Business Continuity Plan for the IBO

Date approved: 30.10.14

Business Continuity Plan August 2014 (V 1.5)


Version Control

Author Version Date Notes

Wendy Xerri Draft 1 November 2012

Draft 2 April 2013

Draft 3 July 2013

Version 1 September 2013

Document Control

Version Date Distributed Recipients

Draft 1 November 2012 TSD Senior Directorate

Draft 2 April 2013 TSD Senior Directorate

Draft 3 July 2013 TSD Senior Directorate

Draft 4 September 2013 Director of Operations &

Planning

Version 1 September 2013 Audit & Risk Management

Committee

Draft 5 August 2014 Pro-VC(Finance &

Planning)

Senior Corporate

Development Officer

Approved (signature) ....................date .................

Plan director

Approved ......................................date ..................


Contents 1. Executive Summary 1

2. Purpose, scope and responsibility 2

2.1 Purpose 2

2.2 Scope 2

2.3 Role of the PVC (Finance & Planning) 2

3. Normal Operations 3

Carmarthen Campus 3

Lampeter Campus 3

Swansea Campus 4

Techniums Swansea 4

Cardiff Campus 4

London Campus 4

Academic Faculties and Schools 5

4. Incident Management 5

4.1 Critical Incident Definition 5

4.2 Reporting an Incident 6

4.3 Incident Response 7

4.4 Notifying Emergency Services 7

4.5 Fire and Emergency Services 8

4.6 Buffer time and Standby Actions 8

4.7 Site Closure 8

4.8 Incident Management Control 9

5. Business Continuity: Activation Procedures 10

5.1 How the Business Continuity Plan is activated 11

5.2 Roles and Responsibilities: Plan Director and Plan Manager 11

5.3 Members of the Gold and Silver Team 12

5.4 Roles and Responsibilities: Gold and Silver Teams 13

6. Business Continuity: Incident Management Plan 14

6.1 Staff Notification 14

6.2 Notifying Other Offices, Students, Key suppliers and Third Parties 15

6.3 Emergency Communications 15

6.4 Media Response 16

6.5 Gold and Silver Team Actions 16

6.6 Actions Timeline 18

6.7 Team Actions 20

6.7.1 Gold Team 20

6.7.2 Silver External Relations Team 22

6.7.3 Silver Home Site 22

6.7.4 Silver Recovery Site Team 23

6.7.5 Silver Academic Team Tasks 24

6.7.6 Silver Operations Team Tasks 25

6.7.7 Silver Student/Staff Liaison Team Tasks 25

6.7.8 Departmental Responsibilities 26

7. Recovery Process 26


7.1 Alternate Work Locations 26

7.2 Recovery of Premises 27

7.3 Recovery of People 27

7.4 Recovery of Technology 27

7.5 Recovery of Information 28

7.6 Recovery of Critical External Suppliers 28

8. Standing the Plan Down 28

9. Audit, Review, Maintenance and Testing 29

Appendices

Appendix 1 – Gold and Silver Team Members 31

Appendix 2 – Salvage Team and Actions 34

Appendix 3 – Recovery Site Location and Contacts 35

Appendix 4 – Succession Planning 36

Appendix 5 – Telephone Cascade 37

Appendix 6 – Staff Contact Details 37

Appendix 7 – Staff Recovery Locations 38

Appendix 8 – Partner Institution Contact Details 41

Appendix 9 – Key Supplier Contacts 41

Appendix 10 – Bank Account Details 41

Appendix 11 – Battlebox 41

Appendix 12 – Emergency Evacuation Plan 42

Appendix 13 – Activity Log 43

Appendix 14 – Call-Out Procedure 44

Appendix 15 – Stakeholder contact Details 44

Appendix 16 – Emergency Information Sources and Local Radio 44

Appendix 17 – Insurance Company/Loss Adjuster Details 45

Appendix 18 – IT DR Plan and Voice Diversion Procedures 45

Appendix 19 – Holding Statement 45

Appendix 20 – Buffer time Action 46

Appendix 21 – Assumptions 47

Appendix 22 – Critical Dates Calendar 47

1 Date approved: 30.10.14

1. Executive Summary

The Business Continuity Plan (BCP) identifies the functions that need to be restored for

normal operations to be resumed after an incident at University of Wales Trinity Saint David.

The objective is to resume operations and supply services to internal and external clients to

an acceptable level, in an acceptable timescale. As clients are serviced globally any incident

that affects South-West Wales has a potentially major impact, not just an incident during

working hours.

This document has been written as a repository of information. It is not a policy document

it is an action plan for use in the event of a disaster.

The plan is structured to deal with a local incident impacting the Carmarthen, Lampeter, and

Swansea campuses, and incidents affecting UW Trinity Saint David’s campuses in Cardiff

and/or London.

Incident Management deals with the immediate impact of an incident and the process of

evaluation. Options for response are either ‘back-to-business’ where there is no impact on

operations, use of ‘buffer time’ where a situation is unclear or the activation of the plan

where disruption to services is obvious and immediate.

The procedures to activate the BCP are described, together with the responsibilities of the

Gold and Silver teams. The tasks and timelines of the recovery teams are defined for use

once the BCP has been invoked.

The recovery processes for premises (including alternative locations), people, technology,

information and key suppliers are described, and the conditions governing the controlled

method of standing the BCP down are identified.

Supporting all aspects of the BCP are a number of Appendices. There are Appendices relating

to the members of the Gold and Silver teams, contact information for all staff and other key

contacts, a telephone cascade, succession planning and staff recovery site information. A list

of standby actions supports preparation during buffer time. The critical functions of IT, with

the priorities and timescales for restoring services and servers are incorporated along with

the technical IT Disaster Recovery Plan.

This document contains all the information required to restore operations in the event of

acute disruption. It has also been designed to be a flexible recovery tool, and can be used in

part, in the event of less serious incidents.


2. Purpose, scope and responsibility

2.1 Purpose

The purpose of this Business Continuity Plan is to enable the operations of the University of

Wales: Trinity Saint David to survive a critical incident that disrupts normal operations and

working practices. The Plan has been arrived at through a business continuity management

process undertaken by the University. It is based on the information obtained and agreed in

the Risk Assessment / Business Impact Analysis.

Within this plan is the method of activation, detailed responsibilities and timelines for

recovery and a process for standing the plan down.

2.2 Scope

This plan addresses the operations that are undertaken at the Carmarthen, Lampeter, and

Swansea campuses, and at the two campuses of University of Wales: Trinity Saint David in

Cardiff and London as at June 2014.

It is possible that an incident may occur that impacts on the whole of the South Wales

region, affecting the Carmarthen, Lampeter, Swansea and Cardiff campuses. It is likely that

an event of this scope would have a significant impact on transport links, and recovery could

not progress until staff could manage to reach the recovery site.

The loss of any campus could be a serious issue during exam sessions. However, this could

be dealt with as part of normal operations as long as another campus was still functional.

However, a critical incident at any one campus that causes injury or death to University staff,

students, guests or visitors, or has the potential to damage the reputation of the University,

may cause the plan to be initiated.

2.3 Role of the PVC (Finance and Planning)

The PVC (Finance and Planning) has responsibility for Business Continuity Management

(BCM) in the University and is the Plan Director. His role is to:

- Integrate the Business Continuity Plan;

- Introduce staff to the BCM programme, and define what it means to them;

- Have a process for identifying and delivering BCM training requirements to relevant

staff and evaluating the effectiveness of its delivery;

- Develop a testing strategy with regular exercises, and involve a variety of staff in

these exercises;

- Keep critical staff up to date with reference to their BCM skills;

- Place information on the Intranet about BCM;

- Add BCM into regular staff meetings;

- Ensure that documentation is kept up to date, completed, reviewed regularly and

signed off.


3. Normal Operations

The University of Wales: Trinity Saint David operates on five different sites - Carmarthen,

Lampeter, Swansea, Cardiff and London.

Carmarthen Campus

The original 1848 building lies at the heart of the Carmarthen campus. Sweeping lawns and

landscaped areas form a picturesque setting for the mix of Victorian and modern buildings.

The campus boasts a range of facilities including a well-stocked library and excellent learning

and teaching spaces, a fully-equipped theatre and workshops, media and music suites as

well as IT facilities which include refurbished open access areas and rooms for students to

complete group work.

Sports facilities include the Sports Centre with a Health and Fitness Suite, swimming pool, a

multi-purpose dance studio. Students Services and Students’ Union are both located in their

own buildings on the campus enabling students to access their facilities and services easily.

Student accommodation includes catered and self-catering halls which are located on the

campus.

Art and Design are offered jointly with Coleg Sir Gâr and include studios, exhibition spaces

and workshops. A new Learning and Teaching block built during the 2012-13 provides

enhanced facilities.

Lampeter Campus

The campus was founded in 1822 as St David’s College to provide a liberal education to

members of the clergy including Classics and History amongst other disciplines. Over the

years it developed the range of subjects and, as the University of Wales Lampeter, enjoyed a

reputation for undergraduate and postgraduate provision in Archaeology, Chinese, Classics,

History, Theology, as well as others including Business and IT.

The campus facilities boast one of the best libraries and private collections of medieval

manuscripts in the country - The Roderic Bowen Library and Archives - as well as the Arts

Hall and Cliff Tucker Theatre which are modern and well-equipped venues used for lectures

as well as arts and community events.

Major refurbishment has been carried out across the campus including the creation of a

centre in the Canterbury Building for the integrated Student Services Department and other

student-facing services. The University’s sports facilities have been enhanced and include

joint provision between the University and Ceredigion County Council. In addition, student

accommodation across the campus has been renewed and upgraded.

Swansea Campus


Swansea is surrounded by resorts, parks, wildlife centres, caves and castles and the Gower

Peninsula was the first part of Britain to be awarded the title of ‘Area of Outstanding Natural

Beauty' by the Government in 1956. It is one of the most stunning peninsulas in the UK, with

wide, clean sands and steeply cliffed coves protected by thick woods.

The Swansea campus is spread across a number of dedicated buildings - all within walking

distance of Swansea city centre. Each subject area has its own dedicated facilities relevant to

the needs of students, from the workshops where formula student racing cars are designed

and built, to the art and design studios where students have spaces set aside to develop

their ideas. The University is currently investing in new and improved facilities and buildings

on the Swansea campus; the aim is to have industry standard facilities for students so that

when they progress to employment they are able to thrive in their future careers.

There are dedicated subject-relevant libraries across campuses and all students have access

to IT suites and remote access to library services and study materials through an online

library catalogue and virtual learning environment.

Techniums Swansea (Techniums 1 & 2) is also part of the Swansea campus. Techniums

Swansea is a unique facility in Wales, offering a 60,000Sq foot incubation facility for

companies undertaking web and computer technical design. The site houses approximately

20 organisations including Cyden, OSTC, and a number of small start-up companies.

Cardiff Campus

The Cardiff campus is the location for the Welsh International Academy of Voice, which

provides a highly specialised and unique environment for a small number of exceptional

singers at the early-professional stage, selected and recruited globally to develop and polish

their talent to the highest professional standards.

London Campus

TSD London is a new development providing an opportunity for predominantly international

students to study a range of programmes in one of the safest areas of London, along with

other professional based courses/employment training offered to students domiciled within

the UK. It is located at Winchester House, Cranmer Road, London SW9 close to both the

Oval Underground station and the Oval cricket ground.

These programmes are offered by University of Wales: Trinity Saint David’s School of

Business, and as such are of the highest academic standard, being part of the University’s

commitment to a growing number of international students.

Academic Faculties and Schools

The University consists of five faculties:

Faculty of Architecture, Computing & Engineering;


Faculty of Art & Design;

Faculty of Business and Management;

Faculty of Education and Communities;

Faculty of Humanities and Performing Arts.

The University of Wales: Trinity Saint David offers high quality education through a range of

undergraduate and post-graduate programmes of study and, throughout the year a range of

activities are held in areas such as professional development. Workshops and conferences

are also held regularly.

The restoration of ‘normal’ services includes:

- Protection of staff, students, visitors and clients;

- Control of the flow of information about an incident;

- The communication to all staff and students of immediate contingency arrangements;

- Collection and processing of inbound post;

- Formulation of an insurance claim with loss adjuster.

The Business Continuity Plan is structured to deal with critical incidents that affect the

following areas, either singly or in combination:

- Premises;

- People;

- Technology – Infrastructure;

- Information and Data;

- Key Suppliers.

To ensure the maximum flexibility, it is not based around the response to specific scenarios,

but looks at the effects any incident might have.

4. Incident Management

Critical Incident Definition

A critical incident may be defined as any event which threatens to severely disrupt (in whole

or in part) the functioning of a faculty, service or the University as a whole, and/or which

carries the risk of significant adverse publicity.

Whilst it is probably impossible to identify in advance all types of event which would

constitute a critical incident, it would be likely to include the following characteristics:

There are substantial threats to the safety or well-being of individuals or to the

fabric or reputation of the institution; and

The incident is likely, or has the potential, to lead to the suspension of normal

operations.


It follows that a critical incident might require:

The calling out of the emergency services;

Special communications mechanisms; and

The necessity to manage a high level of media interest.

Possible examples of critical incidents could include; a major fire or explosion, an occurrence

or outbreak of a contagious disease, such as meningitis.

The majority of incidents are dealt with by the normal management processes of the

business. The Business Continuity Plan will be activated if the incident is of such a critical

nature that normal operations at any or all campuses are unable to continue. In the majority

of cases it is expected that an incident will only partially close a campus, allowing the control

centre (see 4.8 below) to remain at that campus and the rest of the campus to operate as

normally as possible.

The initial response to an incident is described in this section, including the concept of buffer

time where recovery services are placed on standby or time consuming actions started.

There is a sliding scale between ‘normal operations’ and ‘total disruption’. It is important in

the response to an incident to keep definitions as simple as possible – if there is no impact

on operations, then the organisation can go ‘back to business’. There will be a level where

there is some impact, but the extent may be unclear, and here the organisation should

either implement ‘buffer time’ or initiate the plan. Finally, there will be a level where there is

an obvious impact on operations, and the plan should be initiated immediately.

Some incidents may become more severe over time through events outside the control of

the University. As long as this is understood, and any incident is monitored over time, then

the response can be scaled up at any point. It is always better to err on the side of caution

and initiate the plan which can then be stood down, than to do nothing.

4.1 Reporting an Incident

During working hours most incidents will be resolved by the normal processes and

procedures of the business, following normal reporting lines.

Normal Working Hours

If the incident affects a site, the Emergency Evacuation Plan (see 4.5 below) should be

followed. The Gold team (see 5.7.1 below) will then assemble and assess the situation,

taking advice from the emergency services if they have attended the site.

NB: Personal welfare is of paramount importance, and site evacuation (if required) and the

instructions of the emergency services take priority over all other actions.

Out of Hours - during the night, at weekends or on public holidays.


If an incident occurs out of hours at any campus, onsite security will contact an individual on

the Call-Out procedure list (see Error! Reference source not found.). The Call-Out list is appended to certain copies of the BCP due to the confidential nature of the information it contains.

Out of Hours Contact Numbers

Carmarthen campus – duty porter 07767 842738

Lampeter campus – duty porter 07854 458920

Townhill campus – duty porter 07837 591368/07850 321705

Mount Pleasant campus – duty porter 07850 321705

Ty Bryn Glas, Alexandra Road, Dynefor - duty porter 07850 321705

Cardiff (WIAV) – 02920 396576 (Masonic lodge (next door))

London campus – security staff 07972 660557

Emergencies not notified.

If an incident outside normal working hours is not notified through the out-of-hours process,

it will not become apparent until staff begin arriving for work. In this case, the first member

of senior management on site will be responsible for:

contacting emergency services, if staff have not already done so; and

informing the members of the Gold team (see

Appendicles

) who will decide on the appropriate response.

4.2 Incident Response

The options for responding to an incident are as follows:

if the incident is minor, and does not impact on the operations of the University, then

the process ends and return to normal working is declared;

if the incident is unresolved then it must be continuously monitored until a decision can

be made to either return to normal operations, or to activate the Business Continuity

Plan. Buffer time may be utilised (see Buffer Time and Standby Actions), placing recovery

services on standby and starting time consuming actions (see Error! Reference source

not found.);

if the incident has an immediate impact on operations, or has caused serious injury or

death to University staff, students, guests or visitors, then the plan should be activated

immediately.

4.3 Notifying Emergency Services

At any time a member of staff may contact the emergency services by dialling 999,

requesting the appropriate service and reporting the nature and location of the incident.

During working hours the incident should then be reported immediately to the Plan Director

or, if they are not immediately available, to another director or a member of the Gold team.


If in doubt, an individual discovering an incident should report to reception who will pass the

information to the Plan Director (Pro VC (Finance& Planning) & HR) or, if they are not

immediately available, to the most senior, relevant individual onsite at the time

When the emergency services arrive on site they will be met by the Plan Director and, if an

evacuation has taken place, the Emergency Services Liaison.

4.4 Fire and Emergency Evacuation Plans

The University fire and emergency evacuation plans will be used and are not compromised

or superseded by this document. A copy of the University fire and emergency evacuation

plans are attached as Error! Reference source not found..

Fire Wardens will check their areas and report their status to the Emergency Services

Liaison. This information will then be passed to the attending emergency services. The Fire

Incident Commander can be identified by a white tabard.

If an incident requires staff to shelter on-site, the evacuation procedures should be followed.

If a bomb threat is received, as much information as possible should be obtained from the

caller. The instructions of the emergency services must be followed, but would normally

involve keeping staff at their desks and using fire wardens to sweep their areas for anything

unusual.

4.5 Buffer Time and Standby Actions

‘Buffer Time’ is a concept to ensure that no time is lost in the response to an incident. If the

impact of an incident is uncertain (e.g. a gas leak), a period of up to 24 hours may be allowed

to gather information and make a decision. During this time, actions that are time

consuming may be started with the understanding that, if the situation is resolved, they may

be stood down.

At any time during buffer time, the plan may be initiated or ‘back-to-business’ instructed. If

the situation is not resolved after 24 hours, the plan must be initiated by default.

4.6 Site Closure

Partial Closure

The layout of each campus means that it is possible that only parts of the premises are

affected by an incident. In the majority of incidents it is expected that an incident will only

partially close a campus, allowing the control centre to remain at that campus and the rest

of the campus to operate as normally as possible. If this is the case, it may be decided by the

Gold Team to continue some presence in the offices. However, this will only be where

Health & Safety criteria can be met, specifically:

The emergency services confirm there is no further danger;

The Insurance Company agrees to this (where a claim will be made);

Safe access / egress can be maintained;

Heating, lighting, sanitation, power, and network access are available;


The unaffected area is secure;

There is adequate containment (fire or security doors etc.) from the damaged areas.

Full Closure

Where a critical incident has occurred, the emergency services may require the closure of

the premises. When this decision is made during office hours, line managers will be

informed to send staff home, to a recovery centre or to another appropriate venue. Where

closure is initiated out of hours, the Gold team will notify line managers of the situation via

the telephone cascade (see Error! Reference source not found.). Dependent on the

circumstances, line managers may be directed to:

Stay at home pending further instructions;

Attend the office, if closure is not the result of damage (e.g. through a gas leak);

Attend the recovery site;

Contact their staff according to the telephone cascade.

Security Arrangements

Where it is not possible to secure the building by normal means (alarms and locks) owing to the nature of the damage, the Silver Home Site team (see .

Roles and Responsibilities: Gold and Silver Teams) will liaise with the emergency services and give consideration to:

the boarding up / sealing off, of potential points of entry (windows, doors etc.);

the engagement of extra security staff to guard the premises.

Public Access

Public areas will be kept closed until it is safe and convenient for members of the public to

re-enter the building. Prominent notices will be posted at the front door. Any regular visitors

will be contacted by staff in the department to notify them of a closure / restricted service,

and of alternative arrangements. If a member of staff has made an appointment with an

external party, they must contact them to either cancel or reschedule the appointment, if

necessary.

4.7 Incident Management Control Centre If access is denied to the Carmarthen campus, the Gold Team will assemble at the

Lampeter campus which will be the Incident Management Control Centre.

If access is denied to the Lampeter campus the Gold Team will assemble at the

Carmarthen campus, which will be the Incident Management Control Centre.

If access is denied to the Mount Pleasant campus the Gold Team will assemble at the

Townhill campus which will be the Incident Management Control Centre.

If access is denied to the Townhill campus the Gold Team will assemble at the Mount

Pleasant campus which will be the Incident Management Control Centre.


If access is denied to Alexandra Road, Dynefor or Ty Bryn Glas, the Gold Team will

assemble at the Mount Pleasant campus which will be the Incident Management Control

Centre.

If access is denied to Technium 1 the Gold Team will assemble at Technium 2 which will

be the Incident Management Control Centre and vice versa. If both buildings are

unavailable, the Gold Team will assemble at the Mount Pleasant campus

If access Is denied to the Cardiff campus, the Gold Team will assemble at the University

of Wales, Cardiff.

If access is denied to the London campus the Gold Team will assemble at serviced

accommodation.

5. Business Continuity: Activation Procedures

In the event of a critical incident that may cause death or injury to staff, students, guests or

public, damage to or destruction of University property, the alarm must be raised

IMMEDIATELY (as per the University emergency plan – see Error! Reference source not

found.) and the emergency services contacted.

During working hours, any incident (at any campus) that could affect the operations of the

University should be bought to the attention of the Plan Director. The Plan Director must

then assess the incident – if necessary on an on-going basis – and keep the Gold Team

informed so that they may make a decision as to whether they should invoke the Plan. It is

possible that an incident may be of such magnitude that the Gold Team can make a decision

without waiting for confirmation from the Plan Director.

If an incident occurs at the Carmarthen, Lampeter or Swansea campuses out of hours, the

duty porter will contact an individual on the Call Out procedure list. The nature and scale of

the incident should be established, and this may require a visit to the site. The Gold Team

must be informed, and should assemble at the Carmarthen campus if it is accessible, or at

the Lampeter or Swansea campus to review the situation. If an incident occurs on the

Cardiff campus out of hours, staff at the Masonic Lodge will contact an individual on the Call

out Procedure list. If an incident occurs on the London campus security staff will contact an

individual on the Call Out procedure list.


No Majority Majority

Yes

No

5.1 How the Business Continuity Plan is activated.

Activation of the Plan is the responsibility of the Gold Team. They must take a view on how

the incident may impact on the operations of the University.

If an incident has occurred and the situation is not clear the decision may be taken to utilise

‘buffer time’. During this time, actions that are critical and have a lead time may be started.

At any point in the buffer time the plan may either be activated or stood down. Buffer time

must not exceed 24 hours from the time of incident.

The plan is activated by a simple majority of those members of the Gold Team available

at the time when the decision is taken.

If the members are evenly divided then the most senior member will have the casting

vote.

If there is no member with obvious seniority then a tied vote will be taken as a vote for

activation of the plan.

The location of the Incident Management Control Centre will be determined by the Gold

Team. If an incident results in the evacuation of any campus, the members of the Gold

Team should assemble immediately and, depending on the weather conditions, make a

decision as to what to do with staff.

5.2 Roles and Responsibilities: Plan Director and Plan Manager

The Plan Director and Plan Manager, and their deputies have the responsibility for

maintaining the Business Continuity Plan. The Plan Director is the high level champion of the

project, responsible for keeping the profile of business continuity high on the business

agenda. They also have a critical role to play in the activation of the plan. The Plan Manager

Gold Team Assemble at Incident Management Control Centre

Vote taken on plan activation

Activate

Back to Business

Buffer Time

Senior Member present?

Casting Vote


is responsible for the administration of the plan and drives the regular updating and testing

of the document.

Plan Director: Pro-VC (Finance & Planning) & Executive Head of IT/IS

Plan Manager: Director of Operations and Senior Campus Manager

The contents page has a clear expiry date for the validity of the plan, and it should be

updated and re-issued accordingly. Old versions should be collected by the Plan Managers

and securely destroyed. Any changes to personnel, premises or process that impact the

organisation must be reviewed in relation to Business Continuity.

5.3 Members of the Gold and Silver Teams

The members of the Gold Team are listed in the following table. This table should be used to

record any vote for invocation.

Title Vote for activation of

plan (Y / N / Buffer time)

Signature

PVC (Finance and Planning)

PVC (Academic)

PVC (Student Experience)

Executive Head of IT/IS

Director of HR

Once the decision has been taken to invoke the plan, the Silver Teams must be informed.

The following table details the responsibilities for contact:

Team Member to contact Responsibility of Assemble at

External Relations Head of Corporate

Communications &

PR

Gold Team

member – to be

decided at time of

invocation

Affected Site

Home Site Senior Campus

Manager

Affected Site

Recovery Site Director of

Operations

Recovery Site

Academic Dean of Quality and

Enhancement

Recovery Site

Operations Director of Finance Recovery Site

Staff / Student

Liaison

Director of Student

Services

HR representative

Affected Site


Each team head is then responsible for informing the other members of their team, as per

the cascade in Appendix 6 - Staff Contact Details.

Roles and Responsibilities: Gold and Silver Teams

The Gold Team have the responsibility for activating the plan. Once it is initiated, they have

the responsibility for strategic decisions concerning recovery. They must also make the initial

contact to the Silver Teams to inform them that the plan has been activated.

In the immediate aftermath of an event the flow of information may be chaotic and a

system is required to prioritise this information and assess its reliability. The following

system has been agreed:

Priority

Level One Information that has a direct and immediate impact on staff and/or

students, or the operations of the University.

Level Two Information that may indirectly impact on the operations of the University.

Level Three Information that will have no impact on the operations of the University.

Reliability

High Same information from two or more direct sources.

Medium Information from one direct source, television or radio.

Low Information from an indirect or uncorroborated source.

Level 1 Level 2 Level 3

High Critical Important Relevant

Medium Important Relevant Relevant

Low Relevant Relevant Relevant

All information used to take decisions must be kept for the post event review.

There are six Silver Teams. These should be additional staff to those members of the Gold

Team. Their roles and responsibilities are detailed below:

Silver External Relations team will control the flow of information to the media, other

campuses, key suppliers and students. An appointed spokesperson will have sole

responsibility for speaking on behalf of the University.

Spokesperson: Head of Corporate Communications & PR

Members: Additional, identified member of Corporate Communications & PR


Silver Home Site team usually has an IT member, an HR member and a member of the

Technical Services Team. Depending on the nature of the incident, a Salvage team may also

be convened (see Error! Reference source not found.).

Emergency Services Liaison: Senior Campus manager

Members: Head of Information Services and identified member of HR

Silver Recovery Site team will prepare the alternative campus (if necessary) for the teams

that are going there. This team consists of IT to recover the IT environment, HR to handle

pastoral care and organise reception staff to answer voice lines as soon as they are

transferred, if possible.

Members: Director of Operations, IT Manager and an identified member of HR

Silver Academic Team will be responsible for ensuring that the process of maintaining

academic programmes and assessment continues.

Members: Dean of Quality & Enhancement, Dean(s) of the affected Faculty(ies) or Head of

School and an identified member of Registry

Silver Operations team will restore all other functions of the University including Finance,

and Facilities.

Members: Director of Finance, Head of Facilities

Silver Staff/ Student Liaison will be responsible for communication to staff and students and

securing alternative student accommodation if required.

Members: Director of Student Services, Accommodation Officer, HR representative

In the event of an incident that requires a site to be evacuated during working hours, the fire

evacuation procedure should be followed. If, for whatever reason this is not possible, staff

and students should assemble in the following areas:

The Llwyfan car park on the Carmarthen campus;

The Hockey Pitch on the Lampeter campus;

The staff car park on the Mount Pleasant campus;

The car park behind the main teaching block on the Townhill campus;

The car park at Ty Bryn Glas;

The car park at the rear of the Dynefor building;

Alexandra Road – to be confirmed;

The car park at the rear of the WIAV building at the Cardiff campus;

The courtyard at the rear of Winchester House

Fire wardens should sweep their areas and report to the Emergency Services Liaison for the

site, who will then coordinate with the Emergency Services on their arrival.


6. Business Continuity: Incident Management Plan

6.1 Staff Notification

The loss of IT systems may result in the loss of the HR system or access to it, and therefore

to the staff contact details it contains. A hard copy of staff contacts is to be kept in the

Battlebox (see Error! Reference source not found.) and managers should have their team’s

details on their mobile phones.

During working hours all staff on site not immediately required will be briefed before being

sent home. In the event that they are unable to retrieve their cars, the Home Site team will

organise transport to take staff home. Once any staff absent from the site have been

identified (e.g. through sickness or holiday), their managers will be advised and these staff

will be contacted and appraised of the situation.

For an incident outside normal working hours the Gold Team will use the telephone cascade,

if the phone networks are available, to advise all staff of the situation. Contact is as

described in the Telephone Cascade and Staff Contact Details in Appendices 5.1., 5.2. and 6.

If an incident is not perceptible until staff start to arrive for work they should wait to be

advised by their manager as to what is required of them.

For all of the above the number of individuals required for recovery at different locations is

detailed in Appendix 7. Actual staff will be confirmed at the time, taking into account

injuries, holidays and sickness. The Recovery Site team should co-ordinate the lists of staff to

ensure site security. Staff not immediately required will be instructed to return home and

await further instructions.

6.2 Notifying Other Offices, Students, Key Suppliers and Third Parties

Contact will be arranged by the External Relations team. For an incident at the Carmarthen

campus, the Lampeter & Swansea campus should be informed immediately, and they will

notify the other University offices. For an incident at the Lampeter, Swansea, Cardiff or

London campuses, all SMT members currently in Carmarthen should be informed, and they

will then co-ordinate the flow of information to other University offices.

Contact details for other offices are contained in Appendix 23, for Critical Suppliers in

Appendix 9.

6.3 Emergency Communication

In the event of an incident that has caused a significant impact to the operations of the

University, or may be perceived as having done so (e.g. an incident in the surrounding area),

the following methods of communication should be utilised.

Website – the front page should be replaced with one that acknowledges an incident has

occurred and that a response is underway. If an incident affects access to South Wales, but


systems are still running, this can be done by a regional office. If the systems are down, this

will be done as part of the restore process.

Telephone – if the site is evacuated it would not be possible to answer inbound calls.

Email – The email system will be available on the Carmarthen, Lampeter and Swansea

campuses under normal circumstances, unless the incident itself affects the e-mail system.

University of Wales: Trinity Saint David Council – will be contacted by the Vice Chancellor.

6.4 Media Response

Examples of Holding Statements that may be released in the immediate aftermath of an

incident are attached in Error! Reference source not found.. Press releases will be

composed by the Head of Corporate Communications & PR, who is also the nominated

spokesperson for the University). No other member of staff is authorised to speak on behalf

of the University. All inbound requests for information or comment should be forwarded to

the Silver External Relations team.

6.5 Gold and Silver Team Actions.

The following timelines and flowcharts detail the actions from incident to plan stand down

for all teams. This plan has been designed as a flexible recovery tool, and these actions

should form a guideline rather than a prescriptive framework. The Carmarthen campus has

been used as an example – suggested timelines and flowchart below could be used for any

site.


External Relations Recovery Site Home Site Operations Academic

Assemble at or near

to the Carmarthen

campus

Assemble at

Lampeter campus

Assemble at

Carmarthen campus Assemble at

Lampeter campus

Assemble at

Lampeter campus

Issue holding

statement to the

media, deal with

external enquiries

Prepare Lampeter

campus for the

arrival

of University staff.

Monitor casualties,

assess the damage to

site, liaise with the

emergency services

Assess impact,

restore critical

activities, prioritise

recovery of backlog.

Take decision as to

whether normal

processes can

continue

Liaise with

University offices,

media and

stakeholders.

Relocate restored IT

systems to campus

or new site and

acquire to network

Contact Loss

Adjustor, establish

timescale for site

recovery

Return to normal

working operations,

catch up with any

process backlog

Return to Faculty

offices etc. and

work out timescales

for issues

Normal operations resumed - Home Site restored or replacement site sourced.

IT hardware rebuilt, network recreated, data uploaded and acquired, telecoms restored.

STAND DOWN BUSINESS CONTINUITY PLAN

Staff / student

Liaison

Assemble at

Carmarthen campus

Deal with staff /

student queries and

liaise with External

Relations

Establish whether

staff / students need

to be relocated to

another campus

Business Continuity Plan activated by Gold Team

Incident at Carmarthen campus


6.6 Actions Timeline

Activating the Plan should allow the operations of the University to be restored to a

minimum acceptable level within the Maximum Tolerable Period of Disruption defined by

the business and recorded in the IT Disaster Recovery Plan. The resources should be

available to achieve the following:

Incident

During working hours, the University emergency plan followed; outside working hours,

Plan Director notified and informs Gold Team if appropriate.

Gold Team review the situation:

If incident is minor and has been dealt with, no action is taken;

If impact of incident is unclear, buffer time is utilised;

If incident is obviously going to impact on the operations of the University,

Business Continuity Plan is invoked.

Gold Team to assemble at the Incident Management Control Centre to manage initial

response to incident.

BCP invoked:

Gold Team inform all Silver teams. Decision made as to whether to send staff home or to

keep them available. If sending them home, decision made about providing transport

and locksmiths as required;

Liaison with emergency services, next of kin contact (through emergency services),

casualty management, grief counselling all implemented as required;

Silver Home Site team make initial damage assessment, contact Loss Adjustor and

discuss salvage potential with Emergency Services;

Silver Recovery Site team prepare the Recovery campus The University’s telecoms

provider will be contacted to divert lines to the recovery site. As Carmarthen is a C-Pop

installation for the regional PSBA circuit, the PSBA may have to be informed of the

incident;

Silver External Relations team release holding statement and contact other University

offices with a situation report. Public website restored as part of IT recovery;

Silver Operations team on standby to attend the Recovery campus;

Silver Assessment team decide the impact to the examination schedule;

Silver Student/Staff liaison team on standby at the affected site;

Cascade of information to all staff begins.

4 – 24 hours:

Recovery campus- re-build of IT servers starts, as per IT DR plan;


Silver External Relations distribute prepared message to University offices, media and

stakeholders;

Telephone lines continue to operate through the central switchboard at the recovery

site;

Silver Recovery Site Team answer diverted telephone lines;

Silver Operations Site to notify insurance company and begin discussion with the

managing agent;

Decision taken by Gold Team as to whether to prioritise personal or business items for

salvage. Silver Home Site team collate department salvage lists with Heads of

Departments and liaise with emergency services.

24 – 48 hours:

IT systems are restored at the Recovery Site. Servers and PCs are built; data is restored

and acquired to the network;

The Silver Operations team begins recovery projects.

48 – 72 hours:

Staff continue to report to their recovery site locations as detailed in Appendix 7;

Remote access begins to become available to people working at home or in other

locations.

7 days:

On-going review by Gold Team of service levels to affected offices and campuses;

Board review impact on reputation;

Finance informs SMT(and / or University Council) of anticipated financial implications.

Beyond 7 days:

Assessment of length of dislocation from Home Site is made;

Decisions are made on where staff will work in the medium to long term;

New equipment is purchased and prepared for data transfer at the new or restored site;

Insurance claims are finalised;

If any staff members have been injured, decisions need to be taken by the University

whether to temporarily replace or reorganise;

All University offices are kept informed of situation.

Up to 3 months:


Normal operations resumed either at original site or at new location. New IT hardware

built and data restored to it. Plan stood down, debrief occurs and lessons learned are fed

back into the plan.


6.7 Team Actions

6.7.1 Gold Team

Description Time from incident or invocation

Comments Sign Off

0. Incident occurs at one of the five campuses: no resolution possible.

0 hours

If in normal working hours

1. Emergency Evacuation Plan followed

Immediate

2. Gold team assemble to review the situation.

Immediate

3. Decision made as to whether to invoke the plan, use buffer time or go back to business.

Immediate

4. If buffer time used, standby actions started.

Up to 24 hours

5. If incident unresolved within 24 hours, plan must be initiated.

Up to 24 hours

6. If incident resolved, standby actions stood down.

Up to 24 hours

If disaster notified when staff start to arrive on site

7. The first Plan Director or Plan Manager to arrive at the site notifies the emergency services if not already done.

Immediate

8. Plan Director / Plan Manager notifies the members of the Gold Team

Immediate

9. As per actions 2 – 6 above. As above

If out of normal working hours

10. Out of hours contact notified by duty porter/security staff.

0 hours

11. Out of hours contact attends site if necessary. If incident is likely to

0 – 1 hours


affect operations, Gold Team notified.

12. As per actions 2 – 6 above. As above

If Plan is invoked:

13. Plan invoked – notify Silver teams 0 – 2 hours

14. Silver Home Site monitors casualties and provide next of kin information to the emergency services as required. Any casualties notified to the Gold Team.

0 – 4 hours

15. Reception notified to expect increase in call volumes if phone network available. Message to all stakeholders prepared in conjunction with Silver External Relations.

0 – 2 hours

16. Decision made as to whether staff to be sent home. If staff vehicles inaccessible, liaise with Silver Home Site to organise transport.

0 – 4 hours

17. Gold Team instruct Silver External Relations to prepare and distribute holding statements

2 hours

18. Recovery Site campus is prepared. Silver Operations assemble and report impact on operations to Gold Team.

4 hours

19. Gold Team continue to collate and assess information about incident

Ongoing

20. Silver External Relations handle media enquiries and continue to provide updates all stakeholders.

Ongoing

21. Silver Home Site report on damage to site. Gold Team make decision about working arrangements in the medium to long term.

Ongoing


22. Gold Team declares return to normal working, stand down the Plan

Up to end Month 3

23. Gold Team initiates post event debrief

Post event

6.7.2 Silver External Relations Team

Description Time elapsed Comments Sign Off

0. Incident occurs. 0 hours

1. Gold Team advises Silver External Relations Team that plan has been invoked.

Immediate

2. Silver External Relations prepare and distribute holding statements, notify all other University locations.

2 hours

3. Silver External Relations update website with information

4 hours

4. Silver External Relations handle media enquiries and continue to provide updates for all stakeholders.

Ongoing

5. Debriefing and stand-down. 3 months

6.7.3 Silver Home Site



1. Gold Team advises Silver Home Site Team that plan has been initiated.

Immediate

2. Silver Home Site Team assemble at affected site).

Immediate

3. Silver Home Site monitor casualties and provide next of kin contact information to the emergency services

0 – 2 hours


4. Staff allocated to attend hospital with any casualties. Grief counselling put on standby if required.

0 – 24 hours

5. Silver Home Site Team assess damage to the site and contact Loss Adjustor. Potential of salvage investigated and salvage priorities established from departments and Gold Team.

On-going

6. Salvage Team assembled if emergency services are likely to permit salvage.

On-going

7. Silver Home Site provides Gold Team with report on state of home site and likely length of dislocation.

Week 1

8. Silver Home Site advises site recovery or reconstruction options to Gold Team.

On-going

9. Gold Team make decision on move to a new site / return to original site

On-going

10. Silver Home Site manage restoration of home site or move to new site in conjunction with Silver Recovery Site

On-going


6.7.4 Silver Recovery Site Team



1. Gold Team advises Silver Recovery Site Team that plan has been initiated.

Immediate


2. For local incident Silver Recovery Site assemble at the Carmarthen, Lampeter or Swansea campus. For regional incident, Silver Recovery Site to be located at the Cardiff campus. For a local incident at the Cardiff campus, Silver Recovery Site to be located at the University of Wales, Cardiff. For a London incident, Silver Recovery Site will be located at serviced accommodation

2 hours

3. Local or Regional recovery site prepared.

2 – 6 hours

4. IT rebuild commences. From 6 hours

5. IT systems restored and acquired to the network

Up to 96 hours

6. If the Carmarthen, Lampeter or Swansea campus not operational in the medium to long term, Silver Recovery Site involved in the acquisition and equipping of new site.

On-going


6.7.5 Silver Academic Team Tasks

Description Time from invocation

Comments Sign Off


2. Gold Team advises Silver Academic Team that plan has been invoked

Immediate

3. Decision taken as to whether it is a critical time of year for assessment process.

0 – 2 hours

4. Impact to exam schedule investigated

2 – 4 hours

5. Silver Academic team standby to attend the recovery site campus.

4 – 6 hours


6. Silver Academic team restore operations at Recovery Site and catch up any process back log.

Ongoing

7. Debriefing and stand-down. Up to 3 months

6.7.6 Silver Operations Team Tasks



2. Gold Team advises Silver Operations Team that plan has been initiated

Immediate

3. Silver Operations standby to attend Carmarthen campus.

2 hours

4. Silver Operations assemble at the Carmarthen campus and assess impact on operations

4 hours

5. Banking institutions informed. 4 - 24 hours

6. Silver Operations catch up process back log and return to normal operations

Ongoing

7 Debriefing and stand-down. Up to 3 months

6.7.7 Silver Student/Staff Liaison Team Tasks

Description Time from invocation

Comments Sign Off


2. Gold Team advises Silver Staff/Student Liaison Team that plan has been initiated

Immediate

3. Silver Student/Staff Liaison team stand by to attend the affected site campus.

2-4 hours

4. Decision taken as to whether alternative student

4 - 24hours


accommodation has to be sourced.

5. Prepare relevant communications for students and respond to staff queries as required.

Ongoing

6. Inform commercial clients on status of Facilities. Cancel bookings if required.

Week 1

7. Silver Student/Staff Liaison team restore operations at Recovery Site and catch up any process back log.

Ongoing

8. Debriefing and stand-down. Up to 3 months

6.7.8 Departmental Responsibilities

The Silver teams are designed to ensure that the recovery can occur in the most effective

way, and that service to staff and students can be restored. The delivery of these services

will continue in the normal operational way by the departments with delivery responsibility.

Although the teams contain members of different departments, the structure and method of

working will be changed as little as possible and departments will retain their normal

operational responsibility.

7. Recovery Processes

7.1 Alternate Work Locations

In the short term, for an incident at the Carmarthen campus, recovery will be at the

Lampeter campus and vice versa. At Swansea, Mount Pleasant campus recovery will be at

the Townhill campus and vice versa. Alexandra Road, Dynefor and Ty Bryn Glas recovery will

be at the Mount Pleasant campus. For Cardiff, campus recovery will be at the Carmarthen

campus, and for the London campus recovery will be in serviced accommodation.

Serviced Accommodation - London campus

Following an incident on the London campus the following could be implemented:

1. The hire of other rooms, halls and common areas on the Kennington Business Park at

short notice and at affordable prices;

2. There are many temporary D1 premises available in London – it would be possible to

use church halls, community halls and temporary commercial premises for recovery, in

the short term;


3. Between the months of June – September there are other London based University

premises available to rent. The University has already used London South Bank

University premises during the summer of 2013.

For an incident that has a regional impact, recovery will be to the University of Wales

campus, Cardiff. Medium term options will depend on the scale and duration of any

incident, but the more severe an incident the quicker these options should be put into place.

7.2 Recovery of Premises

Recovery of the affected site will be influenced by the degree of damage. It is critical to get

the rapid involvement of the insurance agent and a loss adjuster, especially if a significant

number of other businesses in the area are affected.

It may well be the case that recovery of a site may take a significant amount of time and that

an interim site will have to be sourced. Care should be taken to ensure that it meets IT

requirements. HR will also have to ensure that staff are not adversely affected by the

journey to the interim site, or by its facilities.

7.3 Recovery of People

A major incident may lead to casualties within University staff, and loss of staff with long

term injuries or medical conditions (including stress). The emergency services will contact

next of kin. University staff should not make this initial contact unless explicitly directed to

by the emergency services.

The HR department will be responsible for pastoral care, and the arrangement of grief or

trauma counselling. If the emergency services require the University to make contact with

next of kin for less seriously injured staff, this is also a HR responsibility. Under no

circumstances should untrained staff make this contact.

Succession Planning (Appendix 4) provides a short term staffing solution for critical roles. In

the longer term, prior cross training and production of job manuals can help mitigate the

absence of accumulated knowledge and in training new staff. New staff will be recruited

externally (including temporary staff where appropriate) and the HR department will be

responsible for their integration.

7.4 Recovery of Technology

Whilst technology is always replaceable, the availability of compatible hardware cannot be

predicted, and the pace of change may mean that obsolete equipment cannot be obtained.

As part of the plan, a detailed IT disaster recovery plan must be kept up to date as any

changes occur to the IT systems.

The recovery priority of IT services to the business is detailed in the IT DR plan in Appendix

18.


7.5 Recovery of Information

Electronic data – see IT Disaster Recovery Plan. Financial documentation is held at the Carmarthen campus – invoices that have been

destroyed without being paid will be identified, and resubmitted by the supplier.

All other paper records should be covered by the Records Management System and the

University’s document retention procedures.

7.6 Recovery of Critical External Supplies

Critical (required within 30 days) suppliers are detailed in Error! Reference source not

found.Contacts

The loss of a campus may mean that the Royal Mail will not be able to deliver post. In this

situation, without advice, they will mark all mail gone away and will return to the sender.

Details of the local Royal Mail delivery office and contacts are held in Appendix 9.

If the event renders the normal offices inaccessible for a protracted period then mail should

be redirected or held at the sorting office. The Plan Director can decide to:

Implement the Mail Collect service, a free service to collect mail from the local Delivery

Office by authorised staff with ID;

Redirection. This allows the University to continue to receive mail sent to the former

address, even if the move is only temporary. Details and ID requirements are available

on the Royal Mail website;

Business Keepsafe: To use Business Keepsafe, Royal Mail requires a week’s notice to set

up the service, the name of the organisation including any variations, plus authorising

signatures on the application form. There is a charge for this service.

8. Standing the Plan Down

The plan has an anticipated lifespan of up to three months from activation. This is

considered sufficient time for any damage to the home site to be identified and timescales

for remedial action formalised, or for alternative accommodation to be sourced and

equipped. As such, the plan is either stood down at three months or when:

- the Home Site has been restored to full operational capacity or a new site has been

sourced, equipped and is able to handle normal operations;

- operations have been restored to pre-incident levels;

- staffing issues have been resolved and all departments have sufficient personnel to

undertake their critical activities.

The decision to stand the plan down is taken by the Gold Team, and should be recorded in

the following table.


Title Stand plan down? Signature

PVC (Finance and Planning) Y/N

PVC (Academic)

PVC (Student Experience)

Executive Head of IT/IS

Director of H R

Once the plan is stood down, the information used during the response to the incident

should be collected and stored safely. A debrief for Gold and Silver teams should occur to

assess the success of the plan and the lessons learned. This information should then be used

to update the BCP.

9. Audit, Review, Maintenance and Testing

The responsibility for the maintenance of the plan and for the initial response lies with the

Plan Managers who will work with the teams/departments/units/individuals nominated to

maintain/review the Appendices.

Apendix Responsibility

Appendix 1 – Gold & Silver Team Members SDD/SMT- review

Appendix 2 – Salvage Team and Actions Faculties/Support Units

Appendix 3 – Recovery Site Locations &

Contacts

Corporate Services

Appendix 4 – Succession Planning SDD/SMT- review

Appendix 5 – Telephone Cascade SDD/SMT- review

Appendix 6 – Staff Contact Details HR

Appendix 7 – Staff Recovery Locations SDD/SMT- review

Appendix 8 – Partner Institution Contact

Details

Dean of Quality & Enhancement

Appendix 9 – Key Supplier Contacts Finance Unit

Appendix 10 – Bank Account Details Finance Unit

Appendix 11 – Battlebox Corporate Services

Appendix 12 – Emergency Evacuation Plans Technical & Property Services

Appendix 13 – Activity Log Senior Gold & Silver Teams to be completed at time

of incident

Appendix 14 – Call Out Procedure Corporate Services

Appendix15 – Stakeholder Contact Details Silver External Relations Team

Appendix 16 – Emergency Information

Sources and Local Radio

Corporate Communications & PR

Appendix 17 – Insurance Company/Loss

Adjustor Details

Director of Finance


Appendix 18 – IT DR Plan and Voice Diversion

Procedures

Information Systems

Appendix 19 – Holding Statement SDD/SMT - review

Appendix20 – Buffer Time Actions SDD/SMT -review

Appendix 21 – Assumptions SDD/SMT -review

Appendix 22 – Critical Dates Calendar Academic Services

Appendix 23 – Campus maps Technical & Property Services


Appendicles

The appendicles contain restricted information and are therefore not published for general consumption.

Business Continuity Plan for the IBO

Documents

Transcript of Business Continuity Plan for the IBO