Marsh - School Business Continuity Plan

• Name of School

• Date Written

  Date

• Plan Owner

• Plan Writer

• Version Number

• Review Schedule

  6 Monthly

  Annually

• Date of Plan Review

  Date

• Date of Plan Exercise

  Date

• Plan Storage Details

• Prepared by

VERSION CONTROL

• Check to display additional guidance

• This template and associated guidance has been designed to complement and enhance existing Local Authority procedures and guidance, such as those covering Educational Visits and Health and Safety in Education Premises. It does not supersede those procedures or any existing arrangements for contacting key partners and the Emergency Services during a critical incident.
  
  Although the template has been produced with Schools and other Educational settings in mind, it serves as a generic template for Business Continuity Planning and should be adapted to meet your individual School’s needs.
  
  As a user of the Business Continuity Plan you must familiarise yourself with the whole document upon receipt of it, and wherever necessary, raise any queries immediately with the Plan Owner.

Version Control

• Date

  Date

• Change Details

• Approver

Plan details

• Plan Owner

• Plan Writer

• Version Number

• Review Schedule

  6 Monthly

  Annually

• Date of Plan Review

  Date

• Date of Plan Exercise

  Date

• Plan Storage Details

1.0 PLAN PURPOSE AND SCOPE

• Purpose: To provide a flexible framework to manage the response to any school disruption or emergency maintain critical activities and recover from the incident quickly and efficiently.

• Links to other Plans and Procedures:
  • The Business Continuity Plan may be activated in the event of a highly significant disruption impacting on one/a number of schools. Examples could include major ICT outage, pandemics, industrial action, natural disasters, terrorist attack etc.
  • In the event of a serious emergency, the Council’s emergency response arrangements may be activated alongside the Council’s Corporate Business Continuity Plan to enable the delivery of Local Authority civil protection duties.

• Details of coordinated plans with partners or suppliers if appropriate

• Details of any documented procedures that support the operation of this plan

2.0 PLAN ACTIVATION

• Check to display additional guidance

• Circumstances:
  This Plan will be activated to manage the response to any incident causing significant disruption to normal service delivery, particularly the delivery of key/time critical activities. Plan activation triggers may include:
  
  • Loss of key people or skills e.g. above normal levels of absenteeism due to illness/injury or other scenarios such as severe weather, changes in service structures, major transport disruption, emergency response duties, or people leaving the organisation.
  
  • Loss of critical systems e.g. ICT network disruption, telephony outage, power outage, utilities disruption or third party supplier disruption.
  
  • Denial of access, or damage to, facilities e.g. loss of a building through fire or flood, an external emergency where emergency service cordon would prevent access for a period of time, utilities failure. You may also require the activation of continuity arrangements in the event of an office move.
  
  • Loss of a key resource such as an external supplier or partner vital to the delivery of a key service or activity

• Notification Procedures
  
  Who? and Why?
  Headteacher - Take the decision on whether the Business Continuity Plan should be activated and direct resources. The Headteacher will normally be the ‘Plan Owner’. See section 1.3 for more detail on plan activation.
  
  Board of Governors - Responsible for strategic decisions in response to significant incidents.
  
  
  Stakeholders/ Partners - If the incident is causing significant disruption, an appropriate message should be released to stakeholders/partners detailing:
  • What is causing the disruption and the impact
  • Action being taken to respond to the incident
  • Estimated length of the disruption and return to business as usual.

• Authority for Plan Activation (other than the Plan Owner) Details of circumstances when the Plan is activated by someone other than the Plan Owner and details of personnel whom have been given delegated authority

2.1 PLAN ACTIVATION PROCESS

3.1 INCIDENT MANAGEMENT PHASE

• Purpose
  • Protect the safety and welfare of staff, visitors and the public
  • Protect vital assets e.g. equipment, data, reputation
  • Ensure urgent and necessary communication takes place
  • Support the Business Continuity phase
  • Support the Recovery and Resumption phase
  
  If the disruption is not a ‘no notice’ emergency, section 4.0 will be of more relevance to you.

• 1. Make a quick initial assessment:<br>• Survey the scene/situation<br>• Assess the impact on pupils and staff<br>• Assess (i.e. scale/severity, duration & impact)<br>• Disseminate information (to others)<br>• Call the Emergency Services if needed<br>• Evacuate the school building if necessary

  Done

  Not Done

• Action: Gather and share information to facilitate decision-making and enhance the response. A full impact assessment form can be found in Schools Business Continuity Plan Guidance.

• 2. Nominate individuals to carry out Incident Management roles, as appropriate.

  Done

  Not Done

• Action: Information on roles and responsibilities can be found in Schools Business Continuity Plan Guidance.

• 3. Ensure a log of key decisions and actions is started and maintained throughout the incident

  Done

  Not Done

• Action: The Log template can be found in Schools Business Continuity Plan Guidance.

• 4. Where appropriate, record names and details of any staff or pupils that may have been injured or affected by the incident as part of your incident record keeping.

  Done

  Not Done

• Action: This information should be held securely as it may be required by Emergency Services or other agencies during or following the incident.

• 5. Log details of all items lost by pupils, staff, visitors etc as a result of the incident, if appropriate

  Done

  Not Done

• Action: The Log template can be found in Schools Business Continuity Plan Guidance.

• 6. Assess the key priorities for the remainder of the working day and take relevant action

  Done

  Not Done

• Action:
  
  Consider actions to ensure the health, safety and well-being of pupils, staff and the wider school community at all times. Consider your business continuity strategies, i.e. alternative ways of working, re-location to your recovery site etc to ensure the impact of the disruption is minimised.
  
  Consider the school’s legal duty to provide school meals to some pupils and how this will be facilitated, even in the event of emergency school closure.
  
  Business Continuity Strategies are documented in Section 5.

• 7. Log all expenditure incurred as a result of the incident and seek advice/inform Marsh Education Practice

  Done

  Not Done

• Action: Record all costs incurred as a result of responding to the incident. The Financial Expenditure Log can be found in Schools Business Continuity Plan Guidance.

• 8. Consider your communications strategy to ensure staff and pupils are kept informed about what is required of them. If the incident is taking place outside of normal working hours, staff may need to be contacted to advise of any alterations to normal working arrangements for the next day.

  Done

  Not Done

• Action:
  
  All staff member’s emergency contact details should be held securely electronically as well as in a hard copy as part of your plan. Ensure parents/carers contact details are also available.
  
  Template for your contact lists are contained in Schools Business Continuity Plan Guidance

• 9. Ensure recording processes are in place for staff/pupils leaving the site

  Done

  Not Done

• Action: Ensure the safety of staff and pupils before they leave the site and identify suitable risk control measures as required.

4.1 BUSINESS CONTINUITY PHASE

• Purpose:
  • To ensure that ‘critical activities’ are resumed as quickly as possible and/or continue to be delivered during the disruption
  • To activate one or more of your business continuity strategies to enable alternative ways of working
  • To make best use of potentially limited resources by suspending ‘non critical’ activities

• Time Critical Service Functions: The outcome of the Business Impact Analysis process has been to identify the following service activities as time critical/urgent: (Details)

• 1. Take time to understand and evaluate the impact of the incident on ‘business as usual’ activities by communicating with key stakeholders to gather information. <br><br>It may be useful to refer back to your Business Impact Analysis to review recovery time objectives and resource requirements for your most critical activities.

  Done

  Not Done

• Action: Depending on the incident, you may need additional/specific input in order to drive the recovery of critical activities. This may require the involvement of external partners.

• 2. Plan how critical activities will be maintained, utilising pre-identified or new business continuity strategies (see section 5.3 for your pre-identified strategies).

  Done

  Not Done

• Check to display additional guidance

• Action:
  
  Consider:
  • Immediate and ongoing priorities
  • Communication strategies
  • Resource availability
  • Deployment of resources
  • Roles and responsibilities
  • Finance
  • Monitoring the situation
  • Reporting
  • Stakeholder engagement
  • Any welfare issues
  • Planning the recovery of non critical activities

• 3. Identify any other stakeholders who may be required in the business continuity response

  Done

  Not Done

• Action: Depending on the incident, you may need additional/specific input in order to drive the recovery of critical activities; this may require the involvement of external partners.
  Refer to your key contacts list in the Schools Business Continuity Plan Guidance.

• 4. Log all decisions and actions, including what you decide not to do and include your decision making rationale.

  Done

  Not Done

• Action: The Log of Events, Decisions and Actions can be found in the Schools Business Continuity Plan Guidance.

• 5. Log all financial expenditure incurred as a result of the incident

  Done

  Not Done

• Action: Use the Financial Expenditure Log which can be found in the Schools Business Continuity Plan Guidance.

• 6. Deliver appropriate communication actions as required

  Done

  Not Done

• Action: Ensure methods of communication and messages are developed as appropriate to the needs of your key stakeholders e.g. Pupils, Staff, Partners/Carers, Governors, Suppliers, Local Authority, Central Government Agencies etc.

4.2 BUSINESS CONTINUITY STRATEGIES

• Purpose
  
  • To document alternative ways of working designed to maintain your critical activities in the event of a disruption
  • To ensure alternative ways of working have been agreed, tested and are fit for purpose

• Circumstances when business continuity strategies may be activated
  
  Whatever the cause of disruption, the impacts will generally be one or more of the below categories:
  • Loss of key people or skills e.g. above normal levels of absenteeism due to illness/injury or other scenarios such as severe weather, changes in service structures, major transport disruption, emergency response duties, people leaving the organisation etc
  • Loss of critical systems e.g. ICT network disruption, telephony outage, power outage, utilities disruption, third party supplier disruption etc
  • Denial of access, or damage to, facilities e.g. loss of a building through fire or flood, an external emergency where emergency service cordon would prevent access for a period of time, utilities failure etc. You may also require the activation of continuity arrangements in the event of an office move
  • Loss of a key resource such as an external supplier or partner vital to the delivery of a key activity

TACTICAL OPTIONS TO MITIGATE AGAINST A LOSS OF PREMISES

• 1. Identification of alternative locations designated as the agreed ‘work area recovery site’. You will need to consider transport requirements and accessibility for these identified premises. You may need to have multiple places agreed for your work area recovery if you have large premises and these different options will need to be documented.<br>You may find it helpful to categorise available sites according to the following:<br>• ‘cold’ sites - has no equipment/furniture/computer systems set up but can be re-fitted in the event it is needed. This obviously means it takes longer to make ‘fit for purpose’ following an incident.<br>• ‘warm’ sites - usually these sites will have hardware and connectivity already established though may take some time to be fit for purpose.<br>• ‘hot’ sites - is essentially a duplicate of the original site, with full computer systems as well as near complete back-up of user data, but may not match the capacity of the original site.

  Done

  Not Done

• 2. Creating an emergency ‘grab bag’ that contains essential information and equipment needed for both incident management and business continuity, and should be stored in a secure place on and off site. The contents of the bag should be the responsibility of a named person and should be regularly checked and updated. See Schools Business Continuity Plan Guidance.

  Done

  Not Done

• 3. Mutual support agreements with schools where there is capacity for schools to accommodate each other in the event of an incident.

  Done

  Not Done

• 4. Virtual learning environment opportunities

  Done

  Not Done

• 5. Localising the incident, e.g. isolating the problem and utilising different sites or areas within the school premises portfolio

  Done

  Not Done

• 6. Off site activities e.g. physical activities, school trips

  Done

  Not Done

TACTICAL OPTIONS TO MITIGATE AGAINST A LOSS OF CRITICAL ICT SYSTEMS (INCLUDING TELEPHONY)

• 1. Flexible lesson plans

  Done

  Not Done

• 2. Use of a secure external network, virtualised network or secure cloud that can be accessed via the internet to allow extra back up and protection for your files

  Done

  Not Done

• 3. Manual workarounds: ensure there is a record of where pre-printed forms etc are stored and that there are procedure guides to inform their use where necessary

  Done

  Not Done

• 4. Access systems via the internet outside of your network for secure, cloud based applications.

  Done

  Not Done

• 5. Ensure that anyone who requires ICT to undertake critical activities has the Ability to work at home where possible and appropriate. Ensure that critical equipment is taken home where practical and possible and consider procuring mobile equipment for these users.

  Done

  Not Done

• 6. Using different ways of working. This could include: changing work patterns, suspending ‘non critical’ activities to focus on your priorities and assist the recovery of critical systems in the first instance with a phased approach for all other ICT ‘non critical’ activities.

  Done

  Not Done

TACTICAL OPTIONS TO MITIGATE AGAINST A LOSS OF STAFF OR SKILLS

• 1. Use of temporary staff (teaching/non teaching)

  Done

  Not Done

• 2. Multi-skilling/cross training to ensure staff can undertake different roles and responsibilities. This could involve identifying deputies /job shadowing/staff undertaking temporary additional duties

  Done

  Not Done

• 3. Using different ways of working to allow for a reduced workforce. This could include:<br>Use of pre-prepared educational materials that allow for independent learning<br>Team activities and sports to accommodate larger numbers of pupils at once<br>Larger class sizes (subject to relevant ratios)<br>Virtual learning environment opportunities

  Done

  Not Done

• 4. Suspending ‘non-critical’ activities to focus on your priorities

  Done

  Not Done

• 5. Using mutual support agreements with other schools to focus on your priorities

  Done

  Not Done

• 6. Ensuring that the business continuity aspects of staff management are considered in all management arrangements, e.g. managing attendance, job descriptions, contractual requirements etc.

  Done

  Not Done

TACTICAL OPTIONS TO MITIGATE AGAINST A LOSS OF A KEY SUPPLIER, THIRD PARTY OR PARTNER AGENCY

• 1. Pre-identified alternative suppliers

  Done

  Not Done

• 2. Ensuring all external providers have a Business Continuity Plan in place and you understand the impact to their plan on the delivery of your critical activities in the event of an incident

  Done

  Not Done

• 3. Insurance cover

  Done

  Not Done

• 4. Using mutual support agreements with other schools

  Done

  Not Done

• 5. Using alternative ways of working to mitigate the loss, e.g. suspending activities.

  Done

  Not Done

5.0 RECOVERY AND RESUMPTION PHASE

• Purpose
  • To return to ‘business as usual’ as quickly as possible
  • To ensure any non critical activities suspended as part of your business continuity response are recovered within appropriate timescales
  • Where the impact of the incident is prolonged, normal operations may need to be delivered under new circumstances e.g. from a different building on a longer term basis.

• 1. Agree and plan the actions required to enable recovery and resumption of normal working practises

  Done

  Not Done

• Action: Agreed actions will be detailed in an action plan and set against timescales with responsibility for completion clearly indicated.

• 2. Continue to record all expenditure incurred as a result of the incident

  Done

  Not Done

• Action: Use the Financial Expenditure Log to record any expenditure which can be found in the Schools Business Continuity Plan Guidance

• 3. Respond to any ongoing and long term support needs of Staff and Pupils.

  Done

  Not Done

• Action: Depending on the nature of the incident, the schools Incident Management Team may need to consider the use of health services, for example counselling.

• 4. Once recovery and resumption actions are complete, communicate the return to ‘business as usual’.

  Done

  Not Done

• Action: Ensure all staff are aware that the Business Continuity Plan is no longer in effect.

• 5. Carry out a ‘debrief’ of the incident with Staff and Suppliers/Partners if appropriate.<br>Complete a post incident report to document opportunities for improvement and any lessons identified.

  Done

  Not Done

• Action: The incident de-brief report should be reviewed by all members of the Schools Incident Management Team to ensure that key actions resulting from the incident are implemented within designated timescales.

• 6. Review this Business Continuity Plan in light of lessons learned from the incident and the consequent response to it

  Done

  Not Done

• Action: Implement recommendations for improvement and update this Plan.

• Name and Signature

  Sign