BCP

1. Purpose and Scope

Define what the plan covers:

Core business operations (production, sales, dispatch, finance, comms)

Locations (e.g. warehouse, office, remote operations)

Critical systems (ERP, MaticTrack, FreePBX, n8n, Graphy, printers, servers)

Key suppliers and dependencies (power, internet, courier, substrates)

2. Business Impact Analysis (BIA)

Identify and rank what actually breaks the business if lost:

Function

Max Tolerable Downtime

Dependencies

Impact if Lost

Print production

24h

Colorado, Zünd, RIP PCs

Revenue halt

ERP / MaticTrack

8h

Database, backups, server

Dispatch paralysis

Customer comms

4h

FreePBX, WhatsApp, email

Lost orders

Payments / Banking

24h

Internet, bank access

Cashflow freeze

Premises access

48h

Building, power

Operational stop

3. Risk Assessment

List threats and the level of disruption they’d cause:

Fire/flood (site loss)

Cyber attack / ransomware

Power or internet outage

Staff absence (illness, strike, quarantine)

Supplier failure

Hardware failure

Data corruption

Reputational incident (social or customer backlash)

4. Continuity Strategies

How each critical function will be maintained:

IT & Data: Full daily backups (local + cloud), tested quarterly; mirrored server or hot-swap VM ready.

Communications: Secondary internet connection, mobile hotspot failover; Rocket.Chat accessible via mobile.

Premises: Temporary production site agreement or pre-arranged outsource network.

Staffing: Cross-training matrix; remote access policies; leadership succession list.

Suppliers: Dual-supplier list for key materials; emergency courier options.

5. Incident Response Procedure

Step-by-step response to an event:

Detection & Assessment – who identifies the problem and how it’s logged.

Activation – who decides to trigger the plan.

Internal Communication – key staff WhatsApp group, SMS broadcast.

External Communication – message templates for customers, suppliers, press.

Recovery Actions – restore data, re-route calls, re-start production.

Post-Incident Review – what failed, what changes are needed.

6. Roles and Responsibilities

Define a chain of command:

Incident Lead: Robert McCombe

Deputy Lead: Kelly Power

IT & Systems: Robert McCombe

Communications: Robert McCOmbe

Safety & Facilities: Richard McCombe

Include personal mobiles, secondary emails, and home working access details.

7. Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)

Be specific:

ERP: RTO 8h, RPO 1h

Email/Comms: RTO 2h, RPO 0h (live failover)

Print Production: RTO 24h, RPO N/A

Accounting: RTO 48h, RPO 24h

8. Testing & Maintenance

Simulate a disaster every 6–12 months.

Review after any incident or major system change.

Document every test result and update gaps.