Corporate Business Continuity Plan · FM BCRP FM Business Continuity Recovery Plan Accommodation...

54
CoM Corporate Business Continuity Plan - DM # 4104731 v6 1} Corporate Business Continuity Plan ** FOR FIRST ACTIONS TURN TO PAGE 7** Version: January 2010

Transcript of Corporate Business Continuity Plan · FM BCRP FM Business Continuity Recovery Plan Accommodation...

CoM Corporate Business Continuity Plan - DM # 4104731 v6 1}

Corporate Business Continuity Plan

** FOR FIRST ACTIONS TURN TO PAGE 7**

Version: January 2010

CoM Corporate Business Continuity Plan - DM # 4104731 v6 2}

DOCUMENT CONTROL

Version Control

Document Name CoM Corporate BCP Document Status Distributed Document no. and version 4104731v5 Date Revised 21/10/08 Author xx Authorised By xx Reference Documents Refer to page 6

Change History

All changes to the Business Continuity Plan (BCP) must be approved and authorised by the City of Melbourne (CoM) Risk Management Team. When any part of this document is amended new pages covering the affected section(s) must be forwarded to all Divisions – specifically the Branch Managers and the Business Continuity Coordinators. The record below is to be completed by the person making the amendment(s). Each new page will have a DM reference and version number and date of issue printed on it. Minor modifications do not require a new version of the document to be issued.

Revision No.

DM Ref, incl version

Issue Date

Pages Amended

Amended by Approved by

3 4104731 30/11/07 Contacts Page xx xx 4 4104731 30/06/08 12 xx xx 5 4104731 21/10/08 Contacts List, p36 xx xx

Distribution – Hard Copy

Issued To Issue Date Position/s All Branch Managers and Business Continuity Coordinators

21/12/07 -

All Branch Managers and Business Continuity Coordinators

21/10/08 See Appendix E, Contact List (pp48-51)

Distribution – Soft Copy

Soft copies of the BCP are stored at the Risk Management web page at http://comweb/AboutUs/Divisions/ChiefExecutiveOffice/GovernanceServices/RiskManagement/Pages/BusinessContinuityPlanningandManagement.aspx

Issued To Issue Date Position/s Executive Management Team July 07 CEO, Directors & Branch Managers

Business Continuity Coordinators July 07 See Appendix E, Contact List All Branch Managers and Business Continuity Coordinators

21/12/07 -

All Branch Managers and Business Continuity Coordinators

21/10/08 See Appendix E, Contact List (pp48-51)

CoM Corporate Business Continuity Plan - DM # 4104731 v6 3}

CONTENTS

EXECUTIVE SUMMARY 4

1. ACRONYMS, DEFINITIONS & REFERENCE DOCUMENTS 5

1.1 Acronyms 5 1.2 Definitions 5 1.3 Reference Documents 6

2. FIRST ACTIONS 7

2.1 In the event of an organisational/local emergency affecting CoM operations 7 2.2 In the event of a municipal emergency affecting CoM operations 8

3. INTRODUCTION 9

3.1 Business Continuity Plan (BCP) Purpose 9 3.2 BCP Process 11 3.3 Predetermined BCP Activities 13 3.4 Planning Assumptions 14

4. BCP IN CONTEXT 15

4.1 Risk Management Framework 15

5. BCP RECOVERY ROLES 17

5.1 Business Continuity Roles & Responsibilities 17

6. KEY THREAT SCENARIOS 22

7. INCIDENT LOGS 23

APPENDIX A – KEY THREATS 24

A1. LOSS OF ACCESS TO A BUILDING: Flow Chart 26 A1. LOSS OF ACCESS TO A BUILDING: First Actions 27 A1. LOSS OF ACCESS TO A BUILDING: Impacts and Recovery Strategies 29 A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: Flow Chart 32 A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: First Actions 33 A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: Impacts and Recovery Strategies 35 A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: Flow Chart 37 A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: First Actions 38 A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: Impacts and Recovery Strategies 40 A4. LOSS OF STAFF (NON PANDEMIC): Flow Chart 42 A4. LOSS OF STAFF (NON PANDEMIC): First Actions 43 A4. LOSS OF STAFF (NON PANDEMIC): Impacts and Recovery Strategies 44

APPENDIX B - Incident Log template 45

APPENDIX C - Staff member reporting illness during an influenza pandemic 46

APPENDIX D - Staff Absenteeism Influenza Pandemic Register template 48

APPENDIX E - CoM Notification Form: Suspected Influenza at Work 49

APPENDIX F - CoM Communication & Information Systems Outage Protocols 50

APPENDIX G - Contact List 51

APPENDIX H - Facilities Management BCRP Accommodation Strategy 52

APPENDIX I - CoM Crisis/Issues Management Flowchart 53

APPENDIX J - CoM Essential Service Matrix 54

CoM Corporate Business Continuity Plan - DM # 4104731 v6 4}

EXECUTIVE SUMMARY

Business continuity planning is the act of anticipating and preparing for incidents that could affect critical service delivery functions and processes for the organisation, in order to respond to incidents in a planned and rehearsed manner. The City of Melbourne (CoM) has a single Business Continuity Plan (BCP) that aims to provide a cost-effective means of: - preventing or minimising the impact of incidents capable of disrupting business operations; - ensuring that branch/work areas can respond to unavoidable disruptions; and - ensuring a smooth and rapid restoration of normal business operations after a disaster. The corporate BCP details the CoM‟s response in the event of business disruptions as a result of the following four loss scenarios: - loss of access to a building; - loss of communication and/or information systems; - loss of staff due to an Influenza Pandemic; and - loss of staff (non pandemic). Flowcharts, first actions, impacts and recovery strategies associated with disruptions arising from these four loss scenarios are detailed. The BCP also details the roles and responsibilities of the Crisis Issues Management Team, Director of Corporate Services, Director of Sustainability and Regulatory Services, Branch Managers, Business Continuity Coordinators and the Risk Management Team. The corporate BCP is linked to a number of Business Continuity Recovery Plans (BCRPs) that are tailored for each branch/work area. It is critical that these BCRP‟s are exercised or rehearsed in accordance with the BCP. The BCRPs are based on the four defined loss scenarios and are tailored for each branch/work area. The BCRP‟s contain details from previously completed Business Impact Analysis (BIA) Self Assessments. These assessments quantify the disruptive impact of a given incident or disruption and identify the infrastructure and resources required to enable the branch/work area to operate at the minimum accepted level. The BCP is closely aligned with the: - Business Information Systems Information Technology Disaster Recovery Plan (IT DRP), which

includes a compilation of resource requirements for all critical branch/work areas and may need to be called upon in the event of the BCP being invoked; and the

- Facilities Management (FM) Business Continuity Recovery Plan Accommodation Strategy specifies FM‟s role in identifying, coordinating and advising of alternate recovery and work locations for all CoM branch/work areas in the event of an emergency or crisis.

As part of the BCP development, branch/work areas responsible for essential service delivery that must be maintained during an emergency or crisis have been identified. Relevant templates, protocols and contact lists are contained in the Appendices. The BCP is to be reviewed on an annual basis by the Risk Management Team. In addition, the BCP and accompanying BCRP‟s will be tested and developed in annual scenario testing exercises.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 5}

1. ACRONYMS, DEFINITIONS & REFERENCE DOCUMENTS

1.1 Acronyms

CoM City of Melbourne CIMT Crisis Issues Management Team CIMM Crisis Issues Management Manual BCP Business Continuity Plan BIA Business Impact Analysis BCRP Business Continuity Recovery Plan BCC Business Continuity Coordinator MEMP Municipal Emergency Management Plan MERC Municipal Emergency Response Coordinator MERO Municipal Emergency Resource Officer MECC Municipal Emergency Coordination Centre MEMPC Municipal Emergency Management Planning Committee BECO Building Emergency Control Organisation EMT Executive Management Team BIS Business Information Services, CoM IT Information Technology IT DRP Information Technology Disaster Recovery Plan FM Facilities Management Team, Property Services, CoM FM BCRP FM Business Continuity Recovery Plan Accommodation Strategy EM Emergency Management HR Human Resources PC Personal Computer CEO Chief Executive Officer LM Lord Mayor DLM Deputy Lord Mayor DM Document Management CH1 Council House 1, 200 Little Collins St CH2 Council House 2, 240 Little Collins St TH Town Hall, Swanston St SCC Security Control Centre

1.2 Definitions

Municipal Emergency A „Municipal‟ Emergency is an emergency that affects an area contained within the defined boundaries of the City of Melbourne, which becomes active at the request of the Municipal Emergency Resource Officer. Organisational/Local Emergency An Organisational or Local Emergency is a significant interruption that solely affects the business continuity of one or more City of Melbourne Work Areas.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 6}

1. ACRONYMS, DEFINITIONS & REFERENCE DOCUMENTS cont...

1.3 Reference Documents

Document DM # CoM Business Continuity Policy 4127154 CoM Business Continuity Plan (this document) 4104731 List of CoM BCRPs 4113910 List of CoM BIAs 4113910 BIA template 4081937v2 BIA Guidelines 4081731 Essential Service Matrix 4179062 CoM Communication & Information Systems Outage Protocols 4175721 BCP Incident Log Template 41876757 Staff Absenteeism Pandemic Register 4186741 MEMP 4826908 Influenza Pandemic Action Plan (IPAP) 4308381 Crisis Management Manual 3894186 IT Disaster Recovery Plan 4508762 Facilities Management Business Continuity Recovery Plan Accommodation Strategy

Available from Facilities Management

BECO Manual Available from the Security Control Centre: Ground Floor, Town Hall

CoM Corporate Business Continuity Plan - DM # 4104731 v6 7}

2. FIRST ACTIONS

2.1 In the event of an organisational/local emergency affecting CoM operations

1. The CEO will form the Crisis Issues Management Team (CIMT) in a nominated room referred to as the Crisis Centre.

2. The CIMT will assess the extent of damage.

3. The CIMT will notify Directors and Branch Managers of the emergency and extent of damage.

4. The CIMT will reference the Crisis Issues Management Manual to determine response and recovery requirements.

5. If required, CIMT will enact the CoM Corporate Business Continuity Plan (BCP) and liaise directly with Branch Managers of affected areas.

Please note: The Director Corporate Services will play a lead role in the activation and management of the CoM BCP in the event of an organisational/local emergency, with a supporting role from the Director Sustainability & Regulatory Services.

6. Branch Managers will notify Business Continuity Coordinators (BCCs). Together they will determine the situation and its impacts to establish operational priorities and recovery processes and enact branch/work area Business Continuity Recovery Plans (BCRPs).

7. Branch Managers are required to inform the Director Corporate Services of recovery progress.

For further information regarding emergency scenarios please refer to Section 6: Key Threat Scenarios.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 8}

2. FIRST ACTIONS

2.2 In the event of a municipal emergency affecting CoM operations

1. The CoM Municipal Emergency Resource Officer (MERO) will be advised by the State Police to

enact the Municipal Emergency Management Plan (MEMP). 2. The MERO will coordinate CoM resource, response and recovery requirements as outlined in

MEMP.

3. The MERO and Security Control Centre (SCC) will assess the extent of damage.

Please note: The SCC is staffed 24 hours a day. The Duty Officer is contactable on 9658 9774.

4. The MERO will notify the Chief Executive Officer (CEO) of the emergency and extent of

damage.

5. The CEO will form the Crisis Issues Management Team (CIMT) in a nominated room referred to as the Crisis Centre.

6. The CIMT will notify Directors and Branch Managers of the emergency and extent of damage.

7. The MERO will call out appropriate resources under the MEMP Sub Plans. These resources will be located at the Municipal Emergency Co-ordination Centre (MECC).

Please note: In the event of a pandemic where mass gatherings are discouraged, the MECC may be a „virtual‟ centre operated on-line or over the phone.

Please note: In the event of loss of access to a building, Facilities Management will

enact their Business Continuity Recovery Plan Accommodation Strategy to organise alternative accommodation and resources.

Please note: In the event of loss of the data centre, data and/or communication systems,

Business Information Services (BIS) will enact the CoM Information Technology Disaster Recovery Plan (IT DRP) to restore data and communications.

8. Under the advice of the MERO, CIMT will enact the CoM Corporate BCP and liaise directly with Branch Managers of affected areas.

Please note: The Director Sustainability & Regulatory Services will play a lead role in the activation and management of the CoM BCP in the event of a municipal emergency, with a supporting role from the Director Corporate Services.

Please note: The organisation has identified essential services that it would need to recover as a priority. Please refer to Appendix G – Essential Service Matrix.

9. Branch Managers will notify Business Continuity Coordinators (BCCs). Together they will determine the situation and its impacts to establish operational priorities and recovery processes and enact branch/work area Business Continuity Recovery Plans (BCRPs).

10. Branch Managers are required to inform the CIMT of recovery progress.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 9}

3. INTRODUCTION

3.1 Business Continuity Plan (BCP) Purpose

3.1.1 Purpose of Business Continuity Planning Business Continuity Planning is the act of anticipating and preparing for incidents that could affect critical service delivery functions and processes for the organisation, to ensure that it can respond to any incident in a planned and rehearsed manner. Business Continuity Management comprises six broad elements:

- Understanding the environment in which the organisation operates, the existence of constraints and threats to the organisation that could result in a significant disruption (through conducting risk identification and assessment).

- Determining parts of the business critical to its short and long term success.

- Quantifying the disruptive impact of these threats on critical business functions and processes and identifying the infrastructure and resources required to enable the organisation to continue to operate at a minimum level (the Business Impact Analysis Self Assessment).

- Documenting the key resources, infrastructure, tasks and responsibilities, required to support these critical business functions in the event of a disruption (developing the Business Continuity Plan).

- Establishing processes that ensure the information remains current and relevant to the changing risk and business environments (through maintenance protocols and the ongoing risk management process).

- Ensuring that relevant employees, customers, suppliers and other stakeholders are aware of the continuity arrangements and, where appropriate, have confidence in their application (through annual Business Continuity Management training and testing of the plans).

Effective Business Continuity Management incorporates business resilience and sustainable performance and forms part of good corporate governance for the organisation.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 10}

3. INTRODUCTION continued…… 3.1.2 Scope of City of Melbourne (CoM) BCP The City of Melbourne has a single Business Continuity Plan (BCP) that details Council‟s response in the event of business disruption including:

loss of access to a building;

loss of communication/information systems;

loss of staff due to an Influenza Pandemic; and

loss of staff (non pandemic). The BCP is linked to a number of Business Continuity Recovery Plans (BCRPs) for each branch/work area and is based on relevant loss scenarios and previously completed Business Impact Analysis (BIA) Self Assessments for each branch/work area. Business Impact Analysis (BIA) Self Assessment & Guidelines The BIA process assists the organisation to quantify the disruptive impact of a given incident or disruption and identify the infrastructure and resources required to enable the organisation to operate at the minimum accepted level. To view a copy of the BIA Self Assessment and guidelines please refer to http://comweb/AboutUs/Divisions/ChiefExecutiveOffice/GovernanceServices/RiskManagement/Pages/BusinessContinuityPlanningandManagement.aspx Business Continuity Recovery Plans (BCRPs) Business Continuity Recovery Plans document the key resources, infrastructure, tasks and responsibilities required to enable each branch/work area‟s business to restart or continue operations in the event of an incident or disruption. 3.1.3 Objectives of BCP The objectives of the BCP process are to provide a cost-effective means of:

preventing or minimising the impact of events capable of disrupting business operations;

ensuring that branch/work areas can respond to unavoidable disruptions; and

ensuring a smooth and rapid restoration of normal business operations after a disaster.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 11}

3. INTRODUCTION continued……

3.2 BCP Process

3.2.1 Business Continuity Plan Maintenance and Communications In order for City of Melbourne to respond to an incident in a „planned and rehearsed manner‟ it is important that the Chief Executive Officer, directors, managers and staff receive annual education and training about roles and responsibilities in the event of an emergency/crisis and participate in the testing of the CoM Corporate Business Continuity Plan (BCP) and associated Business Continuity Recovery Plans (BCRPs).

The CoM recognises that business continuity planning is a continual process and as such the corporate BCP, as well as the individual branch/work area BCRPs, should be reviewed annually. Both the CoM BCP and BCRPs will need to evolve in response to ongoing changes such as:

CoM structure and business strategies;

CoM risk management strategies;

Staffing;

client needs and expectations;

services;

technology;

regulations and legislation; and

office locations. Responsibilities - CoM Risk Management Team The Risk Management Team of Governance Services is responsible for ensuring that staff awareness of business continuity is increased and that appropriate education and training is arranged. They are also responsible for the development and maintenance of the CoM Business Continuity Plan. Please refer to #4195018 for the BCP Maintenance and Communications Schedule which outlines in detail the proposed maintenance and communications activities. These include:

- managing the BIA process, including the development of the BIA template and guidelines; - supporting branch/work areas to complete the BIA; - developing the subsequent BCRPs in consultation with each branch/work area; - supporting each branch/work area in the maintenance of BCRPs; - coordinating annual BCRP test exercises; - annual training and awareness communications and workshops; - annual maintenance of the CoM Corporate BCP including updating names and contacts of

positions with a BCP role; and - annual maintenance of the Essential Service Matrix. Branch or work area Responsibility Each Branch will be required to review their Business Continuity Recovery Plans (BCRPs) annually to ensure that the information is up-to-date and recovery capabilities are accurate. This also includes ensuring that the updated BCRP is transferred onto the Branch Flash Drive when updates are undertaken or when promoted by the CoM Risk Management Team. Business Continuity Coordinator Each Branch has assigned a Business Continuity Coordinator (BCC) who is responsible for the development and maintenance of the Branch and/or work area BIA and BCRPs. In the event of an emergency the BCC will manage the pre-determined recovery process of the Branch and/or work area in association with the CoM Crisis Issues Management Team (CIMT).

CoM Corporate Business Continuity Plan - DM # 4104731 v6 12}

3. INTRODUCTION continued……

3.2.2 BCP Exercises It is a critical part of the BCP process that Recovery Plans for individual work areas and/or Branches are exercised or rehearsed in accordance with the CoM BCP, in order to:

validate the underlying planning assumptions;

identify gaps in resources and responses;

ensure that the recovery capabilities are capable of supporting the business in the event of an emergency;

train staff to ensure they are familiar with the recovery facilities, BCP Plans and management‟s expectations in an incident; and

maintain the plan‟s robustness and readiness to respond. Planned exercises range in nature from scenario-based plan walk through (desk checks), to desktop exercises and physical tests involving the recovery of systems and business processes. The Risk Management Team will work with work areas and/or Branches to coordinate BCP exercises each year.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 13}

3. INTRODUCTION continued……

3.3 Predetermined BCP Activities

As part of the CoM Business Continuity Plan development the following activities have been determined:

Essential Service Matrix The corporation has identified branch/work areas responsible for essential service delivery that must be maintained in the event of an emergency or crisis. See Appendix G – Essential Service Matrix.

Facilities Management Business Continuity Recovery Plan Accommodation Strategy In the event of an emergency or crisis, CoM Facilities Management will identify, coordinate and advise of alternate recovery and work locations for all CoM branch/work areas. Please refer to Appendix F - Facilities Management Business Continuity Recovery Plan Accommodation Strategy. Information Technology Disaster Recovery Plan (IT DRP) BIS have compiled resource requirements for all critical branch/work areas and may need to be called upon to coordinate these resources in the event of the BCP being invoked. Please refer to DM # 4176061. Information Technology Data Backups Process CoM data is backed up nightly, and is moved to an offsite location (this is currently Databank at 32 Mollison Street, Abbotsford) during the next business day. There are a number of tapes used in rotation. There is a full backup done monthly which is held offsite for 12 months. Business Impact Analysis (BIA) and Business Continuity Recovery Plans (BCRPs) All branch/work areas have completed BIAs and BCRPs. Please refer to DM # 4113910.

Director Replacement Process In the event that a Director is unable to fulfil their duty, the CEO of the CoM will coordinate a replacement to act in the position.

Location of Building Drawings Engineering/construction drawings for CoM Buildings are held with the Design Branch on Level 6, CH2. Hard copy records of older drawings and any other relevant details are stored at the Archives Building, 602 Little Bourke Street, Melbourne.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 14}

3. INTRODUCTION continued……

3.4 Planning Assumptions

The following assumptions have been made during the business continuity planning process: The incident is not a regional disaster We have assumed that the incident is not a regional disaster, eg. Earthquake. Current Business Continuity Recovery Plans (BCRPs) Branch/Work Area BCRPs are up-to-date, tested and are in place ready to be activated. Building Prevention Measures are Operating and Tested Regularly It is assumed that the buildings prevention measures are operating and tested regularly. To prevent a disaster, such as fire, occupied buildings are well protected by an automatic sprinkler system, which is fully and correctly maintained, monitored and operated.

In addition, each floor is fitted with smoke and thermal fire detectors reporting to the CoM Security Control Centre. There are hydrants and hose reels. There is only a small possibility that a fire in the building would not be detected and not dampened by a sprinkler head. In office hours the detection would be by staff and therefore it is almost certain there would be no risk of fire extending outside an area of the floor. The ability to resume operations Although the Plan is designed for the worst case, the ability to resume operations from a less serious interruption is inherent within the Plan. Lead roles during Municipal and Organisational/Local Emergencies: Municipal Emergency It is assumed that the Director Sustainability & Regulatory Services will play a lead role in the activation and management of the CoM BCP in the event of a municipal emergency, with a supporting role from the Director Corporate Services. Organisational/Local Emergency It is assumed that the Director Corporate Services will play a lead role in the activation and management of the CoM BCP in the event of an organisational/local emergency, with a supporting role from the Director Sustainability & Regulatory Services. Risk Financing and Insurance for losses Council has in place insurances and other risk financing arrangements for certain types of losses that may be incurred by the organisation. Details are maintained by Governance Services, and any claim for costs associated with consequential loss/business interruption will be made on behalf of the organisation by the Branch. For a claim to be made, details on the incident and any related losses (extra costs of working, including labour) are to be maintained by affected Work Areas. Guidance will be provided by the Governance Services Branch on any format and collection details.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 15}

4. BCP IN CONTEXT

4.1 Risk Management Framework

The CoM‟s preparedness for dealing with an emergency, crisis or serious issue is covered in four separate documents:

a) The Municipal Emergency Management Plan (MEMP);

b) The CoM Crisis/Issues Management Plan and its manual;

c) The CoM Business Continuity Plan (this document); and

d) Building Emergency Control Organisation (BECO).

When an emergency, issue or incident occurs, the appropriate treatment plan is invoked by management depending upon the nature of the issue and how quickly it is able to be managed and resolved. The disciplines of Emergency Management, Business Continuity and Crisis Management may be triggered quite independently or in concert. Please see Appendix F – CoM Crisis/Issues Management Flow Chart. 4.1.1 Municipal Emergency Management Plan (MEMP) Emergencies that have a wider impact across the municipality may trigger the activation of the Municipal Emergency Management Plan (MEMP). Emergency Management is a legislated responsibility for municipalities. It requires each Council to develop and maintain a MEMP to provide support, response and recovery services in the event of an emergency. The MEMP includes a series of sub-plans that outline resource requirements for planning, prevention, response and recovery requirements of emergency management. The sub-plans include: nauseous

Public Health Sub-plan to collate and coordinate health resources, personnel and/or facilities;

Physical Resources Sub-plan to identify, provide and coordinate physical resources;

Recovery Sub-plan to coordinate emergency relief centres, support services for evacuees, and medical resources and physical facilities as part of the emergency recovery;

Public and Internal Relations to provide and coordinate communications with emergency services, media and the community; and

Events Sub-Plan to identify, document and mitigate risks and hazards associated with events. For more information regarding the City of Melbourne‟s MEMP Committee and responsibilities please view the Asset Services Team, Emergency Management page at http://comweb/AboutUs/Divisions/SustainabilityRegulatoryServices/EngineeringServices/Asset%20Services/EmergencyManagement/Pages/EmergencyManagement.aspx The MEMP is managed by Engineering Services in the Sustainability and Regulatory Services Division.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 16}

4. BCP IN CONTEXT continued…. 4.1.2 Crisis Issues Management Crisis Issues Management is the strategic response activated by an event that has the potential to severely damage people and/or the city‟s assets, earnings or reputation. This strategic response is coordinated by an internal Crisis Issues Management Team (CIMT). The CIMT may be called in to action by an incident or incidents that involve emergency management or other events that have no bearing on an emergency. Please refer to the CoM Crisis Issues Management Manual DM # 3894186. 4.1.3 CoM Business Continuity Plan (BCP) – this document The CoM BCP anticipates and prepares for incidents that could affect critical service delivery functions and processes for the organisation. It ensures that the organisation can respond to and recover from any incident in a planned and rehearsed manner. The CoM BCP details the „first action‟ responses of the organisation in the event of an emergency and is aligned with individual branch/work area Business Continuity Recovery Plans which detail the step by step procedures for recovering normal business. 4.1.4 Building Emergency Control Organisation (BECO) Building Emergency Control Organisation (BECO) acts to protect council property and staff and refers to building emergency evacuation and fire prevention. The fire systems and evacuation plans are managed, tested and reviewed annually by CoM Security within the Facilities Management Team, Property Services Branch. For more information please view the Facilities Management Security home page at http://comweb/AboutUs/Divisions/SustainabilityRegulatoryServices/PropertyServices/Default/Pages/BECOtraining.aspx

CoM Corporate Business Continuity Plan - DM # 4104731 v6 17}

5. BCP RECOVERY ROLES

5.1 Business Continuity Roles & Responsibilities

5.1.1 Crisis Issues Management Team The CIMT determines the course of action required to protect the reputation and integrity of the CoM and to undertake any communications or operational activities required to support these responsibilities.

With reference to the CoM Corporate Business Continuity Plan (BCP), the role and responsibilities of the CIMT include:

Duties

activate the CoM Corporate BCP when and if required;

ensure effective maintenance and management of Crisis Issues Management Manual (CIMM);

ensure training of the CIMT, their alternates and support staff;

ensure regular testing of the CIMM;

ensure control of operational/business implications; and

maintain communication flow with MERO and MEMP Committee.

Pre-Event

ensure the CIMM is robust, up-to-date and accessible;

decide the CIMT alternates;

confirm recovery objectives of the CoM BCP;

define/confirm interface with MEMP, MEMP Committee and MERO;

define/confirm CIMT member roles and responsibilities;

develop strategies for various situations based on threat analysis; and

maintain suitable tests and exercises.

During an event

confirm the situation with MERO, MEMP Committee and Security Control Centre (SCC);

in association with MERO, MEMP Committee and SCC, determine the:

o level of seriousness of the problem and the likely impact on CoM;

o likely effects of the event; and

o required response and recovery strategies;

establish operational position, and confirm message strategy;

activate CoM Corporate BCP in association with the Director Corporate Services and Director Sustainability & Regulatory Services;

liaise directly with Branch Managers of affected areas;

fully document all decisions and actions taken using incident logs; and

advise MERO & MEMP Committee of continuity and recovery progress.

Post Event

evaluate performance of the CIMT and debrief to capture learning‟s;

evaluate communication/information flows;

review MEMP Committee performance and interaction with the CIMT; and

develop post-event recommendations and ensure CIMT Manual and/or CoM Corporate BCP and Business Continuity Recovery Plans (BCRPs) are updated as required.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 18}

5. BCP RECOVERY ROLES continued….

5.1.2 Director Corporate Services and Director Sustainability & Regulatory Services

With reference to the CoM Corporate Business Continuity Plan (BCP), the roles and responsibilities of the Director Corporate Services and Director Sustainability & Regulatory Services include:

Duties

advise the CIMT in regards to the potential activation of the CoM Corporate BCP;

ensure effective maintenance and management of the CoM Corporate BCP;

ensure training of Director alternates and support staff;

ensure regular testing of the CoM Corporate BCP;

advise the CIMT in relation to the operational/business implications of CoM Corporate BCP;

maintain business continuity communication with MEMP Committee; and

maintain communication flow between CIMT, Branch Managers and Branch Continuity Coordinators (BCCs).

Pre-Event

ensure the CoM Corporate BCP is robust, up-to-date and accessible;

decide on Director Corporate Services and Director Sustainability & Regulatory Services alternate supports;

confirm recovery objectives of the CoM Corporate BCP;

define/confirm interface with MEMP Committee;

define/confirm interface with CIMT, Branch Managers and BCCs;

define roles and responsibilities of the CIMT, Director Corporate Services and Director Sustainability & Regulatory Services, Branch Managers and BCCs;

develop strategies for various situations based on threat analysis; and

maintain suitable tests and exercises.

During an event

confirm the situation with the CIMT;

in association with the CIMT:

o determine required response and recovery requirements;

o establish the operational position and confirm message strategy; and

o activate the CoM Corporate BCP;

activate Business Continuity Recovery Plans (BCRPs) for affected areas;

liaise with Branch Managers and Business Continuity Coordinators (BCCs) of affected areas;

coordinate meetings between the CIMT, Branch Managers and BCCs; and

update the CIMT and MEMP Committee in relation to business response and recovery arrangements and status.

Post Event

evaluate performance and debrief to capture learning‟s;

evaluate communication/information flows;

review the CIMT performance and interaction with the Director Corporate Services and Director Sustainability & Regulatory Services;

review performance and interaction with Branch Managers and BCCs; and

develop post-event recommendations and ensure CIMT Manual and/or CoM BCP and BCRPs are updated.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 19}

5. BCP RECOVERY ROLES continued….

5.1.3 Branch Managers Duties

ensure that appropriate staff and themselves participate in regular testing of their BCRP;

ensure control of operational/business implications as a result of BCRP activation during an incident or interruption;

ensure effective maintenance, development and management of branch/work area Business Continuity Recovery Plans (BCRPs) and Business Impact Assessments;

ensure they receive appropriate business continuity training and awareness and that branch/work area Business Continuity Coordinators (BCCs), their alternates and supports also receive appropriate business continuity training and awareness; and

maintain communication flow between Director Corporate Services and Director Sustainability & Regulatory Services, Branch Managers and BCCs during an incident or interruption.

Pre-Event

ensure branch/work area BCRPs are robust, up-to-date, and accessible and that the updated document is transferred onto the Branch Flash Drive when updates are undertaken;

decide/confirm alternative Branch Manager and BCC;

review and amend BCRP recovery objectives as required;

review and amend BCRP scenario first actions and strategies as required;

understand the interface with Director Corporate Services and Director Sustainability & Regulatory Services by participating in suitable tests and exercises and reading their roles and responsibilities detailed in the corporate BCP;

understand the roles and responsibilities of Director Corporate Services and Director Sustainability & Regulatory Services, Branch Manager and BCC by participating in suitable tests and exercises and reading all roles and responsibilities detailed in the corporate BCP; and

participate in suitable tests and exercises. During an Event

confirm situation with Director Corporate Services and Director Sustainability & Regulatory Services/CIMT;

in association with the Director Corporate Services and Director Sustainability & Regulatory Services determine the:

o level of seriousness of the problem and the likely impact on your branch/work area

o likely effects of the event; and

o required response and recovery strategies of your branch/work area;

activate your branch/work area BCRP;

establish Priority Key Function Lists for response and recovery;

ensure staff complete Incident Log sheets for recovery steps and actions taken;

liaise with the BCC of the affected area; and

advise Director Corporate Services and Director Sustainability & Regulatory Services of continuity and recovery progress.

Post-Event

evaluate performance and that of BCC and debrief to capture learning‟s;

evaluate communication/information flows;

review Director Corporate Services and Director Sustainability & Regulatory Services performance and interaction with the role of the Branch Manager and BCC; and

CoM Corporate Business Continuity Plan - DM # 4104731 v6 20}

develop post-event recommendations and ensure BCRP and Priority Key Function Lists are updated.

5. BCP RECOVERY ROLES continued….

5.1.4 Business Continuity Coordinators

Duties

ensure understanding and effective maintenance and management of the branch/work area BCRP, Priority Lists and Business Impact Assessments;

ensure that they receive appropriate business continuity training and awareness. This also applies to their alternates and support staff;

participate in regular testing of the BCRP;

ensure control of operational/business implications as a result of BCRP activation during an incident or interruption; and

maintain communication flow with Branch Manager during an incident or interruption.

Pre-Event

ensure branch/work area BCRPs are robust, up-to-date, and accessible;

decide/confirm alternative BCC in conjunction with the Branch Manager;

review and amend BCRP recovery objectives as required;

review and amend BCRP scenario first actions and strategies as required;

define/confirm interface with Branch Manager;

confirm their roles and responsibilities with the Branch Manager; and

participate in suitable tests and exercises as required.

During an Event

confirm situation with Branch Manager;

in association with Branch Manager:

o determine the level of seriousness of the problem and the likely impact on the branch/work area;

o determine the likely effects of the event;

o determine the required response and recovery strategies of the branch/work area;

o activate branch/work area BCRP; and

o establish priority lists for response and recovery;

advise Branch Manager of continuity and recovery progress; and

complete Incident Log sheets for recovery steps and actions taken.

Post-Event

evaluate performance and debrief to capture learning‟s;

evaluate communication/information flows during the incident or interruption;

review their interaction with the Branch Manager; and

develop post-event recommendations and ensure the BCRP and associated documents are updated.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 21}

5. BCP RECOVERY ROLES continued….

5.1.5 Risk Management Team, Governance Services

Duties

maintain communication with MEMP Committee and Sub-Committees, CIMT and Director Corporate Services and Director Sustainability & Regulatory Services in relation to management of the CoM Corporate BCP;

ensure effective maintenance, management and testing of CoM Corporate BCP;

ensure effective maintenance, management and testing of BCRPs;

ensure effective development of branch/work area BIAs; and

arrange business continuity planning training, education and awareness programs within Council.

(Please refer to #4195018 for the BCP Maintenance and Communications Schedule)

Pre – Event

ensure the CoM Corporate BCP is robust, up-to-date and accessible;

confirm recovery objectives of the organisation as specified in the CoM Corporate BCP and Branch/Work Area BCRPs;

advise MEMP Committee, CIMT and Director Corporate Services and Director Sustainability & Regulatory Services in relation to business continuity planning, response and recovery requirements;

arrange business continuity planning training, education and awareness programs within Council; and

maintain suitable business continuity tests and exercises.

During an Event

provide support and advice to MEMP Committee, CIMT and Director Corporate Services and Director Sustainability & Regulatory Services, Branch Managers and BCCs as required.

Post-Event

evaluate performance of the Risk Management Team, CoM Corporate BCP and Branch/Work Area BCRPs and debrief to capture learning‟s;

develop post-event recommendations and ensure BCRP and individual Priority Key Function Lists are updated; and

report to Directors and Audit Committee on performance of CoM Corporate BCP and BCRPs.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 22}

6. KEY THREAT SCENARIOS The Corporate Business Continuity Plan (BCP) details the City of Melbourne response in the event of business disruptions as a result of the following four loss scenarios:

6.1 Loss of access to a building

The loss of a building can be for a multitude of reasons whether it is as a result of physical damage (fire, flood, explosions etc) or denial of access (strike, terrorism etc). It is possible that the recovery plan for the loss of a building could be activated as part of the MEMP or as a result of a local incident.

Please see Appendix A1 for „FIRST ACTIONS‟ information.

6.2 Loss of communication/ information systems

The loss of communication and/or information systems at the CoM could severely impact operations. Delays or disruptions to service could be a matter of minutes, hours or days depending upon the scale of the incident or emergency. CoM BIS are responsible for the management, maintenance and recovery of all communication and information systems via the Information Technology Disaster Recovery Plan (IT DRP).

The corporate data centre is currently located at Level 5 at Council House 1. A back up system is located on Level 4, Town Hall, with an additional back up system located off site in a suburb outside of the city. All telephones are linked to the computer system and as such may be affected if the computer systems are down. If this were to occur, staff will be encouraged to use mobile phones when and where possible.

Please see Appendix A2 for „FIRST ACTIONS‟ information.

6.3 Loss of staff due to an Influenza Pandemic

Avian Flu has been identified as a key threat to the organisation as it could result in: a significant loss of staff (as a result of staff who are ill, looking after those who are ill, or staff

who do not come to work as they are worried, but well);

supply delays or interruptions;

contractor delays or disruptions;

increased/decreased demand for services;

fuel and/or energy delays or disruptions;

communication/information system disruptions;

movement of people/imports/exports delayed or disrupted; and

temporary closure of venues/events and financial implications.

Please see Appendix A3 for „FIRST ACTIONS‟ information.

Please note: The CoM has identified Influenza Pandemic as a specific threat to the organisation however it is worth noting the first actions and recovery strategies identified in this scenario can be applied to any pandemic event.

6.4 Loss of staff (non pandemic)

A major loss of staff could have a significant impact on CoM‟s ability to maintain essential services. 'Loss of staff' refers to any emergency, incident or issue where a significant number of staff are absent from work. This could include, but is not limited to, transport strikes, industrial strikes, natural disasters that restrict people‟s movement to and from the city, travel restrictions and terrorist threats etc. Please see Appendix A4 for „FIRST ACTIONS‟ information.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 23}

7. INCIDENT LOGS In the event of an emergency or incident that disrupts or delays the normal operations of the CoM, it is important to document the steps taken to recover normal business. Please see Appendix B – Incident Log Template.

Details provided in the log enable the organisation to review the effectiveness of the recovery process and document the rationale behind decisions made. Incident Logs detail:

- what the issue and/or event was;

- details of the action taken;

- details of who took the action;

- when the action was taken; and

- who was advised of the action taken. Hints on how to complete the Incident Log In general:

- Be clear and precise. To be useful, the information needs to make sense.

- Be as accurate as you can. The credibility of the information will be affected if the information provided is not accurate.

Time/Date of Event/Issue:

If the incident occurs for any length of time, please specify the period as it will help show the scale of the problem. Event/Issue: Try and describe the type of event, issue or incident. Action Taken Was any action taken to resolve the event, issue or incident? Describe what action was taken. Log entry time/date When have you recorded the incident in the log?

CoM Corporate Business Continuity Plan - DM # 4104731 v6 24}

APPENDIX A – KEY THREATS

The following pages detail the flowcharts, first actions and impacts and recovery strategies associated with the event of business disruptions as a result of the four loss scenarios detailed in “Section 6 Key Threat Scenarios”.

The following notes are supporting information to be read in conjunction with the flow charts contained within Appendix A. FLOWCHART GENERAL NOTES MEMP The Municipal Emergency Management Plan (MEMP) outlines the support, response

and recovery requirements of the wider municipal in the event of an emergency. MEMP is a legislated responsibility for municipalities and each Council is required to develop and maintain them.

CIMT The Crisis Issues Management Team (CIMT) use the Crisis Issues Management Manual to manage an issue or crisis that affects the corporation including internal and external communication, activation of the CoM BCP and branch/work area BCRPs.

EMIPWG The CoM Emergency Management Influenza Pandemic Working Group (EMIPWG) has determined Council's support, response and recovery requirements in the event of an influenza pandemic and have outlined these responsibilities within the IPAP.

BCP The CoM Corporate Business Continuity Plan (BCP) provides a wider business continuity context for the organisation. It details response and recovery requirements of each loss scenario. It is activated and managed by the CIMT.

BCRP Business Continuity Recovery Plans (BCRPs) confirm the key function priorities of each branch/work area and the steps required for business continuity. BCRPs are activated by CIMT and managed and maintained by each branch/work area.

IT DRP The Information Technology Disaster Recovery Plan (IT DRP) details recovery strategies for information and communication systems and is managed, maintained and activated by BIS

FLOWCHART LEGEND BCP Business Continuity Plan which details CoM business continuity actions and is

activated by CIMT BCRP Business Continuity Recovery Plan for each branch/work area, activated by CIMT

and managed and maintained by the branch/work area. IT DRP Information Technology Disaster Recovery Plan which details recovery strategies for

information and communication systems and is managed, maintained and activated by BIS

FM BCRP Facilities Management Business Continuity Recovery Plan which details alternate work location and resource requirements and is managed, maintained and activated by the Facilities Management Team, Property Services

BCC CoM Business Continuity Coordinator MEMP Municipal Emergency Management Plan MERO Municipal Emergency Recovery Officer EMIPWG CoM Emergency Management Influenza Pandemic Working Group IPAP Influenza Pandemic Action Plan CIMT CoM Crisis Issues Management Team BIS CoM Business Information Services HR CoM Human Resources

CoM Corporate Business Continuity Plan - DM # 4104731 v6 25}

APPENDIX A – KEY THREATS

Guideline: How to read a Process Map

Overview: We document the principles and practices of all our processes, where practical, on a document we call a process map. Our process maps define who does what, why and when and indicates what supporting documents, processes or equipment are required. Branch Managers and Team Coordinators are responsible for the development and maintenance of their process maps. This guideline provides an overview of the main components of the process map. The polygons are used to define specific activities throughout a process and are shown under boxes, indicating responsibilities. The responsibilities may be a position, part of an organisation or external bodies/individuals.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 26}

A1. LOSS OF ACCESS TO A BUILDING: Flow Chart

CoM Staff

1

4

3

6

Y

NOTES OR OTHER SPECIFIED

PERSONS

N

5

Context

The loss of a building can be for a multitude of reasons

whether it be as a result of physical damage (fire, flood,

explosions stc) or denial of access (strike, terrorism etc). It

is possible that the recovery plan for the loss of a building

could be activated as part of the MEMP or as a result of a

local incident.

Notes

1. The Security Control Centre is located on the ground floor

of town Hall. Access to all CoM owned buildings is

controlled from this room.

2. The CoM data Centre is located on Level 5 at Council

House 1 with a back up system that is located on Level 4

Town Hall and an additional back up system located off site

in a suburb outside of the City.

3. The data Centre is located on Level 5, CH1

4. a) The BIS Warm site is located on level 4 T/Hall

b) BIS Activated the ITDRP

5. The security control room is located on the Ground Floor

T/Hall

6. Facilities Management are responsible for sourcing and

organizing alternative accommodation arrangements.

Branch

ManagerBCC CIMT F&AM BIS HR

Assess extent of damage and activate BCP

Are there any access restrictions?

Activate warm

site for DC & IT

DRP

Business Continuity Planning is the act ofanticipating and preparing for incidents that couldaffect critical service delivery functions andprocesses for the organisation, to ensure that it canrespond to any incident in a planned and rehearsedmanner.

The CoM has a corporate BCP that details Councilsresponse in the event of business disruptionincluding:

- Loss of access to a building

- Loss of communication/information systems

- Loss of staff due to an influenza pandemic; and

- Loss of staff (non pandemic)

The BCP is linked to a number of BusinessContinuity Recovery Plans (BCRP) for each workarea and are based on relevant loss scenarios andpreviously completed Business Impact Analysis(BIA) Self Assessments for each work area.

The CoM recognise that business continuityplanning is a continual process and as such thecorporate BCP, as well as the individual work areaBCRPs, should be reviewed and tested annually.

The CoM‟s preparedness for dealing with anemergency, crisis or serious issues is covered infour separate documents:

- Munic ipal Emergency Management Plan(MEMPlan)

- CoM Crisis/Issues Management Plan and it‟spolicy and it‟s manual.

- CoM Business Continuity Plan (#4104731); and

- Building Emergency Control Organisation (BECO)

When an emergency, issue or incident occurs, theappropr ia te t reatment p lan is invoked bymanagement depending the nature of the issue andhow quickly it is able to be managed and resolved.The disciplines of Emergency Management,Business Continuity and Crisis Management may betriggered quite independently or in concert.

- Australian Standard AS3745

- Emergency Control Organisation

- HB221 2003 BCM Handbook

- Buildings Occupational Health & Safety Act (1985)

The loss of a building can be for a multitude of

reasons whether it be as a result of physical

damage (fire, flood, explosions etc) or denial of

access (strike, terrorism etc). It is possible that the

recovery plan for the loss of a building could be

activated as part of the Municipal Emergency

Management Plan (MEMP) or as a result of a local

incident.

1. It is possible that this process has been activated

as part of a declared Municipal Emergency and the

Crisis Issues Management Team (CIMT) have been

notified of the incident by the Municipal Emergency

Response Officer (MERO).

2. The BCP is activated and monitored by the CIMT.

3. The CoM Data Centre is located on Level 5 at

Council House 1 with a back up system that is

located on Level 4 Town Hall and an additional back

up system located off site in a suburb outside of the

City.

4. a) The Business Information Systems (BIS) Warm

site is located on level 4 T/Hall

b) BIS activate the IT DRP

5. The security control room is located on the

Ground Floor Town Hall

6. Facilities Management are responsible for

sourcing and organizing alternative accommodation

arrangements.

7. Branch Managers and BCC‟s need to confirm the

resumption of systems and operations with CIMT

and BIS.

Updated Date: 1 June 2007

Business Continuity

Planning

Is the Security Control

Centre available?

Is the Data

Centre

available?

Determine alternative accommodation & resource requirements, including the

Security Control Centre

Confirm work locations and access

arrangements

Confirm restoration of Business

Staff to assemble at advised location

Activate affected Branch/Work Area BCRP

2

Y

What is Business Continuity Planning

CoM Business Continuity Plan (BCP)

Risk Management Framework

References

Context

Notes

N

NY

Is access to the building now possible?

Reassess the impact, amend

recovery plans as required

N

Y7

CoM Corporate Business Continuity Plan - DM # 4104731 v6 27}

A1. LOSS OF ACCESS TO A BUILDING: First Actions

1) Assess the seriousness and extent of the damage

The Crisis Issues Management Team (CIMT) and the Facilities Management Team, Property Services (FM) will determine the seriousness of the situation.

2) Determine if there are access restrictions to the affected site

FM will advise if access to the affected site is possible.

FM, via the Business Continuity Recovery Plan Accommodation Strategy, will identify and arrange alternate work locations and resources (desks, phones, PCs etc).

3) Confirm availability of communication and information systems

BIS will advise if communication and information systems are available.

The Information Technology Disaster Recovery Plan (IT DRP) will identify, respond and recover affected communication and information systems in the event of an emergency.

4) Confirm alternate work location, access arrangements and/or systems availability

a) CIMT to liaise with FM who, in turn, will advise of the alternate work location and access arrangements;

b) CIMT to liaise with BIS who, in turn, will advise of systems availability;

c) CIMT to advise Branch of alternate work location, access and systems availability; and

d) Branch Managers to advise BCCs and staff of alternate work locations, access and systems availability.

5) Staff to assemble at advised alternate location

Branch Managers and BCC will coordinate staff to assemble at advised alternate work location(s).

6) Activate affected branch/work area BCRPs

a) In association with CIMT, Director Corporate Services and Director Sustainability & Regulatory Services will activate CoM BCP;

b) Director Corporate Services and Director Sustainability & Regulatory Services will advise Branch Managers of affected branches/work areas to activate BCRPs; and

c) Branch Managers and BCCs will confirm key function priorities of branch/work area and begin recovery process, including contacting key stakeholders at short notice to advise of short term relocation.

7) Has there been a change to the impact of the emergency on access to the building?

Is access now possible?

If Yes: Reassess the impact, amend recovery plans as required

If No: Proceed to Step 8.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 28}

A1. LOSS OF ACCESS TO A BUILDING: First Actions (continued..)

8) Maintain and monitor situation

a) Director Corporate Services and Director Sustainability & Regulatory Services to liaise with Branch Managers and BCCs in relation to response and recovery progress; and

b) Director to advise CIMT of business continuity status.

9) Is access to the building now possible?

Facilities Management and SCC will advise when access to building is once again available.

If Yes: Return to the building when advised possible and confirm and resume normal operations.

If No: Return to Step 7.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 29}

A1. LOSS OF ACCESS TO A BUILDING: Impacts and Recovery Strategies

The loss of access to a building for an extended period of time would represent a worst-case scenario for the CoM as it has the potential to seriously disrupt operations and major infrastructure. In the event of an emergency or crisis, CoM Facilities Management will identify, coordinate and advise of alternate recovery and work locations for all CoM work areas. Please see Appendix F for the Facilities Management Business Continuity Recovery Plan Accommodation Strategy. Town Hall Potential impact Recovery Strategy

Loss of CoM Security Control Centre (SCC) Ground Floor, Town Hall.

- Security staff posted at entrance of CoM buildings.

- Depending upon telephone redirection capabilities, staff may be advised of new security numbers to call.

Disruption or loss of Safety City Camera Command Centre (located in the SCC), Ground Floor, Town Hall.

- The Safe City Camera does not have a back up plan and would therefore be off-line until the damage is fixed and/or the system is re-instated.

Loss of Customer Services Call Centre Ground Floor, Town Hall.

- Relocate to Level 5, Council House 1 Training Rooms.

- Telstra to redirect main hotline number. Risk of damage and/or loss of vital and/or valuable records and items

- Work area BCRPs detail all vital documents and records, DM reference numbers and/or locations.

Loss of Data Recovery Server Room Level 4, Town Hall.

- BIS Disaster Recovery Plan would be activated

- CoM has off-site server available if both CH1 Data Centre and DR Server Room at Town Hall are unavailable

Essential and support service work areas at Town Hall to be recovered as a priority: 1 Security Control Centre 2 Office of CEO, LM, DLM and Councillors 3 Customer Contact 4 Media Office 5 Corporate Communications 6 Pathway Please note: Remaining work areas will be recovered as soon as possible. Tenants of Town Hall Metshop Flower Stand Half Tix/City Gallery Epicure Lord Mayors Charitable Trust Please note: Recovery steps for tenants of Town Hall would be in accordance with tenant

licence agreements. Each tenant should have their own BCP in place.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 30}

A1. LOSS OF ACCESS TO A BUILDING: Impacts and Recovery Strategies (Continued…) Council House 1

Potential Impact

Recovery Strategy

Loss of the CoM BIS Command Centre Level 5, Council House 1.

- BIS Disaster Recovery Plan would be activated.

- Data Recovery Server Room on Level 4, Town Hall would be activated.

- CoM has off-site server available if both Council House 1 BIS Command Centre and Data Recovery Server Room at Town Hall are unavailable.

Risk of damage and/or loss of vital and/or valuable records and items

- Work area BCRPs detail all vital documents and records, DM reference numbers and/or locations.

Loss or disruption to Corporate Fleet - Asset Services would find alternate fleet and

petrol services in the event of a loss or disruption.

- Hire car arrangements put in place

Essential and support service work areas at Council House 1 to be recovered as a priority:

1 Business Information Services 2 Statutory Services – Urban Services, Emergency Management 3 Community Services 4 Human Resources 5 Financial Services 6 Rates & Valuations - GIS 7 Asset Services – Corporate Fleet Petrol Station

Please note: Remaining work areas will be recovered as soon as is probable and possible. Tenants of Council House 1 Hairy Canary Stellini‟s Premiere Car Parking Cannes Boutique Rochis Opals

Please note: Recovery steps for tenants of Council House 1 would be in accordance with tenant licence agreements. Each tenant should have their own BCP in place.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 31}

A1. LOSS OF ACCESS TO A BUILDING: Impacts and Recovery Strategies (Continued…)

Council House 2

Potential Impact

Recovery Strategy

Risk of damage and/or loss of vital and/or valuable records and items

- work area BCRPs detail all vital documents and records, DM reference numbers and/or locations.

Risk of damage or loss to black water treatment plant

- Turn off system and use freshwater .

Risk of damage or loss of phase change material

- Revert to cooling tower or chiller operations.

Risk of damage or loss of data loop - The data loop system has two sides. In the event of a loss of one side of the loop, the other would cover operations

Essential and support service work areas at Council House 2 to be recovered as a priority: 1 Aspects of Health Services, Development Planning, Asset Services, Building Certification

and Parking & Traffic 2 Aspects of Facilities Management - Property Services Please note: Remaining work areas will be recovered as soon as is probable and possible.

Tenants of Council House 2 Calibre Please note: Recovery steps for tenants of Council House 2 would be in accordance with tenant

licence agreements. Each tenant should have their own BCP in place.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 32}

A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: Flow Chart

CoM Staff

3

2

NOTES OR OTHER SPECIFIED

PERSONS

1

N

Notes

1. BCP

2. DRP

3. MEMP used

4. Notify CoM staff by BIS

5. BIS DRP +

6. Activate BCRP‟s in accordance

Branch

ManagerBCC CIMT F&AM BIS HR

Assess the impact of the complete or partial loss of communication & or information systems

Should the corporate BCP &

affected BCRPs be activated

or remain active?

Activate

IT DRP

Should the IT

DRP be

activated?

MEMP

Activate corporate BCP and affected

Branch/Work area BCRPs for Loss of

Communication/Information Systems

or modify as required

Y

N

Y

The loss of communications and/or information

systems at the CoM severely impact operations.

Delays or disruptions to service could be a matter of

minutes, hours or days depending upon the scale of

the incident or emergency.

CoM Business Information Systems (BIS) are

responsible for the management, maintenance and

recovery of all communication and information

systems via the Information Technology Disaster

Recovery Plan (IT DRP).

The Corporate data centre is currently located at

Level 5 at Council House 1 and Level 4 Town Hall.

CoM data is backed up nightly and is moved to

Databank, in Abbotsford the next business day.

There are a number of tapes used in rotation. There

is a full backup done monthly which is held offsite for

12 months. All telephones are linked to the computer

system (VOIP) and as such may be affected if the

computer system are down. If this were to occur,

staff are encouraged to use mobile phones when

and where possible.

1. BIS will activate the IT DRP if and when

necessary

2. BIS will advise CoM staff of potential delays or

disruptions to systems.

3. The recovery plan for the scenario of the loss of

information/communication/systems should be used

in conjunction with the Information/Communication

Outage protocols.

4. Full or partial resumption of information and

communication systems will be determined by BIS

and the status advised to the Cris is Issues

Management Team (CIMT).

5. Branch Managers and BCC‟s need to confirm the

resumption of systems and operations with CIMT

and BIS.

Updated Date: 19 February 2008

Business Continuity Planning

Business Continuity Planning is the act of anticipatingand preparing for incidents that could affect criticalservice delivery functions and processes for theorganisation, to ensure that it can respond to anyincident in a planned and rehearsed manner.

The CoM has a corporate BCP that details Councilsresponse in the event of business disruptionincluding:

- Loss of access to a building

- Loss of communication/information systems

- Loss of staff due to an influenza pandemic; and

- Loss of staff (non pandemic)

The BCP is linked to a number of Business ContinuityRecovery Plans (BCRP) for each work area and arebased on relevant loss scenarios and previouslycompleted Business Impact Analysis (BIA) SelfAssessments for each work area.

The CoM recognise that business continuity planningis a continual process and as such the corporateBCP, as well as the individual work area BCRPs,should be reviewed and tested annually.

The CoM‟s preparedness for dealing with anemergency, crisis or serious issues is covered in fourseparate documents:

- Municipal Emergency Management Plan (MEMPlan)

- CoM Crisis/Issues Management Plan and it‟s policyand it‟s manual.

- CoM Business Continuity Plan (DM#4104731); and

- Building Emergency Control Organisation (BECO)

When an emergency, issue or incident occurs, theappropriate treatment plan is invoked by managementdepending the nature of the issue and how quickly itis able to be managed and resolved. The disciplinesof Emergency Management, Business Continuity andCris is Management may be t r iggered qui teindependently or in concert.

- Australian Standard AS3745

- Emergency Control Organisation

- HB221 2003 BCM Handbook

- Occupational Health & Safety Act (1985)

Has the impact or loss of communication/information

systems reduced?

Maintain and monitor situation at branch and organisation wide levels

Has the impact

been resolved?

Resume and confirm normal operations

Y

N

What is Business Continuity Planning?

CoM Business Continuity Plan (BCP)

Risk Management Framework

References

Context

4

5

Notes

N

2

N

CoM Corporate Business Continuity Plan - DM # 4104731 v6 33}

A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: First Actions

1. Assess the impact of the (complete or partial) loss of communication and information systems

Crisis Issues Management Team (CIMT) and Business Information Services (BIS) determine the seriousness of the situation.

2. Should the Information Technology Disaster Recovery Plan (IT DRP) be activated?

BIS determine whether or not the IT DRP should be activated.

If Yes: BIS to activate the IT DRP and then proceed to Step 3

If No: Proceed to Step 3.

3. Should branch/work area Business Continuity Recovery Plans (BCRPs) be activated?

Crisis Issues Management Team (CIMT) and BIS determine whether or not the situation warrants the activation of BCRPs.

If Yes: Proceed to Step 4.

If No: Proceed to Step 5.

4. Activate the affected branch/work area BCRPS

a) In association with CIMT, Director Corporate Services and Director Sustainability & Regulatory Services to activate CoM BCP;

b) Director Corporate Services and Director Sustainability & Regulatory Services to advise Branch Managers of affected branches/work areas to activate BCRPs;

c) Branch Managers and BCCs confirm Key Function priorities of affected branch/work area depending upon type systems availability; and

d) Branch Managers and BCCs of affected branches/work areas to advise staff and activate BCRPs.

5. Has the impact of the loss of communication and information systems reduced?

Are systems now available?

If Yes: Reassess the impact, amend recovery plans as required.

If No: Staff to follow CoM Communication & Information Systems Outage Protocols See Appendix D.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 34}

A2. LOSS OF ACCESS TO COMMUNCIATION/ INFORMATION SYSTEMS: First Actions (Continued…)

6. Maintain and monitor situation

a) Director Corporate Services and Director Sustainability & Regulatory Services to liaise with affected Branch Managers and BCCs in relation to response and recovery progress; and

b) Director to advise CIMT of business continuity status.

7. Has the impact been resolved / Are systems now available?

BIS will advise when information and communication systems are available and /or Branch Managers and BCC‟s need to confirm the resumption of systems.

If Yes: Confirm and resume normal operations.

If No: Return to Step 5.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 35}

A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: Impacts and Recovery Strategies

The loss of communication and information systems at the CoM would severely impact operations. Potential delays or disruptions could result in systems being unavailable for a matter of minutes, hours or days depending upon the scale of the incident or emergency. In the event of a delay or disruption, BIS will activate the Information Technology Disaster Recovery Plan (IT DRP) to reinstate the communication and information systems. Communication Systems The CoM phone system is run across the data network and has two servers - one located at Council House 1 (referred to as the publisher) and the other located at Town Hall (subscriber). The system has been designed to sustain a 30% loss of capacity in order to maintain activity. Information Systems Remote Access Currently only 70 staff can obtain remote access to the Council information systems at any one point in time. The remote access service is only available to staff members who have been authorised by their managers to do so and have successfully set up access protocols on their systems. Interestingly 545 are currently listed as having remote access privileges. In the event of an emergency or incident where staff are encouraged to work from home, BIS has confirmed that they are able to purchase more licences to allow for more staff to have remote access. This can be done immediately. Remote Access Recovery Priority BIS will prioritise the number of licenses, which staff have access and the order in which programs are recovered in accordance with the Application Recovery Priority (refer to next page), the IT-DRP procedures and the direction of the Crisis Issues Management team.

Potential Impact

Recovery Strategy

Loss of BIS Command Centre Level 5, Council House 1.

- BIS activate BIS DRP. - Activate on-site back up data from Disaster

Recovery Server Room at L4, TH. Loss of BIS Command Centre (L5, CH) and Disaster Recovery Server Room (L4, TH)

- BIS activate BIS DRP. - Activate off-site back up data.

Loss of Communication Systems (phones) - BIS activate BIS DRP. - Redirection of telephone ranges by Telstra. - Staff encouraged to work from mobiles.

Loss of two-way radio services - Staff will be encouraged to use mobile phones or land lines until the system is restored.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 36}

A2. LOSS OF ACCESS TO COMMUNCIATION/ INFORMATION SYSTEMS: Impacts and Recovery Strategies (continued….) Business Critical Applications List – as outlined in Appendix D of the IT DRP

TCM

Pathway

Document Management

Oracle Financials (IP, ADI)

CoM Static Web Page

Pinforce / Afaria

CoM External Internet sites

Customer Service Portal

Pharos (Libraries)

LMS Links (City Baths)

Call Manager (VoIP)

IPFX (Call Centres)

Majik (QVM)

Marina Management (Docklands)

MACHS

Aurion

CoMWeb

Hardcat

CoM Corporate Business Continuity Plan - DM # 4104731 v6 37}

A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: Flow Chart

CoM Staff

3

4

2

Business Continuity

Planning

NOTES OR OTHER SPECIFIED

PERSONS

1

Avian Flu has been identified as a key threat to the

organisation as it could result:

- in a significant loss of staff (as a result of staff who

are ill, caring for those who are ill, or staff who do not

come to work as they are worried, but well);

- supply delays or interruptions;

- contractor delays or disruptions;

- increased/decreased demand for services;

- fuel and/or energy delays or disruptions;

- information/communication systems disruptions;

- movement of people/imports/exports delayed or

disrupted; and

- temporary closure of venue/events and financial

implications.

1. The Victorian Department of Human Services

(DHS) wi l l advise the Municipal Emergency

Response Officer if and when an influenza pandemic

outbreak occurs and what „phase of alert ‟ is

applicable.

2. The MEMP Committee (in association with the

Cr i s i s I ssues Managemen t Team and the

Emergency Management Influenza Pandemic

Working Group) will activate the MEMP Health Sub

Plan and resulting Influenza Pandemic Action Plan

(IPAP). The IPAP details the CoM support, response

and recovery requirements in the event of a

pandemic. As a part of the initial assessment of

response and recovery requirements

- Human Resources will monitor organizational wide

staff resourcing, staff re-assignment and support

- Facilities Management will provide accommodation

requirements of the recovery centre

- Business Information Systems will provide the IT

needs for the recovery centre as well as prioritize

who can work from home;

3. CIMT and the Director of Corporate Partnerships

will provide formal notification of response and

recovery requirements to the corporation as

previously determined as part of the Essential

Service Matrix (DM# 4095877)4.Director Corporate Partnerships and DirectorSustainability & Regulatory Services, in associationwith HR, will monitor staff numbers5. Phases for the pandemic are defined by theVictorian Government Department of HumanServices and are detailed in the IPAP.6. Branch Managers and BCC‟s need to confirm the

resumption of systems and operations with CIMT

and BIS.

Updated Date: 1 June 2007

Branch

ManagerBCC CIMT F&AM BIS HR

Assess the response and recovery requirements

Notify branches of

response & recovery

requirements

MEMP

MERO

EMIPWG

Actviate affected Branch/

Work Area BCRPs for

Pandemic scenario or

modify as required.

Y

N

CoM notified of

Pandemic

Outbreak

Assess

phase of

Pandemic

(Scope)

Business Continuity Planning is the act ofanticipating and preparing for incidents that couldaffect critical service delivery functions andprocesses for the organisation, to ensure that it canrespond to any incident in a planned and rehearsedmanner.

The CoM has a corporate BCP that details Councilsresponse in the event of business disruptionincluding:

- Loss of access to a building

- Loss of communication/information systems

- Loss of staff due to an influenza pandemic; and

- Loss of staff (non pandemic)

The BCP is linked to a number of BusinessContinuity Recovery Plans (BCRP) for each workarea and are based on relevant loss scenarios andpreviously completed Business Impact Analysis(BIA) Self Assessments for each work area.

The CoM recognise that business continuityplanning is a continual process and as such thecorporate BCP, as well as the individual work areaBCRPs, should be reviewed and tested annually.

The CoM‟s preparedness for dealing with anemergency, crises or serious issues is covered infour separate documents:

- Munic ipal Emergency Management Plan(MEMPlan)

- CoM Crisis/Issues Management Plan and it‟spolicy and it‟s manual.

- CoM Business Continuity Plan (#4104731); and

- Building Emergency Control Organisation (BECO)

When an emergency, issue or incident occurs, theappropr ia te t reatment p lan is invoked bymanagement depending the nature of the issue andhow quickly it is able to be managed and resolved.The disciplines of Emergency Management,Business Continuity and Crisis Management may betriggered quite independently or in concert.

- Australian Standard AS3745

- Emergency Control Organisation

- HB221 2003 BCM Handbook

- Occupational Health & Safety Act (1985)

Has the impact

reduced?

Maintain and monitor the situation at branch wide and organization wide levels

Has the impact of the pandemic to

business been resolved?

Resume & confirm normal operations

N

Yes

Business Continuity

Planning

What is Business Continuity Planning?

CoM Business Continuity Plan (BCP)

Risk Management Framework

References

Context

Notes

4

6

5

CoM Corporate Business Continuity Plan - DM # 4104731 v6 38}

A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: First Actions

1. City of Melbourne is notified of Pandemic outbreak

a) the Victorian Government Department of Human Services (DHS) will advise the Municipal Emergency Recovery Officer (MERO) which „phase‟ of pandemic alert is applicable. It is possible the CoM Public Health Liaison Officer will be notified first due to their close working relationship with the DHS. If this occurs then the Public Health Liaison Officer will notify the MERO;

b) MERO will call upon the Municipal Emergency Management Planning (MEMP) Committee;

c) MEMP Committee will activate the MEMP and MEMP Health Sub Plan and its committee;

d) MEMP Health Sub Planning committee will activate the Emergency Management Influenza Working Group (EMIPWG); and

e) MEMP Health Sub Planning committee will activate the CoM Influenza Pandemic Action Plan (IPAP) which details the corporate planning, prevention, response, recovery and immunisation requirements in an influenza pandemic.

2. CoM Pandemic response and recovery requirements confirmed with CIMT

a) the Health Sub Planning committee (in association with MEMP Committee and EMIPWG) will confirm which phase of the IPAP is to be activated and the subsequent CoM response and recovery requirements;

b) the Health Sub Planning committee will advise CIMT of CoM response and recovery requirements;

3. CoM Pandemic response and recovery requirements confirmed with Director Corporate Services, Director Sustainability & Regulatory Services and affected Branch Managers and BCC’s

a) CIMT will advise Director Corporate Services and Director Sustainability & Regulatory Services, Branch Managers and Business Continuity Coordinators (BCCs) of CoM response and recovery requirements; and

b) Branch Managers and BCCs advise staff of CoM response and recovery requirements.

4. Staff absenteeism monitored

a) Branch Managers are to report staff absenteeism to Human Resources (HR) using the Staff Absenteeism register template (See Appendix C);

b) Director Corporate Services and Director Sustainability & Regulatory Services, in association with HR, will monitor staff numbers;

c) When, and if, staff numbers in a given work area fall bellow 70% availability, the Director Corporate Services and Director Sustainability & Regulatory Services will recommend to CIMT that BCRPs be activated; and

d) Director Corporate Services and Director Sustainability & Regulatory Services will monitor staff numbers of work areas considered to provide an essential or support service as per the Essential Service Matrix (See Appendix H). The Director will commandeer staff from other work areas to assist in essential or support service when and if required.

5. Activate affected branch/work area BCRPs

a) Director Corporate Services and Director Sustainability & Regulatory Services to advise Branch Managers of affected branches/work areas to activate BCRPs;

b) Branch Managers and BCCs confirm Key Function priorities of branch/work area depending upon type systems availability and notify Director Corporate Services and Director Sustainability & Regulatory Services;

c) Branch Managers and BCCs advise staff and activate BCRPs; and

d) Branch Managers to advise Human Resources (HR) of absent staff.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 39}

A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: First Actions (continued….)

6. Assess the phase (or scope) of the pandemic

The MERO will receive regular updates from the DHS as to the escalation or down scaling of alert phases. (The Public Health Liaison Officer will also be receiving regular updates from the DHS and will be in close contact with the MERO through-out the pandemic)

Has the impact reduced?

If Yes: Proceed to Step 7.

If No: Reassess the pandemic impact and amend recovery plans according to alert phase and as outlined in IPAP.

7. Maintain and monitor situation

a) Director Corporate Services and Director Sustainability & Regulatory Services to liaise with Branch Managers and BCCs in relation to pandemic response and recovery progress;

b) Director Corporate Services and Director Sustainability & Regulatory Services to coordinate staff re-deployments according to essential service maintenance and IPAP requirements;

c) Director to advise CIMT of business continuity status; and

d) CIMT to advise MEMP Committee of the status.

8. Has the impact of the pandemic to business been resolved?

If Yes: Resume and confirm normal operations.

If No: Return to Step 3.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 40}

A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: Impacts and Recovery Strategies

Potential Impacts

The likely impact of a human pandemic depends upon characteristics of the virus such as its infection rate, the proportion of the population infected in each age group, and the severity of the illness caused. Historically, there is a tendency for pandemics to occur in waves, so a second and sometimes third wave, may begin simultaneously in different parts of the world, and should be expected. Each wave could typically last about eight weeks, building to a peak in week four before abating again.

A pandemic among humans will not be like a natural or physical disaster that organisations may have experienced previously. There will be a wider variety of variables that may affect businesses.

Many existing continuity plans assume some part of an organisation is unaffected and can take up the required capacity for the organisation to perform at the required level – this may not be the case with a pandemic. They may also assume the event is short/sharp and that recovery can start immediately.

A pandemic would not be a short, sharp event leading to the commencement of a recovery phase. It is not possible to predict exactly how long a pandemic may last or when it may occur.

In the event of an influenza pandemic the MEMP, IPAP and CoM Corporate BCP will be activated.

Potential Impact

Recovery Strategy

Staff Absenteeism - Consult Essential Service Matrix (see Appendix H).

- Redeploy staff from branches/work areas that can be shut down or reduced to those areas that are likely to be enhanced or considered essential or support services.

- Activate branch/work area BCRPs and focus on key function priorities.

Supplies of materials for ongoing activity may be disrupted

- Consult branch/work area BCRPs to confirm predetermined alternate supply options.

- Advise stakeholders of potential delay.

Availability of services from sub-contractors or other supplies may be impacted

- Consult branch/work area BCRPs to confirm pre-determined alternate contractor options.

- Advise stakeholders of potential delay. - Consult Legal Services division within CoM in

relation to legal and financial implications associated with delayed or suspended contracts.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 41}

A3. LOSS OF STAFF DUE TO INFLUENZA PANDEMIC: Impacts and Recovery Strategies (continued)

Potential Impact

Recovery Strategy

Demand for services may be impacted - Activate branch/work area BCRPs and focus on key function priorities.

- Advise Branch Manager when capacity is reached who, in turn, will advise Director Corporate Services and Director Sustainability & Regulatory Services and CIMT.

Fuel and energy supplies may be disrupted - Activate branch/work area BCRPs and focus

on key function priorities.

Information and Communications Systems disrupted and/or slow

- Activate BIS DRP. - Activate branch/work area BCRPs and focus

on key function priorities. - Staff to follow CoM Communication &

Information Systems Outage Protocols (Appendix C).

The movement of people, imports and exports may be restricted or delayed by quarantine and isolation measures both within Australia and overseas

- Activate branch/work area BCRPs and focus on key function priorities.

- Advise stakeholders of potential delay.

Temporary closure of venues and/or events - Activate branch/work area BCRPs and focus on key function priorities.

- Advise stakeholders of potential delay.

Financial implications - Activate branch/work area BCRPs and focus on key function priorities.

- When and where appropriate activate insurance mechanisms.

Social isolation and working from home - It is likely that the number of staff working from

home or outside of Council will increase during a pandemic. It is important to note that Council currently has a capacity of 70 people who can obtain remote access to the Council information systems at the one time. It is likely that in the event of a pandemic, Council may increase this number and/or prioritise who can have remote access.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 42}

A4. LOSS OF STAFF (NON PANDEMIC): Flow Chart

CoM Staff

2

Business Continuity

PlanningNOTES OR OTHER SPECIFIED

PERSONS

1

Notes

1. BCP

2. DRP

3 a) CIMT use the C/I Management manual for

actions, including communications to staff.

b) MEM Plan used by

c) HR specific note

d) Note on impact level

4. Impact

- NOS + time duration and spread

5. Reference note to min staff NOS for functions .

(part/all)

Branch

ManagerBCC CIMT F&AM BIS HR

Assess the issue and the impact of the loss of staff

Activate BCP and affected branch/work

area BCRP‟s or modify as required

Should the BCP and BCRP‟s

be activated or remain active?

MEMP

MERO

EMIPWG

Activate IT-DRP and or

Facilities Management

BCRP

NAre systems and facilities

available?

Y

Y

A major loss of staff could have a significant impact

on the corporations ability to maintain essential

services „Loss of Staff‟ refers to any emergency,

incident or issue where a significant number are

absent from work. This could include, but is not

limited to, transport strikes, union strikes, natural

disasters that restrict people movement to and from

the city, travel restrictions, terrorist threats etc .

1. The Municipal Emergency Management Plan

(MEMP) Committee and/or the Crisis Issues

Management Team (CIMT) in association with

Branch Managers and BCCs, will assess the issue

and the impact of loss of staff.

a) Staff absences should be reported to Human

Resources (HR) who will monitor the total number of

staff absent;

b) HR, in associat ion with the Crisis Issues

Management Team (CIMT), will monitor the number

of staff absent and the duration of absenteeism to

determine the impact on the organisation.

2. Change in the impact of staff absences

a) HR in association with CIMT, will continue to

monitor the number of staff absent and the duration

of absenteeism to determine the impact on the

organisation;

b) Branch managers and BCC‟s will need to monitor

Key Function priorities and the number of staff

required to ensure that they continue.

3. A reduction of the impact at this stage may lead to

the resumption and confirmation of normal

operations.

4. Branch managers and BCC‟s need to confirm the

resumption of normal operations with CIMT.

Updated Date: 1 June 2007

Has there been a reduction in the

impact of staff absences?

Maintain and monitor situation at Branch and organisation wide levels

Resume & confirm normal operations

Has the impact of staff absences

reduced?

3

N

N

Y

Y

Business Continuity Planning is the act ofanticipating and preparing for incidents that couldaffect critical service delivery functions andprocesses for the organisation, to ensure that it canrespond to any incident in a planned and rehearsedmanner.

The CoM has a corporate BCP that details Councilsresponse in the event of business disruptionincluding:

- Loss of access to a building

- Loss of communication/information systems

- Loss of staff due to an influenza pandemic; and

- Loss of staff (non pandemic)

The BCP is linked to a number of BusinessContinuity Recovery Plans (BCRP) for each workarea and are based on relevant loss scenarios andpreviously completed Business Impact Analysis(BIA) Self Assessments for each work area.

The CoM recognise that business continuityplanning is a continual process and as such thecorporate BCP, as well as the individual work areaBCRPs, should be reviewed and tested annually.

The CoM‟s preparedness for dealing with anemergency, crisis or serious issues is covered infour separate documents:

- Municipal Emergency Management Plan(MEMPlan)

- CoM Crisis/Issues Management Plan and it‟spolicy and it‟s manual.

- CoM Business Continuity Plan (DM#4104731); &

- Building Emergency Control Organisation (BECO)

When an emergency, issue or incident occurs, theappropriate treatment plan is invoked bymanagement depending the nature of the issue andhow quickly it is able to be managed and resolved.The disciplines of Emergency Management,Business Continuity and Crisis Management may betriggered quite independently or in concert.

- Australian Standard AS3745

- Emergency Control Organisation

- HB221 2003 BCM Handbook

- Occupational Health & Safety Act (1985)

Context

Notes

Risk Management Framework

What is Business Continuity Planning?

CoM Business Continuity Plan (BCP)

References

4

N

CoM Corporate Business Continuity Plan - DM # 4104731 v6 43}

A4. LOSS OF STAFF (NON PANDEMIC): First Actions

1. Assess the issue and the impact of loss of staff

The cause of the potential loss of staff could be anything at all – flood, power outages, transport or industrial strikes, health or terrorist threats etc.

The Municipal Emergency Management Planning (MEMP) Committee and/or the Crisis Issues Management Team (CIMT) in association with Branch Managers and BCCs, will assess the issue and the impact of loss of staff.

2. Are communication and information systems and work location facilities available?

If yes: Proceed to Step 3.

If no: BIS will activate the IT DRP and Facilities Management will activate the BCRP Accommodation Strategy. Then Proceed to Step 3.

3. Should the CoM BCP and branch/work area BCRPs be activated or remain active? Has, or will, the issue affected normal business operations?

If yes: Branch Managers must monitor staff numbers and report absenteeism to Human Resources (HR) and then proceed to Step 4.

If no: Proceed to Step 5.

4. Activate affected branch/work area BCRPs or modify as required

a) Director Corporate Services and Director Sustainability & Regulatory Services to advise Branch Managers of affected branches/work areas to activate BCRPs;

b) Branch Managers and BCCs confirm priorities of branch/work;

c) Branch Managers and BCCs advise staff and activate BCRPs; and

d) Branch Managers to advise Human Resources (HR) of absent staff.

5. Has there been a reduction in the impact of staff absences?

If Yes: Proceed to Step 6.

If No: Reassess the impact, amend recovery plans as required.

6. Maintain and monitor situation

a) Director Corporate Services and Director Sustainability & Regulatory Services to liaise with Branch Managers and BCCs in relation to response and recovery progress;

b) Director Corporate Services and Director Sustainability & Regulatory Services to coordinate staff re-deployments according to essential service maintenance;

c) Director to advise CIMT of business continuity status; and

d) CIMT to advise MEMP Committee of the status.

7. Has the impact of staff absences reduced?

If Yes: Resume and confirm normal operations.

If No: Return to Step 3.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 44}

A4. LOSS OF STAFF (NON PANDEMIC): Impacts and Recovery Strategies

The loss of staff, irrespective of the cause, would have a significant impact to the organisation. The CoM has a duty to ensure the provision of essential services (See Appendix G) in the event of an emergency, incident or issue where a significant loss of staff may occur.

Potential Impact

Recovery Strategy

Staff Absenteeism - Consult Essential Service Matrix (see Appendix G).

- Redeploy staff from branches/work areas that can be shut down or reduced to those areas that are likely to be enhanced or considered essential or support services.

- Activate branch/work area BCRPs and focus on key function priorities.

Information and Communications Systems disrupted and/or slow

- Activate BIS DRP. - Activate branch/work area BCRPs and focus

on key function priorities. - Staff to follow CoM Communication &

Information Systems Outage Protocols.

CoM Corporate Business Continuity Plan - DM # 4104731 v6 45}

APPENDIX B - Incident Log template The following is an incident log for the CoM Business Continuity Plan (BCP). Please refer to DM # 4186757 for a copy of this document. Date of Entry

Description of Issue Description of Action Taken When (date & time)

By whom Who has been advised of action taken

Example: North Melb Town Hall

20/5/08

CIMT have advised that all CoM operated venues, where mass gatherings occur, must close until further notice.

- Contact all stakeholders and contracts and advise of venue closure

- Contact all venue hirers and advise of venue closure, discuss ramifications for ticketed shows

20/5/08 Emma Smith, Venue Manager

Team Leader of Arts House and Arts & Culture Branch Manager

Signed ………………………………

CoM Corporate BCP

APPENDIX C - Staff member reporting illness during an influenza pandemic The following is a hi-level guideline procedure to be followed in the event of a staff member reporting illness during an outbreak of an influenza pandemic. As the City of Melbourne will follow advice and instructions from the Department of Human Services (DHS), the following may be modified as necessary with Branch Managers upon further directives from DHS.

1. Staff member to report illness during influenza pandemic to branch manager or delegate (If the staff member reports influenza illness while at work, avoid visiting the person if possible and manage the process over the phone);

2. Branch Manager or delegate to confirm whether the employee has had any of the following

symptoms or answers positive to the following:

Fever 38 degrees or higher (or history of fever)

Headache, fatigue and weakness

Sore throat, cough, chest discomfort, difficulty in breathing (shortness of breath);

Muscle aches and pains

Been overseas recently

Been in contact with someone diagnosed with influenza

3. If none of the above, unlikely to be influenza. If staff member is concerned, advise them to consult with their GP before attending work.

4. If employee answers positive for any of the items listed above in point 2 , person should be considered as a possible influenza case:

If the employee is at work, Branch Manager to complete a CoM Notification Form (refer to Doc # 4988370 ) and inform employee that they require isolation from other workers;

Confirm when symptoms first appeared;

Confirm any close contacts of the employee (see below for a definition);

Advise the employee where to locate a surgical mask and to wear the mask.

Advise the employee to seek medical advice and for them to advise work of the outcome;

Ask the employee to leave the workplace immediately: and

Notify the employee that the Branch Manager or delegate will contact him/her again after they have more information available on the recommended absenteeism and arrangements.

If the employee is not at work, follow the above steps and advise the employee not to attend work until instructed (information as per DHS advice).

5. Branch Manager or delegate to ensure the absenteeism register is completed (and maintained) by the nominated branch Business Continuity Coordinator – See Appendix D: Staff Absenteeism Register. (Doc # 4186741)

6. If applicable, Branch Manager or delegate to undertake further identification of close contacts and arrange for these individuals to be informed that they have been in contact with a suspect case. The necessary advice should be provided to these contacts, as per instructions from DHS (Refer to DHS Fact Sheet below “Information for people who may have been exposed to pandemic influenza and are isolated”) This will involve asking close contacts to go home, closely monitor their health and if they begin to feel ill, seek immediate medical advice and advise the Branch Manager.

Fact_sheet_3_Info_for_exposed__and__isolated.pdf

CoM Corporate BCP

7. Branch Manager or delegate to register illness with HR by sending the absenteeism register to HR - Team Leader HR Consultancy (See Appendix D: Staff Absenteeism Register);

8. Branch Manager or delegate to arrange for clean up of person’s workstation/ area, including area where staff member may have been isolated from other staff members. (Contact Spotless 1800 689 366);

9. HR to review return to work policy. (Currently the DHS period of exclusion for influenza is “exclude until well”. This may reviewed by DHS during a pandemic influenza outbreak.)

CLOSE CONTACT - The definition of a close contact is likely to change once the transmission characteristics of the pandemic strain are known and depending upon the phase of the pandemic. The below definition is a draft guideline. A close contact is defined as:

people who have been within one metre contact with an infectious case including physical contact or exposure to their respiratory droplets or droplet nuclei; or

people who have spent more than 15 minutes in a confined space with the infectious person. This time period may be adjusted following consideration of the room size, ventilation, humidity and the number of people in the room.

CoM Corporate BCP

APPENDIX D - Staff Absenteeism Influenza Pandemic Register template This form is to be completed by the Branch Manager and/or Business Continuity Coordinator and forwarded to Team Leader, Human Resources Consultancy upon daily notifications of staff members reporting pandemic illness. For a copy of the template please refer to DM # 4988370

Division Branch Work Area Employee

Name Pandemic response and recovery role

Absent from work (yes/no)

Employee Suspect case or *close contact

Influenza confirmed by doctor (yes/no)

Date Absent

Expected Return

**Period of Exclusion met before return to work

EXAMPLE: Corporate Services

Financial Services

Strategic Procurement

Emma Smith

Contact Manager of Essential Service – waste collection

Yes Reported illness from home.

Suspect Case

Case confirmed

1/05/09

11/05/09

Yes returned to work on 15/05/09 **Complete once staff return to work

*CLOSE CONTACT - The definition of a close contact is likely to change once the transmission characteristics of the pandemic strain are known and depending upon the phase of the pandemic. The below definition is a draft guideline. A close contact is defined as:

people who have been within one meter contact with an infectious case including physical contact or exposure to their respiratory droplets or droplet nuclei; or

people who have spent more than 15 minutes in a confined space with the infectious person. This time period may be adjusted following consideration of the room size, ventilation, humidity and the number of people in the room.

**PERIOD OF EXCLUSION – The definition for the exclusion period for influenza is “exclude until well”. This period may be reviewed once the infectious period for pandemic influenza is determined.

CoM Corporate BCP

APPENDIX E - CoM Notification Form: Suspected Influenza at Work This form is to be completed by the Branch Manager and/or Business Continuity Coordinator and forwarded to the Team Leader, Human Resources Consultancy. (For a copy of the template please refer to DM #4988370)

Details of Affected Employee

Name: Branch: Location of work area(s) of employee (Building, Floor, Room)

Job Title: Area of Responsibility: (Service provider)

Location of isolation area:

Address (home): Telephone No: (w): (h): (m): personal email: Symptoms noticed:

Fever • Body Aches • Cold •

Headache • Fatigue •

Dry Cough • Others • Details: ___________________

Time of fever on-set: ________________ am / pm Date: _______________ Time of isolation: ________________ am / pm Date: _______________ Travel History over the past 8 days: Countries visited (if applicable): Flights taken (if applicable): Where Referred & Information Issued:

Details of Reporter

Name: __________________________ Job Title: ____________________________ Branch: _____________________ Telephone Contact No: (w) _______________________ (h) ____________________ (m) __________________

CoM Corporate BCP

APPENDIX F - CoM Communication & Information Systems Outage Protocols

The loss of communication and/or information systems at the CoM could severely impact operations. Potential delays or disruptions could result in systems being unavailable for a matter of minutes, hours or days depending upon the scale of the incident or emergency. In the event of a delay or disruption, BIS will activate the Information Technology Disaster Recovery Plan (IT DRP) to reinstate the communication and information systems. It is important to note that BIS will prioritize the order in which programs are recovered. Please refer to “A2. LOSS OF ACCESS TO COMMUNICATION/INFORMATION SYSTEMS: Impacts and Recovery Strategies”.

Work expectation

In the event of a delay, disruption or partial loss of the communication and/or information systems:

staff are NOT permitted to go home;

when and where possible and depending upon systems availability, staff must continue with computer work;

staff must continue with work using manual procedures and other activities if the systems are completely unavailable; and

staff may be required to use their mobile phones (for which, they will be reimbursed).

Manual procedures

In the event of a delay or disruption to communication and/or information systems staff are required to continue with work using manual procedures that are listed in their Business Impact Assessment.

These may include activities such as:

filing

conducting a spring clean; and

manually completing computer tasks that would normally be automated

For example: Manually complete an insurance claim so that it may be entered in to the data system once the computers are back on line.

CoM Corporate BCP

APPENDIX G - Contact List

Note – confidential details of key contacts have been deleted in this edition of the BCP.

Police/Fire/Ambulance 000

CoM Security Control Centre 9658 9774

In an emergency 9658 9999

Municipal Emergency Management Planning (MEMP) Committee

Crisis Issues Management Team (CIMT)

Business Continuity Coordinators (BCCs)

Work areas involved in continuity, response and recovery management

CoM Corporate BCP

APPENDIX H - Facilities Management BCRP Accommodation Strategy

In the event of an emergency or crisis, CoM Facilities Management will identify, coordinate and advise of alternate recovery and work locations for all CoM work areas. Please see the table below for the Facilities Management Business Continuity Recovery Plan Accommodation Strategy.

TIME ACTION STRATEGY Up to 24 Hours Send staff home

Key personnel only Establish how long access is restricted 1) return next day 2) return one week

Up to one week

Non essential staff: Work from home Sharing of desks Alternatives in CoM buildings Convert meeting rooms Use Service providers offices Annual leave Key Personnel:

find desks

Review /confirm time before return

Over one week Review alternatives Up to six weeks Serviced offices

Sharing of desks (shifts) Working from home

Review /confirm time before return

Over 6 weeks Seek to lease alternative space Note: Insurance cover is in place for consequential loss/business interruption, including the procurement of alternative temporary accommodation and the provision of relevant equipment. The level of cover is subject to terms of the insurance policy.

CoM Corporate BCP

APPENDIX I - CoM Crisis/Issues Management Flowchart

CoM Corporate BCP

APPENDIX J - CoM Essential Service Matrix

Essential Service Matrix DM # 4179062