View Current

Business Continuity procedure

This is the current version of this document. To view historic versions, click the link in the document's navigation bar.

Section 1 - Preamble

(1) This Procedure is effective from 22 February 2018.

(2) This Procedure includes the following schedule:

  1. Schedule A: Business Continuity Management Validation.
Top of Page

Section 2 - Purpose

(3) This Procedure explains how to comply with the Business Continuity policy.

Top of Page

Section 3 - Scope

(4) This Procedure applies across the University.

Top of Page

Section 4 - Policy

(5) This Procedure is pursuant to the Business Continuity policy.

Top of Page

Section 5 - Procedures

Activating a Business Continuity response

(6) Activation of a Business Continuity Management (BCM) response is initiated by the Critical Incident Management Team (CIMT) Leader when an incident disrupts the business as usual operations of the University, and the disruption has or threatens to breach the Recovery Time Objective (RTO) of one or more critical activities.

(7) During a Critical Incident the CIMT has responsibility for BCM and will establish a Business Recovery Team (BRT) who is responsible for coordinating the implementation of the Deakin University Business Continuity Plan (BCP) by the local areas.

(8) To support a large relocation of activities or staff, the CIMT may require the displacement of other areas who are undertaking activities that, through the Business Impact Analysis (BIA) information, are deemed non-time critical in order to access their resources. This may be required to obtain office space or equipment such as computers.

(9) When the situation has been recovered to the point that the CIMT is stood down, the BRT may continue to work with the effected areas and report to the Critical Incident Management Team Leader.

(10) Disruptive incidents that do not require a CIMTresponse, are managed through implementing the relevant section of the  University’s BCP by the local area. In these instances, the BRT may provide support.

ICT disaster recovery

(11) ICT disaster recovery is a component of the University's overall business continuity capability. It provides for the timely recovery and restoration of ICT systems and processes, including applications, infrastructure and data resources that support critical activities.

(12) ICT Recovery is managed in accordance with the Business Continuity policy and the eSolutions ICT Recovery Framework.

Business Continuity Program elements

Policy and Governance

(13) The Business Continuity policy outlines the scope and overarching responsibilities in relation to the management of the University's BCM Program.

(14) The University’s BCM program aligns with the international standard ISO 22301:2012 Societal security — Business Continuity management systems, Technical Specification ISO/TS 22317:2015 Guidelines for Business Impact Analysis and the Business Continuity Institute Good Practice Guidelines.


(15) A Business Impact Analysis (BIA) is the primary information collection and assessment tool in the development of BCM strategies and plans.

(16) The BIA identifies activities performed and measures the impact of a disruption by assessing the impact over time, determining the service level timing and the maximum tolerable period of disruption.

(17) A Recovery Time Objective (RTO) for each activity is drafted and where these meet the scope of the Business Continuity policy, the dependencies and supporting resources are subsequently identified. Activities captured in this step are deemed critical activities.


(18) The information captured and assessed via the BIA process is used to prioritise the restoration of critical activities and set a suitable RTO within the context of broader university activities. Continuity and recovery strategies are then designed to meet the RTO for these activities.

(19) Where these strategies involve ICT requirements, details will be provided to eSolutions for inclusion and consideration in ICT Recovery analysis and planning.


(20) The strategies that have been developed at the design stage are documented within the University’s BCP, providing a pre-defined and approved course of action to be initiated in response to an operational disruption.


(21) Validation of the University's BCM capability is completed annually within the CIMT exercise and periodically through BIA updates, desk checks and simulations. Refer to Schedule A: Business Continuity Management Validation for more information.

(22) The testing of the University's ICT disaster recovery capability is managed independently by eSolutions.

(23) Risks that are identified from the Business Continuity validation program will be evaluated and treated in accordance with the University's Risk and Compliance Management policy and Risk Management Framework.

Accountability and Responsibilities

(24) In addition to the accountabilities listed in the Business Continuity policy, the following shall apply:

  1. the CIMT provides executive decisions and strategic direction on University priorities when responding to critical incidents and managing related Business Continuity responses, and:
    1. directs the BRT during a Business Continuity response
    2. endorses financial decisions relating to the Business Continuity response that are outside of normal delegations
    3. prepares all communications to relevant stakeholders during the Business Continuity response.
  2. the BRT is made up of subject matter experts in Business Continuity, ICT, Timetabling and Facilities Services, and:
    1. reports to the Planning Team of the CIMT or the CIMT Leader during a Business Continuity response
    2. coordinates the implementation of the Deakin University BCP by local areas when an incident has caused a disruption to a critical activity.
Top of Page

Section 6 - Definitions

(25) Definitions relevant to this Procedure are listed in the Business Continuity policy.