Business Continuity Plan

BCP

BCP

1. Purpose and Scope

Define what the plan covers:

Core business operations (production, sales, dispatch, finance, comms)
Locations (e.g. warehouse, office, remote operations)
Critical systems (ERP, MaticTrack, FreePBX, n8n, Graphy, printers, servers)
Key suppliers and dependencies (power, internet, courier, substrates)

2. Business Impact Analysis (BIA)

Identify and rank what actually breaks the business if lost:

Function	Max Tolerable Downtime	Dependencies	Impact if Lost
Print production	24h	Colorado, Zünd, RIP PCs	Revenue halt
ERP / MaticTrack	8h	Database, backups, server	Dispatch paralysis
Customer comms	4h	FreePBX, WhatsApp, email	Lost orders
Payments / Banking	24h	Internet, bank access	Cashflow freeze
Premises access	48h	Building, power	Operational stop

3. Risk Assessment

List threats and the level of disruption they’d cause:

Fire/flood (site loss)
Cyber attack / ransomware
Power or internet outage
Staff absence (illness, strike, quarantine)
Supplier failure
Hardware failure
Data corruption
Reputational incident (social or customer backlash)

4. Continuity Strategies

How each critical function will be maintained:

IT & Data: Full daily backups (local + cloud), tested quarterly; mirrored server or hot-swap VM ready.
Communications: Secondary internet connection, mobile hotspot failover; Rocket.Chat accessible via mobile.
Premises: Temporary production site agreement or pre-arranged outsource network.
Staffing: Cross-training matrix; remote access policies; leadership succession list.
Suppliers: Dual-supplier list for key materials; emergency courier options.

5. Incident Response Procedure

Step-by-step response to an event:

Detection & Assessment – who identifies the problem and how it’s logged.
Activation – who decides to trigger the plan.
Internal Communication – key staff WhatsApp group, SMS broadcast.
External Communication – message templates for customers, suppliers, press.
Recovery Actions – restore data, re-route calls, re-start production.
Post-Incident Review – what failed, what changes are needed.

6. Roles and Responsibilities

Define a chain of command:

Incident Lead: Robert McCombe
Deputy Lead: Kelly Power
IT & Systems: Robert McCombe
Communications: Robert McCOmbe
Safety & Facilities: Richard McCombe

Include personal mobiles, secondary emails, and home working access details.

7. Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)

Be specific:

ERP: RTO 8h, RPO 1h
Email/Comms: RTO 2h, RPO 0h (live failover)
Print Production: RTO 24h, RPO N/A
Accounting: RTO 48h, RPO 24h

8. Testing & Maintenance

Simulate a disaster every 6–12 months.
Review after any incident or major system change.
Document every test result and update gaps.