Business Continuity Policy
Guidelines to ensure the continuity of critical functions during and after disruptions
Purpose
This policy sets out the guidelines to ensure the continuity of the organization's critical functions during and after a disruption. It ensures staff know the principles of business continuity, risk management, incident response and compliance. Compliance is mandatory for all staff and applies to all areas.
Objectives
- Identify critical processes and services and ensure their continuity in the event of a disruption.
- Minimize the impact on the organization, customers and interested parties.
- Ensure the fast, orderly recovery of essential operations.
- Align the BCMS with the strategy and regulatory requirements.
- Establish a clear crisis management structure.
- Maintain an up-to-date, practical BCMS under continuous improvement.
Scope
This policy covers:
- All locations, offices and business units.
- Essential functions such as IT, Finance, Operations, HR and other key areas.
- Critical processes and necessary resources (equipment, facilities, applications, knowledge).
- Relevant risks: natural disasters, cyberattacks, technical failures, human error.
- Training and awareness programs for all staff.
Standard
Risk Assessment
Identify threats and vulnerabilities that may affect continuity. Determine critical processes and minimum operational requirements.
Business Continuity Plan (BCP)
Develop plans for each critical function, including recovery steps, roles, communication and safeguarding of information. Plans must be tested and updated periodically.
Incident Response
Activate response procedures in the event of disruptions to restore services with the least possible impact and recover critical systems, data and processes.
Training and Awareness
- Mandatory annual training.
- Regular awareness campaigns.
- Induction training for new employees.
- Refresher sessions according to relevant changes.
- Up-to-date records of all training.
Legal and Regulatory Compliance
The BCMS must comply with applicable requirements such as GDPR, HIPAA, BRRD or other regulators depending on the jurisdiction.
Business Impact Analysis (BIA)
Carry out a full BIA every three years, with annual reviews to adjust priorities and recovery times.
Vendor Assessment
Identify critical vendors and validate their compliance with continuity agreements, especially during the BIA and periodic reviews.
Exercises and Testing
Carry out regular BC/DR exercises to validate recovery times, roles and the effectiveness of the plans.
Incident Response Structure
Define how serious incidents are managed, such as:
- Loss of a data center
- Loss of offices or facilities
- Failures of critical vendors
- Absence of essential staff
Competencies
Define the skills required for BCMS roles and ensure they're met through ongoing training.
Performance Evaluation
Measure BCMS performance through KPIs and report them to the Continuity Committees to prioritize improvements.
Audit and Assessment
Carry out internal and external audits to validate the effectiveness of the BCMS. Audits must cover all areas at least once every 3 years.
Continuous Improvement
Identify corrective actions, non-conformities and improvement opportunities, apply them and verify their effectiveness in each review cycle.
Protection Against Utility Failures
To ensure continuity, facilities and systems must be protected against power or utility failures through:
- Equipment configured and maintained according to specification.
- Periodic capacity assessments in light of growth.
- Regular inspections and tests.
- Failure alarm systems.
- Redundant power and diverse routes.
- Network separation between critical equipment and IT systems.
- Protection of internet-connected equipment.
- Emergency lighting and communications available.
Resource Commitment
Management defines the resources needed for continuity annually and Finance guarantees the required funds.
Communication
The BCMS Manager, with Internal Communications, manages communication about the program. In emergencies, the established crisis communication strategy is followed to protect the corporate reputation.
Compliance
Compliance with this policy is mandatory. If there are stricter laws or standards, they prevail.
Monitoring and Review
The organization maintains a process to evaluate the effectiveness of the BCMS through:
- Regular review of documents, policies and controls.
- Evaluation of legal and contractual compliance.
- Periodic reports to management on BCMS performance.
- Ongoing evaluation of internal controls and timely communication of deficiencies.
- Verification and follow-up of corrective actions.
- Periodic internal audits and effectiveness reviews.
Management reviews the results and ensures improvements and adjustments are implemented when needed to maintain the organization's continuity and resilience.