SAMPLE DISASTER CONTINUITY / RECOVERY PLANNING

OUTLINE

A most-often-neglected invisible border--that provides continuous operations

security for any business--is one that also surrounds and protects the local
economy of a city or town. It's the border that provides a shield every
corporation or SMB should construct...by creating a "Business Continuity
and Disaster Recovery Plan" (BCP). And, as fiduciary managers of your
business, all stakeholders in your company require it of you.

As Americans discovered, following the Attack on America, you don't have

to live and work in a city attacked by terrorists, to suffer economically and
otherwise by the after-effects of such an attack. Taking it a step
further...what would you do if your facilities, IT, business units,
communications systems, and/or entire staff were suddenly unavailable?

Ask yourself, if a major disaster or pandemic flu took out your ability to run
your business, would you be capable of getting up-and-running immediately?
Within 24 hours or less? 48 hours? 72 hours? Or, ever? Today's global
business climate demands that most businesses be available 24/7--at least on
the cyber-level, if not through its physical infrastructure.

The Institute for Business and Home Safety has established that 43% of all
businesses involved in local disasters never reopen. Of those who reopen, an
additional 29% are gone within two years...because they did not establish a
business continuity and disaster recovery plan.
(SOURCE: IBHS)

THE PURPOSE OF A BCP:

TO GET YOUR BUSINESS UP-AND-RUNNING AS QUICKLY AS

POSSIBLE, FOLLOWING A DISASTER -- WHETHER NATURAL OR
MAN-MADE.

If time or staff is limited--or your company just needs guidance to get you on
the right tract--consider engaging a BCP consultant to assist with project
planning, testing, updating and maintenance. At Business Continuity - BCP,
we provide inventory and analysis of your existing human and physical
infrastructure to evaluate and determine your crucial Business Continuity
Planning needs.

A BC plan is a dynamic instrument that, once complete, must be consistently

updated and maintained, over time. But rewards, for effort expended, can be
tremendous in the face of a natural or man-made catastrophe.

Today, we live and work in a fast-paced, risk prone environment. It

necessitates facilitation of business continuity and disaster recovery planning
in order to protect your investment of time, talent, effort, and resources. In
turn, it helps our economy thrive in the good times...and survive during
difficult periods.

To do this, you must analyze and assess all potential risks to--and impacts
upon--your business that could possibly shut you down. Depending on
circumstances, the risks could include a tornado, hurricane, flash flood, fire,
earthquake, power blackout or power spikes, terrorist attacks, a biological
epidemic, or other disasters.

Determine what you can do to provide added protection to your own

business. Consider what needs to be done to protect your employees, their
families, and the economy of your community.

After all, why take chances that--in spite of all your brilliant efforts--your
company could permanently close due to a natural or man-made disaster
such as a blizzard or ice storm, a chemical spill, or a cyber attack.

A "BC" plan is not meant to be overblown. Not every element needs to be

completed at one time. Nor does every element (below) need to be in a plan.
Begin with the segments that best suit your immediate needs. Then, over
time, fine-tune and improve on the model. Finally, test and evaluate, and
maintain your plan at least on an annual basis.

THE BCP OUTLINE, BELOW, IS ONLY MEANT TO BE A GUIDE.

THERE ARE A NUMBER OF WAYS TO ESTABLISH A PLAN. THIS IS
ONE EXAMPLE. CONTACT US IF YOU NEED ASSISTANCE IN
BUILDING OR COMPLETING YOUR OWN PLAN.

HERE ARE YOUR COMPLIMENTARY FOUNDATION BASICS--IN

OUTLINE FORM--TO CONSIDER WHEN YOU OR YOUR BUSINESS
CONTINUITY TEAM, OR CONSULTANT ESTABLISHES A BC PLAN:

FREE SAMPLE BCP OUTLINE:

A. INDEX

B. STATEMENT OF MISSION

What objectives do you wish to accomplish? Be specific

C. MANAGEMENT ENDORSEMENT LETTER

You must gain management endorsement to have a successful plan

D. Part I - STANDARD DISASTER RECOVERY POLICIES

1. Introduction
a. The full scope and objectives of the plan
b. Project background description

2. Establish Key Personnel & Form Emergency Teams

a. EMT - Emergency Management Team (Including HR)

b. DAT - Damage Assessment Team (Including Security)

c. SMT - Senior Management Team

d. BURs - Business Unit Representatives

3. Form / Negotiate Joint-Powers Agreements

e. External Vendor Contacts, Agencies , & Community Reps

1. Upstream & Downstream Suppliers

2. Police, Fire, EMTs, Public Health

3. FBI, CDC, and other Government Agencies

4. Assign Damage, Emergency and Other Team Responsibilities

a. SMT - Senior Management Team

b. EMT - Emergency Management Team (Including HR)

c. DAT - Damage Assessment Team

d. Various Business Unit Team &/or Union Leaders

e. Key Emergency Contacts

1. Fire, Police, Medical

2. Suppliers / Vendors

3. CDC, FBI, Public Health, etc.

5. Internal and External Risk Analysis

a. Internal Risks (Natural & Man-made)

b. External Risks (Natural & Man-made)

c. IT & Physical Security Risks

d. Employee / Family / Community Risks (Including Bio-Chem)

6. Define Various Disaster Possibilities

a. Disaster Types (Natural & Man-made)

b. Projected / Anticipated Losses

1.Severity (Consider Bio Epidemic)

2. Overall Impact (Consider Govt.-imposed Quarantine)

7. Business Impact Analysis (BIA)

a. Business Unit Operations

b. Information Systems /Telecommunications

c. Physical & Human Infrastructure

d. Home Office / Regional & Satellite Operations

8 Disaster Mitigation Programs / Security Analysis

a. Standard Operational Analysis

b. Special Mitigation Programs for Staff / Families / Community

9. Disaster Mitigation, Recovery & Relocation Strategies

a. Specific Type Event Mitigation (Include Bio-Chem)

b. Critical Information Recovery Process

c. Employee, Operations Relocation Process (Include Bio-Chem)

1. Hot or Cold Sites

2. Mirroring IT operations

3. Home-office Options, etc.

a. Consider "Shelter-in-Place" Possibilities

1. On-Site / Off-Site

2. Govt. Commandered Facilities (for Bio-event)

d. Health exams / physical exams (if necessary for Bio-event)

1. Include Exec and Staff Travel Overseas

2. Include Temp and Loaned Employees

e. Business Recovery/Continuity Activities (Include Bio-Chem)

1. Consider Home-office / Supplies benefits

2. Consider Wireless Laptops & Various Comm Devices

10. Employee & Community Awareness and Training Programs

a. Meetings / Workshops for Employees, Families, Community

b. Emergency Team Training (Include C.E.R.T. program)

c. Employee Training Programs

d. Other Training Activities (Include C.E.R.T. program for Community)

11. Disaster Response & Recovery Programs (Including Restoration)

a. Immediate Crisis Response Programs (Include Employees, Families,

Community)
1. Determine Employee / Families Condition

2. Joint-powers Govt. / Private Agency Contacts

3. Initiate Insurance Followup / Coverage

4. Creditor Contacts

5. Employee Disaster Benefits / Supplies

6. Community Contact & Assistance

b. Internal / External Damage Assessment Programs

c. Prioritize Salvage & Cleanup Needs

1. Consider possible decontamination (from Bio-Chem)

d. Immediate to Long-Term Recovery Operations

1. Vendor / Supplier / Customer Contacts

2. Maintain or Reestablish Web Presence

e. Facility / Equipment Restoration Programs

12. Documentation & Update Schedule for the Plan

a. Policies / Procedures / Forms for Documentation

b. Required Documentation Format for Company & Agencies

c. Update Authority / Requirements / Timing /

13. Distribution List & Policies / Procedures (Consider Proprietary

Confidentiality)
a. Distribution Policies

b. Distribution Procedures

14. BCP Testing Schedule

a. Testing Polices / Procedures

b. Calendar

15. Plan Maintenance Policies & Schedule

a. Policies and Procedures to Maintain BCP

b. Updating / Maintenance Calendar

16. Budget & Funding Procedures

a. Policies and Procedures

b. BC Plan Budgeting / Controls

c. Financial Records

17. Key Records, Assets, & Other Inventory

a. IT / Mission Critical Data (Include Web Presence for Customer/Vendor

Contact)

b. Paper vs. Digital Data / Records

c. Communication Networks / Systems

1. Consider Wireless & Walkie-Talkies for Human Rescue

and/or Asset Coordination

2. Consider "Carrier-class" Communications Outsourcing

a. Employee / Families / Community Notification

b. Key Customer / Vendor / Supplier Notification

d. Security & Building Infrastructure

e. Key Customer Lists / Data

f. Mission-Critical Machinery

18. Inventory Needs

a. Create "emergency stock" levels or maintain just-in-time levels

b. Determine automated / robotic vs. human input / control

19. Furniture, Office Equipment

a. Recovery vs. Restoration

b. Decontamination

20. Office vs. Manufacturing / Warehouse Space

a. Recovery vs. Restoration

b. Decontamination

21. Insurance Needs

a. Human & Physical Infrastruture

b. Workman's Comp

21. Recovery of Voice, Data, & Other IT Systems

a. Data vs. Tele-Communications Recovery Questions / Solutions

b. Physical Comm-Equipment Infrastructure Recovery Questions / Solutions

d. Unique Comm-System Recovery Questions / Solutions

E. PART II - RESPONSE / RECOVERY& RESTORATION NEEDS

1. Introduction

2. Emergency Teams & Key Employee Responsibilities

3. Planned / Anticipated Response & Recovery Strategies / Guidelines

4. Emergency Declaration Guidelines

a. Staff Members Authorized to Declare a Disaster

1. Include at Least 3 Tiers

b. Criterion for Disaster Declaration

5. Expected Recovery Time-Frames (hours to days)

a. 1-3 Hours From Notification (Immediate Priority)

b. 4-12 Hours From Notification (Mid-level Priority)

c. 13-24 Hours After Being Notified

d. 25-72 Plus Hours After Being Notified

1. Consider Bio-Chem Quarantine That Could Heavily Affect Human

Infrastructure / Productivity / Customer Service

6. Specific Actions / Responsibilities For Disaster Response

a. Initial Assessment of Disaster / Damage

b. Crisis Management in Place (Emergency Operations Center)

c. Employee Evacuation or Shelter-in-Place

d. Assess Physical Infrastructure Damage

e. Mitigation of Circumstances

f. Prioritize Response

g. Additional Response

1. Families / Community Assistance

2. Disaster Supplies Distribution

7. Specific Response for Disaster Recovery Activities

a. Prioritization of Response / Strategies Enacted

b. Telecomm & IT Systems Recovery Response

c. Staff Shelter-in-Place / Quarantine / Relocation and/or Reactivation Response

d. Reactivate Business Process According to Set Priorities / Available Resources

e. Recovery of Business Units (prioritized by Recovery Plan Stratagies)

f. Cut Losses Decision Time

8. Specific Recovery Actions - Restoration of Infrastructure

a. Prioritize Response

b. Restore Business Units Process

c. Reactivate Communications / IT / Web Systems

d. Employees Allowed to Return to Facilities (or Not)

e. Business Unit Restoration Plans (based on Restoration Activities)

9. Post-Recovery Activities

a. Review BCP (Plan vs. Actuality)

b. Update BCP (Based on Lessons Learned or New Information)

F. Appendices

1. Disaster Emergency Teams

2. Disaster Recovery Teams

3. Key Suppliers / Vendors

4. Communications Service Provider & Outsourcing

5. Disaster Supply Houses

6. Insurance Policies & Brokers

7. Creditor Contacts

8. Key Valuable Customers / Clients

9. Special Emergency Forms for Human / Physical Infrastructure

10. Restoration / Recovery Support Agreements

11. Disaster Supply Checklists

12. Joint-Cooperative Agency & Private-sector Agreements

13. Glossary / BCP Terms