business continuity plan in education

• (888) 244-1912
• [email protected]

• Understanding Business Continuity vs BDR: A Guide
• About Invenio IT
• Business Continuity

Business Continuity in Education & Acing Your School’s Disaster Response

• February 10, 2023

Imagine that you’re a school administrator finishing up a busy day of meetings with board members, reviewing curriculum changes, and approving facilities plans. As you start to shut down your computer, a message appears. Your systems have been hacked, exposing the data of thousands of students, faculty, and staff, and the attackers are demanding a staggering ransom. While this scenario might seem farfetched, it’s become reality for many school leaders around the world, and it’s the reason why business continuity in education has never been more important.

To establish a solid system of business continuity, academic institutions must first understand why it’s needed. In this article, we’ll explore the types of threats schools face and explain why a business continuity plan is one of the strongest tools you can employ against them.

Why Education Is a Target for Cyberattacks

Let’s begin with ransomware, which is one of the most dominant threats to every school. Modern cyber-criminals have good reasons for setting their sights on the education sector. Schools have not only a moral obligation but also a legal responsibility to protect student data. With accounting systems, student records, payroll, and financial data all at risk, hackers are willing to bet that schools will be willing to put up a substantial payment to restore their data.

Recent history has shown that schools will indeed pay when they feel it’s necessary. In 2021, a school district in San Antonio, Texas, paid more than half a million dollars to prevent hackers from releasing sensitive data. The district has since faced significant criticism, but it’s far from the first academic institution to make a desperate choice, and it’s unlikely to be the last.

Types of Threats in Education

Ransomware is only one part of the picture.

At a time when everything is stored digitally, data in higher education has become incredibly valuable, and the risks have grown in kind. From community colleges to elite private universities, all schools need to be prepared for a wide variety of adverse situations, including:

• Malware attacks and viruses
• Human errors like accidental file deletion
• Phishing attacks
• Misconfigured data migrations or overwrites
• Hardware failures
• Application crashes

Additionally, there’s the risk of physical damage to infrastructure through events like fires, floods, and tornadoes, which pose a hazard not only to your data but also to students, staff, and visitors.

All of these concerns should inform your institution’s business continuity planning. Weaknesses in any one area could spell disaster for an ill-prepared university.

Why Business Continuity in Education Is Essential

Whether a school experiences a cyber-attack or a natural disaster, the consequences can be far-reaching. Business continuity planning helps protect academic institutions from significant hardships in an increasingly more threatening landscape.

Ransom Attacks

Colleges and schools across the country have experienced a surge in ransomware attacks in recent years. While not every school has agreed to meet the attackers’ demands, many find themselves feeling pressured to pay in order to protect and restore their data.

Consider these alarming statistics from a recent study conducted by Sophos :

• 66% of higher education institutions experienced a ransomware attack in 2021 compared to 44% in 2020.
• 50% of higher education organizations paid ransom demands to restore their data, but only 2% recovered all their data after paying.
• Recovery rates for education are slow, with 9% of organizations saying that their recovery periods ranged between 3 and 6 months.

These statistics represent the real-life experiences of schools throughout the United States that have suffered as a result of ransomware. For instance, in the summer of 2022, the Cedar Rapids school district paid an undisclosed ransom to prevent hackers from releasing stolen data. Public school districts are notoriously underfunded, and ransomware attacks can put a significant burden on their budgets and on local taxpayers.

Ransomware attacks on colleges often operate on a larger scale. In 2021, a massive cyberattack affected hundreds of organizations , including California State University, Stanford University’s School of Medicine, and Yeshiva University in New York City. The hackers in this case stole private information from students, faculty, and staff, and in some cases shared screenshots of private data online. These hacks can cause schools long-lasting reputational damage and put them at risk of regulatory penalties.

Experts warn that college ransomware attacks are on the rise as hackers deploy more targeted attacks in hopes of securing larger ransom payments. In 2022, 44 universities and colleges reported experiencing ransomware attacks, and this number likely only represents a fraction of the actual incidents. Many organizations never report cyber-attacks and attempt to resolve them quietly without the public’s knowledge to avoid damage to their reputation.

Closure Risks

In late 2021, Lincoln College in Illinois received a ransom note stating that school administrators no longer had access to student enrollment, admissions, and fundraising data. The college paid a ransom through its cyber insurance policy, but doing so didn’t grant staff immediate access to their files. Instead, they struggled for months to fully recover. Ultimately, as a result of the attack, they permanently  closed their doors in May 2022 .

Lincoln College isn’t alone. A total of 48 colleges closed in 2022 , a notable uptick from 35 colleges in 2021. The closures are a result of a combination of factors, including the COVID-19 pandemic, cyber-attacks, reduced enrollment, and lost funding. Experts anticipate that closures will continue to rise, particularly among small schools that serve specific student populations. These schools, which tend to enroll fewer than 1,000 students, are the most at risk of being shuttered by an unexpected disaster.

A 2020 study by U3 Advisors found that the majority of colleges have increasing debt levels and decreasing revenues, which places them in an especially vulnerable position. The study also revealed that approximately 560 schools in higher education are at serious risk of closure or consolidation within the next several years even without taking into account the impact of COVID-19.

Even a single ransomware attack or extended period of downtime could be enough to force a small college to permanently close its doors, which is why schools of every size need to take continuity planning seriously.

How to Create a Business Continuity Plan for Colleges

Colleges and universities must have detailed plans for preventing, responding to, and recovering from a multitude of disaster scenarios. The foundation of this planning is a  business continuity plan (BCP). A BCP for colleges is much like the kind you would create for any other organization. It’s a comprehensive document that outlines all the systems and protocols for mitigating the impact of a disruption.

Consider Departmental Specifics

At a college, some departments may require their own specific continuity planning. For example, Alabama Crimson Tide’s multimillion-dollar football program may have completely different continuity objectives than its admissions department. However, even when department-specific plans are in place, there should still be a single college-wide BCP that provides a continuity framework for all other units to follow.

Incorporate Key Categories

A BCP is often a lengthy document that encompasses every aspect of disaster prevention and response. While every BCP should be developed according to the specific needs of the institution, these are some of the core categories that should be included in every plan:

• Plan objectives:  Identify what the plan aims to achieve and what its areas of focus are. You may need separate plans for disaster planning and IT-specific concerns.
• Key contacts : Establish who wrote the plan, who maintains it, and which stakeholders to inform first when it’s time to activate your recovery plans.
• Risks : Conduct an assessment of all likely disaster situations that pose a threat to a university’s operations, systems, or people.
• Impact : Analyze how each risk will negatively impact the organization.
• Prevention : Describe implemented systems and protocols for preventing disruptions from occurring.
• Response : Detail immediate steps for mitigating a disaster situation, assessing the damage, and getting people to safety.
• Recovery : List the procedures for fully restoring systems and operations.
• Contingencies : Compile a list of secondary resources, equipment, or locations that staff can utilize if primary means are destroyed or inaccessible.
• Communication : Outline how recovery personnel will remain in contact and communicate important status updates to all affected parties, including students, staff, parents, and visitors.
• Recommendations : Suggest improvements and solutions for weaknesses that your team has identified in the existing continuity planning.
• Plan review schedule : Create a timeline for reviewing the plan and making updates on a regular basis throughout the year.

Each of these categories serves a unique purpose within your BCP and allows you to develop the best possible system for protection and recovery. The risk assessment and impact analysis are arguably the most important components of a business continuity plan. Without them, you’ll never truly know which disaster scenarios to prepare for or how they would disrupt the school. Let’s dig a little deeper into these two categories.

Assess the Risks

It might seem logical to assume that all colleges face the same risks, but it’s critical for each institution to conduct an individual, specific assessment. While many institutions share the same common risk types, such as cyberattacks and power outages, some schools are naturally more prone to experience certain disruptions than others.

For example, schools located along the southeastern U.S. coastline will be more at risk of hurricanes, while universities in southern California will be more at risk of earthquakes. Other types of threats may seem more benign, but they can still cause significant disruptions. Consider large-scale political demonstrations and student sit-ins and how they might affect your school’s ability to operate. Each school will have its own unique risks, which is why it’s important to assess them all individually.

Understand the Impact

An impact analysis helps a higher education institution understand exactly how each threat would negatively affect operations. Negative outcomes can manifest in some ways that are obvious and others that are more unexpected. These are some of the most common impacts that your BCP should address:

• Anticipated length of the outage or interruption
• Cost of downtime, idle staff, and wages
• Cost of recovery and repairs
• Effects on classes, enrollment, and other operations
• Long-term effects on school funding and reputation

A thorough impact analysis will consider all these factors and how they translate into actual monetary costs.

Regardless of whether a university is public, private, for-profit, or non-profit, continuity planning is a matter of survival. Like any organization, schools must focus on continuity and the bottom line. A failure to understand the impact of a major disaster could spell doom, especially for an already struggling college.

How to Reduce Damage from Disasters

Schools may be facing unprecedented threats on multiple fronts, but there are ways to minimize the risks at your institution. Taking some fundamental steps will lower the chance that the effects will be insurmountable when a disaster arrives.

Perform Frequent Data Backups

When it comes to protecting your school’s data, backups have a vital role to play. Without them, institutions leave themselves open to the risk of prolonged downtime when data loss inevitably happens. Data loss and downtime are costly , often to the tune of millions of dollars, and higher education organizations have a lot at stake.

Consider the impact of a ransomware attack that blocks access to all student applications and records within an admissions department or the loss of financial aid applications and award statuses. Even a single accounting spreadsheet that somebody accidentally deletes can derail an entire department for days.

A recent study found that education institutions lost $3.56 billion to downtime caused by ransomware in 2021. The longer this downtime lasts, the more expensive it becomes. Using a reliable data backup solution  helps ensure that you can restore your data and get systems back up and running as quickly as possible. With high-quality data backup services, schools can also back up their files every few minutes to prevent gaps in their data restoration.

Prepare for Natural Disasters

Natural disasters pose a risk to both people and IT systems.

In preparation for a hurricane or blizzard, schools often cancel classes and close administrative offices. While this itself is an operational disruption, it’s also smart planning. Closing campuses leading up to a weather event ensures the safety of staff and students by allowing them to stay home or evacuate.

Behind the scenes, schools also take other precautions. In the event of a hurricane, for example, colleges face the risk of severe flooding and the potential for damage to IT infrastructure. They can keep their critical data secure by storing backups off-site, away from the physical threat of the storm, and using hybrid cloud backups . These backups store data in two locations: on campus for the fastest possible recovery speeds and in the cloud for added protection against on-site events.

Plan for Degraded Service in Addition to Full Recovery

Keep in mind that instant recovery from a major disaster is an unrealistic goal for any school, no matter how prepared. Your continuity planning needs to outline how critical functions should continue at a degraded service level.

First, identify which operations are most vital. In other words, determine which functions cannot be disrupted under any circumstances. Then identify what’s needed to keep those operations running at a minimum level, such as technology, equipment, personnel, and electricity.

Each operation, and indeed each unit of the college, will have its own requirements. To make full recovery a reality, you must have proper planning to keep these essential functions active while your systems are impaired.

Quickly Initiate Emergency Responses

The moments immediately following a disaster will almost always dictate the speed and success of the recovery. If steps aren’t taken quickly to assess the situation and mitigate the damage, then recovery efforts will stretch out longer. Schools with solid business continuity planning can activate disaster-response protocols right away, which substantially increases the odds of a full recovery.

Effectively responding to various types of disasters is challenging without a detailed emergency response plan. Designated recovery teams should know exactly what to do after a disruption, whether it’s people-focused (i.e. seeking safety for students) or IT-related (i.e. restoring a backup after data loss).

Take Advantage of Business Continuity Resources and Tools

Schools play a central role in students’ academic and social development, and business continuity is just one piece of a complex puzzle that ensures students receive the best possible experience in a safe environment free of disruptions or delays. If your school needs to implement strong continuity planning and systems, the experts at Invenio IT are happy to help.

Looking for a better data backup solution to protect student and staff information?  Request a free demo  of advanced data backup solutions that can protect against data loss, ransomware, and downtime. Or reach out to our business continuity team to learn more about disaster recovery and creating a BCP that works best for your school.

Join 23,000+ readers in the Data Protection Forum

Related articles.

The Essential (and Best) Guide to All Datto SIRIS Models

Where’s My Data? 411 on Datto Locations around the Globe

BCDR Faceoff: How Do Datto Competitors Stack Up?

2023 Guide to Datto SaaS Protection for M365 and Google Workspace

Do you know what makes Datto Encryption So Secure?

Cybersecurity.

© 2023 InvenioIT. All rights reserved.

You are using an outdated browser. Please upgrade your browser or activate Google Chrome Frame to improve your experience.

BCI Regional Awards Now Open

The BCI Regional Awards 2024 are now open for nominations.

BCI World Hybrid 2024 Call for Presentations

Do you have an interesting story, case study, or practical advice you would like to share at BCI World Hybrid 2024?

BCI Emergency & Crisis Communications Report 2024

The BCI is pleased to launch the 10th edition of its Emergency and Crisis Communications Report

Good Practice Guidelines (GPG) Edition 7.0 - Arabic

The latest edition of the global guide to good practice in business continuity is now available in Arabic

CBCI Refresher Course

Bridge the knowledge gap between the GPG 2018 and GPG 7.0

BCI Mentoring

The BCI has partnered with PushFar to provide a career progression and professional mentoring software platform.

Leading the Way to Resilience

Join other business continuity professionals and resilience thought-leaders.

What is The BCI?

The BCI is the global membership association of choice for business continuity and resilience professionals. With 9,000 members in more than 120 countries, we provide education, training & certification, membership, thought leadership, events, and more.  Find out more about what the BCI can do for you by following the links below… 

Looking to become a Member? Learn more here

Learn more about our training courses here.

Thought Leadership

Explore our reports & content here.

View all upcoming events here

Our mission:.

Through the excellence of our renowned education & training courses, our global network of BCI Members , the strength of our relationships , and the extensive foresight of our thought leadership , together with our members we work to build a world where organizations are resilient .

Never heard of business continuity before? Click here to learn all you need to know…

Answers to your sleepless nights

The BCI Regional Awards 2024 are now open

The stages of crisis management testing

The BCI announces fee update

BCI Competency Framework 2024 Aligned to the GPG 7.0

• Reference and Guides

GPG Edition 7.0 - PP1 – Establishing a business continuity management system

Navigating Supply Chain Challenges

Eventi estremi e come gestirli - Climate change. Un rischio sempre più sistemico

Preparing for DORA: Automating ICT Risk Management for Operational Resilience

BCI Emergency & Crisis Communications Report 2024 Americas Launch

BCI Emergency & Crisis Communications Report 2024 APAC Launch

BCI Membership Roadshows - Americas

BCI Membership Roadshows - APAC

BCI Membership Roadshows - EMEA

BCI Italian Chapter fireside chat

Experience Convene Learn how Convene can give your boards a superior meeting experience. Enquire for a free demo with no cost or obligation.

Best Practices in Business Continuity Planning for Higher Education

• by Tanecia Jackson on October 01, 2020
• last update on December 28, 2023
• Reading Time: 4 minutes

Higher education has taken the brunt of COVID-19 . As classes transitioned to the online medium and campuses emptied, universities were left to find new ways to improve current and future operations. Inevitably, business continuity for higher education institutions is now a much-discussed topic among university boards.

Playing the role of microcities, universities embrace a wide array of functions that are often deeply ingrained into local communities, the economy, and the healthcare system. Bearing that in mind, universities need to develop comprehensive business continuity plans to ensure their own short-and long-term welfare and the stakeholders’ .

Here are the best practices in business continuity planning for higher education institutions.

Prepare a Special Task Force

Establishing a special task force is critical to respond to any crisis effectively—the task force steps in when a disaster situation requires a swift and decisive response.

The task force should consist of multidisciplinary professionals. Distributed across specialist work teams, these professionals use their expertise to define the scope of a disaster and design a mitigating plan, both short- and long-term .

The work teams in a task force are led by an integration team, which manages and coordinates the work of those teams.

Example of work teams that could be included in a special task force:

• Finance and legal
• Faculty and staff
• Teaching and research
• External communications
• Internal communications
• Campus operations

Note : The exact combination of work teams depends on the size of the institution and the range of its operations.

Develop a Comprehensive Communication Plan

With multiple stakeholders involved in the operation of every university, a communication plan will help address the uncertainties that are bound to amount during a crisis.

It’s important to have regular communication with all stakeholders. A communication plan should have directions and steps for various scenarios (even those unlikely ones). The goal of every communication plan is to:

• Provide reassurance
• Give accurate information regarding the crisis
• Describe mitigating actions that the stakeholders should take

Note : Use secure and collaborative communication tools to help key decision-makers act swiftly. Consider video conferencing for a more engaging experience.

Account for Financial Issues

A plan of action regarding the financial situation of a higher education institution is one of the key elements of a business continuity plan.

You should develop both short- and long-term plans with potential financial consequences and solutions across different scenarios.

Specifically, you should prepare for:

• A COVID-19 outbreak on campus and the funds necessary to continue operations
• Stockpiling supplies (incl. services and equipment)
• IT cybersecurity needs to support social distancing while delivering online classes
• Potential staff reduction and the necessity to support critical staff

Collaborate and Partner with Other Institutions

The COVID-19 crisis has affected higher education institutions across the whole globe. This opens up a wide range of collaboration opportunities between institutions .

These collaboration efforts could include:

• Exchange of information to facilitate crisis response and risk management
• Creation of strategic partnerships to support initiatives (e.g., online learning)
• Repurposing campus space to aid the government in the fight with the crisis

Safeguard the Health and Well-Being of the Vulnerable

Some students might lack the resources to participate in online learning. The transition to online coursework could also result in a greater discrepancy between students who struggle academically and those performing well.

There can also be students for whom a return home is difficult (e.g., international students). Furthermore, some students may have on-campus employment, which can be disrupted if the campus shuts down.

Prepare a comprehensive assessment and response plan that addresses the well-being of the vulnerable. Also, consider the concerns of graduating seniors, faculty, and critical staff since they, too, are affected by the crisis.

Act Quickly but with a Future-Proof Mindset

While it’s critical to control the immediate effects, university leaders should also keep in mind that the short-term decisions will greatly impact long-term responses.

The key is to plan the resumption of in-person classes under different scenarios. For example, use work teams to prepare appropriate action decisions. These decisions should support the overarching strategy for future-proofing the university’s operations .

Analyze and reconsider how to deliver student experiences and approach admissions, testing, and graduation in the new reality.

Guard Values and Principles

During a crisis such as the COVID-19 pandemic, where the disease originated in China, it’s important to have the capacity to deal with potential xenophobic responses on campus.

University leaders should actively dispel misinformation . The goal is to strengthen a university’s values and principles, for example, respect, tolerance, and understanding toward fellow students.

Be active in speaking out against stereotypes and discrimination and supporting affected groups.

Planning Business Continuity for Universities

When developing a business continuity plan for a university, keep in mind that the plan should contain guidance and information describing how to restore critical operations. However, the overarching goal of a business continuity plan is to fortify the university for the future. Long-term resilience can be achieved through a regular assessment of the plan and the introduction of necessary updates . Set aside time slots during board meetings for discussions on business continuity planning. Communicate with stakeholders using convenient and beneficial communication tools to increase collaboration.

Read: Your Guide to Creating Business Continuity Plans

Convene for Higher Education

Used by top universities worldwide, Convene is a board portal meeting and collaboration tool that allows higher education boards to lead and direct regardless of location effectively. Whether it’s to organize board or department meetings, send across curricula for approval, or gather feedback from colleagues, Convene has universities covered.

Learn how Convene supports business continuity for higher education institutions.

Tanecia is a current Chief Governance Officer at Convene with former experience working as a Cybersecurity Manager. She is a renowned advisor when it comes to corporate governance, board oversight, resource allocation, and risk management plans for organizations. In her work, she also helps shed light on strategies that can be done to ensure effective governance, while minimizing overall regulatory risk in the company’s cybersecurity projects.

Related Articles

How University Boards Are Adopting Digital Transformation

Essential Business Continuity Tools For Organizations

Is Technology the Key to Business Continuity?

Take your organization’s meetings to the next level.

Learn how Convene can give your boards a superior meeting experience. Enquire for a free demo with no cost or obligation.

Become an Insider

Sign up today to receive premium content.

Considerations for K–12 Administrators to Improve Business Continuity Planning

Even the best-laid plans of mice and men often go awry.

If the pandemic has made one fact clear, it’s that planning for an uncertain future is difficult to do. Schools have come a long way from the tumultuous days of required remote learning, yet — as districts look ahead — the uncertainty remains. Planning for the coming school year could prove to be just as challenging.

Although the requirement to create learning continuity plans was tied to the implementation of emergency remote learning, business continuity plans are a long-standing approach to maintaining the integrity of a business. Be it fire, cyberattack, the loss of a key employee or the onset of a pandemic, difficult situations are inevitable; a business continuity plan can enable organizations to deal with the fallout. Districts that have a plan in place have already identified ways to minimize risk before a problem occurs and what to do in the worst-case scenario.

Click the banner  below to access customized content and exclusive interviews with industry experts.

To better coordinate for the coming year — or even the next semester — administrators should work with the IT teams and other departments in their districts. This will help them understand the full scope of the district’s needs and challenges, such as the extent of the burnout causing  widespread staffing shortages in K­–12 schools . Here are other key takeaways for the business continuity plan process.

Considerations for School Leaders Creating Business Continuity Plans

Consider what the worst-case scenario might be, and prepare for that. Figure out what would require the most work, the most technology and the most preparation. It is always better to be overprepared than caught off guard.

If district leaders are prepared for business continuity in the event of the worst-case scenario, and they don’t need to enact all of their plans, they will have an a la carte menu of solutions to choose from, and will have the freedom to choose the options that work best for their situation, whatever that looks like next year.

When creating a plan, district leaders should also remember  the total cost of ownership for technology solutions . This includes all the components necessary to make the device functional as intended.

The total cost of ownership also encompasses solutions to get new tech up and running, and keep it that way. This means that districts need to consider professional development for users, IT knowledge and resources when it comes to troubleshooting and repairs, and more. Factoring in this total cost will give administrators a clearer idea of their budgets now and in the coming years for accurate business continuity planning.

DISCOVER:  Districts use IT investments to boost the bottom line amid tight budgets.

There are also  technology lifecycle  considerations to remember with new tech purchases. Once it’s been purchased, school IT teams need plans for integration and adoption phases. Beyond that, how will the technology be maintained, repaired, retired and refreshed? These factors can all affect a district’s business continuity, particularly in the event of a disaster, as seen with COVID-19. Subsequently, these factors also affect the post-disaster process. In some cases, they prevent districts from going back to business as usual; instead, rebuilding with something better than before, if possible.

State and Local Requirements Factor into Planning Logistics

In addition to the aforementioned considerations and takeaways, schools also need to look at their state and local requirements for planning.

There may be a specific template districts need to use or specific information they must be sure to include. Administrators should look at  whether spending needs to be justified on the front end or the back end .

California, for example, requires districts to create  a Local Control and Accountability Plan . This requires schools to set goals, create action plans, provide data, and show how they want to achieve their goals and why. The LCAP also requires districts to hold community listening sessions in which they explain their plan and solicit feedback. This allows stakeholders to have a voice in the plan and the decisions being made.

Once created, the LCAP functions as the district’s funding plan, so it’s important for schools in the state to make their planning decisions carefully. The LCAP, and other states’ requirements, can guide districts to improved business continuity planning.

Stopgap Measures to Improve Business Continuity in the Short Term

Administrators who find they haven’t planned appropriately for the current year should look at what they need most urgently to maintain business continuity in the coming semester. They should determine their priorities for the spring and figure out — of the things they would like to improve — what actions most closely align with those priorities. Those are the improvements they need to make; everything else should be let go.

WATCH NOW:  Innovate on a small budget with a limited IT staff. 

It may seem necessary to put resources into creating a short-term fix for numerous concerns, but in the long run it will be more beneficial to focus time and money on only the most crucial changes. In trying to fix everything, districts may wind up fixing nothing. Instead, it’s best to focus on the changes that provide the best ROI for learning and the ROI for time.

If schools focus on high-quality, technology-enhanced instruction, they will improve learning outcomes no matter what model they’re using. Educators should be set up to use technology in a way that is most advantageous for what they’re trying to teach.

Ultimately, everything comes down to, how does this help all students access a high-quality education? How does it relate back to students needing to have access to school? Students — what they are learning and what schools are trying to teach them — should always be at the center of any decision-making processes.

This article is part of the “ ConnectIT: Bridging the Gap Between Education and Technology ” series. Please join the discussion on Twitter by using the   #ConnectIT   hashtag.

• Business Continuity

Related Articles

Unlock white papers, personalized recommendations and other premium content for an in-depth look at evolving IT

Copyright © 2024 CDW LLC 200 N. Milwaukee Avenue , Vernon Hills, IL 60061 Do Not Sell My Personal Information

• Buildings & Facilities
• CommuterChoice
• Energy & Utilities
• Real Estate
• Sustainability
• Transit & Fleet

Departments

Energy & facilities.

• Events Management
• Global Support Services
• Harvard Faculty Club
• Harvard International Office
• Harvard Real Estate
• Harvard University Housing
• Office for Sustainability

Transportation

Business Continuity

Lab safety guidelines & sops.

Business continuity focuses on planning efforts that keep Harvard’s critical functions operational during and after disruptive incidents. It connects the emergency response and recovery phases in the emergency management cycle.

Proper business continuity planning improves Harvard's chance of minimizing losses from interruptions by keeping business like teaching and research running.

Schools and departments can use our central tools, templates, applications, and support to help develop their own business continuity program and plan.

Department Contact

Brian Mazmanian 617-495-2062 brian_mazmanian@harvard.edu

Did You Know?

There is a Harvard University Critical Position Policy . For a quick overview, watch the following video.

• Building Maintenance
• Fire Safety
• Shuttle Information
• Evening Van Service

University Operations Center

• Building Automation
• Fire Alarm Reporting
• Wireless Communication

Education Business Continuity Plan Template

What is an Education Business Continuity Plan?

An education business continuity plan outlines the strategies, actions, and processes that educational institutions, schools, and universities can take to ensure the continuity of academic programs, student services, and administrative operations during emergencies or disruptions. This plan helps to ensure that students are not adversely affected, that student progress is monitored, and that students and staff are supported.

What's included in this Education Business Continuity Plan template?

• 3 focus areas
• 6 objectives

Each focus area has its own objectives, projects, and KPIs to ensure that the strategy is comprehensive and effective.

Who is the Education Business Continuity Plan template for?

This Education Business Continuity Plan template is for educational institutions, schools, and universities that are looking to develop their business continuity plans. This template provides a framework for defining focus areas and objectives, setting measurable targets (KPIs), implementing related projects, and tracking results.

1. Define clear examples of your focus areas

Focus areas are the areas of your organization that need to be addressed in order to achieve the objectives of your business continuity plan. Examples of strategic focus areas that could fall under an Education Business Continuity Plan could be: Continuity of Academic Programs, Continuity of Student Services, and Continuity of Administrative Operations.

2. Think about the objectives that could fall under that focus area

Objectives are the goals you want to achieve within each focus area. Examples of some objectives for the focus area of Continuity of Academic Programs could be: Ensure students are not adversely impacted, and Monitor student progress.

3. Set measurable targets (KPIs) to tackle the objective

KPIs (key performance indicators) are measurable targets that can be used to track progress towards achieving objectives. Examples of KPIs may include the number of online courses, the number of students using a tracking system, or the number of student inquiries.

4. Implement related projects to achieve the KPIs

Projects (actions) are the activities that need to be implemented in order to achieve the KPIs. Examples of projects may include online learning, an online tracking system, or a student support services helpline.

5. Utilize Cascade Strategy Execution Platform to see faster results from your strategy

Cascade Strategy Execution Platform is a solution that helps educational institutions, schools, and universities to develop and manage their business continuity plans. Cascade’s intuitive platform helps to define focus areas and objectives, set measurable targets (KPIs), implement related projects, and track results.

Business Continuity in Higher Education

In just the past few years, higher education has faced a wide range of incidents and emergencies, including: 

• Earthquakes
• Campus shootings
• Civil unrest
• Power outages
• Chemical, biological, and radiological hazards. 

Having a business continuity plan helps maintain services in an emergency. Being prepared is not just a great idea; it should be expected. Not being prepared for foreseeable events and disasters can harm the institution, faculty, staff, and students. 

What Is Business Continuity?

Business continuity is an institution’s ability to continue performing critical functions after an emergency, whether natural or human-made. A business continuity plan dictates the clear steps the institution will take when faced with those emergencies. This can help higher education institutions (particularly private universities) avoid bankruptcy and financial problems if they lose just a semester or more of tuition. 

Due to limited budgets, creative solutions are needed in business continuity planning for higher education to address new threats. In traditional continuity planning, businesses are able to afford full redundancy for all functions and information technology. That luxury is not affordable or available for most higher education institutions. 

Why Should You Include a Business Continuity Plan? 

Business continuity plans in higher education help improve risk management and ensure your institution rebounds and continues to function. They focus on identifying key assets that are critical to providing necessary services as well as identifying the key risks to those vital assets and processes. 

Without risk management and a business continuity plan, institutions are faced with a longer recovery period after an emergency, which can lead to reduced income, donations, and support for the institution. It can also lead to a critical pause in education and research, which can have significant and long-lasting consequences.

What Makes a Great Business Continuity Plan in Higher Education?

The three keys to success in business continuity planning are training, drills, and exercises. Business continuity in higher education is more than just a document that can sit on a shelf and be forgotten about. It is a living plan that is practiced, revised, and improved. 

Practicing your plan is vital to its success because it maximizes awareness of the plan and increases its overall effectiveness and efficiency. If faculty and staff are not aware of your continuity plan when it comes time to implement it, they will not fully understand their role or responsibilities. 

Kuali Ready

Higher education is faced with maintaining critical services like student residents, clinical services, academic instruction, research, and special events security that have no comparison or equal in traditional business organizations. Kuali Ready is built to help address those unique elements of higher education, the organizational structure in higher ed, and is designed to help maintain a business continuity plan for higher education institutions.

‍ Sign up for your demonstration today to see how it can help you manage your complex responsibilities with structured importable data, plan status reports, and more.

REQUEST A DEMO

Let's setup a time to see Kuali in action!

• Search Search Please fill out this field.
• Business Continuity Plan Basics
• Understanding BCPs
• Benefits of BCPs
• How to Create a BCP
• BCP & Impact Analysis
• BCP vs. Disaster Recovery Plan

Frequently Asked Questions

• Business Continuity Plan FAQs

The Bottom Line

What is a business continuity plan (bcp), and how does it work.

Investopedia / Ryan Oakley

What Is a Business Continuity Plan (BCP)? 

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

Key Takeaways

• Business continuity plans (BCPs) are prevention and recovery systems for potential threats, such as natural disasters or cyber-attacks.
• BCP is designed to protect personnel and assets and make sure they can function quickly when disaster strikes.
• BCPs should be tested to ensure there are no weaknesses, which can be identified and corrected.

Understanding Business Continuity Plans (BCPs)

BCP involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy. Risks may include natural disasters—fire, flood, or weather-related events—and cyber-attacks . Once the risks are identified, the plan should also include:

• Determining how those risks will affect operations
• Implementing safeguards and procedures to mitigate the risks
• Testing procedures to ensure they work
• Reviewing the process to make sure that it is up to date

BCPs are an important part of any business. Threats and disruptions mean a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition. It is generally conceived in advance and involves input from key stakeholders and personnel.

Business impact analysis, recovery, organization, and training are all steps corporations need to follow when creating a Business Continuity Plan.

Benefits of a Business Continuity Plan

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic. Business continuity planning is typically meant to help a company continue operating in the event of major disasters such as fires. BCPs are different from a disaster recovery plan, which focuses on the recovery of a company's information technology system after a crisis.

Consider a finance company based in a major city. It may put a BCP in place by taking steps including backing up its computer and client files offsite. If something were to happen to the company's corporate office, its satellite offices would still have access to important information.

An important point to note is that BCP may not be as effective if a large portion of the population is affected, as in the case of a disease outbreak. Nonetheless, BCPs can improve risk management—preventing disruptions from spreading. They can also help mitigate downtime of networks or technology, saving the company money.

How To Create a Business Continuity Plan

There are several steps many companies must follow to develop a solid BCP. They include:

• Business Impact Analysis : Here, the business will identify functions and related resources that are time-sensitive. (More on this below.)
• Recovery : In this portion, the business must identify and implement steps to recover critical business functions.
• Organization : A continuity team must be created. This team will devise a plan to manage the disruption.
• Training : The continuity team must be trained and tested. Members of the team should also complete exercises that go over the plan and strategies.

Companies may also find it useful to come up with a checklist that includes key details such as emergency contact information, a list of resources the continuity team may need, where backup data and other required information are housed or stored, and other important personnel.

Along with testing the continuity team, the company should also test the BCP itself. It should be tested several times to ensure it can be applied to many different risk scenarios . This will help identify any weaknesses in the plan which can then be corrected.

In order for a business continuity plan to be successful, all employees—even those who aren't on the continuity team—must be aware of the plan.

Business Continuity Impact Analysis

An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis. The worksheet should be completed by business function and process managers who are well acquainted with the business. These worksheets will summarize the following:

• The impacts—both financial and operational—that stem from the loss of individual business functions and process
• Identifying when the loss of a function or process would result in the identified business impacts

Completing the analysis can help companies identify and prioritize the processes that have the most impact on the business's financial and operational functions. The point at which they must be recovered is generally known as the “recovery time objective.”

Business Continuity Plan vs. Disaster Recovery Plan

BCPs and disaster recovery plans are similar in nature, the latter focuses on technology and information technology (IT) infrastructure. BCPs are more encompassing—focusing on the entire organization, such as customer service and supply chain. 

BCPs focus on reducing overall costs or losses, while disaster recovery plans look only at technology downtimes and related costs. Disaster recovery plans tend to involve only IT personnel—which create and manage the policy. However, BCPs tend to have more personnel trained on the potential processes. 

Why Is Business Continuity Plan (BCP) Important?

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic and business continuity plans (BCPs) are an important part of any business. BCP is typically meant to help a company continue operating in the event of threats and disruptions. This could result in a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition.

What Should a Business Continuity Plan (BCP) Include?

Business continuity plans involve identifying any and all risks that can affect the company's operations. The plan should also determine how those risks will affect operations and implement safeguards and procedures to mitigate the risks. There should also be testing procedures to ensure these safeguards and procedures work. Finally, there should be a review process to make sure that the plan is up to date.

What Is Business Continuity Impact Analysis?

An important part of developing a BCP is a business continuity impact analysis which identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis.

These worksheets summarize the impacts—both financial and operational—that stem from the loss of individual business functions and processes. They also identify when the loss of a function or process would result in the identified business impacts.

Business continuity plans (BCPs) are created to help speed up the recovery of an organization filling a threat or disaster. The plan puts in place mechanisms and functions to allow personnel and assets to minimize company downtime. BCPs cover all organizational risks should a disaster happen, such as flood or fire.  

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15 - 17.

Ready. “ IT Disaster Recovery Plan .”

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15-17.

• Terms of Service
• Editorial Policy
• Privacy Policy
• Your Privacy Choices

How to Create a Business Continuity Plan

While risk is always a part of running a business, there are proactive steps you can take to identify and mitigate threats to your business. It begins with creating a BCDR—a Business Continuity and Disaster Recovery plan.

A BCDR outlines the key ways you will protect your business, ensure employee safety, and minimize financial loss. For example, imagine the financial impact on your business should a natural disaster make it impossible for your location to reopen for weeks or even months, as well as how the safety of employees and customers on the premises could be jeopardized.

Bad actors can also negatively affect your business financially and its reputation, simply by breaching your cyber security and stealing customer data. And it's not just big businesses that lose out — IBM's 2023 Cost of Data Breach report found that businesses with fewer than 500 employees paid an average of $3.31 million per data breach, averaging out to $164 per record. Your BCDR can outline your exposure, Cyber Liability insurance coverage, and the process you will put into action to communicate with your customers and protect them.

A Business Continuity and Disaster Recovery plan includes things like:

• An emergency response plan
• How you’ll backup and recover your electronic data
• Your communications protocols for various types of events
• The extent to which different types of potential financial losses are covered by insurance
• Who is responsible for various components of the plan — and more

Depending on your business, your business continuity and disaster recovery plan may need to account for multiple facets of operations. Read on to learn more about what a BCDR plan is, who needs one, and how to create one for your small business.

WHAT IS A BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN (BCDR)?

As the name implies, a BCDR outlines the tools, processes, and strategies a company will use to ensure its business operations continue and recover from disruptions that stop or slow operations. This includes both natural and non-natural disasters, such as:

• Floods or storms
• Cyberattacks
• Equipment or technology failures
• Some other unforeseen disaster or disruption

WHO NEEDS A BCDR?

Because disasters can occur in many forms and wreak havoc on your company’s finances, equipment, property, employees, and even safety, every organization should have a business continuity and disaster recovery plan in place — no business is exempt from unforeseen risks. As you create a BCDR for your small business, think about specific aspects of your company and its operations, and what types of risks it could face. Then come up with the strategies you will use to:

• Minimize interruptions to operations (i.e., when a disruption occurs, how quickly can your business resume operations?)
• Protect and recover critical processes and assets, like your ability to process payments or recover customer data
• Mitigate financial loss from the disruption or disaster, including through resuming operations and insurance coverage
• Make sure your employees and customers are safe
• Ensure compliance with your industry’s legal, regulatory, and best practice standards

9 STEPS FOR CREATING YOUR BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN

The specific components of your business continuity and disaster recovery plan will depend on your business and its size, scope, and operations. However, every BCDR should include the following:

1. Develop a Risk Assessment and Business Impact Analysis Statement

A risk assessment outlines the various disasters or disruptions that could affect your business and how your operations are vulnerable. The impact analysis explains the extent to which your business could be negatively impacted by an unforeseen disruption, such as the amount of daily revenue at risk, being unable to fulfill orders, or what your business stands to face in insurance claims from customer lawsuits resulting from being hacked, and so on.

2. Identify the Critical Functions of Your Business

What aspects of your business operations are critical or essential to its survival? List these functions (e.g., online orders, sales, payment processing, physical operations such as in-person retail sales, etc.) and then rank them in order of priority.

3. Establish a Data Backup and Recovery Process

Develop a backup and recovery process for your online business operations. This includes not only customer data, online sales, and payment processing, but also things like your website, email, and so on.

4. Outline Your Emergency Response Plan

List the types of immediate response actions you can take to ensure customer and employee safety in the event of a disaster or disruption. This includes things like calling 911, evacuating the building, and putting announcements on your website, social media, email autoresponders, and voice mail. It might also entail shutting down equipment or removing equipment, files, and physical assets from a location to keep them safe.

5. Create a Communication Plan

This part of your BCDR explains how you will communicate with employees, customers, suppliers, investors, and other stakeholders during a disaster. It should also outline who is authorized and responsible for ensuring the communication takes place and when it will occur (such as when and how you will announce a data breach or tell customers about your expected reopening after a flood).

6. Explain Your Recovery Strategies

This section of your business continuity and disaster recovery plan addresses both how you’ll continue operations (such as designating an alternative work location) as well as recovery strategies for data, technology, apps, and more.

In addition, financial recovery often requires that your business has adequate and appropriate insurance in place, so make sure you know what types of insurance your company needs. For example, if you're renting an office in a commercial building, your landlord may require that you list them as an Additional Insured and obtain Damage to Premises Rented coverage.

7. Identify the Disaster Recovery Team

For every continuity and recovery strategy you have, you should designate a person responsible for implementing and executing the tactics. If your business is small, you might be the disaster recovery team at first, but as it grows, so too will this team.

8. Test and Train

Remember those fire drills you had to do back in school? They were in place for a reason; a plan is only as good as its execution and results. For this reason, don’t assume that a plan on paper will work without testing it and training your team.

9. Regularly Review and Update Your Plan

Set aside time to review and update your plan at least annually and make it part of your process when growing your business. Any time you add new business functionality (such as expanding your online operation with a brick-and-mortar location) your plan may need to be updated to ensure that your company can recover from a disaster as quickly as possible.

No one wants to think about disasters that could take out their business. But it’s important that you do so that you can recover as quickly as possible and protect your business’ finances, assets, employees, and reputation. Creating a business continuity and disaster recovery plan is an essential piece of this puzzle.

Ready to document your BCDR plan? Download this Business Continuity and Disaster Recovery plan template and use it to jump-start your process. You'll also find a BCDR checklist and emergency planning guides there to help ensure your plan is as comprehensive as possible.

Did you find this article helpful?

You might also be interested in.

How to prepare your small business for unexpected setbacks

Follow these five tips to help prepare your small business for a variety of unexpected setbacks - from inflation, supply chain issues, staff turnover, and emergencies.

6 Strategies to Create a More Resilient Small Business

How to manage your small business in a cash crunch

To ensure you receive the best online experience, this website uses cookies. You can read about how we use them in our Privacy and Cookies Policy. 

• Skip to content
• Skip to search
• Staff portal (Inside the department)
• Student portal
• Key links for students

Other users

• Forgot password

Notifications

{{item.title}}, my essentials, ask for help, contact edconnect, directory a to z, how to guides, policy library.

Implementation Documents

• Business Continuity Management Guidelines (PDF 685 KB) Staff only
• Business Continuity Planning Toolkit and Template (DOCX 1277 KB) Staff only

Related Documents

• Business Continuity Response Team Charter (PDF 214 KB) Staff only

Business Continuity Management

This policy sets out the arrangements for the NSW Department of Education to ensure that critical services are maintained and restored following a disruptive event.

Changes since previous update

Changes since previous version

2020 Feb 18 - updated contact details and made minor style and editing changes.

Document history

2019 Jun 05 - Updates to reference the new Strategy and Delivery division and deputy secretary. Update reference to the revised risk standard ISO31000

A complete revision of the Guidelines: New toolkit and Business Continuity Plan template & New Business Continuity Response Team Charter.

Updated roles and responsibilities, simplified guidelines, revised toolkit and template and new Business Continuity Response Team charter.

Previously reviewed in 2012 to align with AS/NZS5050:2010

Superseded documents

• The department provides, funds and regulates education services for NSW students from early childhood to secondary school. The operational, financial, social and political consequences of a major disruption to critical services would be unacceptable.
• This policy and its supporting documents aim to ensure that the department has arrangements in place to prevent, prepare for, respond to and recover from a disruptive event so that critical business functions and services are maintained at an acceptable level.
• Senior executives (Deputy Secretaries, executive directors or directors) are required to assess and manage the risks of disruption to critical business functions for which they are accountable.
• Senior executives accountable for critical business functions are required to develop, maintain and test business continuity plans (BCPs) at least on an annual basis to ensure that essential services are maintained at an acceptable level during a major disruptive event, and restored to full functionality within an acceptable timeframe. This includes review of their business impact analysis to ensure all relevant critical business functions are captured in their BCP.
• Senior executives who are responsible for the delivery of one or more critical business functions are referred to as the business continuity owner of their BCP.
• Each BCP must identify the senior executive(s) with the authority to approve and activate (and deactivate) the relevant BCPs in the event of a localised business disruption.
• Each BCP must be approved by the business continuity owner and their deputy secretary.
• In the event of the disruption affecting a number of critical business functions in multiple divisions and affecting the operations of the department as a whole, the Executive Director, Policy Coordination and Governance will mobilise the Business Continuity Response Team (BCRT) to activate the department-wide Business Continuity Activation Plan (BCAP). The BCRT, led by the appointed incident controller will prioritise and coordinate the department's business continuity response and recovery efforts. The department-wide BCAP must be approved by the BCRT. The BCRT must activate (and deactivate) the department-wide BCAP in the event of a disruption that affects the operations of the department as a whole in accordance with the BCRT Charter.
• When a BCP is activated, senior executives must ensure that the required people, information, facilities, assets and other infrastructure are available to ensure business continuity and recovery. Staff must re-prioritise their efforts to the delivery of critical business functions and services and the recovery of normal business operations. The business continuity owner must also advise Corporate Governance (Policy Coordination and Governance directorate) when their BCP is activated as this may inform the activation of the department-wide BCAP.
• In the event that the incident endangers or threatens to endanger life, property or the environment, emergency management always takes priority over business continuity arrangements. BCPs are only activated once the health and safety of staff and bystanders have been assured.
• In the event of an emergency, the department is required to implement its emergency management plans, as required by the department's Emergency Management guidelines. Emergency management is handled by the department's Health and Safety directorate.
• In the event of an emergency affecting the operations of the department as a whole, the Emergency Planning and Response Committee will coordinate the department's emergency response.
• This policy applies to all business units with the department.
• The Business Continuity Management Policy is an essential element of the department's broader corporate governance, and Enterprise Risk Management framework.
• This policy is supported by the Business Continuity Management guidelines, toolkit and templates to assist with business continuity planning.
• This policy and guidelines reflect the international standard for business continuity management systems, ISO 22301:2012 and best practice.
• The Enterprise Risk Management Group and the Audit and Risk Committee oversee implementation of this policy.
• Staff also have responsibilities for identifying and managing risk under the department's Enterprise Risk Management Policy, and responsibilities relating to health and safety, emergency response planning and incident notification under the department's Work Health and Safety policy and Incident Notification and Response policy .
• Responsibilities and delegations
• ultimately accountable for risk management in the department, and must attest to NSW Treasury in relation to compliance with the eight core requirements of TPP15-03 Internal Audit and Risk Management Policy for the NSW Public Sector.

Executive Group

• approve any substantial amendments to the existing Business Continuity Management Policy and guidelines tabled by the Deputy Secretary, Strategy and Delivery.

Executive Director, Policy Coordination and Governance

• approves amendments to the existing Business Continuity Management Policy and guidelines or where amendments are substantial, takes an amended policy or guidelines to the Executive Group for approval via the Deputy Secretary, Strategy and Delivery
• develops and maintains the department-wide Business Continuity Activation Plan (BCAP) as the business continuity coordinator for the department-wide BCAP when the plan is not activated.

Deputy Secretaries

• communicating the value and importance of effective business continuity management
• ensuring that the resources needed for business continuity management are available
• ensuring that BCPs are developed and maintained
• approving BCPs for their division.

Business continuity owners (Deputy Secretary, executive directors or directors) (BCO)

• build awareness of this policy, and the value and importance of business continuity management
• nominate a business continuity coordinator and ensure they have the capabilities, training and experience for the role
• undertake a business impact analysis and risk assessment to identify the risks and impacts of disruptive events on critical business functions
• implement preventative controls and prepare a BCP to manage a disruptive event on critical business functions
• ensure BCPs and the required resources are available where and when they are needed, and are adequately protected against improper use
• ensure staff are aware of their roles in the event of a major disruption
• test and update BCPs (at least) annually
• advise Corporate Governance unit (Policy Coordination and Governance directorate) when their BCP is activated as this may inform the activation of the department-wide BCAP.

Business continuity coordinators (BCC)

• nominated by business continuity owners as the liaison person for business continuity management within each business unit. Business continuity coordinators support business continuity owners to manage disruption-related risks, including developing and maintaining the BCP(s) for the business unit.

Government schools

• under the department's Work Health and Safety Policy, all government schools must develop an emergency management plan. Additional procedures are also outlined for temporarily ceasing school operations due to an emergency. This includes business continuity arrangements that meet the requirements of this policy.
• ensure they are aware of their roles and responsibilities for business continuity management and participate in any training required
• when a BCP is activated, staff must re-prioritise their efforts to the delivery of critical business functions and services and recovery of normal business operations.

Corporate Governance Unit (Policy Coordination and Governance directorate)

• providing oversight across the department's BCPs, including the identification and management of interdependencies
• supporting business continuity owners and business continuity coordinators by providing high-quality guidelines, tools (including business continuity exercises to test the BCP) and training to support good practice
• reporting business continuity performance and compliance with this policy to the Audit and Risk Committee
• identifying and implementing continual improvements to the suitability and effectiveness of business continuity management in the department
• monitor the activated BCPs and advise the Executive Director, Policy Coordination and Governance to mobilise the BCRT if the disruption affects a number of critical business functions within multiple divisions
• support the Executive Director, Policy Coordination and Governance in their role as business continuity coordinators for the department-wide BCAP.

Business Continuity Response Team (BCRT)

• the BCRT comprises members of the Executive Group
• the BCRT, led by the incident controller, prioritises and coordinates the department's business continuity response and recovery efforts where the disruptive event impacts a number of critical business functions across multiple divisions
• approves the department-wide BCAP and authorises the activation and de-activation of the department-wide BCAP.

Incident controller

• appointed by the Secretary to lead the BCRT and coordinate department-wide business continuity management activities. The incident controller will be the business continuity coordinators when the department-wide BCAP is activated.

Enterprise Risk Management Group

• support the development, implementation and continuous improvement of the department's Business Continuity Management Policy and its application within their divisions.

Internal Audit

• provide assurance to the Secretary and the Audit and Risk Committee on the effectiveness of the Business Continuity Management Policy and supporting processes.

Audit and Risk Committee

• provides independent assistance to the Secretary by monitoring, reviewing and providing advice about the Business Continuity Management Policy, supporting documents and processes.

5. Monitoring and review

5.1 The Executive Director, Policy Coordination and Governance monitors the implementation of this policy, regularly reviews its contents to ensure relevance and accuracy, and updates it as needed.

Chief Risk Officer, Corporate Governance, Policy Coordination and Governance [email protected] 02 7814 1326

Processing Payment

• Take Courses
• Get Certified
• Attend Events
• Explore Resources
• The Foundation
• On-Demand Training

We offer a mix of in-person and online, instructor-led courses. Search courses for more information.

• Business Continuity
• Business Continuity Review

Advanced Continuity

• Mastering Business Continuity
• Continuity Audit
• Auditing a Business Continuity Program: ISO 22301
• Auditing a Business Continuity Program: NFPA 1600
• Cyber Resilience
• Cyber Resilience Review
• Healthcare Continuity
• Business Continuity for Healthcare
• Business Continuity for Healthcare Review
• Public Sector Continuity
• Public Sector Continuity Review
• Risk Management
• Risk Management for Business Continuity
• Risk Management for Business Continuity Review
• BCOE 0100: Understanding Professional Practice One
• BCOE 0200: Understanding Professional Practice Two
• BCOE 0300: Understanding Professional Practice Three
• BCOE 0400: Understanding Professional Practice Four
• BCOE 0500: Understanding Professional Practice Five
• BCOE 0600: Understanding Professional Practice Six
• BCOE 0700: Understanding Professional Practice Seven
• BCOE 0800: Understanding Professional Practice Eight
• BCOE 0900: Understanding Professional Practice Nine
• BCOE 1000: Understanding Professional Practice Ten
• Instructor-Led Training
• Healthcare Continuity Review
• Risk Management Continuity Review
• Master's Case Study Review
• IT Disaster Recovery Planning
• Crisis Communications
• Business Continuity for Insurance Professionals
• Managing BC Team Burnout
• Business Continuity Metrics
• Exercising a Business Continuity Plan
• What's New in Business Continuity?
• Business Impact Analysis
• Pandemic Preparedness for Organizations
• Business Continuity Overview
• Professional Examinations
• Qualifying Exam 2017 Version - Arabic
• Qualifying Exam 2017 Version - English
• Qualifying Exam 2017 Version - English (ADA Compliant)
• Qualifying Exam 2017 Version - Español
• Qualifying Exam 2017 Version - Français
• Qualifying Exam 2017 Version - Hebrew
• Qualifying Exam 2017 Version - Italian
• Qualifying Exam 2017 Version - Japanese
• Qualifying Exam 2017 Version - Português
• Qualifying Exam 2023 Version - English
• Qualifying Exam 2023 Version - English (ADA Version)
• Qualifying Exam 2023 Version - Português
• Master's Case Study Examination
• Specialty Examinations
• 2023 Audit Exam - ISO 22301
• 2023 Cyber Resilience Exam
• 2023 Cyber Resilience Exam-Japanese
• Audit Exam - CSA Z1600-17
• Audit Exam - ISO 22301
• Audit Exam - NFPA 1600
• Cyber Resilience Exam
• Cyber Resilience Exam - Japanese
• Healthcare Exam
• Public Sector Exam
• Risk Management Exam
• Workshop Examinations
• BCP BIA Exam
• BCP BIA Exam - Español
• BCP COMMS Exam
• BCP EXR Exam
• BCP IT/DR - Español
• BCP MET Exam
• BCP MET Exam - Español
• BCP MND Exam

See a summary of all our training options one page. All courses are currently available online.

The leader in business continuity education and certification across many industries, DRI International offers team training designed to fit the needs of every organization, from private corporations to the public sector and everywhere in-between.

DRI International offers colleges and universities the opportunity to familiarize their students with information on business continuity professions and certifications recognized by private and public sector organizations around the world.

• Individual Certification
• Organizational Certification
• Honor Society
• Center of Excellence in Resilience
• Resilient Enterprise

* DRI's three levels of certification are associate certified, certified and master certified. Certifications beginning with "A" are associate, "C" certified and "M" master.-->

Certification is a two-part process; verification of knowledge and confirmation of experience.

A DRI International certification is the most widely recognized and respected business continuity certification in the world. DRI only certifies professionals that have demonstrated both knowledge and experience in the business continuity and/or disaster recovery profession.

Learn more about how to unlock your DRI digital badge and display your DRI certification to enhance your online professional profile today.

Maintaining your DRI International certification carries two requirements; an annual maintenance fee as well as Continuing Education Activity Points (CEAP).

• Annual DRI Conference
• Agenda/Program
• Awards of Excellence
• Submit a Nomination
• Past Award of Excellence Winners
• Collegiate Conferences
• Past Webinars
• Resilience Excellence Summit

Learn more and register for this free online event March 1-3, 2021!

Be a part of the premier business continuity conference. Join us at DRI2025 in Las Vegas, Feb. 2-5, 2025. Check back for more information.

We speak at numerous industry events around the globe and engage with our community in a variety of ways. Find out where you can meet DRI at these upcoming events.

Join us for the must-attend DRI annual conference for business continuity and resilience professionals taking place in Las Vegas, Nevada Feb 17-20, 2019.

• Professional Practices
• Government/Policymakers
• Digital Badges
• RFP Assistance
• Drive en Español
• Advertising in Drive
• Scholarships
• High School/College
• Veterans Outreach Program
• Women in Business Continuity Management
• Certified Professionals
• Certified Vendors
• Hiring Resources
• Hiring Guide
• Local Language Information

Through committees and other initiatives, we publish research and insights about the profession. Explore our library and other resources.

DRI International webinars cover vital resilience issues, engaging and informing professionals in the field. See what's coming up next and view previously broadcast presentations here.

Learn how to hire the right business continuity professionals that will enable your organization to withstand any crisis and come through even stronger with the DRI Hiring Guide. Download now.

• Our Mission
• Annual Review
• Leadership and Staff

Testimonials

• Diversity and Inclusion
• International Partners
• United Kingdom
• Collaborative Partner Organizations
• DRI in the News
• Press Releases
• What is BCM?

BCM is a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience.

We reach out and engage as many audiences as possible using broad media coverage to provide a forum for discussion. We serve as a trusted resource to other professions and the general public.

We speak at numerous industry events around the globe and engage with our community in a variety of ways. Find out where you can meet DRI.

DRI International Accessibility Statement

DRI International is committed to ensuring that individuals with disabilities can access the content offered through our website, www.drii.org .

If you are having trouble accessing www.drii.org , you can email [email protected] for assistance. Please put "ADA Inquiry" in the subject line of your email and we will assist you.

Payment Receipt

Conference orders.

Master's Case Study Review

Track: Advanced Continuity Course Title: Mastering Business Continuity (Exam Prep) Course ID: BCP 601 Relevant Certifications (requires additional step): MBCP Duration: 2 Days (Two full days of instruction 8:30 a.m. – 5:00 p.m.; Examination online at your leisure) Prerequisites: 5 years of business continuity experience; passing score on the DRI Qualifying Examination for Business Continuity Management 16 Continuing Education Activity Points (CEAPs) may be awarded toward recertification if applicable. The cost of this course includes both the course and the exam. A certificate of completion for the course will only be delivered once the exam is completed and payment has been received. Exam results will then be released. Cost: $1,950.00

Description

1. Review the elements of a disaster/emergency management and business continuity program, as defined by the DRI International Professional Practices for Business Continuity Management. 2. Understand industry terminology in the Professional Practices. 3. Become proficient in methods for creating and managing a planning project. 4. Understand the actions taken within a hypothetical business continuity planning case. 5. Prepare to pass the Master’s Case Study Examination with a minimum passing grade of 75%.

This course consists of 10 problem solving exercises through which you will apply your knowledge of the Professional Practices and business continuity management. Based on a hypothetical entity, the exercises are challenging and thought-provoking. The course addresses all phases of business continuity planning, disaster recovery, and emergency management as follows: 1. Introduction and Overview 2. Program Management 3. Risk Assessment 4. Business Impact Analysis 5. Business Continuity Strategies 6. Incident Preparedness and Response 7. Plan Development and Implementation 8. Awareness and Training Programs 9. Business Continuity Plan Exercise/Test, Assessment and Maintenance 10. Crisis Communications 11. Coordination with External Agencies and Resources Sections two through 11 consist of a thorough Professional Practice review, its corresponding problem description and discussion, a rigorous problem-solving exercise you complete individually, a critique of your solution, and a review of a correct solution to the problem. ------- For in-person courses: This course will be held in-person and the exam will be online, at leisure. A computer is required for this course in order for you to take the exam. The system requirements will be sent to you via email together with information about how to access the course materials prior to the start of the course. For courses held online: All online courses are held via Zoom and a computer is required for this course. The system requirements will be sent to you via email together with information about how to access the course materials prior to the start of the course. You will also be provided with instructions for how to take the exam online, at leisure following the course. For international courses: This course is being hosted by a DRI International partner. To register, you will be asked to provide your contact information and we will put you in touch with the local team for details. For courses held pre-conference: This course is being held in-person prior to the DRI Annual Conference at or near the conference venue. You can then attend the conference immediately following your course with an additional registration (separate fee applies).