(1) This Procedure was approved by the Vice-Chancellor on 27 August 2014 and incorporates all amendments to 9 February 2016. (2) This Procedure includes the following schedule: (3) This Procedure explains how to comply with the Business Continuity policy. (4) This Procedure applies across the University. (5) Refer to the Business Continuity policy. (6) The methodology as shown in Schedule A: Business Continuity methodology/life cycle is used to design, develop, implement and manage Business Continuity across the University. This approach aligns with the international standard AS/NZ ISO022301:2012 Societal security — Business Continuity management systems, Technical Specification ISO/TS22317:2015 Guidelines for Business Impact Analysis and the Business Continuity Institute Good Practice Guide. (7) The Business Continuity policy outlines the scope and overarching responsibilities in relation to the management of Deakin's Business Continuity Program. (8) A Business Impact Analysis (BIA) is the primary information collection and assessment tool in the development of Business Continuity strategies and Contingency Procedures. (9) The BIA identifies activities performed and measures the impact of a disruption through assessing the impact over time and determining the 'Die Time' (also referred to as the Maximum Tolerable Period of Disruption), (10) A Recovery Time Objective (RTO) for each activity is drafted and where these meet the scope of the Business Continuity policy, the dependencies and supporting resources (people, information and communications technology (ICT) services, facilities, equipment, third parties) are subsequently identified. Activities captured in this step are deemed 'critical activities'. (11) The information captured and assessed via the BIA process is used to prioritise the restoration of critical activities and set a suitable RTO. (12) Continuity and recovery strategies are then designed to meet the RTO for critical activities (13) Where these strategies involve ICT requirements, details will be provided to eSolutions for inclusion and consideration in ICT Recovery analysis and planning. (14) The implementation of the strategies that have been developed at the design stage is done through the production of a documented Business Continuity Contingency Procedure. (15) These procedures provide a pre-defined and approved course of action including strategies to be initiated in response to an operational disruption. (16) Validation of the University's Business Continuity capability is undertaken through a validation program that comprises of periodic desk checks, walkthroughs, simulations, tests or rehearsals. (17) The testing of the University's ICT disaster recovery capability is managed independently by eSolutions. (18) Risks that are identified from the Business Continuity validation program will be evaluated and treated in accordance with the University's Risk and Compliance Management policy and Risk Management Framework. (19) Activation of a Business Continuity response is initiated by the Critical Incident Management Team Leader when an incident disrupts the business as usual operations of the University, and the disruption has or threatens to breach the RTO of one or more critical activities. (20) As a guide, Deakin's Business Continuity response will be activated in accordance with Schedule B: Business Continuity Overview. (21) During a Critical Incident Management Team response, the Planning Team has responsibility for Business Continuity and will establish a Business Recovery Team (BRT) who is responsible for coordinating the implementation of Deakin's Business Continuity Contingency Procedures by the Local Recovery Teams (LRT). (22) To support a large relocation of activities or staff, the Critical Incident Management Team may require the displacement of other areas who are undertaking activities that, through the BIA information, are deemed non-time critical in order to access their resources. This may be required to obtain office space or equipment such as computers. (23) When the situation has been recovered to the point that the Critical Incident Management Team is stood down, the BRT may continue to work with the LRT of the affected Faculty or Portfolio and report to the Critical Incident Management Team Leader. (24) Disruptive incidents that do not require a Critical Incident Management Team response are managed through the implementation of the relevant Faculty or Portfolio’s Business Continuity Contingency Procedure. (25) In these instances, the BRT Team Leader may provide support to the LRT's and mobilise the broader BRT as appropriate. (26) ICT disaster recovery is a component of the University's overall business continuity capability. It provides for the timely recovery and restoration of ICT systems and processes, including applications, infrastructure and data resources that support critical activities. (27) ICT Recovery is managed in accordance with the Business Continuity policy and the Deakin eSolutions ICT Recovery framework and guidelines. (28) In addition to the Accountabilities listed in the Business Continuity policy, the following shall apply: (29) Definitions relevant to this procedure are listed in the Business Continuity policy.Business Continuity procedure
Section 1 - Preamble
Top of PageSection 2 - Purpose
Section 3 - Scope
Section 4 - Policy
Section 5 - Procedures
Business Continuity methodology/life cycle
Business Continuity Program elements
Policy and Governance
Analysis
Design
Implementation
Validation
Activating a Business Continuity response
Implementing Business Continuity Contingency Procedures
ICT disaster recovery
Accountability and Responsibilities
Top of Page
Section 6 - Definitions
View Current
This is not a current document. It has been revoked and is no longer in force.