Rescinded [2019-06-28] - Operational Security Standard - Business Continuity Planning (BCP) Program

An essential element of governance is the development of departmental BCP Program policy to apply GSP requirements to new and existing departmental programs and operations, pursuant to any constituent or other legislative requirements.

It is therefore essential that Senior departmental managers commit to the BCP Program, integrate it into a strategic planning framework, ensure compliance with government policy, ensure appropriate departmental expert review (e.g., legal, policy, finance, communications, information management and human resource specialists), and appoint participants. This can be done through a senior management committee. Its support is essential to:

1. Provide strategic direction and communication.
2. Approve departmental BCP Program policy and governance.
3. Commit financial and other resources.
4. Review and approve identified critical services and associated assets.
5. Resolve conflicting interests and priorities.
6. Approve business continuity plans and activities.
7. Ensure regular training, review, testing and audit.
8. Ensure BCP Program activities are supported by IM, IT, and other continuity plans and arrangements, as required.

Governance includes the appointment of a Departmental BCP Coordinator to:

1. Obtain senior management support and funding.
2. Develop a departmental BCP Program policy and governance.
3. Ensure the development of a strategy to communicate BCP activities to employees and stakeholders.
4. Establish working groups and define their roles and responsibilities.
5. Ensure the completion of the business impact analysis and the development and maintenance of business continuity plans.
6. Ensure that IM, IT, and other continuity plans and arrangements are fully integrated into the BCP Program.
7. Provide for regular training, review, testing and audit.
8. Liaise with other departments and agencies as necessary to coordinate BCP.
9. Collaborate with the IT Security Coordinator throughout the process.
10. Inform the Departmental Security Officer (DSO) throughout the process if the Coordinator does not functionally report to the DSO.

Please note that in accordance with 10.1 of the GSP, the Departmental Security Officer is to direct and coordinate the security program, which includes the BCP.

The coordinator and the working groups must conduct a business impact analysis to assess the impacts of disruptions on the department and to identify and prioritize critical services and associated assets. This analysis involves the following steps:

1. Determine the nature of the department's business (e.g. role, mandate) and the services it must deliver according to its constituent or other legislation, government policy, obligations to other departments, and service sharing arrangements, treaties, contracts, memoranda of understanding or other agreements. Internal and external functions on which services depend must also be identified.
2. Determine the direct and indirect impacts of disruptions on the department, including the quantitative and qualitative effects.
3. Assess services to determine which are likely to cause high degree of injury to Canadians and the government, if disrupted. It is vital to achieve immediate recovery or maintain minimum levels of service until full service is restored.
4. Identify and prioritize critical services and list the resources (personnel, contractors, suppliers, information, systems and other assets) that support them directly or indirectly, within or outside the department. Priority is assigned based on the maximum allowable downtime and the minimum service level required before high degree of injury will result. Services that must always be available, for which a disruption is not acceptable and immediate recovery is essential, are ranked at the top.
5. Obtain senior management approval of the results of the business impact analysis before proceeding with the development of continuity plans.

Based on the results of the business impact analysis, business continuity planning activity must include:

1. Development of recovery options, from which to determine a recovery strategy for each critical service.
2. Assessment of each option in terms of possible disruption, impacts on the department, benefits, risks, feasibility, and cost in order to select the most appropriate strategy.
3. Obtaining senior management approval to support and fund selected strategies.
4. Development of business continuity plans, including IM and IT continuity plans, identifying:
   1. Critical services, information assets, and dependencies identified in the business impact analysis.
   2. Approved recovery strategies.
   3. Measures to deal with the impacts and effects of disruptions on the department.
   4. Response and recovery teams, including the membership and contact information.
   5. Roles, responsibilities and tasks of the teams including internal and external stakeholders.
   6. Resources and procedures for recovery.
   7. Coordination mechanisms and procedures.
   8. Communications strategies.
5. Obtaining senior management approval of developed plans.
6. Completion of arrangements to ensure that plans can be put into effect, and where departments share in the delivery of a critical service, arrangements to ensure that the plans of the sharing departments are concerted.
7. Briefing and training of staff.

With continuity plans developed, approved and ready to be put into effect, a permanent maintenance cycle must be established to include:

1. Ongoing review and revision of all plans to account for any changes (legislation, critical services, organization, mandate, management, threat environment, stakeholders, dependencies, etc.).
2. Additional training as required.
3. Regular testing and validation of all plans, including the preparation of a lessons learned report after testing activities or actual events (validation can range from a questionnaire through table top exercises to departmental or interdepartmental live exercises -frequency as determined by departments).
4. Development of an audit cycle for the BCP Program, as the basis of regular reporting to the Treasury Board Secretariat.

It is recognized that the Royal Canadian Mounted Police (RCMP) and the Canadian Forces (CF), for the purpose of their business continuity planning, may include additional measures as necessary to provide for the protection of personnel and assets resulting from their legal responsibilities with respect to the protection of critical infrastructure during any emergency.