Business Continuity Policy

Policy Statement

Our organisation is committed to ensuring the safety of our staff and the continuous delivery of services to our clients, even during a major operational disruption. This policy outlines our framework for preparing for, responding to, and recovering from emergencies. It applies to all employees, premises, and core business operations.

Core Business Continuity Objectives

In the event of an emergency or business interruption, our priorities are to:

1. Ensure the immediate safety and wellbeing of all employees and visitors.
2. Protect critical business data, assets, and infrastructure.
3. Maintain communication with clients, key suppliers, and partners.
4. Recover core business operations within 24 hours of the incident.

Identification of Critical Functions

To keep the business running, we have identified our most time-sensitive, critical functions that must be recovered first:

• Client Communication & Support: Maintaining active phone, email, or digital channels.
• Financial Operations: Processing payroll, receiving client payments, and paying critical suppliers.
• Service Delivery / Project Management: Accessing project files and software to fulfil active contracts.

Disruption Scenarios & Mitigation Strategies

Scenario A: Loss of Workplace / Premises (e.g., Fire, Flood, Power Outage)

• Immediate Strategy: The physical office will be closed, and all staff will immediately pivot to a pre-arranged remote working model.
• Controls:
  • All staff are issued laptops capable of connecting securely to work systems from home.
  • Essential contact details for utility providers and building management are kept off-site by the Business Continuity Lead.

Scenario B: Loss of IT Systems or Cyberattack (e.g., Ransomware, Cloud Outage)

• Immediate Strategy: Isolate affected devices from the network and switch to cloud-native backups or alternative communication channels.
• Controls:
  • All critical business data is hosted in secure, cloud-based environments (e.g., Microsoft 365, Google Workspace) with automatic, daily off-site backups.
  • Multi-Factor Authentication (MFA) is strictly enforced on all accounts to prevent unauthorized system takeovers.

Scenario C: Severe Staff Shortage (e.g., Widespread Illness, Key Personnel Loss)

• Immediate Strategy: Reallocate tasks based on cross-training and postpone non-essential business projects.
• Controls:
  • Core administrative and operational tasks (e.g., invoicing, customer service, system access) are documented in a central “Standard Operating Procedures” folder.
  • At least two employees are trained to handle critical financial and client management workflows.

Roles and Responsibilities (Incident Response Team)

When a disruption occurs, specific individuals are responsible for managing the recovery process:

• Business Continuity Lead: Rob Quinn
  • Responsibility: Declares an official business continuity event, coordinates the overall response, and makes final operational decisions.
• Communications Coordinator: Karen Gray
  • Responsibility: Contacts staff to give working instructions, updates active clients regarding delays, and notifies key suppliers or insurers.

Emergency Contacts & Communication Log

A digital and physical copy of the “Emergency Contact Log” must be securely stored off-site and accessible by the Incident Response Team. This log must contain up-to-date phone numbers and account details for:

• All active employees (personal mobile numbers and emergency contacts).
• Key IT vendors, software hosts, and internet service providers.
• Commercial insurance brokers and claims hotlines.
• Primary business bank and merchant service providers.

Policy Testing and Maintenance

This policy is a living document. To ensure it remains effective, our business will:

• Review and update all contact details and supplier lists every six months.
• Conduct a basic “desktop simulation exercise” once a year, where management talks through a hypothetical disaster scenario to test response times and identify gaps in the plan.