Policy
Business Continuity Management
Policy
About this document
Disclaimer
For Department of Conservation (DOC) internal use only .
Document
D
rew Coleman, Senior Advisor, Risk Management
Coordinator
Document
Graeme Ayres, Director, Business Assurance
Owner
Approved for
Rachel Bruce, Deputy Director-General, Corporate Services (Acting)
use by
Date: 20/02/2020
Effective date
20/02/2020
Last reviewed
20/02/2020 (please check this document within two years to ensure it is up-
to-date)
Classification
IN-CONFIDENCE
docCM ID
doc-1313310
link to page 3 link to page 3 link to page 3 link to page 3 link to page 3 link to page 3 link to page 4 link to page 4 link to page 4 link to page 5 link to page 6 link to page 9 link to page 10 link to page 13 link to page 13
Contents
1.
Background
2
1.1
Purpose
2
1.2 Scope
2
1.3 Audience
2
1.4 Introduction/Context
2
1.5 Objectives
2
1.6 Guiding principles
3
1.7 Mandate
3
1.8 Statement of Governance
3
1.9 Terms and definitions
4
2.
Critical Functions and Critical Services
6
3.
Roles and responsibilities
9
4.
Policy statements for Business Continuity
10
5.
Related documents
12
6.
Document history
13
1.
Background
1.1
Purpose
This Policy ensures the Department is clear about Critical Functions and Critical Services required for
minimum business operability. This policy defines the way in which the organisation will approach
business continuity and how the Business Continuity Management programme will be structured and
resourced.
1.2
Scope
This Policy describes the strategic direction from which the business continuity programme is
delivered. The business continuity programme is to be rolled out across the Department beginning
with governance roles and executive level business continuity plans for Critical Functions and Critical
Services.
This Policy sets out the Governance structures and roles and responsibilities required to maintain
minimum business operability.
Minimum business operability covers the Critical Functions and Critical Services that the Department
of Conservation provides to staff, contractors, key stakeholders, and customers in an emergency or
disruption to business. These Critical Functions and Services are owned by Deputy Directors-General
who are accountable for the delivery of the Critical Function or Critical Service.
1.3
Audience
This Policy applies to the Senior Leadership Team, and specifically to Deputy Director s-General with
accountability for Critical Functions and Critical Services. Directors with responsibility for delivering
the function or service through their business group must ensure the Policy is understood by their
staff.
1.4
Introduction/Context
Business continuity management is critical to responsible business management practice and is an
integral part of DOC’s approach to risk management. Effective management of risk in this context will
develop a more resilient organisation to threats and business disruption events.
This policy is aligned with the Business Continuity Institute [BCI] ‘good practice guidelines’, which
follows the global standard ISO 22301:2012 Societal Security, Business Continuity Management
Systems requirements. It is also supported by protective security best practice .
1.5
Objectives
Implementing this policy will:
- Demonstrate a commitment toward Business Continuity activities as a core assurance
function for the Department.
- Document senior leadership commitment towards long-term and comprehensive business
continuity planning within DOC.
Business Continuity Management Policy – doc-1313310
2
IN-CONFIDENCE
- Identify governance structures and accountability for the development, implementation,
monitoring, review and ongoing maintenance of Business Continuity Management.
1.6
Guiding principles
The business continuity policy provides the intentions and direction of the Department as formally
expressed by the Executive.
Business continuity:
o is an integral element in DOC’s risk management and protective securities processes.
o is embedded into the culture of the organisation through structured and resourced Business
Continuity practices.
o requirements are considered while developing new business initiatives, and where business
partners are involved in the delivery of critical functions or critical services.
The ‘Team Process’ leadership and decision-making methodology underpins the process of Business
Continuity planning (see
Team Process guidelines for managers (docdm-1521828) and
Team Process
Intranet page).
1.7
Mandate
The mandate for this policy originates from legislation governing the management of business
continuity and government protective security requirements.
-
The New Zealand government
Protective Security Requirements for Governance
(GOV03 –
Prepare for business continuity) require agencies to:
o Maintain a business continuity management programme, so that your organisation’s
critical functions can continue to the fullest extent possible during a disruption. Ensure
you plan for continuity of the resources that support your critical functions.
- The
Civil Defence Emergency Management Act 2002, Section 58
Every department must:
o ensure that it is able to function to the fullest possible extent, even though this may be
at a reduced level, during and after an emergency:
o make available to the Director in writing, on request, its plan for functioning during
and after an emergency.
The State Services Commission, Department of the Prime Minister and Cabinet and Officials
Committee for Domestic and External Security Coordination (ODESC) require central government
agencies to prepare business continuity activities to support Ministers from an Auckland base during
significant disruption to government business.
1.8
Statement of Governance
Policy Accountability
The Deputy Director-General, Corporate Services, accepts Single Point Accountability for
implementing this Policy. Accountability includes:
- resourcing and budget for the Business Continuity programme of work.
- monitoring and measuring indicators of implementation of this Policy.
Business Continuity Management Policy – doc-1313310
3
IN-CONFIDENCE
- monitoring progress of Executive Business Continuity Plans associated with the Critical
Functions and Critical Services identified in this policy.
Critical Function & Service Accountability
Individual DD-Gs have accepted accountability for Critical Functions and Critical Services within
parameters of their role as identified in this Policy.
System Custodian
The Business Assurance Unit is custodian of this Policy and the associated Busine ss Continuity
framework.
1.9
Terms and definitions
Term
Definition
The capability of the organisation to continue delivery of products or
Business
services at acceptable pre-defined levels following a disruptive
Continuity
incident.
A holistic management process that identifies potential threats to an
organisation and the impacts to business operations those threats, if
Business
realised, might cause, and which provides a framework for building
Continuity
organisational resilience with the capability of an effective response
Management (BCM)
that safeguards the interests of its key stakeholders, reputation,
brand and value-creating activities.
Business
Documented procedures that guide organi sations to respond, recover,
Continuity Plan
resume, and restore to a pre-defined level of operation following
(BCP)
disruption.
Business
The ongoing management and governance process supported by top
Continuity
management and appropriately resourced to implement and maintain
Programme
business continuity management.
An event that has an adverse effect on the delivery of the critical
Business
functions of an organisation. It may be an acute, creeping or
Disruption Event
sustained event.
Business Impact
The process of analysing activities an d the effect that a business
Analysis (BIA)
disruption might have upon them.
Processes and activities which, if interrupted, will cause an
organisation to lose the capability to deliver on its objectives, and as
Critical Function
a result suffer serious financial, legal, reputational, or other damages
or penalties.
Beneficial outcomes provided by an organisation to its customers,
Critical Services
recipients and interested parties.
Disaster Recovery
A disaster recovery plan documents how informatio n technology (IT)
Plan
systems would be recovered in the event of a disaster.
A situation that might be, or could lead to, a disruption, loss,
Incident
emergency or crisis.
Business Continuity Management Policy – doc-1313310
4
IN-CONFIDENCE
Maximum
The time it would take for adverse impacts, which mig ht arise as a
acceptable outage
result of not providing a product/service or performing an activity, to
(MAO)
become unacceptable.
Maximum tolerable
The time it would take for adverse impacts, which might arise as a
period of
result of not providing a product/service or performing an activity, to
disruption (MTPD)
become unacceptable.
Minimum Business
The minimum level of services and/or products that is acceptable to
Continuity
the organisation to achieve its business objectives during a
Objective (MBCO)
disruption.
Protective
An all-of-government policy framework that when implemented,
Securities
provides pathways for successfully protecting people, information and
Requirements
assets.
The ability of an organisation to absorb and adapt in a changing
Resilience
environment.
Coordinated activities to direct and control an organi sation with
Risk management
regards to risk.
An exercise whose aim is to obtain an expected, measurable pass/fail
Test
outcome.
Business Continuity Management Policy – doc-1313310
5
IN-CONFIDENCE
2.
Critical Functions and Critical Services
Critical Business Functions
Maximum
Maximum
Minimum Business
Critical
Business
Tolerable
Why is it important?
Acceptable
Continuity
Function
Group
Period of
Outage
Objective
Disruption
Ensure all staff can
DOC is reliant on
access core business
workable ICT solutions
critical
for everyday tasks and
T
G
communication
1 day
1 week
C
S
I
C
for maintaining
services
minimum business
functions.
external
dependency?
Ensure safety of DOC
Alternative
1 month
6 months
owned
buildings.
accommodation
ytr
e
G
Provide alternative
p
S
or
C
work accommodation
Alternative office
P
2 weeks
3 years
for staff to resume
space
normal operations.
t
Until the
d
n
l l
n
e
a
next pay
o
m
Average fortnightly
r
e
e
To support our people
1 day
y
l
g
date
a
p
pay is provided
a
P
o
e
g
P
n
(1-14 days)
E
s
e
Working capital
t
l
n
b
a
Maintain working
u
v
G
60 days
90 days
o
i
S
Money due may not be
c
e
C
capital
c
c
recovered
A
e
R
Ministerial advice is
Advice to the DG,
provided that at least
Minister, other
1 day
1 week
meets Minister’s
agencies and
s
minimum
e
Operations on:
ci
expectations.
v
r
e
G
S
S
Policy or statutory
l
C
a
implications of
Policy & Legal advice
g
e
L
decisions made in
is provided to SLT
1 day
1 week
response to an event,
during response &
and on DOC’s Critical
recovery
Functions.
Business Continuity Management Policy – doc-1313310
6
IN-CONFIDENCE
National DOC radio
Wellington and
N
/A
2 weeks
e
network
Auckland are
r
a
focussed on to
w
d
Dependent on external
r
restore service.
Cell phones
a
G
infrastructure
H
S
s
C
External response
m
m
and recovery
o
N
/A
Satellite phones
3 days
C
agencies rely on
DOC radio network.
Consideration of
g
ni
emergency authorities
s
s
or consents from the
Consents required
e
c
o
DG of Conservation or
for remediation of
r
s
1 day
1 week
p
p
Minister of
roading, buildings etc
t
O
n
e
Conservation that may
under the RMA.
s
n
be needed for a
o
C
response.
t
n
Ensure H&S of staff
&
e
e
Maintain DOC’s H&S
l
m
impacted by the event,
p
e
g
1 day
3 days
H&S
o
system
e
a
and during response
g
P
n
E
and recovery efforts.
t
g
n
n
&
e
Ensure wellbeing of
i
Maintain DOC’s
e
el
m
b
e
staff impacted by the
1 day
3 days
l
p
l
o
g
Wellbeing system
e
e
a
g
event.
W
P
n
E
Onboarding of
temporary staff for
t
n
response and
e
m
recovery.
e
g
a
g
Assessment of
n
1 week
1 month
Maintain HR system
HR
E
allowances.
& elp
Dispute resolution.
o
e
P
Relocations due to
disruption.
Critical Business Services
Maximum
Maximum
Minimum Business
Critical
Busines
Tolerable
Why is it important?
Acceptable
Continuity
Service
s Group
Period of
Outage
Objective
Disruption
s
t
e
n
l
Maintaining obligations
u
b
G
90 days
3 periods
o
a
S
c
y
C
to Debtors
c
a
A
P
Business Continuity Management Policy – doc-1313310
7
IN-CONFIDENCE
Focussed on
Maintaining key
accounts and
Contractors critical to
contractors
the recovery of
60 days
2 periods
associated with
business systems or
response and
activities
recovery efforts
t
DOC website, social
n
s
e
Internal communication
1 day
1 week
media, and the DOC
m
m
e
to staff
m
g
intranet
o
a
g
C
n
&
E
a
DOC website used to
i
&
d
e
External
e
l
p
1 week
1 month
indicate safe sites
M
o
communication
e
for public access
P
Service Standards
st
n
e
Minimising risk to
m
Provision of
s
s
engineering
public
e
s
s
s
assessment services,
a
90 days
8 months
Closure of huts
p
g
O
and asset planners for
nir
data relating to
Closure of bridges
e
e
inspection
n
and structures
i
g
n
E
Closure of tracks
Business Continuity Management Policy – doc-1313310
8
IN-CONFIDENCE
3.
Roles and responsibilities
This Policy applies to all DOC staff responsible for, or involved in, the delivery of DOC’s critical
functions and services.
All staff members: Must be familiar with the [policy subject] principles and apply them to their
day-to-day activities as necessary.
Managers and team leaders: In addition to their usual responsibilities, staff members must
provide support and guidance to assist staff and contractors to follow the policy.
Directors: If responsible for delivery of a Critical Function or Critical Service must develop a
Business Continuity Plan that meets agreed MAO, MTPD, & MBCO as stated in this policy.
Deputy Directors-General [SLT collective]:
- Must agree on the Critical Functions and Critical Services detailed in this Policy;
- Must ensure Delegations of Authority are formalised for their Tier 1 or Tier 2 roles, and
maintained at all times;
- Must own the relevant Function or Service as appropriate within their role and span of
control; and
- Must agree to champion business continuity activities with the Department.
Deputy Director-General, Corporate Services
- Accountable for the coordination and strategy of Business Continuity within the Department;
- Promotes compliance with Business Continuity policies, SOPs and guidelines; and
- Final approval and policy sign-off.
Business owner – Director, Business Assurance
- Responsible for the implementation of Business Continuity Management System including the
supervision of appropriate documentation, training, testing, monitoring and reviewing of the
Business Continuity Framework.
Senior Advisor Risk Management:
- Manages, maintains and advises on DOC’s Business Continuity Management practices and
activities.
- Over-sees the Business Continuity (Senior) Advisor / Coordinator.
Business Continuity (Senior) Advisor/Coordinator [Not funded]:
- Contributes towards improving the process by which business continuity planning is
organised and maintained within DOC.
- Ensures that business continuity planning for individual units or sites is consistent and does
not contradict or undermine other plans.
- Ensures current practice is aligned with Business Continuity standards and good practice.
Business Continuity Management Policy – doc-1313310
9
IN-CONFIDENCE
4.
Policy statements for Business Continuity
Business Continuity Management [BCM] Governance
Governance for business continuity primarily focuses on:
-
Ensuring the Policy is approved.
-
Supervision; support and resourcing of the business continuity framework.
-
Ensuring the Business Continuity framework aligns with the Department’s objectives and
strategic risks.
-
Planning for business disruption events to minimise impacts.
Threat and Risk Assessment
-
Critical functions and critical services are assessed with an all-risks approach to business
disruption.
-
DD-G’s assess the specific risks to maintaining their critical functions.
Business Impact Analysis
The Business Impact Analysis (BIA) is critical to DOC’s business continuity planning. It identifies the
roles, facilities and systems required to support key processes for Critical Functions or Services,
including interdependencies between business areas and external providers.
Business Continuity Plans
This Policy requires DOC to have an overarching Business Continuity Plan for Critical Functions and
Critical Services. This Policy defines the following for each Critical Function and Critical Service:
-
Maximum Tolerable Period of Disruption [MTPD]
-
Maximum Allowable Outage [MAO]
-
Minimum Business Continuity Objective [MBCO]
Business Continuity planning ensures the continued delivery of Critical Functions or Services
identified in the Policy in the event of a disruption or emergency. These plans consider the impact of
all risks and identify the options to increase resilience for critical functions and to minimise
disruption to the Department.
Business Continuity Management Testing
DOC Business Continuity Management arrangements are tested to ensure that they continue to meet
business requirements. The Business Continuity test programme is coordinated and maintained by the
Business Assurance Unit.
External Providers
When engaging with external providers, DOC staff always consider both the nature and scale of the
service being provided, and the level of assurance required from providers for contingency planning.
This must be included in the contract conditions and deliverables when contracting for services
regarding continuity of essential services.
Business Continuity Management Policy – doc-1313310
10
IN-CONFIDENCE
Business Continuity Documentation and Records
The following documentation and activities form the essential elements of DOC Business Continuity
management:
-
Business Continuity Management Policy
-
Exercising and testing plan
-
Business Impact Analyses
-
Maintenance and review schedule
-
Risk Assessments
-
Internal audit and/or external review
-
Business Continuity Plans
-
Instrument of Delegation
Documentation Controls
Controls are established over the Business Continuity documentation to ensure:
-
documents are approved for use by the appropriate DD-G prior to their issue (this is
coordinated by Business Assurance as custodian of the Business Contin uity Framework).
-
documents are reviewed, updated and re-approved as required by the Business Rules
Framework.
-
all DOC business continuity documentation is discoverable from a central file within the
document management system.
Auditing Business Continuity Management
Periodic internal or external audit of the status of DOC’s system of Business Continuity management
and associated documentation will be undertaken against Business Continuity standards.
Maintaining this policy
Keeping this policy up to date is the responsibility of the Deputy Director-General, Corporate Services,
and a review of this policy is to be undertaken every two years.
Business Continuity Management Policy – doc-1313310
11
IN-CONFIDENCE
5.
Related documents
DOC Business Continuity Planning
Business Continuity Management policy
docDM-1313310
Legislation
The Civil Defence Emergency Management Act 2002,
Section 58
External Standards
ISO 22301:2012 Societal Security, Business Continuity Management Systems – requirements
AS/NZS 5050:2010; Business continuity – Managing disruption-related risk
Protective Securities Requirements
Related DOC publications
Risk Management Policy
doc-2224884
Research and analysis to support DOC Business Continuity planning
doc-2968865
2017-18
Register of Corrective Actions 2017
doc-3089707
Conservation House Critical Emergency Plan
doc-5463211
Hamilton/Kirikiriroa Critical Emergency Plan in the event of a large
doc-2956380
Wellington earthquake
Risk Leadership Guideline
doc-2901864
Team Process guidelines for managers
docDM-1521828
Business Continuity Management Policy – doc-1313310
12
IN-CONFIDENCE
6.
Document history
Document ID and
Date
Details
Amended by
revision number
10/02/2014
First draft - unpublished
docDM-
1313310
Carolyn
revision 1
Ramsay
01/07/2014
Second draft - unpublished
docDM-1242481
Leah Watts
4/08/2017
First version for publication
doc-
1313310
Nicki Stevens
- unpublished
revision 15
06/09/2019
Updated Policy for approval
doc-
1313310
Drew Coleman
revision 16
20/02/2020
Approved Policy
doc-1313310
Drew Coleman
revision 25
12/03/2020
Urgent update in the context
Doc-1313310
Drew Coleman
of COVID-19 to reflect the
Revision 28
need for Delegations of
Authority for T1 and T2
roles.
Additions to:
- Chapter 3 – Roles
and Responsibilities.
- Chapter 4 – BC
Documentation and
Records
Business Continuity Management Policy – doc-1313310
13
IN-CONFIDENCE
