Business Continuity Policy

Our Commitment

We are committed to:

1. Resilience — Building the capability to withstand and adapt to disruption
2. Preparedness — Planning for potential disruptions before they occur
3. Response — Responding quickly and effectively when incidents happen
4. Recovery — Restoring normal operations as rapidly as possible
5. Communication — Keeping stakeholders informed throughout any disruption
6. Continuous Improvement — Learning from incidents and testing to improve our capabilities

Scope

This policy covers:

• All business operations and locations
• All services we deliver to clients
• All employees, contractors, and subcontractors
• Critical suppliers and third parties
• IT systems and infrastructure
• Premises and facilities
• Communication systems

Business Continuity Objectives

Our business continuity objectives are:

Business Continuity Framework

Our business continuity framework is based on ISO 22301 principles.

Framework Components

Critical Business Activities

We have identified our critical business activities and their recovery requirements.

Critical Activities

Recovery Time Objectives (RTO)

Recovery Point Objectives (RPO)

Risk Assessment

We assess risks that could disrupt our operations.

Threat Categories

Risk Assessment Process

For each threat, we assess:

• Likelihood of occurrence
• Potential impact on operations
• Existing controls and mitigations
• Residual risk level
• Additional actions required

Key Risks and Mitigations

Business Continuity Plans

We maintain documented plans for responding to disruptions.

Plan Structure

Plan Contents

Each plan includes:

• Activation criteria and triggers
• Roles and responsibilities
• Escalation procedures
• Response actions and checklists
• Resource requirements
• Communication templates
• Recovery procedures
• Return to normal operations

Plan Ownership

Incident Management

We have clear procedures for managing disruptive incidents.

Incident Classification

Incident Management Team

For significant incidents, we activate an Incident Management Team (IMT):

Incident Response Process

Phase 1: Alert and Activation

1. Incident reported and logged
2. Initial assessment of severity
3. Incident Manager notified
4. Decision to activate business continuity plans
5. Incident Management Team convened if required

Phase 2: Response

1. Immediate actions to protect life and safety
2. Containment actions to limit damage
3. Assessment of impact and recovery needs
4. Activation of relevant continuity plans
5. Resource mobilisation
6. Stakeholder communication initiated

Phase 3: Recovery

1. Recovery actions implemented
2. Workarounds and interim solutions
3. Progressive restoration of services
4. Ongoing communication with stakeholders
5. Monitoring of recovery progress

Phase 4: Return to Normal

1. Full restoration of services
2. Stand-down of incident management
3. Post-incident review
4. Lessons learned documented
5. Plans updated based on learning

IT Disaster Recovery

Our IT systems are critical to service delivery.

IT Recovery Strategy

Backup Strategy

IT Recovery Procedures

Cyber Incident Response

In the event of a cyber attack:

1. Isolate affected systems
2. Notify IT and Incident Manager
3. Assess scope and impact
4. Activate IT Disaster Recovery Plan
5. Notify relevant authorities (ICO if data breach)
6. Communicate with stakeholders
7. Recover from clean backups
8. Investigate root cause
9. Implement additional controls

Premises Continuity

We plan for loss of or denial of access to our premises.

Premises Recovery Strategy

Alternative Working Arrangements

Alternative Premises

Remote Working Capability

All office staff are equipped to work remotely:

• Laptops with VPN access
• Cloud-based applications
• Mobile phones
• Video conferencing
• Access to job management and email
• Secure remote access

Workforce Continuity

We plan for significant staff unavailability.

Workforce Risks

Key Roles and Deputies

Cross-Training

• Critical functions have multiple trained staff
• Documented procedures for key activities
• Regular knowledge sharing
• Succession planning for key roles

External Resources

Supply Chain Continuity

We manage supply chain risks.

Critical Suppliers

We have identified suppliers critical to our operations:

Supply Chain Mitigations

Supplier Relationships

• Key supplier relationships documented
• Emergency contact details maintained
• Regular supplier reviews
• Supplier business continuity assessed
• Contractual provisions for continuity

Communication

Effective communication is essential during disruptions.

Communication Principles

• Timely — communicate early and often
• Accurate — provide factual, verified information
• Consistent — single source of truth
• Appropriate — tailor messages to audience
• Two-way — listen and respond to concerns

Stakeholder Communication

Communication Templates

We maintain templates for:

• Staff notification messages
• Client notification letters
• Supplier notifications
• Holding statements
• Recovery updates

Contact Information

We maintain up-to-date contact lists:

• Employee emergency contacts
• Client contacts (multiple per client)
• Supplier emergency contacts
• Subcontractor contacts
• Regulatory body contacts
• Insurer contacts
• Emergency services

Out-of-Hours Communication

• On-call manager rota for 24/7 response
• Emergency contact number for critical issues
• Escalation procedures documented
• Mobile phones for key personnel

Pandemic Response

We have specific arrangements for pandemic situations.

Pandemic Response Measures

Control Measures

Service Prioritisation

During severe workforce shortage:

1. Priority 1: Emergency repairs, gas safety, fire safety
2. Priority 2: Other safety-critical services
3. Priority 3: Urgent repairs
4. Priority 4: Planned maintenance

Severe Weather Response

We plan for disruption from severe weather.

Weather Risks

Weather Monitoring

• Daily weather forecast review
• Met Office warnings monitored
• Proactive rescheduling when warnings issued
• Communication with clients about potential delays

Winter Preparedness

• Gritting of depot and parking areas
• Winter equipment for vehicles
• Cold weather PPE for operatives
• Frozen pipe response procedures
• Increased parts stock for heating repairs

Testing and Exercising

We regularly test our business continuity arrangements.

Testing Programme

Test Objectives

• Validate plans are current and effective
• Identify gaps and weaknesses
• Train staff in their roles
• Test communication and coordination
• Verify recovery capabilities

Test Records

• Test objectives and scope documented
• Outcomes and observations recorded
• Issues and improvement actions logged
• Follow-up actions tracked to completion
• Lessons incorporated into plans

Training and Awareness

We ensure people understand their business continuity roles.

Training Programme

Awareness Activities

• Policy communication to all staff
• Regular reminders and updates
• Lessons learned from incidents shared
• Participation in exercises

Roles and Responsibilities

Managing Director

• Overall accountability for business continuity
• Final decision-making during major incidents
• Resource allocation for continuity capabilities
• Annual review and approval of policy

Operations Director

• Day-to-day responsibility for business continuity
• Chair of Incident Management Team
• Ensuring plans are in place and tested
• Reporting on continuity performance

Plan Owners

• Maintaining and updating assigned plans
• Ensuring team awareness and training
• Participating in tests and exercises
• Implementing improvements

All Managers

• Understanding business continuity plans
• Ensuring team awareness
• Participating in exercises
• Reporting incidents and concerns

All Employees

• Understanding their role during disruptions
• Following instructions during incidents
• Reporting potential issues
• Participating in training and exercises

Insurance

We maintain insurance to support recovery.

Insurance Coverage

Insurance Claims

• Report potential claims to Finance Lead immediately
• Document losses and damage
• Preserve evidence where possible
• Cooperate with insurers
• Maintain records of additional costs

Continuous Improvement

We continuously improve our business continuity capabilities.

Improvement Sources

• Post-incident reviews
• Exercise findings
• Audit and assessment results
• Near-miss analysis
• Industry best practice
• Regulatory changes
• Client feedback

Post-Incident Review

After any significant incident:

• Review meeting held within 2 weeks
• What happened and timeline
• What went well
• What could be improved
• Root cause analysis
• Actions assigned and tracked
• Plans updated based on lessons

Performance Indicators

Compliance and Audit

Regulatory Requirements

We meet business continuity requirements in:

• Client contracts (SLA commitments)
• ISO 9001 (quality management)
• ISO 27001 principles (information security)
• Data protection (availability of personal data)
• Industry regulations

Audit

Policy Review

This policy is reviewed annually and updated to reflect:

• Changes in business operations
• Lessons learned from incidents and exercises
• Changes in risks and threats
• Audit findings
• Regulatory and client requirements
• Best practice developments

Related Documents

This policy should be read in conjunction with:

• IT Disaster Recovery Plan
• Incident Management Plan
• Pandemic Response Plan
• Severe Weather Plan
• Premises Continuity Plan
• Communication Plan
• Health and Safety Policy
• Cyber Security Policy
• Data Protection Policy

Approval

This Business Continuity Policy has been approved by the Managing Director.

Signed:

[Name] Managing Director All Services 4U

Date: [Date]

Review Date: [Date + 1 year]

Contact

Business Continuity Lead Email: continuity@allservices4u.co.uk Phone: [Phone number]

Incident Reporting (24-hour) Phone: [Emergency number]

Quick Reference

Incident Reporting

Report any disruption or potential disruption immediately:

Phone: [Emergency number] Email: incidents@allservices4u.co.uk

Critical Services

Key Contacts

Your Role

✓ Know your responsibilities during disruptions
✓ Report incidents and potential issues immediately
✓ Follow instructions from the Incident Management Team
✓ Keep your contact details up to date
✓ Participate in training and exercises
✓ Be flexible and adaptable

All Services 4U is committed to maintaining services to our clients even in challenging circumstances. Our business continuity arrangements ensure we are prepared, can respond effectively, and recover quickly from disruptions.