efforts are not required or documented in this plan.
Service or Function Name
Busy/ Peak
Timeframe
Maximum Downtime (how long
can service be down for?)
Rationale (for maximum downtime)
Consider impacts to: People, Operations,
Reputation, Financial, Community Support
< 2 days
Essential
2-5 days
Necessary
> 5 days
Valued
1. Staff, Client and Volunteer
Communications and
Management
Anytime X Staff, clients and volunteers must be contacted to
be advised of any disruption in services.
Vulnerable clients to be checked on as appropriate
2. Payroll 15 and 31 of
month
X Statutory requirements. Only essential at payroll
time (2 times per month)
3. Community Emergency
Response
At time of
Disaster or
Emergency
X Staff may be mobilized at the request of CEMA to
support a response through Emergency Wellness
Response Team
4. Accounts Receivable;
Accounts Payable
30 days from
invoice
X Critical suppliers must be paid within 30 days of
invoice date to avoid penalty; Accounts Receivable
must be collected and deposited to ensure financial
stability.
5. Outreach Services Weekdays, 8am
– 8pm
X Once clients have been contacted and advised of
initial disruption of regular services, the situation will
be monitored. Depending on the nature and length
of the disruption this will inform the need for further
communication and support for clients.
6. Counselling Services Weekdays, 8am
- 5pm
X Once clients have been contacted and advised of
initial disruption of regular services, the situation will
be monitored. Depending on the nature and length
of the disruption will inform the need for further
communication and supports for clients.
7. Volunteer Coordination Weekdays, 8am
- 5pm
X Once volunteers have been contacted and advised
of initial disruption of regular services, the situation
will be monitored. Depending on the nature and
82
Non-Profit BCMP Toolkit | Template & Example
length of the disruption this will inform the need for
further communication and support for volunteers.
8. Community Development Anytime X Once staff and members of community
development programs have been advised of the
disruption of service in the agency they may be
mobilized to support communities in the recovery
phase of the disaster or emergency.
9. Community Collaborations Anytime X Non-disaster community collaborations can be put
on hold during the active phase of disaster or
emergency.
10. Fundraising Anytime X Active regular fundraising campaigns can be put on
hold during a disaster or emergency. However,
depending on the nature of the event they may be a
need to set up a platform to accept donations and
grants.
Maximum Downtime
Service Definitions
< 2
days
Essential
Service
Services/function must be maintained or there would be extreme consequences for the agency
(e.g. imminent threat to, or loss of life or major/multiple injuries, major facility damage or destruction, extreme
brand and reputation impact, or extreme monetary losses to the Agency)
2-5
days
Necessary
Service
Disruption would have moderate consequences to the Agency and would not threaten the provision of essential
services / functions
(e.g. no loss of life or injuries, moderate but recoverable brand and reputation impact and moderate monetary
losses)
>5
days
Valued
Service
The consequences are dealt with by routine operations and would have negligible consequence to the Agency
(e.g. no loss of life or injuries, minimal or no reputational impact or monetary losses)
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result of not providing a service or performing an
activity, to become unacceptable
83
Non-Profit BCMP Toolkit | Template & Example
Crisis Management Plan (CMP)
7.1.Objective
The objective of the Crisis Management Plan is to provide tools and guidance to support executive-level
strategic decision-making and actions to manage the agency during and after a disruption or crisis.
This includes coordination with teams involved in response and recovery efforts.
Crisis Definition - A crisis is defined as a situation of sufficient magnitude that it could substantially
threaten Agency operations or reputation. Often a crisis is an event that originates from a disruption or
community emergency that has widespread reputational and financial impacts to your Agency. There are
also non-emergency threats or situations that may lead to a crisis (e.g. employee behaviour impacting
reputation, major financial loss).
Crisis Management Team (CMT) - The actual CMT composition will be determined based on nature of
the disruption. Typical approach is to “go big” and bring in anyone you think may be impacted, and scale
back as you assess the situation. See section 2.3 for the contact information and list of typical starting
CMT members. For most Agencies, this team will also manage the Business Continuity activation,
response, recovery and restoration.
7.2.Crisis Management - Action Checklist
Done
CMT ACTIVATION (immediate) - begins with notification that an event has occurred that may
cause a business disruption to day-to-day operations or longer-term impact to business viability
or reputation. Conduct an assessment to determine what plan(s) need to be activated. .
1.
***Disruption Occurs***
Notification can come from a variety of sources to any Crisis Management Team (CMT)
member or other Agency staff of volunteer
2.
CMT Member(s) or delegates conduct assessment to determine impact to Agency
● Any CMT member can determine who needs to be involved to assess the nature and
severity of the disruption or emergency, and impact to the Agency
● Arrange a meeting or conference call to assess – at a minimum, include the Crisis
Management Lead, BCP Lead and Communicator (or their alternates). Use conference
bridge: Call in Number 1-877-4567, Participant Number 123-456-789, PIN 1234
● Assign a Crisis Management Lead and determine CMT membership for this event,
based on availability and nature of disruption
● Share relevant information, gather critical information, ascertain facts, assess situation
● Activation Considerations:
○ Is the situation still escalating and expected duration
○ Impacts to life, health or safety, customer service, reputation, financial,
community support
Complete “Appendix A2 - Activation Assessment Worksheet” and distribute to all CMT
members and alternates, including those not present at the meeting
3.
CMT Activation Decision: Is this a Crisis (see definition above) requiring CMT involvement?
● No – stand-down, no further action, or continue to monitor and report
● Unknown – continue to monitor and assess
84
Non-Profit BCMP Toolkit | Template & Example
● Yes – continue with CMT Response and Recovery below
4.
Other Plan Activation Decision: Is this a business disruption - do the BCP, or other plans
(e.g. ERP, IT DRP) need to be activated?
● No – do not activate any other plans; continue to monitor and report
● Unknown – continue to monitor and assess
● Yes – reference and follow applicable plan(s), continue to CMT Response and
Recovery below
5.
Notification
● Determine all stakeholders to be notified of activation decision (even if decision is not
to activate) e.g. Staff, Board, Executive Team, other Agency’s, external stakeholders
● See Crisis Communication Plan (CCP) for preapproved message content and
stakeholder groups to notify
Done
CMT RESPONSE AND RECOVERY - focus is to support the Agency’s restoration of essential
and necessary services/functions.
6.
Coordinate regular meetings (in person and/or by conference call)
• Determine timeframe for CMT meetings (at least daily e.g. CMT calls 6:30 am, 4:30
pm)
• Complete then distribute the “Appendix A2 - Activation Assessment Worksheet”
and
“Appendix A3 - Disruption Status Summary and Actions”
after all calls
7.
Determine required liaison points with other internal Agency areas not on CMT (e.g.
Emergency Manager, Corporate Security, HR Manager), or with other external stakeholders
• Communicate support requirements
• Establish information flow between all required groups
• Continually assess situation to determine when activation of any of the plans can stand
down; if so, communicate this decision. If the situation is under control and no longer
meets the definition of a Crisis, move to 3. Restoration phase (below).
8.
Support Communicator in completing the “Appendix A4 - Communications Plan and Log”
• Determine ongoing communication goals, method and frequency to all staff and other
stakeholders
9.
Provide executive support to the BCP Lead in executing BCP, for example:
• Set Agency objectives, goals, priorities and actions to help guide the BCP Action Plan
• Establish (or authorize enactment of) policies during disruption: worksite (tele-
commuting), work hours (expectation, staggered shifts), payment for contractors, etc.
• Authorize or enact MOU’s with other organizations as part of contingencies
•
Authorize extraordinary expenses
10.
Execute actions as per “Appendix A3 - Disruption Status Summary and Actions”
11.
Resolve any escalated issues that have arisen during recovery.
85
Non-Profit BCMP Toolkit | Template & Example
Done
CMT RESTORATION - Once the situation is under control, the Crisis phase will be declared
over. This decision will be communicated to stakeholders and the following activities
undertaken.
12.
Notify BCP Lead and determine if BCP will also stand-down or if continued activation is
required.
13.
Identify and recognize extra staff efforts during disruption
14.
Conduct a post-disruption review and ensure all documents are updated accordingly,
“Appendix A5 - Post-Disruption Review”
86
Non-Profit BCMP Toolkit | Template & Example
Crisis Communications Plan (CCP)
8.1.Objective
The objective of the Crisis Communications Plan (CCP) section is to describe the procedures and actions
required to communicate to the community, internal and external stakeholders and to the public, in the
event of a business disruption or community emergency. The intent is to identify the teams, people,
procedures and tools that will enable you to:
• Respond quickly
• Communicate efficiently and accurately
• Assist in protecting and enhancing the Agency’s reputation
• Help keep people, volunteers and clients safe by sharing timely, accurate, and relevant
information to key stakeholders
See Section 2.3 for a list of potential Crisis Management Team members with their contact information.
Key members involved in executing the Crisis Communications Plan are the Primary and Alternate
Communicators. Refer to section 2.2 for a description of roles and responsibilities.
8.2.Stakeholders
Stakeholder Group to be
communicated to:
Location of contact lists:
Method(s) of Communication
Executive
Cloud drive – Contacts folder
Email, phone
Supervisors
Cloud drive - Contacts folder
Email, phone
Staff
Cloud drive – Contacts folder
Email, phone
Volunteers
Cloud drive – Contacts folder
Email, phone, webpage
message
Clients
Cloud drive – Contacts folder
Email, phone, webpage
message
Donors
Cloud drive – Contacts folder
Media release, webpage
message
Community at large
Cloud drive – Contacts folder
Media release, webpage
message
Suppliers
Cloud drive – Contacts folder
Email, phone, webpage
message
Regulatory bodies
Cloud drive – Contacts folder
Email, phone, webpage
message
8.3.Media and Social Media Strategy
During a disruption or emergency, the media will want to get the facts in a timely manner to meet their
deadlines, under the precedent of the public’s right to know. The Agency is responsible for providing
timely, accurate and transparent information to help ensure the safety and security of people and the
community. The identified Primary Communicator will lead all interaction with the media, all media
requests should be directed to this person.
Ensure there is timely and accurate social media monitoring.
87
Non-Profit BCMP Toolkit | Template & Example
8.4.Messaging
The normal approval process for internal and external messages during normal operations should not
change in an emergency. The speed at which such approval takes place will increase significantly as the
situation dictates.
Approval Process: Any Agency member can draft a message, which must be approved by the
Communications Specialist followed by the CEO.
8.5.Media Holding Statement
The following messages have been pre-approved by the XYZ Calgary executive team so they can be
sent out as soon as a crisis or business disruption has been declared. Other messages may be included
for specific events (e.g. building outage) in future updates.
Subject: XYZ Calgary disruption
Internal to Staff:
XYZ Calgary is experiencing a disruption in our operations due to (general situation). A team is
working to identify the extent of the problem and has begun work to resolve it.
You will receive an update on the situation in approximately 1 hour.
Subject: XYZ Calgary disruption
External to Clients:
XYZ Calgary is experiencing a disruption in our operations due to a disruption at our main
facility (12 – 2222 Centre Street SE, Calgary T1T 3P3). A team is working to identify the extent
of the problem and has begun work to resolve it.
You will receive an update on the situation in approximately 1 hour.
If you require immediate assistance, please contact us at info@xyzagency.calgary.org or call
1.800.666.6666.
8.6.Develop Communications Plan
Build a plan as the disruption progresses (Immediate Response to Recovery to Restoration) following the
format in Appendix. The plan should indicate messages to be delivered, to whom and how. Also use this
plan as an activity log, indicating when each message has been sent out. [See Appendix A4 for
Communications Plan and Log]
88
Non-Profit BCMP Toolkit | Template & Example
Business Continuity Plan (BCP)
9.1. Overview
The objective of this section is to direct staff and other stakeholders towards the recovery of people,
facilities and resources needed to help the Agency provide Essential (Maximum Downtime <2 days) and
Necessary (Maximum Downtime 2-5 days) services/functions during a business disruption or emergency
within the community. The services provided will be the ones that have a time-sensitive impact on:
● People - life, health or safety of staff and clients
● Operations - customer service
● Reputation - public perception
● Financial – continued viability
● Community Support
89
Non-Profit BCMP Toolkit | Template & Example
9.2. BCP General Action Checklist
Done
BCP ACTIVATION (Immediate) - Activation begins with notification from a member of the
CMT that an event has occurred that may cause a business disruption and impact your day-
to-day operations.
1.
***Disruption has Occurred***
CMT has activated the BCP – BCP Lead is part of Crisis Management Team (CMT) with
responsibility to lead BCP activation and provide communication with CMT
2.
BCP Lead:
• Compare actual disruption or emergency to BCP scenario
• Review Essential and Necessary services/functions and determine priorities, create
workplan, assign responsibilities with reference to BCP
• Identify managers and/or critical staff to manage implementation of BCP
• Complete “Disruption Status Summary and Actions” worksheet [Appendix A3] in
consultation with managers and/or critical staff for services and functions affected;
communicate this information to the CMT
Done
BCP RESPONSE AND RECOVERY - The focus during Recovery is to ensure the Agency is
able to execute pre-identified essential business services in order of recovery priority.
3.
BCP Lead conduct Initial BCP Meeting
● Establish regular meeting schedule for with identify representatives e.g. once per day
via conference call
● Confirm impacted areas and who needs to be part of the BCP response
● Continue to brief on disruption and assess status of disruption
● Discuss BCP priorities and what immediate actions need to be taken
● Determine who outside of your Agency needs to be informed (now and ongoing)
● Confirm work location – office, home, other
● What other responses are underway; what other groups/people are involved?
● Communicate key results of this meeting in next CMT status report
4.
If main work facility is impacted - determine and arrange alternate work location (home,
alternate office, activate MOU’s, etc.)
5.
Contact staff to provide updates on disruption or emergency and determine potential staff
impacts and availability, possible relocation to alternate work location and ensure ongoing
communication
6.
In consultation with Communicator:
Identify key external stakeholders that need to be notified and kept advised of situation and
confirm communication plan, including
- Assign contact person(s)
- Determine messaging content
- Convey stakeholder concerns back to CMT
Determine frequency of communications
90
Non-Profit BCMP Toolkit | Template & Example
7.
Execute BCP and create an Action Plan
● Review Essential and Necessary services/functions and determine priorities, create
action plan with reference to specific Essential and Necessary Service/Function
Checklists (section 6.5) below, and assign responsibilities. Determine and assign
tasks for based on current priorities.
● Execute continuity strategies outlined in the BCP
● Prioritize critical and vital service duties over normal responsibilities, determine which
services are going to be temporarily discontinued. Communications Team and/or
Managers to convey this information to the appropriate stakeholders.
● Create a shift schedule with alternates to ensure coverage if there is an extended
duration expected (if appropriate for your agency)
● Determine if your resources can be allocated to other Agencies if required
● Ensure that quality, control and regulations are being maintained
8.
Communicate with Technology Advisor to ensure IT recovery of applications reflects
service/function restoration priorities set.
9.
Conduct regular BCP meetings (held on schedule set at initial meeting) - agenda:
● Invite each representative to provide an update on their area
● Review status of activated contingency plans (e.g. manual procedures; work from
alternate site)
● Review, assess and reprioritize Action Plan
● Update on communications with stakeholders
● Continue to assess support requirements - what you need and what you have to offer
● Allow opportunity to clarify actions to ensure understanding and consensus
● Set/confirm time for next meeting
● Communicate the results of the meeting with staff and CMT
Done
BCP RESTORATION - Restoration begins once the business disruption is over and the
Agency has determined they can return to normal operations. The focus is to ensure a safe,
uninterrupted resumption of normal business operations.
10.
Verify restoration of primary Agency facilities, required Technology/Data, Critical Staff
11.
Work with Communicator to determine what communication is required to all staff, volunteers,
clients and other stakeholders to advise the resumption of services
12.
Participate in BCP Post Disruption review – your own or other Agencies “Post-Disruption
Review” [Appendix A5], and update your BCP accordingly
13.
Ensure overtime and other salary adjustment forms related to disruption are processed; and
recognition for personnel who went “above-and-beyond” during disruption
14.
Resume services and functions suspended during the disruption, dealing with backlog.
91
Non-Profit BCMP Toolkit | Template & Example
9.3. Specific Essential and Necessary Service/Function Checklists
RECOVERY AND RESPONSE (2+ hours) - Specific actions to be taken after Activation to continue
Essential Services (continue within 2 days) or Necessary Services (continue within 5 days) – how are
you going to carry out your strategy above?
Done
Service /
Function (copy
from BIA)
Specific Recovery Procedures Manual Contingencies (What
can you do if IT services and
applications are not available?)
1.
Staff, Client and
Volunteer
Communications
and Management
● Review the communications that
occurred to date and address any
gaps
● Offer debriefing for those staff
involved in the response
● Review current staff capacity and
schedule accordingly
● Review and update agency
communication management plan
● Client database is in the
cloud
● Go to latest backup
● Include a hardcopy client
and staff list with BCP
binder (within privacy
regulations) or use hard
copy files
2.
Payroll ● Contact payroll provider to run
last periods payroll amounts
● Ensure any payroll activities that
were completed were accurate
● Manual cheques to staff
● Update payroll manually
3.
Community
Emergency
Response
● Move from EWRT response to
recovery services through Critical
Service Providers as directly by
CEMA
● Assess current agency clients and
communities that have been
directly affected
● Work directly with CEMA to
address this
4.
Outreach
Services
● Ensure that there is staff capacity
to resume services
● Contact agency clients to restore
regular services
● Use hard copy staff and
client lists and files
92
Non-Profit BCMP Toolkit | Template & Example
RESTORATION (Post Disruption) - Specific actions to return Services and Functions to normal
business operations once the business disruption is over.
Done
Service / Function (copy from
BIA)
Specific Restoration Procedures
1. Payroll ● Run last periods payroll, make any adjustments required
in next pay period
2.
Outreach Services ● Identify critical Outreach Services required
● Determine which services can be postponed and
communicate to required partied
3.
●
4.
●
COMMUNITY EMERGENCY (no direct impact to your operations) - How would you change your
service provision if this is a community emergency (and your operations are not affected)?
Done
Service / Function
(copy from BIA)
Actions
1. Community
Emergency
Response
● Continue delivering Agency Essential and Necessary Services
● Support Emergency Wellness Response Team (EWRT) Activation as
able and capacity allows
● Determine if we have capacity to offer assistance to other agencies
that may be impacted
93
Non-Profit BCMP Toolkit | Template & Example
9.4. Business Continuity Resource Requirements
This section lists everything needed to execute Essential (Maximum Downtime <2 days) and Necessary (Maximum Downtime 3-5 days)
services/functions. Valued services can be suspended during disruption response and recovery.
Staff
Human resources needed to provide Essential and Necessary services/functions. [See Appendix A1 for link to staff contact information.]
Service / Function (copy
from BIA)
Staff Type
(e.g. staff,
volunteer,
contract)
Regular
Number
Minimum
Number
Needed
Unique skills or
quals
Comments
(include possible sources of additional people, e.g.
from less critical services / functions, other
organizations)
Staff, Client and Volunteer
Communications and
Management
Staff
5
2
n/a
Supervisors
Payroll
Staff
1
1
Payroll and ADP
experience
Accounting payable clerk is cross trained for
payroll functions. Also, ABC Agency has agreed
to run our payroll if needed
Community Emergency
Response
Staff,
Volunteers
35
10
n/a
Service only provided when Emergency
Wellness Response Team (EWRT) activated
A/R; A/P
Staff
2
1
General accounting
skills
Mutual aid agreement with Edmonton branch for
provision of additional trained staff if needed
with 1 day notice
94
Non-Profit BCMP Toolkit | Template & Example
Facilities
Offices, Warehouses, Parking, etc. needed to provide Essential and Necessary services / functions
Service /
Function
(copy from
BIA)
Regular Location
(address)
Capacity
of Regular
Location
Minimum
Capacity
Needed
Timeframe
(Required
by)
Comments
(include possible alternate sites, any special
requirements)
All
12 – 2222 Centre Street SE,
Calgary T1T 3P3
56
16
12 hours
Most critical staff can work from home; rest can
work from alternate site: 214 – 10133 64 Street
NE, Calgary T1X 3P3
Information Technology (IT)
IT Services and Applications required.
Service / Function (copy
from BIA)
IT Application
Name
Internal,
External
Service, Cloud
RTO*
(when)
RPO**
(how
old)
Comments
All
Email
Cloud
4 hrs
4 hrs
All
Desk phones
Internal
12 hrs
N/A
Cell phones as alternate
Staff, Client and Volunteer
Communications and
Management
Website Updated
Cloud
4 hrs
23 hrs
Payroll
ADP
External
Service
24
hours
2 weeks
Community Emergency
Response
Phone and e-mail
Cloud, external
4 hrs
24hrs
Landline and cell phone may be required
A/R; A/P
SAP
Cloud, external,
72 hrs
24hrs
* Recovery Time Objective (RTO): The time goal set for the restoration and recovery of information based on the acceptable downtime in case of
disruption of operations. ** Recovery Point Objective (RPO): The point to which information used by an activity must be restored to enable the
activity to operate on resumption.
95
Non-Profit BCMP Toolkit | Template & Example
Telephone Numbers / Communications re-routing
The table below reflects the critical phone or fax numbers that must be rerouted.
Number to be
Rerouted
Rerouted to where
(number and
description)
Purpose of Line
Requirements for Line
Timeframe (Required
by)
403.777.7777
1.800.666.6666
Client / Public Inquiries
Regular phone line
4 hrs
Policies, Manuals, Vital Records and Key Information
List any Policies or Procedures, Manuals, Vital Records and Other Key Information required for execution of Essential or Necessary
services/functions. Records are identified as vital if they are important to the continued operations of your agency. They may not be easily
reproducible and are unique. Refer to Section 1.2 for Vital Business Information needed in case of major business disruption.
Description
Location (include links)
Timeframe
(Required by)
Comments
(i.e. Stored at Alternate Location)
Insurance Policy
Downtown office
1 day
Also at Bowness location
Master Client List
\calgary-clients\2019
4 hrs
Cloud Access
ND-Computer Support
4 hrs
Other Resources (Specialized Equipment, etc.)
List anything else not captured above that you would require e.g. specialized equipment.
Service /
Function (copy
from BIA)
What do you
have?
What do you need?
(Minimum Quantity)
Timeframe
(required by)
Who else has
it?
Comments
n/a
There is nothing else required
96
Non-Profit BCMP Toolkit | Template & Example
Key Dependencies, MOU’s, Mutual Aid Agreements and Contact Information
The table below reflects the people or organizations outside of the Agency required for delivery of agency Essential or Necessary
Services/Functions who should be contacted during a disruption or emergency e.g. Insurance company, HVAC, remediation companies
It includes any memorandums of understanding (MOU’s) or Mutual Aid Agreements with other Agencies.
Service /
Function (copy
from BIA)
Organization
(Who)
Contact
Information
(Name, Phone)
Involvement
(Nature of dependency or MOU)
Timeframe
(To be
contacted by)
Additional Information
(Impact, Penalty, Account
Information)
Payroll
ABC agency
Daffy Duck
403-222-8122
1234
Richmond St.
Alternate facility, payroll. ABC
Agency has agreed to run our
payroll if needed
24hrs
Accounts
Receivable;
Accounts
Payable
Edmonton Branch
Sunshine
Yellow,
Mutual aid agreement with
Edmonton branch for provision of
additional trained staff if needed
with 1 day notice
72hrs
Focus on critical
payments and invoices
that have significant
penalties
97
Non-Profit BCMP Toolkit | Template & Example
Psychosocial Considerations during a Business Continuity
Response
Employees are one of the most critical resources that support an organization’s services and operations.
Supporting employee, health, psychosocial well-being and resiliency before, during, and after a business
continuity disruption will ultimately support the continuity of operations and services.
Emergencies, disasters and business disruptions typically are stressful and can impact staff in a variety of
ways. As part of a comprehensive Business Continuity Management Program, it is critical that there are
steps in place to support staff. The focus should be on enhancing staff coping, resiliency and to develop a
culture of support. The objectives are to:
• Protect and promote the psychosocial well-being and resilience of staff
• Mitigate or prevent more serious psychosocial or mental health issues
• Support staff willingness and ability to continue to provide services
10.1. Five Essential Elements of Psychological First Aid
• Promote Safety – Physical and psychological safety – This should nclude providing employees
with accurate information about existing or emergent safety risks and hazards in the workplace or
community and what mitigation strategies or controls should be implemented.
• Promote Calm – Disasters, emergencies or disruptions can create a number of losses at the
same time. This can cause feelings of anxiety and uncertainty, which can interfere with sleep,
decision-making, and effective coping. Letting employees know that these feelings are normal
can help reduce anxiety. Encouraging calming techniques (e.g. deep breathing, meditation) can
help.
• Promote Self and Community Efficacy – Research shows that loss of personal, social, and
economic resources can lead to a diminished perception of self-efficacy and confidence in the
community’s ability to recover. Encourage employees to carry on regular activities outside of work
responsibilities and to look for opportunities to participate in community or group activities.
• Promote Connectedness – Social support improves emotional well-being and recovery. It’s
important to involve, engage, and connect with employees increasing the quantity, quality and
frequency of supportive interactions
• Instill Hope – Instilling hope is a crucial component, . helping impacted employees envision a
challenging but realistic future can instill hope and optimism.
Refer to “Appendix A7 - Psychosocial Staff Support Checklist”
98
Non-Profit BCMP Toolkit | Template & Example
Appendices
A1 – Contact Information – Staff and Volunteers
Staff contact info, including home phone numbers and personal email addresses is available in our
cloud storage: \xyz\hr\staffcontact
Volunteer contact info, including home phone numbers and personal email addresses is available in our
cloud storage: \xyz\hr\volunteercontact
99
Non-Profit BCMP Toolkit | Template & Example
A2 – Activation Assessment Worksheet
Disruption
Date and Time
Description
Assessment
Participants
Disruption Assessment
No
?
Yes
Comments
Is the situation escalating?
Do you expect the disruption to continue?
Is there an impact to continuity of Services?
Facilities
Are the building facilities impacted > 1 day?
Have assets been impacted?
Technology
Have technology resources been impacted
for > 1 hour?
Personnel
Are people currently ill or hurt?
Is there a threat of illness or injury?
External Service
Are any Essential Services impacted <2 days
Are any Necessary Services impacted 3-5
days?
Reputation
Is our reputation impacted or at risk?
Financial
Are any large sources of funding at risk?
Are there unexpected expenses > $20K
(replace with an appropriate threshold
amount)
Community
Is the community impacted or at risk?
Other
Are there legal or regulatory considerations?
Other impacts to consider?
Decision
Is activation of the CMP, CCP and/or BCP elements required?
No
Stand-down the CMP, CCP and/or BCP. Proceed with normal business operations.
? Unknown
Continue to monitor and report.
Yes
Communicate activation: All required stakeholders
100
Non-Profit BCMP Toolkit | Template & Example
A3 - Disruption Status Summary and Actions
This document provides a status summary across various areas within the Agency. It is a useful tool for
communicating to internal stakeholders and can be used to capture information during all status calls and
distributed to stakeholders to provide a status update.
Disruption Date
Crisis
Management
Lead
CMT Role CMT Member Name Status Actions Comments
BCMP Sponsor /
Crisis
Management
Lead
Crisis
Management
Team
Communicator
BCP Lead
Technology
Advisor
Other
Other
Legend - Status
0
No Issues
1
Minor Issues
2
Unknown
3
Major Issues
101
Non-Profit BCMP Toolkit | Template & Example
A4 – CCP - Communications Plan and Log
Disruption Event Communications Plan and Log
Event Name:
Date:
Done
Message (samples in italics)
Audience & Method (examples in italics)
Immediate Response (first few hours after incident)
1
•
Event has happened
• Focus on preserving life and safety
•
More information later
•
Executive - phone
• Staff/Volunteers - email
• Clients – webpage message
2
• Status of response
• Executive - phone
• Staff/Volunteers - email
• Clients – webpage message
•
Recovery (after immediate response – conducting essential/necessary services)
1
• Status of response
• Executive - phone
• Staff/Volunteers - email
• Clients – webpage message
• Donors – webpage message
• Suppliers – webpage message
• Community – webpage message
2
• Staff to be on standby from home
• Alternate work location for essential staff
•
Changes in reporting structure (if any)
• Executive - email
• Staff/Volunteers - email
3
• Services being continued; services deferred
until after disruption
• Executive - phone
• Staff/Volunteers - email
• Clients – webpage message
• Donors – webpage message
• Suppliers – webpage message
• Community – webpage message
•
Restoration (after disruption is over)
1
• Disruption over
• Impact of disruption (internal and external
services)
• Work underway to restore normal level of all
services
• Next steps
• Executive - email
• Staff/Volunteers - email
•
2
• Disruption over
• Impact of disruption (external services)
• Work underway to restore normal level of all
services
• Next steps
• Clients – webpage message
• Donors – webpage message
• Suppliers – webpage message
• Community – webpage message
•
102
Non-Profit BCMP Toolkit | Template & Example
A5 - Post-Disruption Review
After any activation of the Crisis Management Plan (CMP), Business Continuity Plan (BCP) or IT Disaster Recovery Plan
(DRP), information must be gathered and analyzed to record exactly what happened, when, the impacts it had, what went
right, what could have been improved, then identify follow-up actions to improve the plan(s) and related documents or
processes to apply the lessons learned.
Ideally, someone not directly involved in the activation should conduct this work for more objectivity. All key people
involved in the activation should participate in providing information needed on what happened. Documentation contained
on the various Checklist forms should be gathered to help develop a chronology of what was done. This effort should be
undertaken as soon as possible after normal business activities have resumed, while memories are still fresh.
The Post-Disruption Review Report should cover the following topics:
• A consolidated event timeline, including communications, technical activities, crisis and team leadership changes
• Cause of the disruption
• Recommendations on how to avoid a similar event in the future
• Summary of communications during the event
o What was communicated
o To whom
o When
o By whom
o Through what method (e.g. phone, email, face-to-face)
• Activation of Crisis Management, Emergency, Business Continuity and/or IT Disaster Recovery Plan
o Effectiveness of the plans
o Strengths, weaknesses, issues with the plans
• Management of the event
o Escalation, de-escalation/stand-down
o Resource management
o Strengths, weaknesses, issues
• Impact of the event on the Agency, for instance:
o Lost productivity (in estimated staff hours, extended to approximate dollar value)
o Reputational impact (positive or negative)
o Staff morale
• Lessons learned
• List of follow-up actions to avoid a similar event and to improve performance in future situations
The report should be presented to the Executive Team.
103
Non-Profit BCMP Toolkit | Template & Example
Opportunity for Improvement Rating
Recommendations/
Actions to be taken
Owner
Group
Owner
Name
Status
For any "Opportunity for Improvement"
type from previous column, select a rating
category on how the item impacted
overall Program and/or Plan functionality
or effectiveness
If you have suggested
recommendations feel
free to include e.g.
update BIA and/or BCP
High - item had significant impact on the
overall functionality or effectiveness of
the Program and/or Plan
You can leave this
column blank
Medium - item somewhat impacted overall
functionality and improvement required,
but the Program and/or Plan worked with
experienced team
Low - item is minor and a nice to have
update, it did not impact the overall
Program and/or Plan
As we navigate the ongoing Covid-19 Situation, identifying lessons learned early and ongoing is very important to improving the future performance of [TBD] Business Continuity Management Program.
TO BE COMPLETED BY OEM
BCP Coordinator
Lessons Learned Instructions
Contacts: Please contact [TBD] if you have any questions or would like to have a meeting to discuss and help complete the worksheet
Name email
Name email
# Department Branch Section
Identified /Submitted
by Name
Observations / Findings /
Comments
Type - Worked Well;
Opportunity for Improvement;
Other
Indicate name of person
who submitted. This will
assist with any
questions or follow up
action from the BCP
Coordinator.
List anything you would like
to capture
Worked Well - Strategies and
Processes that led to success
Opportunity for Improvement -
Areas of potential Improvement
Select "Rating" category in next
column
Other - doesn't fit either
category above e.g. general
observation
As we navigate the ongoing Covid-19 Situation, identifying lessons learned early and ongoing is very important to improving the future performance of [TBD] Business Continuity Management Program.
List your Department / Branch / Section level
as applicable
If the finding is at a Department level,
indicate n/a for Branch and Section
If the finding is at a Branch level, indicate n/a
for Section
Confidential - if you are not comfortable sharing this information or
being linked as the identifier, indicate "Confidential" in any column.
You can also reach out to the OEM BCP Officers directly to share and
discuss any lessons learned
A5 – Lessons Learned
Lessons Learned Instructions
Contacts: Please contact [TBD] if you have any questions or would like to have a meeting to discuss and help complete the
worksheet
Name
email
Name
email
As we navigate the ongoing Covid-19 Situation, identifying lessons learned early and ongoing is very important to improving the future performance of [TBD] Business Continuity Management Program.
Complete the "Tracker" on the next tab to capture any lessons learned from the onset of the COVID-19 disruption in the table below.
#
Department
Branch
Section
Identified /Submitted by Name
Observations
/ Findings /
Comments
Type - Worked
Well; Opportunity
for Improvement;
Other
List your Department / Branch / Section level
as applicable
If the finding is at a Department level, indicate
n/a for Branch and Section
If the finding is at a Branch level, indicate n/a
for Section
Indicate name of person who
submitted. This will assist with any
questions or follow up action from
the BCP Coordinator.
List anything
you would like
to capture
Worked Well -
Strategies and
Processes that led
to success
Confidential - if you are not comfortable sharing this information or being linked as
the identifier, indicate "Confidential" in any column.
You can also reach out to the OEM BCP Officers directly to share and discuss any
lessons learned
Opportunity for
Improvement -
Areas of potential
Improvement
Select "Rating"
category in next
column
Other - doesn't fit
either category
above e.g. general
observation
104
Non-Profit BCMP Toolkit | Template & Example
A6 – Scenario Based Plans
Scenario Planning Assumptions Location of Plan
Community
disaster –
EWRT
activated
• Community disaster has minimal impact on
Agency resources
• Agency facilities, personnel available
• Increased access to regular services
• EWRT Services provided as determined in
consultation with CEMA
Cloud storage:
\xyz\bcmp\EWRT2019
Pandemic Plan Contents
• Sources of Information
o Include credible information sources that will be utilized (these are examples from COVID-19), be sure to
update with current source information:
Government of Alberta: COVID-19 information for Albertans
Government of Canada: COVID-19 Outbreak update
Centre for Disease Control and Prevention: COVID-19 Resources
World Health Organization: COVID-19 Updates
• Introduction, Background, Scope
• Pandemic Response Team – structure and responsibilities
o In the initial stages of a potential epidemic or pandemic identify a Pandemic Response team who will
monitor the situation and be activated if the situation escalates and Pandemic Plan Activation is required
o This may mirror the crisis management team
• Pandemic Activation Triggers & Authority
o Identify who has the authority to activate the Pandemic Plan
• Pandemic Phases
o Monitor & Prepare - pre-outbreak
o Response – outbreak, pandemic declared
o Relaunch & Recovery – ongoing duration of pandemic
o Restoration & New Normal – post outbreak
• Action list for each phase
A7 - Psychosocial Staff Support Checklist
Prepare
Learn about the disaster, emergency,
or business continuity disruption
o Know basic information
o What happened?
o When and where did it take place?
o How many people and who is affected?
o Communicate information about the disruption and
impact to services/operations to employees
105
Non-Profit BCMP Toolkit | Template & Example
Learn about available services and
supports
Learn about safety and security
concerns
o Who is providing basic needs (e.g. emergency
medical care, food, shelter)?
o Where and how can people get services and
supports?
o Who else is helping? (e.g. provincial, community)
o Know key players/responding organizations to be
able to direct people to where they may go to
seek/access assistance
o Communicate available services and supports to
employees, whether they are internal employee
and family assistance programs, or supports
offered in community
o Is the crisis or disruption over?
o What dangers may be in the environment or
workplace?
o Are there areas, worksites, offices to avoid?
o Keep safe by knowing more about the specific
dangers. Safety is key when responding
o Communicate to employees what safety and
security concerns may exist and what new safety
or security process are being implemented as part
of the business continuity response
Look
Check for safety
Assist with obvious urgent basic
needs
Look for people with serious distress
o Don’t put employees in a situation that is unsafe
o Communicate the safety risks or hazards that may
have arisen as a result of a business continuity
disruption
o Employees may be impacted by a community
emergency or disaster that has caused a business
continuity disruption to your organization.
Employees need to have their basic needs (food,
clothing, shelter, etc.) met before they can continue
working and supporting activities to resume an
organization’s operations and services
o If employees have been directly impacted by an
emergency or disaster, they may need help to
access services or supports.
o Is anyone extremely upset, immobile, not
responding to others or is in shock?
o Consider who may benefit from psychosocial
support and how best to help
Listen
Make contact with people who need
support
Ask about people’s needs and
concerns
o Does anyone need assistance?
o Are there quiet spaces you can take employees to
talk if they need support?
o Approach people respectfully
o Ask if you can provide help
o Try and make people feel comfortable and safe
o What are the needs of employees?
o What priority are those needs?
o It is important to ask about needs, even if they are
obvious. People may help prioritizing their needs
106
Non-Profit BCMP Toolkit | Template & Example
Listen to people and help them feel
calm
o Is the employee in distress?
o If they are in distress, help them feel calm and
make sure they are not alone
Link
Help employees address basic needs
and access services
Help employees cope with problems
Give accurate information
Connect employees with social
supports
o What needs is the employee expressing?
o What services are available (e.g. internal employee
and family assistance programs, counselling
services, etc.)?
o Consider how the employee normally copes with
challenging situations
o Ask the employee how they have coped in the past
and discuss health coping strategies and unhealthy
coping strategies
o Is the employee familiar with services available to
them?
o Is the employee looking for any specific information
(e.g. related to the emergency, disaster, disruption
to an organization’s services or operations)?
o Find out where to get updated information and
keep updated while you are supporting employees.
Be sure you know where people can access
specific services to give accurate information.
o Link employees to social supports
o Are there peer supporters in the workplace they
can access or connect with?
o Promote self-care and activities that support
psychosocial wellness and resiliency (e.g. nutrition,
rest/taking breaks, exercise, etc.)
o If employees are in serious distress, they may need
to be referred to professional mental health
supports
Mental health information during crisis is important. Alberta Health Services has information and a number of resources
available for Albertans.
Mental health resources are available here
• www.ahs.ca/helpintoughtimes
• https://www.albertahealthservices.ca/amh/Page16759.aspx
• Supporting the Psychosocial Well-being of Health Care Providers During the Novel Coronavirus (COVID-19)
Pandemic
107
Non-Profit BCMP Toolkit | Template & Example
A8 - Local Emergency Information Reference Sites
Alberta Emergency Alert @AB_EmergAlert l Emergencyalert.alberta.ca
Alberta Emergency Alerts are issued to warn people about potential risks to their health and safety.
The City of Calgary @cityofcalgary l Calgary.ca
In the event of an emergency, The City of Calgary website is a great source of up-to-date information.
Calgary City News blog and mobile app Calgarycitynews.com
Stay on top of what’s happening in Calgary with the City of Calgary News app.
Calgary 311 mobile app
Report and track select City services from your smartphone using location-based technology.
The City of Calgary Facebook Facebook.com/thecityofcalgary
Receive the latest City of Calgary updates on Facebook.
The City of Calgary Road Conditions mobile app
The City of Calgary Road Conditions app is designed to help you plan your commute during winter storms.
Calgary Police Service @Calgary_Police l calgarypolice.ca
Calgary Police Service tweets regularly about potential dangers in Calgary and will help keep you up-to-date in an
emergency situation.
Public Safety Canada @Safety_Canada l publicsafety.gc.ca
Public Safety Canada works to keep Canadians safe from risks such as natural disasters, crime and terrorism.
108
Non-Profit BCMP Toolkit | Update this
108
Non-Profit BCMP Toolkit | Simplified Template
Note: This template is provided to support the Non-Profit Business Continuity Planning — Toolkit.
This template is a guide only, adjust to fit your organization as required
Simplified Business Continuity Plan
(BCP) Template
Insert Organization Name
Location of Electronic Document
Location of Paper Copy(s)
Document Owner
109
Non-Profit BCMP Toolkit | Simplified Template
Document Control
Revision Date Revised By Details (changes made)
Business Continuity Team - Key Contact Information
The actual team composition will be determined based on nature of the disruption. Typical approach is to “go big” and bring in anyone you think
may be impacted, and scale back as you assess the situation.
Business
Continuity Team
Role
Name Work # Cell # Email Backup
Document Objective
The objective of this Business Continuity Plan (BCP) is to provide a process to ensure the appropriate operational response, recovery and
continuation of essential processes if there were a business disruption that affects the organizations ability to operate.
The essential processes identified will be the ones that have a time-sensitive impact on:
● People - life, health or safety of staff, volunteers or clients
● Operations - customer service
● Reputation - public perception
● Financial – continued viability
● Community Support
110
Non-Profit BCMP Toolkit | Simplified Template
Organization Overview
What is your purpose / mandate?
What services do you provide?
Who are the clients of this service?
Vital Business Information
Business License Number
Registered Charity Number
Insurance Provider and Policy Number
Location of Critical Paper Records
Backup Computer Records Location
Primary Work Location and Phone
Alternate Work Location(s) and Phone
Conference Bridge
111
Non-Profit BCMP Toolkit | Simplified Template
Business Continuity Team
5.1. Structure
BCMP
Sponsor
[Name]
BCP Admin BCP Lead
Operations Facilities HR IT Finance
Others as
required
Comms
BCP Team Members
112
Non-Profit BCMP Toolkit | Simplified Template
5.2. Responsibilities
Role Responsibilities
BCMP Sponsor
Provide strategic guidance, direction and approvals
• Determine and represent the interests of company leadership – set strategic priorities
• Communicate with board members, and others as required
• Approve temporary funding/ authority level changes
BCP Lead Business Continuity Lead for the overall business continuity response
• Receive notification, conduct assessment
• Activate the BCP
• Gather and advise Business Continuity Team
• Update CEO as required
• Work with BCP Team Members to ensure smooth execution of the BCP
BCP Team
Members
(specific role
details below)
All BCP Team Members
• The team is nimble, internal or external parties will be engaged or released by the BCP Team as required
• Report to BCP Lead during BCP response, recovery and restoration
• Participate and provide input into Team meetings
• Review and confirm essential processes identified in the BIA section of this document and ensure they are continued
• Provide direction to your department / employees
Operations
• Provide analysis on the impact of the disruption on the organization’s overall operations and essential processes
Facilities
• Establish and manage alternate work location as required (in coordination with BCP Lead)
• Arrange and coordinate staffing needs, including scheduling and locations
• Secure other necessary supplies and resources and leads on related procurement processes
HR
• Manage all HR aspects of the BCP response, recovery and restoration
• Ensure Supervisors understand staffing considerations and processes
• Ensure staff understand compensation arrangements and other HR protocols
• Ensures provision of contact information and staff supports required to facilitate the execution of essential processes
IT
• Liaises closely with the BCP Team to determine needs and gaps in relation to IT and other resources
• In coordination with BCP Lead, liaises with Corporate IT to ensure quick delivery of IT services and any necessary
troubleshooting
113
Non-Profit BCMP Toolkit | Simplified Template
Role Responsibilities
• Manages and tracks IT equipment used by staff e.g. iPads, laptops
Finance
• Manage all financial aspects of the BCP response, recovery and restoration
• Ensures provision of financial resources to facilitate the execution of essential processes
• Ensure accurate tracking and approvals are in place
• Manage procurement, contracts and mutual aid agreements
• Manage claims e.g. insurance
Others as
Required
• TBD based on nature of disruption and what is required by additional parties
Communications Responsible for all internal and external communications
• Activate and follow the Crisis Communications Plan
• Directs overall communications efforts - internal and external audiences, including media
• Priority is timing, effective comms and protecting reputation
BCP Admin
Admin Support
• Set up meeting invites
• Document management - meeting minutes, decision log, action items
• Ad-hoc admin support as required e.g. manage supplies, order catering
114
Non-Profit BCMP Toolkit | Simplified Template
Risk Assessment and High-Level Strategy
This BCP is based on an all hazards approach for a broad range of risks and disruptions. Below are potential risks with mitigation strategies for
each risk. When an actual disruption or emergency occurs, the parameters of the disruption should be compared to the risk description below
so that the BCP Lead can adjust the plan appropriately. For each risk, rate the impact it would have if it were to occur, along with rationale and
mitigating strategies you have in place.
Impact
Risk to Organization
Low
Med
High
Rationale for Risk Impact
Risk Mitigation Strategy – Organization Level
Loss of Facilities
Primary work location will not be
available for up to 30 days
•
Loss of Technology
IT applications and data are not
available for at least 3 days; cloud-
based services are not impacted
•
Loss of Personnel
Large portion of staff and/or
volunteers are not available to work
•
Loss of External Third Parties
Disruption affecting external provider
•
Community
Disaster impacting your municipality
or which may change the demands
on your organization
•
External or Major Issue(s)
External events e.g. severe weather
(flood, fire, snow), power outage,
road closure, school closure,
extended large scale event e.g.
earthquake, pandemic
•
Legend - Impact Level to
Organization
Low
Organizations operations could continue within acceptable timeframes
Med
Clients would be impacted by degraded service levels, but no injury or loss of life
High
Potential for injury or loss of life, or significant reputational or financial impact
115
Non-Profit BCMP Toolkit | Simplified Template
Business Impact Analysis (BIA) - Process Priority and Summary
Below is a listing of process in priority order, along with the Maximum Downtime - the time it would take for adverse impacts, which might
arise as a result of not providing a process or performing an activity, to become unacceptable. This plan supports Essential (Maximum
Downtime <2 days) and Necessary (Maximum Downtime 2-5 days) process. Valued processes can be postponed, and business continuity
efforts are not required or documented in this plan.
Service / Department Process
Busy/ Peak
Timeframe
Maximum Downtime (how long
can process be down for?)
Rationale - Consider impacts to:
People, Operations, Reputation,
Financial, Community Support
< 2 days
Essential
2-5 days
Necessary
> 5 days
Valued
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
Maximum Downtime
Definition
< 2
days
Essential
Process
Process must be maintained or there would be extreme consequences for the organization
e.g. imminent threat to, or loss of life or major/multiple injuries, major facility damage or destruction, extreme
brand and reputation impact, or extreme monetary losses to the organization)
2-5
days
Necessary
Process
Disruption would have moderate consequences and would not threaten the provision of essential processes
e.g. no loss of life or injuries, moderate but recoverable brand and reputation impact and moderate monetary
losses
> 5
days
Valued
Process
The consequences are dealt with by routine operations and would have negligible consequence
e.g. no loss of life or injuries, minimal or no reputational impact or monetary losses
116
Non-Profit BCMP Toolkit | Simplified Template
Business Continuity Requirements & Strategy – Essential Processes Only
This section is to collect requirements and strategy for only the essential processes required within 2 days identified in the BIA section above.
Add as many essential processes as needed.
8.1. Essential Process 1 – [NAME]
Process Requirements
High-level process overview
Process owner & alternate
Facility - Work location (can process be done from
home?)
IT Requirements – applications along with required
time objective (RTO)
IT Application Name
RTO – when is it required?
People - Critical roles required
Critical Role / Title
Special skills, designations, certifications
External third-party dependencies
Other Requirements (equipment, physical records)
Specific process recovery strategies
8.2. Essential Process 2 – [NAME]
Business Continuity Requirements & Strategy – Essential Processes Only
This section is to collect requirements and strategy for only the essential processes required within 2 days identified in the BIA section above.
Add as many essential processes as needed.
8.1. Essential Process 1 – [NAME]
Process Requirements
High-level process overview
Process owner & alternate
Facility - Work location (can process be done from
home?)
IT Requirements – applications along with required
time objective (RTO)
IT Application Name
RTO – when is it required?
People - Critical roles required
Critical Role / Title
Special skills, designations, certifications
External third-party dependencies
Other Requirements (equipment, physical records)
Specific process recovery strategies
8.2. Essential Process 2 – [NAME]
117
Non-Profit BCMP Toolkit | Simplified Template
APPENDIX
9.1. Quick Reference - BCP Phases and Actions
The table below depicts the four phases and actions of a business disruption, along with key actions during each phase.
BCP
Phase
1. ASSESSMENT (at
disruption)
2. RESPONSE (within 24
hours)
3. RECOVERY (ongoing throughout disruption)
4. RESTORATION (post
disruption)
Purpose
Gather information and
determine if it is a
disruption that could
impact operations
Mobilize the BCP Team and
actions to be taken
immediately following a
disruption
Ongoing actions to be taken after Response to
support the organization to continue critical and
essential processes
Post disruption actions to
return the organization to
normal business
operations
Spo
nsor
• Provide corporate direction and guidance as required
• Updates to the Board throughout disruption
BCP Lead
• BCP Activation
decision – may involve
BCP Team in decision
o No – monitor or
stand-down
o Yes – continue
• Determine who needs to be
part of the BCP Team
• Lead Team meetings
• Conduct regular BCP Team meetings to
determine status and requirements
• Validate IT status
• Determine when to stand-down the BCP
• Verify restoration
activities at an
organizational level
• Organize post
disruption review
activities
BCP Team Members
• Receive notification of
an actual or potential
disruption
• Conduct assessment
to determine impact
on continuity of
operations
• Set organizational priorities
based on strategic direction
• Notify employees of BCP
activation
• Work with Comms and
determine what is required
• Create action plan and
assign responsibilities
• Continue to review and set organizational
direction
• Review, assess and reprioritize Action Plan
• Continually validate BIA - critical and essential
processes
• Ongoing communication updates
• Monitor team well-being
• Determine when to stand-down the BCP
• Determine new normal
priorities, structure,
resourcing, etc.
• Ongoing comms
updates
• Participate in post
disruption review
• Update required plans
• Employee recognition
Com
ms
• Work with BCP Team on corporate direction and messaging content, requirements and strategy
• Internal - ongoing communications to employees
• External – public, media, government, external stakeholders
118
Non-Profit BCMP Toolkit | Simplified Template
9.2. BCP Activation Triggers and Assessment
A business disruption does not necessarily require activation of the BCP if it does not pose a threat to the operations of essential or necessary
processes beyond their Maximum Downtime. Identifying the level of impact that a disruption can have is intended to help in determining the
extent of effort required for the response. This is not an exhaustive list and each situation will require assessment and adjustment.
Risk Level Level 1– Low Risk (Monitor) Level 2 – Medium Risk Level 3 – High Risk
Description
• Aware of possible or pending
disruption
• Minor/routine event
• Limited or short-term impact to
operations or singular department
• Significant or long-term impact to
operations or reputation
• Corporate wide impact to processes
Length of
Disruption
• Short term impact, 0-24 hours
• Short term impact expected, 1-5 days
• Long-term impact expected, > 5 days
Response
Action
• Maintain all processes with minimal
impact to employees and clients
• Maintain most processes with modest
impact to employees and clients
• Maintain essential processes remotely
where possible
• Protect employees and clients
BCP Activation
• NO - Status quo
• POSSIBLY YES • YES
Approach
• Maintain all processes with minimal
impact to employees and clients
• Handled by normal operating
procedures
• Handled by normal operating
procedures
• Maintain most processes with modest
impact to employees and clients
• Maintain core processes remotely
where possible and protect employees
and clients
Communications
• No Communications required
• Targeted Comms to required internal
and external stakeholders
• Organization wide comms
• Broad external comms
119
Non-Profit BCMP Toolkit | Simplified Template
9.3. Psychosocial Considerations during a Business Continuity Response
Employees are one of the most critical resources that support an organization’s services and operations. Supporting employee, health,
psychosocial well-being and resiliency before, during, and after a business continuity response will ultimately support the continuity of
operations and services. Emergencies, disasters and business disruptions typically are stressful and can impact staff in a variety of ways. As
part of a comprehensive Business Continuity Management Program, it is critical that there is a plan in place to support staff. The focus of the
plan should be on enhancing staff coping, resiliency and to develop a culture of support. The objectives of a psychosocial plan would be to:
• Protect and promote the psychosocial well-being an resilience of staff
• Mitigating or preventing more serious psychosocial or mental health issues
• Support staff willingness and ability to continue to provide service
Five Essential Elements of Psychological First Aid
• Promote Safety – Physical and psychological safety – This can include providing employees with accurate information about existing
or emergent safety risks and hazards in the workplace or community and what mitigation strategies or controls should be implemented.
• Promote Calm – Disasters and emergencies can create a number of losses at the same time. This can cause feelings of anxiety and
uncertainty, which can interfere with sleep, decision-making, and effective coping. Letting employees know that these feelings are
normal can help reduce anxiety. Encouraging calming techniques (e.g. deep breathing, meditation) can help.
• Promote Self and Community Efficacy – Disaster research shows that loss of personal, social, and economic resources can lead to
a diminished perception of self-efficacy and confidence in the community’s ability to recover. Encourage employees to carry on regular
activities outside of work responsibilities and to look for opportunities to participate in community or group activities.
• Promote Connectedness – Social support improves emotional well-being and recovery. It’s important to involve, engage, and connect
with employees increasing the quantity, quality and frequency of supportive interactions
• Instill Hope – Instilling hope is a crucial component in disaster recovery. Helping impacted employees envision a challenging but
realistic future can instill hope and optimism.
Psychosocial Staff Support Considerations
• Prepare - Learn about the disaster, emergency, or business continuity disruption; Learn about available services and supports; Learn
about safety and security concerns
• Look - Check for safety; Assist with obvious urgent basic needs; Look for people with serious distress
• Listen - Make contact with people who need support; Ask about people’s needs and concerns; Listen to people and help them feel
calm
• Link - Help employees address basic needs and access services; Help employees cope with problems; Give accurate information;
Connect employees with social supports
120
Non-Profit BCMP Toolkit | Project Material
Calgary’s Integrated Non-Profit
Business Continuity Project (INBCP)
— Project Material
121
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Purpose
• During Calgary’s Integrated Non-Profit Business Continuity Project (INBCP)significant material was
created with the intention to share and support other organizations in developing or revising their
BCP
• This project material slidedeck is a collection of the four project workshops conducted throughout
the project – kick off meeting, training and Business Impact Analysis, Business Continuity Plan
(BCP) development, and BCP exercise
• The intent is to provide a source of information that can utilize and customize when building a
Business Continuity Management Program (
BCMP)
• It is also intended to help replicate the approach for an integrated, cross-organization project
• The material includes:
o Calgary project background
o Survey content
o Pre and post email content
o Workshop materials
122
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
INBCP Background in Calgary
• Following the 2016 Wood Buffalo Wildfire response, using funds allocated by Red Cross,
The United Way of Calgary & Area released a call for proposal to identify organizations to
provide emergency preparedness and business continuity support to Calgary non-profit
organizations individually and as part of a network to respond to an emergency
• carya was selected to act as lead organization and was awarded funding from this call for
proposal beginning April 1, 2018
• The concept was to provide coordinated business continuity planning support and
resources for non-profit organizations and to collaborate with participating members to
build capacity for business continuity through an integrated, inter-sectoral approach
• The concept was coined: Integrated Non-Profit Business Continuity Project
“INBCP”
• The project was a pilot with the hope and intention to continue and expand on what was
created to assist other non-profit organizations in developing and/or revising their BCP
123
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Timeline for Calgary’s INBCP
Date Activity
January 2018 United Way/Red Cross initiated RFP for project
April 2018 Established Steering Committee with 7 agencies
May 2018 Survey of Critical Service Provider agencies on their BCP needs
June 2018 Meeting with Critical Services Providers to outline project and gather feedback
July 2018 Development of RFP for consultant to provide BCP training; Discovery Meeting and proposals submitted by two consultants
August 2018 MNP hired to provide the BCP workshops and one on one support to CSP agencies
November 2018 Project kick off with Critical Service Providers
December 2018 Presentation at AEMA conference - “ESS Integration in Municipal Emergency Planning with NPO’s”
December 2018 Workshop #1 (one of two) – BCP 101 and Business Risk Assessment and Business Impact Analysis
January 2019 Workshop #1 (two of two) – BCP 101 and Business Risk Assessment and Business Impact Analysis
January 2019 Engaged with Consultant to do research and write a learning report
January 2019 One on one consultations with MNP and individual agencies begin
February 2019 Workshop #2( one of two) – BCP Plan Development Workshop
February 2019 Workshop #2(two of two) – BCP Plan Development Workshop
May 2019 One on one consults
May 2019 Asset Mapping Exercise
May 2019 Workbooks finalized
June 2019 Workshop #3 Tabletop Exercise
July 2019 MNP wraps up the one on one consults with agencies – work will be pro bono at this point
August 2019 Consultant completes Learning Report – includes interviews with agencies participating in the project and steering committee members
August 2019 Wrap up celebration with Steering Committee Members
September 2019 Critical Service Provider Meeting – members receive finalized toolkit
Below is the timeline of major activities with Calgary’s INBCP
124
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Scope – CSP Group
• The initial group of non-profits for the INBCP project was the Critical Service Provider
(CSP) group
• The CSP group facilitates increased coordination and communication between the
non-profit sector and The City of Calgary’s emergency response. The CSP group is
intended as a resource to supplement The City’s response in order to provide an
effective service delivery to people and communities impacted by an emergency event
in Calgary, with an emphasis on people experiencing greater vulnerability.
• CSP service categories include emotional wellness, food, lodging, medical, cultural,
pet care, recreation, accessibility
• The intention is to roll-out the project to other non-profits within Calgary
125
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Phases and Timelines
Phase 1
INBCP Kickoff
Meeting
• November 21, 2018
• 2 hour meeting
• Target: All interested
CSPs
Phase 2
Business Continuity
Training & BIA
• December 12, 2018
OR January 17, 2019
• 3 hour workshop
• Target: CSPs who
would like more in-
depth business
continuity training
Phase 3
BCP Development
Workshop
• February 12 OR 26
2019
• 3 hour workshop
• Target: CSPs who do
not have a plan in
place or plan is out of
date
Phase 4
Joint tabletop
Exercise
• June 17, 2019
• 2 hour workshop
• Target: All interested
CSPs
Project Delivery to Agencies was broken into 4 phases as outlined below
One-on-one support from BCP Consultant offered throughout each Phase for a total of 4 hours to
meet the Agency’s needs
126
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Agency Survey Questions - sent out prior to project start)
This survey was distributed to agencies to gain an understanding of their business continuity status and needs
(sent our prior to project start)
Sample survey questions
1. The Critical Service Provider Group has been organized into critical service categories aligned with CEMA's Emergency Social Services. Please
identify the critical service categories your organization can contribute to during an emergency or disaster response (select all that apply)
2. What term best describes your role?
3. How long has your organization been in operation?
4. How many employees does your organization employ?
5. Does your organization have a Business Continuity Plan (a plan for how to continue to operate after a service interruption)?
6. When was the last time your Business Continuity Plan was reviewed or updated?
7. What is the main reason for not reviewing or updating the Business Continuity Plan?
8. When was the last time the Business Continuity Plan was exercised?
9. What is the main reason for not exercising the Business Continuity Plan?
10. Are your organization's employees aware of the Business Continuity Plan?
11. Has your organization experienced an interruption that has impacted the ability to operate?
12. What type of interruption impacted your organization's ability to operate? (select all that apply)
13. What was the length of time your operations were impacted during the most significant service interruption your organization experienced?
14. What was the biggest impact during the most significant service interruption your organization experienced? (select all that apply)
15. What is the main reason for not having a Business Continuity Plan?
16. Would you be interested in learning more or having assistance developing a Business Continuity Plan?
17. What resources would you use to assist you with business continuity planning?
18. Does your organization have a budget line for business continuity planning?
19. Would you be interested in learning more about business continuity planning or having a review of your Business Continuity Plan?
20. What is the preferred delivery method for support with business continuity planning?
21. Has your organization partnered with similar organizations to establish shared continuity strategies?
22. Would your organization benefit from partnering with other similar organizations to develop shared continuity strategies?
127
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Agency Consultation
• The survey results clearly pointed to the desire to have both an
opportunity for collaboration during workshops along with one-on-one
support throughout the project
• BCP Consultant provided one-on-one support offered throughout each
phase as required by each Agency
o The INBCP included 4 hours of consultation per Agency
• This included assessment of Agency’s current plan and/or assistance
in completing/updating their plan, general advice or whatever each
Agency required
128
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCP Consultation – BCP Assessment
CSP Agency Name:
Review Date:
Documents Reviewed:
Summary Comments:
Overall Business Continuity Management Program Criticality of Update:
129
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop Survey Example
• Workshop Name:
• Date:
Evaluation (1-5 scale rating)
o The workshop lived up to my expectations?
o The workshop objectives were clear to me?
o The workshop was a good way for me to learn the content?
o The instructor was well prepared?
Comments (open text)
o What was the most valuable part of the workshop?
o What was the least valuable part of the workshop?
o What improvements would you recommend?
o Additional Comments
Surveys were
completed at the end
of each workshop
130
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
COVID-19 Lesson’s Identified
• Including considerations for psychosocial support for employees
into business continuity planning is critical, especially during
disruptions with an extended duration (e.g. global pandemic) or
high impact (e.g. employee deaths)
• Being prepared and having a plan is important - in June 2020, a
recent survey of clients who participated in Calgary's’ INBCP
showed that 84% of respondents felt the project adequatel
y
prepared their organizations to respond to COVID-19
• Preference is for a simple plan with the following key
components: BCP Team structure and roles and
responsibilities, process priority, requirements for essential
processes only
131
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
The following slides are a
compilation of material from
each of the Workshops
132
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Workshop Agenda’s
Phase 1
INBCP Kickoff
Meeting
• Introductions
• Project background and
overview
• Introduction of business
continuity management
program concepts
• Recent BCP activation by
a CSP member
• Project structure and
timelines
• Project participation
options
• Next steps
• Q&A
• CEMA update
• Initial assessment of CSP
project participation
options (handout)
Phase 2
Business Continuity
Training & BIA
• Introductions
• Project Overview
• Business Continuity
Management
• Business Continuity
Management Program
(“BCMP”) and Business
Continuity Plan (“BCP”)
Development
• Individual and Group Work
• Next Steps
• Q&A
• Individual questions with
BCP Consultant
Phase 3
BCP Development
Workshop
• Introductions
• BCMP Overview
• Business Continuity Plan
Topics
• Workshop
• Next Steps
• Q&A
• Individual questions with
BCP Consultant
Phase 4
Joint tabletop
Exercise
• Introductions
• Project Status
• BCMP – Sustainment and
Continuous Improvement
overview
• How to develop a BCP
Exercise
• Tabletop Exercise
• Exercise de-brief and Q&A
• Next steps with project
Below are the agenda’s for each workshop
133
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase1
Calgary INBCP
Kick-Off
134
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Sample Kickoff Meeting Agenda
Date/time:
Location:
Agenda:
1. Introductions
2. Background and overview of project
3. Introduction of business continuity planning concepts
4. Project structure and timelines
5. Project participation options
a. Business continuity training and program development
b. Assessment and enhancement of existing business continuity program
c. Integration of business continuity strategies
d. Tabletop exercise
6. Overview and timelines of training program
7. Q&A
8. Training session sign-up
135
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Agenda
• Introductions
• Project background and overview
• Introduction of business continuity management program concepts
• Recent BCP activation by a CSP member
• Project structure and timelines
• Project participation options
• Next steps
• Q&A
• CEMA update
• Initial assessment of CSP project participation options (handout)
136
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Vision & Mission
Vision
• A sustainable framework for business continuity planning is
established for the non-profit sector that provides an integrated,
collaborative, and inter-sectoral approach for non-profit organizations
to develop strategies to ensure continued service delivery during and
after a large scale emergency or disaster.
Mission
• To provide coordinated business continuity planning support and
resources for non-profit organizations and to collaborate with
participating members to build capacity for business continuity
through an integrated, inter-sectoral approach.
137
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Objectives
• Participating organizations receive support, through workshops
and one-on-one third party consultant expertise, to complete a
business continuity plan
• Participating organizations are provided with an opportunity to
establish shared continuity strategies with other participating
organization
s
• The project model of business continuity planning support will
be to inform the development of a sustainable strategy and
collective impact model for business continuity planning support
across the non-profit sector
• Ensure this project is aligned with current municipal response
framewor
ks
138
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Work Plan
• United Way RFP (April 1, 2018 – April 30, 2019)
• Creation of a steering committee
• Survey of Critical Service Providers on status of their Business Continuity
Program
• Initial Critical Service Provider meeting in June
• Identification of Business Continuity Program needs
• Development of an RFP – MNP was the successful candidate
• Official Kick off meeting – November 21
• Trainings and One-on-One Coaching
• Asset Mapping
• Tabletop
• Explore options for the long term sustainability of the project
139
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Steering Committee Members
• carya – Committee Chair
• Boys and Girls Club of Calgary
• The City of Calgary
• Distress Centre
• Federation of Calgary Communities
• United Way of Calgary and Area
• Woods Homes
140
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Recent BCP Activation – Example
• A representative from an agency provided an overview of a
recent business disruption and what they learned
• Friday October 5
th
, 2018
o 9:30am- small fire breaks out in server room, causing smoke to flow
throughout agency and is quickly extinguished
o 9:40am- building evacuated
o 10:30am- entry back into building but need to shut down operations to
do work in the server room- emergency operations plan is triggered
o 11:00am-9:00pm- initial response and recovery work
o 9:00pm- all services are back online
141
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Recent BCP Activation – Example learnings
• What helped us
o We have amazing staff who wanted to help
o We have an Emergency Operations Plan
o We have MOU with partners for service delivery transfers
o We have a lot of partnerships flow through our contact centre work and they care
o We are improving our technology infrastructure
o The community is there for our agency and follows our social media
o HOWEVER………
• Preparing for the next disruption
o Important to have clear defined roles and responsibilities that make sense
o Need an Emergency Operations Plan that can work at an operational level and be accessible
o Need to further enhance and safeguard our technology infrastructure
o Need to ensure our physical space is safe
142
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Approach
• Follow industry best practices and standards i.e. Canadian
Standards Association (CSA Z1600)
• Align with municipal emergency response planning and
business continuity programs (e.g. AEMA, CEMA)
• Training, framework document and templates provide a basi
s
for agencies to develop their own BCP
• Leverage existing Agency plans
• Needs and timing will be determined on an agency to agency
basis with BCP Consultant
143
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Guiding Principles
• Create a simple process for BCP development and
maintenance
• Efficient and practical for the agency, requires minimal effort
Keep it simple
• Each agency will be responsible for owning and maintaining
their BCP
Agency owned
• A BCP Consultant will support agencies and offer a
consistent approach for development and maintenance
Facilitated approach
• Commitment from all levels within the organization
• BCP becomes part of people’s job
• Maintenance built into process
Sustainable
144
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 2 - Training Workshop Outline (2 hrs)
• Details of Business Continuity Planning concepts
• How to develop a Business Continuity Plan
• How to determine critical processes in time of disaster
• Techniques to gather info to complete the BCP
• Things to consider in developing a Business Continuity Plan for
critical processes (high level)
• Techniques to gather info to complete your BCP
• Next step
s
• Q&A
145
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 3 – BCP Development Workshop Outline
(3 hrs)
• Introduction and walkthrough of the Business Continuity
Management Program Framework and BCP template
o Each Agency to complete information they are able to as we go through
the template
o Identify take away items that require follow up
• Small group activity – discuss BCP template and identify
techniques to complete follow up items
• Group discussion of challenging areas
• Next steps
• Q&A
Phase 2 - Training Workshop Outline (2 hrs)
• Details of Business Continuity Planning concepts
• How to develop a Business Continuity Plan
• How to determine critical processes in time of disaster
• Techniques to gather info to complete the BCP
• Things to consider in developing a Business Continuity Plan for
critical processes (high level)
• Techniques to gather info to complete your BCP
• Next step
s
• Q&A
146
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 4 – Tabletop Exercise Outline (3 hrs)
• BCP Overview and Training
o Methodology
o Planning Scenario
o BCP Activation
o BCP Simulation Exercise
• BCP Exercise Objectives
o Scenario overview
o Walkthrough of draft BCP (plans can be in progress)
• Plan updates
o How to incorporate gaps and lessons learned
• Maintenance
• Q&A
147
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Participation Options
• Agency: ______________________________
• Name: ______________________________
• Which parts of this project does your agency wish to participate in?
• Select all that apply (can be updated at any time):
q A. Phase 2 Workshop - Participate in Business Continuity Training Session (3 hours)
• Which date will you attend ___ Dec. 12 ___ Jan. 17
• Who will be attending the session: __________________________________
q B. Phase 3 Workshop - Business Continuity Program and Plan Development (3 hours)
q C. Phase 3
Workshop - Cross-agency session to review strategies, asset mapping and
identify opportunities for integration and resource sharing (2 hours)
q D. Phase 4
Workshop - Tabletop cross-agency exercise (3 hours)
q E. One-on-one support from BCP Consultant as required throughout project (4 hours)
This form was used to
determine participants
interest in each phase
of the project
148
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Next Steps
• Send any existing BCP or related documentation to:
o BCP Consultant contact information
• Complete CSP member Project Participation Option handout
• Is there anything missing?
Putting It All Together
Focus on your business, people,
processes, technology and
brand/reputation protection throughout
response and recovery
149
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 2
Training, Risk
Assessment & BIA
150
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop 2 Meeting Agenda Example
Date/time:
Location:
Agenda:
• Details of Business Continuity Planning concepts
• How to develop a Business Continuity Plan
• How to determine critical processes in time of disaster
• Techniques to gather info to complete the BCP
• Things to consider in developing a Business Continuity Plan for critical
processes (high level)
• Techniques to gather info to complete your BCP
• Next steps
• Q&A
151
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Agenda
• Introductions
• Project Overview
• Business Continuity Management
• Business Continuity Management Program (“BCMP”) and
Business Continuity Plan (“BCP”) Development
• Individual and Group Work – Risk Assessment and BIA
• Next Steps
• Q&A
• Individual questions with BCP Consultant
152
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop Objectives
• Provide additional training around Business Continuity
Management Program concepts
• Give each participant the confidence and tools to gather
information and begin to draft a Business Continuity Plan for
their agency, starting with the Risk Assessment and Busine
ss
Impact Analysis
153
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Training
154
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Introductions
• Name
• Position / Responsibilities
• Agency
• Size of your team
• Business Continuity maturity
• Were you at the kick-off meeting on [date]
• What are you hoping to gain from this session?
155
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Objectives
• Reduce the impact of business disruptions
o Through careful advance planning of key services
o Through identification of time-sensitive services and business functions, along with
their supporting resources (cost-effective and practical)
• Ensure rapid availability of management decision-making capabilities
• Ensure timely communication – internal and external
• Preserve reputation
• Mitigate risk and financial exposure
• Increase citizen confidence
• Maintain key relationships
Ø KEEPS YOUR SERVICES GOING
Ø SUPPORTS THE CITY AND CITIZENS
156
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Lifecycle and Components
1. Governance
• Develop enacting policy
•Define program structure & management
• Set goals and objectives
2. Risk Assessment & BIA
• Analyze your business
• Assess the risks
• Complete a Business Impact Analysis
(BIA)
3. Plans and Procedures
• Emergency Procedures and Plans
• Crisis Management Plan
• Crisis Communications Plan
• Business Continuity Plan
• IT Disaster Recovery Plan
4. Sustainment
• Training and Awareness
• Exercise
• Maintenance
• Program Audit & Review
• Post-Incident Review
Based on
CSA-Z1600
Standards
Separate
workbooks will
include details on
each Component
157
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Component - Governance
• Build an overall program that will align plans and resources vs. individual
plans in isolation
• Develop enacting policy
o Obtain management commitment and authorization to ensure appropriate support
and that the program is integrated, coordinated, effective and sustainable
o Formalize requirements and provide direction regarding the roles, responsibilities and
accountabilities
o Comprehensiveness of the policy can vary depending on the agency’s internal policy
systems and guidelines
• An effective policy should consider and include the following basic
elements
o Policy Statement - Goals and Objectives / Purpose
o Scope
o Roles, Responsibilities, Enabling Authority
o Budget
158
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Component – Risk Assessment & BIA
• Forms foundation for BCP development
• Help to identify, prioritize and prepare for the most damaging and/or most likely
threats and risks that an agency is exposed to
• Informs the development of programs, plans and procedures
• Aids in sequencing and ensures efforts are focused on time-sensitive services
and functions
• An effective means to articulate the value of the program to senior management
• Types of risk assessments
o Enterprise or Program Risk Assessment (RA)
o Hazard Identification and Risk Assessment (HIRA)
o Threat Vulnerability Risk Assessments (TVRA)
• Business Impact Analysis (BIA) – this is what we will be doing today
o Identify your time-sensitive, critical processes
o Critical processes require a plan to ensure they continue - the BCP
o If not performed will have a negative impact to your Agency
159
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Component - Plans and Procedures
• Below are the common plans that make up a BCMP
• Creating a BCP is the focus of this project
Emergency Response and
Management Plan (ERP)
• A documented plan usually addressing the
immediate reaction and response to an
emergency situation
Initial evacuation
Crisis Management Plan (CMP)
• The ability of an organization to manage incidents
that have the potential to cause significant
security, financial, or reputational impacts
An identified senior management team that comes
together to manage a crisis
Crisis Communications Plan (CCP)
• A document that outlines the processes an
organization will use to respond to a critical
situation that would negatively affect its profitability,
reputation or ability to operate
Internal and external Communication processes
Business Continuity Plan (BCP)
• Documented collection of procedures and
information that is developed, compiled, and
maintained in readiness for use in an incident
that enables an organization to continue to
deliver its critical activities at an acceptable
pre-defined level
The ability to continue after a business disruption
IT Disaster Recovery Plan (DRP)
• Document that defines the resources, actions,
tasks, and data required to manage the
technology recovery effort
Getting IT back up and available
Scenario Based Plans
• Built for a specific purpose / type of disruption
• i.e. Pandemic, Labour Disruption, Cyber Security
160
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Business Continuity Phases
Continuously During Disruption:
• Validate priorities during
disruption
• Confirm requirements e.g. work
location
• Confirm critical and essential
services / processes
• Execute BCP and other plans
• Communicate with stakeholders
– internal and external
At Disruption Time
• Assess to determine
BCP activation
• Determine immediate
(<24 hours) priorities
and actions
• Confirm critical
services / processes
• Communicate with
stakeholders –
internal and external
Pre-Disruption –
Mitigate, Prepare
• Program governance
• Develop plans
• Sustainment -
awareness, training
& exercise,
maintenance,
program review
Post Disruption - New
Normal, Re-imagine
• Lessons learned
• Update plans
• Ongoing program
governance
• Ongoing sustainment
activities
Disruption has ended:
• Define “new normal”
• Procedures for
transition to “New
Normal” operations
• Communicate with
stakeholders –
internal and external
Normal
Operations
Response
Recovery
Normal
Operations
Restoration
161
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
What is a BCP? What isn’t it?
ü Actionable document
ü Process List
o What needs to continue?
o What can stop?
ü Procedures
ü Resource requirements
o Work location
o People
o Technology
o Equipment
o Files/documents
ü Dependencies and contact info
o Internal
o External – other agencies, vendors
× Emergency Response steps e.g.
building evacuation
× Internal and External Communications
approach and strategy
× IT recovery
162
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Roles and Responsibilities
Larger agencies may have additional roles (i.e. Steering Committee, BCP
Manager), but this is the baseline
BCP Role Primary Responsibilities
– During BCP Development
Primary Responsibilities
– During BCP Activation
Program
Sponsor
(Executive)
• Endorse program, funding and
resources
• Support agency and BCP Lead
during disruption
BCP Lead
(Senior Manager
or Director)
• Accountable for timely and
comprehensive BCP delivery,
exercise and ongoing
maintenance
• Declare BCP activation
• Manage the agency through a
disruption
• Provide ongoing updates to
leadership
• Liaison to other agencies
Critical Staff • Provide business expertise
during BCP development,
exercise and maintenance
• Conduct critical business processes
163
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Component - Sustainment
• Training and Awareness
• For all staff, create awareness regarding the program and how the program functions
• Understand various roles and responsibilities
• For staff with designated responsibilities within the program, training will enhance the skills required to develop,
implement, maintain and execute during activation
• Exercise
• Plans are not considered complete and fully functional until they have been exercised
• Tabletop, scenario specific (i.e. building or IT outage), annually
• Ensure plans are current, relevant, functional, and continuously improving as needed
• Maintenance
• Annual maintenance is recommended
• Typically done in conjunction with an exercise
• Program Audit & Review
• Standardized audit process, based on best practices from the Institute of Internal Auditors (IIA), should include:
planning, work program, and reporting – provide program assessment
• Post-Incident Review
• Incorporate learnings from any applicable event
• Evaluate how effective a plan is and how well prepared teams are
Ø All are essential to an actionable and comprehensive program
164
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Approach to BCMP Development
• Training and Business Continuity Management Program – Framework and
Workbook” (with templates) to provide a basis for agencies to develop or update
their own BCP
o Agencies can combine plans into one document, or have separate documents
• Consultant expertise and one-on-one coaching will support individual agencies
o By phone, email or in-person
o Approximately one hour per agency after initial training
o Four hours per agency during BCP development
• Consultant review and feedback will be provided on plans as they are drafted
• Program integration across CSP’s - explore opportunities for resource sharing
and collaboration in case of a disruption
165
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
WORKSHOP –
Complete Risk
Assessment & BIA
166
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Framework and Workbook
• Framework is a “how
to guide”
• Workbooks contain
templates
• Framework and all
Workbooks will be
provided for Phase 3
– BCP Development
Workshop
Phase 3
BCP Development
Workshop
• TBD - February 12
and 26, 2019
• 3 hour workshop
• Target: CSPs who
do not have a plan
in place or plan
that is out of date
Ø Followed by one-
on-one support
from BCP
Consultant
• 4 hours / Agency
• May include cross
agency workshop
167
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
How to Develop a BCMP
BCMP Components
• Governance
• Risk Assessment & BIA (today’s focus)
1. Analyse your agency’s business
2. Assess the risks and identify mitigation strategies to address the risk
3. BIA - Identify your time-sensitive services / functions
• Plans and Procedures - make a plan
• Sustainment - exercise your plan
168
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 1: Analyse your Agency’s Business
• What is your agency’s purpose or mandate?
• What services do you provide?
• Who are your clients / who are the recipients of your services?
• Where is the primary location your organization works out of?
• What type of community support would you provide during a
disaster?
• How long could you suspend your services in an emergency?
169
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 2: Assess the Risks
• There are many natural, human-caused and technological
threats or hazards that could impact your service delivery
• What are the risks in your operating area?
• Which of these could have major impact on your agency?
170
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Risks to Service Delivery
Ø Consider a disruption to your individual organization as well as municipal emergency you would have to support
Risk to Agency Examples of Mitigation Strategies
Facilities:
Loss of work location for an extended period (up to 30 days)
• MOU - Memorandum of understanding
• Alternate work location
• Work-from-home capability
Technology:
Loss of IT systems, applications and data (up to 5 days)
• Reliable off-site data backup
• Fail-over to alternate data centre
• Cloud applications or storage of data
• Alternate phone systems
Personnel:
Loss of key staff or a large percentage of staff and/or
volunteers (up to 50%)
• Identified trained alternates for key roles
• MOU - Memorandum of understanding
External Service or Product:
Disruption affecting external provider needed to provide your
service (up to 30 days)
• Require supplier to have BCP
• Identify alternate suppliers
Community:
Disaster impacting your municipality or client group which
may change or increase the services your agency provides
(up to 30 days)
• Communication with other agencies or groups to get early notice
of situation that potentially requires service changes
171
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Develop Strategies to Address the Risks
• Avoid
o Do not engage in service or activity
• Mitigate / Reduce
o Business Continuity and other plans
• Transfer
o Insurance for potential financial loss
• Accept
o Too costly or impractical to avoid, reduce or transfer
o Or, does not exceed tolerance
172
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Assess the Risks
• Verify the risks and timeframes
• Agreement from senior management on definitions of low/
medium/ high impact for your agency
Low
Agency operations could
continue within acceptable
timeframes
Medium
Clients would be impacted by
degraded service levels, but no
injury or loss of life as a result
High
Potential for injury or loss of
life, or significant reputational
impact
173
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 3: BIA - Identify Time-Sensitive
Services / Functions
• Consider the worst case scenario
• All people and processes are important – otherwise they would
not exist
• However, not all services and processes are time sensitive
• Business continuity planning is about priority as it relates to time
• Consider services / functions that might only be done or
become more important during a community emergen
cy
• Agreement from senior management on characteristics of
essential, necessary, or valued services
• Map agency services against the impact definitions if unable to
deliver the service
174
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Business Impact Analysis (BIA)
Service or Function Name
Busy/ Peak
Timeframe
Maximum Downtime (how long can
service be down for?)
Impacts (Low/ Medium/ High) (impact if the Service does not resume after
Maximum Downtime)
< 2 days
Essential
3-5 days
Necessary
> 5 days
Valued
People –
Health and
Safety
Customer
Service
Reputation Financial Community
Support
1.
2.
3.
4.
5.
6.
7.
8.
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result
of not providing a service or performing an activity, to become unacceptable.
175
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Business Impact Analysis (BIA) – Service
Definitions
Maximum Downtime Service Definitions
< 2
days
Essential
Service
Services / function must be maintained or there would be extreme
consequences for the agency
e.g. imminent threat to, or loss of life or major/multiple injuries, major
facility damage or destruction, extreme brand and reputation impact, or
extreme monetary losses to the agency
3-5
days
Necessary
Service
Disruption would have moderate consequences to the agency and would
not threaten the provision of essential services / functions
e.g. no loss of life or injuries, moderate but recoverable brand and
reputation impact and moderate monetary losses
> 5
days
Valued
Service
The consequences are dealt with by routine operations and would have
negligible consequence to the agency
e.g. no loss of life or injuries, minimal or no reputational impact or
monetary losses
Business Impact Analysis (BIA)
Service or Function Name
Busy/ Peak
Timeframe
Maximum Downtime (how long can
service be down for?)
Impacts (Low/ Medium/ High) (impact if the Service does not resume after
Maximum Downtime)
< 2 days
Essential
3
-5 days
Necessary
> 5 days
Valued
People
–
Health and
Safety
Customer
Service
Reputation
Financial
Community
Support
1.
2.
3.
4.
5.
6.
7.
8.
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result
of not providing a service or performing an activity, to become unacceptable.
176
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Identify the Impacts
• Determine the impacts to the following if the service does not
resume after Maximum Downtime
Impacts (Low/ Medium/ High) (impact if the Service does not resume after
Maximum Downtime)
People –
Health and
Safety
Customer
Service
Reputation Financial Community
Support
177
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
INDIVIDUAL AND
GROUP WORK
178
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Individual and Group Work
Refer to Risk Assessment and BIA Workbook
• Individually: Note on the Agency Overview, and Business
Impact Analysis (BIA) worksheets where you would obtain the
information
• Short group discussion on challenges foreseen and question
s
on the process to do this
179
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 1: Analyze Your Business
Agency Overview Worksheet
• Individual activity – complete the Worksheet
Agency Name
What is your agency’s
purpose / mandate?
What services do you
provide?
Who are the clients of
this service?
What main services do you provide and what clients do you serve – internally
and externally
•
•
Regular work location Including offices, warehouses, vehicle/equipment parking, etc.
•
Community support What types of support would you provide the Community during a widespread
disaster (e.g. flood, fire, pandemic)
•
Service suspension How long could you suspend your services in an emergency?
•
180
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 2: Assess the Risks - Agency Risk
Assessment
• Individual activity – complete the Worksheet
• For each risk, rate the impact it would have on your agency if it were to occur
Agency Name: Impact Levels to Agency
Risk to Agency
Low
Agency
operations could
continue within
acceptable
timeframes
Medium
Clients would be
impacted by
degraded service
levels, but no injury
or loss of life as a
result
High
Potential for injury
or loss of life, or
significant
reputational impact
Rationale and Risk Mitigation Strategy
Facilities: Loss of work location for an extended
period (up to 30 days)
Technology: Loss of IT systems, applications and
data or other technology (up to 5 days)
Personnel: Loss of a large percentage of staff
and/or volunteers (up to 50%)
External Service or Product: Disruption affecting
external provider needed to provide your service
(up to 30 days)
Community: Disaster impacting your municipality
or client group which may change or increase the
services your agency provides (up to 30 days)
Other Risk? (specify)
181
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Step 3: Business Impact Analysis (BIA)
• Individual Agency activity – complete the Worksheet
Maximum Downtime - the time it would take for adverse impacts, which might arise as a result
of not providing a service or performing an activity, to become unacceptable.
Service or Function Name
Busy/ Peak
Timeframe
Maximum Downtime (how long
can service be down for?)
Rationale (for maximum downtime)
Consider impacts to: People, Operations,
Reputation, Financial, Community Support
< 2 days
Essential
3-5 days
Necessary
> 5 days
Valued
182
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Group Discussion
Challenges foreseen
and questions on the
process to do this
183
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 3
BCP Development
184
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop 3 Meeting Agenda Example
Date/time:
Location:
1.Details of Business Continuity Planning concepts
2.How to develop a Business Continuity Plan
3.How to determine critical processes in time of disaster
4.Techniques to gather info to complete the BCP
5.Things to consider in developing a Business Continuity Plan for
critical processes (high level)
6.Techniques to gather info to complete your BCP
7.Next steps
8.Q&A
Agenda:
185
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop Objectives
• Provide guidance on development of Business Continuity Plan
and related documents
• Give each participant the confidence and tools to gather
information and begin to draft a Business Continuity Plan for
their agency, building on previous Risk Assessment and
Business Impact Analysis
186
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Workbook “How to Guide”
• The Workbook is an information
guide on the how to build a
comprehensive BCMP, tailored for
CSP’s
• Expands on the information provided
in the Risk Assessment workbook
previously provided
• Provides assistance in how to
complete the plans
187
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Plans & Procedures
• Emergency Response
• Crisis Management (focus of this workshop)
• Crisis Communications (focus of this workshop)
• Business Continuity (focus of this workshop)
• IT Disaster Recovery
• Scenario Based
All are important
• BCMP Workbook contains guidance and templates for development
of all these plans & procedures:
• Based on material your agency already has, and risks foreseen,
determine the priority for developing or revising each plan type
188
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Plan Structure
• Templates provided reflect the suggested plan structure for small to
medium sized not-for-profit agencies
• Separate documents for:
o Emergency Response Procedures
o Business Continuity Plan, including sections for Crisis Management Plan and
Crisis Communications Plan
o Scenario-based Plans (business continuity specialty plans)
o IT Disaster Recovery Plan
• The templates show a format and topics and provide some
sample wording
• They must be heavily customized to meet the needs of your
Agency
189
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Roles and Responsibilities (BCP Section 2.2)
Role Usually filled by Responsibilities
BCMP Sponsor /
Crisis Management
Lead
An Agency
Executive
• Represent the Program at the Executive / Board level
• Lead execution of the Crisis Management Plan
Crisis Management
Team
Small group of
Agency
Executives
and/or
Management
• Manage affairs on behalf of the Agency during a business
disruption
Communicator Agency
Communications
Lead
• Develop specific communication plan for a disruption
BCP Lead Senior Manager
or Director
• Ensure Business Continuity Plan (BCP) is developed, updated
and exercised
• Direct response and recovery efforts
Technology Advisor Senior technical
staff or manager
• Provide expert IT advice to Crisis Management Team and/or
BCP Lead
Critical Staff Regular staff
roles
• Implement Essential and Necessary services / functions
recovery procedures and manual contingencies, as required
190
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCMP Documents (BCP Section 2.2)
Document Name Document / Section
Owned By
Description
ERP - Emergency Response
Procedures
Crisis Management Lead
Details the Agency’s immediate response to various
emergencies.
BCP - Business Continuity Plan (combined plan containing CMP, CCP and BCP elements)
CMP - Crisis Management
Plan Section
Crisis Management Lead
/ BCMP Sponsor
The CMP outlines effective and timely communications
between the entity and all stakeholders’ impacts by an event or
involved during response and recovery efforts.
CCP - Crisis
Communications Plan
Section
Communicator
Governs internal and external communication during each
phase of a crisis, disruption and emergency.
BCP - Business Continuity
Plan Section
BCP Lead
Procedures and information to enable the Agency to continue
to deliver its Essential Services (continue within 2 days) or
Necessary Services (continue within 5 days) at an acceptable,
pre-defined level during a business disruption or emergency.
IT DRP - IT Disaster
Recovery Plan
Technology Advisor
Defines the resources, actions, tasks, and data required to
manage a technology recovery effort.
191
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
BCP Template Contents
1. Document Information
2. Overview
3. Business Impact Analysis (BIA)
4. Crisis Management Plan (CMP) Element
5. Crisis Communications Plan (CCP) Element
6. Business Continuity Plan (BCP) Element
7. Appendices
Note: for several area’s, suggested wording is provided, but must
be adjusted to reflect your agency’s situation
192
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
1. Document Information
Contains:
• Document Contact Information
• Vital Business Information
• Document Objectives
• Document Control
To be completed on your own after the workshop
193
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
2. Overview
Contains:
• Agency Overview (from training session – Risk Assessment)
• Roles and Responsibilities (suggested wording provided)
• BCMP Document Summary Table (complete after documents
are created)
194
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
3. Business Impact Analysis (BIA)
Contains:
• Business Impact Analysis (BIA) (from training session – Risk
Assessment)
195
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
4. Crisis Management Plan
Contains:
• Overview (wording provided)
• Crisis Management Team (begin completion today)
• Crisis Management Checklist (wording provided, adjust)
• Disruption Assessment Worksheet (provided in template
Appendix)
• Disruption Status Summary and Actions (provided in template
Appendix)
196
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
4. Crisis Management Plan
Workshop – 20 minutes
1. Read section 4 of template (3 pages)
2. Insert names and their regular titles against each of the Crisis
Management Team roles in section 4.2 (confirm this with your
executive and insert contact info after you are back at your
office)
3. Adjust procedures or timing to be realistic for your agency in
the Crisis Management Checklist (section 4.3)
4. Review Disruption Assessment Worksheet (Appendix A1) and
Disruption Status Summary and Actions (Appendix A3)
197
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
5. Crisis Communications Plan
Contains:
• Objective (wording provided)
• Roles & Responsibilities (begin completion today)
• Stakeholders (wording provided, adjust)
• Media & Social Media Strategy (wording provided, adjust)
• Messaging (wording provided, adjust)
• Media Holding Statement (wording provided, adjust)
• Develop Communications Plan (wording provided, adjust)
• CCP - Communications Plan and Log (provided in template
Appendix)
198
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
5. Crisis Communications Plan
Workshop – 15 minutes
1. Read section 5 of template (2 pages)
2. Insert names and regular positions against each role in
section 5.2 (confirm this and insert contact info after you
are back at your office)
3. Adjust Stakeholders and methods of communication to be
realistic for your agency (section 5.3)
4. Look at sections 5.4 and 5.5 in Example BCP, (To be
completed with/by Communicator after the workshop)
5. Review “Communications Plan and Log” format in Appendix A4
199
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
6. Business Continuity Plan
Contains:
• Overview (wording provided, adjust)
• Planning Assumptions (adjust for your agency)
• Risk Assessment and High-level Strategy (copy info from your Risk
Assessment worksheet from Training session)
• Business Continuity Action Lists (wording provided, adjust)
• Business Continuity Resource Requirements (headings provided, to be
completed)
• Post-Disruption Review (process provided in template appendix)
• Scenario Based Plans (format provided in template appendix to record any
specialty BCPs your Agency has)
• Local Emergency Information Reference Sites (several provided in
example BCP; add/delete sites to reflect your agency’s needs)
5. Crisis Communications Plan
Workshop – 15 minutes
1. Read section 5 of template (2 pages)
2. Insert names and regular positions against each role in
section 5.2 (confirm this and insert contact info after you
are back at your office)
3. Adjust Stakeholders and methods of communication to be
realistic for your agency (section 5.3)
4. Look at sections 5.4 and 5.5 in Example BCP, (To be
completed with/by Communicator after the workshop)
5. Review “Communications Plan and Log” format in Appendix A4
200
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
6. Business Continuity Plan
Workshop – 60 minutes
• Review/adjust sections 6.1 and 6.2 (Overview and Planning
Assumptions) of template
• Review/adjust Action Checklists (section 6.4)
• Begin completion of Resource Requirements (section 5.5);
finish completion back at your office
201
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Techniques to gather info to complete the BCP
• Refer to Agency documents
• Previous BCP’s, notes/documentation/lessons learned from
past events
• Consult with senior Agency members to get guidelines and
validate intermediate draft
s
• Short 1-on-1 interviews (in person or on the phone) or meetings
with executive group
• Talk to a BCP representative from another CSP Agency
• Ask BCP Consultant
202
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Next Steps
• Complete Training Survey
• Gather information and complete Business Continuity Plan for
your agency
o Contact BCP Consultant for questions or to schedule 1-on-1 session at
your agency
o Submit the completed BCP to BCP Consultant by end of March for
review and feedback
o You will use your BCP when participating in the Tabletop Exercise in
April
203
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Phase 4
Exercise
204
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Workshop 4 Meeting Agenda Example
Date/time:
Location:
Agenda:
1. Introductions
2. Project Status
3. BCMP – Sustainment and Continuous Improvement overview
4. How to develop a BCP Exercise
5. Tabletop Exercise
6. Exercise de-brief and Q&A
7. Next steps with project
205
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Objectives
• Explain the BCMP Sustainment and Continuous Improvement
component, specifically exercises
• Provide framework of how to design and conduct an exercise
• Participate in an actual exercise, allowing you to test the
usability of your Business Continuity Plan
206
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Project Status
As of June 17, 2019
• 17 agencies supported
• In-person meetings or facilitated sessions with 10 agencies
• BCP’s reviewed one or more times for 10 agencies
• 4 rated as ‘good’ (Comprehensive content and plan is executable)
• 3 rated as ‘improvement possibilities’ (Fairly comprehensive and
executable, with some areas where improvements could be made)
• 3 ‘rated as gaps’ (Significant gaps in content or ability to execute the plan)
207
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Types of Exercises
Exercise Type Description Strengths Weaknesses
Tabletop
• Narrative walkthrough and confirmation of the plan, where a
facilitator explains a scenario and asks participants to discuss
their response.
• Meeting room format: can be achieved through a slideshow,
panel discussion, or a facilitated walkthrough of a scenario.
• Small time commitment for
planning and executing
• Very few resources required
• Simpler preparation
• Basic teaching tool, good for an
introduction to a BCP
• Artificial approach
• Measures process, but not
necessarily capability
• Does not highlight the decision-
making process
Simulation
• More intensive and involved form of exercise
• Attempts to replicate real world conditions (e.g. making phone
calls or sending messages, activating alternate work sites,
testing IT workarounds, and involving other stakeholders
required to execute continuity strategies).
• More care and attention must be made to ensure that anyone
contacted realizes that this is only a test.
• Immersive; places participants in
near real-world setting
• Can test not only procedures but
also participant capability
• Large time commitment, for
planning and executing
• Resource intensive
• Can be safety and logistical
issues
Hybrid
• Combination Tabletop and Simulation
• Meeting room format, but includes some simple simulations
(e.g. phone calls, emails, access to computer systems)
• Combines strengths of Tabletop
and Simulation
• Medium time commitment for
planning and executing
• No in-depth capability testing
Work from Home day
• This can be pre-announced or unannounced
• Assume primary work location is not available and all staff will
work from home for the day
• Test all systems and access to required information
• Builds and tests remote-working
ability
• This only tests the loss of facility
risk
208
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
How to Exercise your BCP
1.Define the exercise objectives: Examples
o Validate recovery strategies
o Validate plan contents
o Test plan usability
o People with roles in BCP execution understand their role and BCP information
available to them
209
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
How to Exercise your BCP con’t
2. Design the exercise: Based on defined objectives
o Appoint: An exercise facilitator to build out the details of the exercise and lead the
exercise
o Type: Tabletop (walkthrough), Simulation (includes some test activation e.g. phone
calls to resources, access to information via computer) or Hybrid
o Scenario: Pick one that can produce results to meet all exercise objectives
o Impact: Imagine how the scenario would affect your organization (Loss of work
location? Reduced staffing? Technology outage?)
o Expected Actions: What actions do you anticipate from the scenario as it
progresses? Should be aligned with protocols in your plans
210
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Example Scenarios
• Spring/Fall Storm
o Similar to “Snowtember”
o Would entail power outages, transportation disruptions and have a multi-day impact
• Flood
o Would entail parts of the City being inaccessible and have a multi-day and multi-
agency impact; staff shortages, power outages, transportation disruptions, building
inaccessibility
• Technology outage
o Internet outage - Drastic impact to internet infrastructure impacts business email,
computer systems, internet-based phones
§ Possible cause is an event such as building fire, cable cut during nearby construction, solar
storm
o System outage – Would entail a loss of your computer systems – applications and
data
§ Possible cause is a cyber security breach or server failure
• Loss of People – Infectious Disease or Pandemic
o Would entail a loss of your staff and volunteers
211
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
How to Exercise your BCP con’t
3.Conduct exercise
o Book location/facilities
o Invite participants
o Conduct exercise and document the results on Scenario Event List
4.Evaluate results
o During and Immediately after exercise: review results against objectives, what
went well and improvements possible for future exercises.
o Summarize results, identifying areas in the BCP or CMP to improve
o Document gaps and schedule follow-up actions and owners
212
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Example:
Scenario Event List
Scenario Event List - BCP Exercise X - Date:
Seq.
#
Time From To Description
Expected
Actions
Actual Actions
Gaps
(Yes/No)
Notes Owner
1 900
Exercise
Facilitator
Exercise
Participants
Participants gather in designated
exercise area. Exercise briefing
provided.
Consensus Consensus No None n/a
2 930
Exercise
Facilitator
Exercise
Participants
Exercise Kick Off. Scenario -
Tornado touchdown in SE Calgary.
Consensus Consensus No None n/a
3 935
CMT
Member
Crisis Mgmt
Team, BCP
Lead,
Communicator
CMT Member(s) or delegates
conduct assessment to determine
impact to Agency, determine BCP
Activation is required
Activate BCP
Activation of BCP,
unclear roles
Yes
Confusion regarding
who was responsible
for this, review in BCP
Joanne
Black
4 945
Communic
ator
Exercise
Participants
Communicate to all required
stakeholders
Comms lead
to identify and
contact
stakeholders
Wasn’t able to identify
who needed to be
contacted and their
contact info
Yes
Ensure contact lists are
up to date, and key
stakeholders identified
Autumn
Red
213
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Roles and Guidelines
Facilitator
• Leads the exercise, provides details of the scenario, inject points to consider, and help finalize
decisions or assumptions
• Record gaps and findings
• In order to meet all objectives we may “parking lot” issues or actions not directly related to the
exercise
Participants
• Participate!
• Don’t focus on the scenario details
o The focus is not the validity of the scenario details
• The intention is to walkthrough a scenario and understand the components of an exercise and how
effective your plan is for use in a disruption
• Make decisions and assumptions to move the scenario along
• Discuss inter-agency dependencies and expectations
• Success of this exercise is dependant on your participation and your honest and open responses
214
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Tabletop Exercise Objectives
• You are NOT expected to actually contact anyone outside the
room, just react to the scenario as it unfolds as you would given
your knowledge and contents of your BCMP plans.
• Exercise Objectives:
o Give you a feel for what an exercise would look like for your agency
o Give you experience and content to be able to run your own exercise
o Validate agency plans (make note of required changes throughout
exercise)
o Increase familiarity of people involved in BCP activation with their role
and resources available
215
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Now the Fun Begins!
216
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
The Scenario
EVENT: Day 1, Monday, June 17 - Now
• It is Monday afternoon, June 17 (today), everything
is moving normally for your organization
• A fire alarm is activated in your main building and it
is evacuated
• You are offsite attending a meeting
• Are you notified?
• What do you do in the next 30 minutes?
• Who do you contact and how?
Actions
Create a scenario to
match the risks / concerns
of your Agency
217
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Scenario Update
Day 1: Monday, June 17 - 30 mins later
• Fire crews are onsite and indicate this is
not a drill
• There has been a fire in your primary
operating building and you are not
getting back in today
• Your Site Supervisor calls you to notify
you of this situation
• Your Emergency Response Plan was
activated
218
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Actions
• How will you react to this?
• Do you activate your BCP?
• What is your role?
• Who do you contact and how?
• Do you contact your City of Calgary non-profit organization liaison?
• Do you have everything you need with you?
The actions should follow
the flow and contents of
the plan you are testing
219
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Scenario Update
Day 1: Monday, June 17 – 2 hrs later
• Fire crews confirm there are no people
remaining in the building
• Building Manager indicates there has
been building damage along with
residual smoke smell
• You are not getting back into your main
building for approximately 3-5 days
• At least one of your essential services
are impacted
220
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Actions
• Do you activate your BCP? How do get to your plan?
o What about the Crisis Management Plan element?
• Who fills the roles?
o Crisis Management Lead and Team, Communicator, BCP Lead, Technology Advisor,
other?
• Who do you need to communicate to?
o Executive, clients, other agencies, staff, volunteers
• How will your plans be communicated and to whom?
• Have your essential and necessary services been impacted?
• How are you prioritizing what you need to resume?
• What services will you be suspending?
• What actions do you need to take to resume your essential and necessar
y
services?
• Who and what do you need for those services (staff, facilities, IT, Phone re-
routing, Vital Records, Other)?
221
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Scenario Update
Day 2-3: Tues – Thurs, June 18-20
• Clean up crews are working in the building
• No further issues are identified
• Still expected to be back in your building Friday
• Who do you need to continue to communicate to?
o Executive, clients, other agencies, staff, volunteers
• What are your Response and Recovery efforts?
Actions
222
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Scenario Update
Day 4: Friday, June 21 - morning
• Building is given the all clear you are able to return to
your building
• What are your next steps to stand-down your activated BCMP plans?
• What do you need to do to restore normal service?
Actions
223
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Tabletop Exercise Debrief – Evaluate Results
• Were the tabletop exercise objectives met?
o Give you a feel for what an exercise would look like for your agency
o Give you experience and content to be able to run your own exercise
o Validate agency plans (make note of required changes throughout exercise)
o Increase familiarity of people involved in BCP activation with their role and resources
available
• Were the expected actions taken?
• Suggestions for improvements to the conduct of the exercise
• Make note of changes you feel should be made to your plans based on
this exercise
o What information is missing?
o Were people clear on roles and responsibilities?
• When you return to your agency:
o Schedule and complete follow-up actions
o Determine if an Agency specific exercise is required
224
Non-Profit BCMP Toolkit | Calgary’s Integrated Non-Profit Business Continuity Project (INBCP) - Project Material
Next Steps
• Complete Training Survey
• Review the revised/final Workbook, with particular emphasis
on components 1 and 4
• Update your Plan based on results of this exercise
Non-Profit BCMP Toolkit | Completed 2021 | [email protected]