Business continuity plan
maggiejChapter 15: policies and procedures
Policies and procedures
Well-crafted policies and procedures can guide employees by explaining to them how to best support organizational recovery efforts.
Policies and Procedures not intended to replace instructions in DR/BCP
They are to provide need support
policies
General statement of direction that provide employees guidance in the shared goal of supporting the organizations’ mission
Have following characteristics:
Present a high-level statement affecting a large part of the organization
Provide general guidance on the appropriate action
Change infrequently
Tell the “what” and/or “why”
Address major operation issues
Define the goal to be achieved
procedures
Specific instructions on how to perform an activity
Have following characteristics:
Present a detailed statement affecting a specific part of the organization
Provide detailed instruction on the appropriate action
Can change frequently
Tell the “how” and/or “who”
Address a particular process
Define the specific result to be achieved.
Creating and managing policies and procedures
Policy authority and responsibility
Policy creation and approval process
Organization and format
Implementing policies
Policy maintenance
Determining what needs a policy
Policies reinforce what’s important to the organization
Benefits of a well-crafter policy:
Ensuring regulatory compliance
Providing consistency in operations
Preventing ambiguity about how to handle certain situations
Promoting harmony in the workplace
Managing risks
Establishing a basis for continuous improvement
Providing legal protection
Business continuity planning policy
BCP Policy Introduction
BCP Policy Scope
BCP Policy History
BCP Policy
Identify Critical Resources and Processes
Create a BCP
Maintain and Test the Plan
Training
BCP Policy Authority
Policies that may affect disaster recovery
Attendance policy
Sick leave policy
After-hours entry policy
Payroll policy
Work-from-home policy
Vacation policy
Employee Assistance Program (EAP) policy
Records destruction and data retention policy
Social media policy
Purchasing policy
summary
Policies and procedures are a critical component of the recovery effort
They provide the guidance needed that is not specifically covered in the DR/BCP
All policies should be reviewed on a regular basis