Disaster Recovery Plan and Business Continuity Plan
Scottish Schools’ FA – Disaster Recovery Plan (DRP) & Business Continuity Plan
Information Technology Statement of Intent
This document highlights Association policies and procedures for technology disaster recovery, as well as plans for recovering critical technology platforms and the telecommunications infrastructure. This document summarises recommended procedures.
In the event of an actual emergency situation, modifications to this document may be made to ensure physical safety of people, systems or data.
The principal aim of this plan is to ensure information system uptime, data integrity and availability, and business continuity.
The disaster recovery plan should cover all essential and critical infrastructure elements, systems and networks, in accordance with key Association activities.
All members of President’s Committee must be aware of the disaster recovery plan and their respective roles in implementing the plan.
The disaster recovery plan is to be kept up to date to take into account changing circumstances.
The principal objective of the disaster recovery programme is to develop and document a well structured and easily understood plan, which will help the Association, recover as quickly and effectively as possible from an unforeseen disaster or emergency which interrupts information systems and Association operations.
Additional objectives include the following:
- the need to ensure that all employees fully understand their duties in implementing such a plan
- the need to ensure that operational policies are adhered to within all planned activities
- the need to ensure that proposed contingency arrangements are cost-effective
- the need to consider implications on organisations involved in schools’ football
It is necessary for the process of updating the DRP to be properly structured and controlled.
Whenever changes are made to the plan appropriate, these should be intimated to all volunteers conducting the central work of the Association.
The DR plan will rely principally on key members of management and staff who will provide the technical and management skills necessary to achieve a smooth technology and business recovery. Suppliers of critical goods and services will continue to support recovery of business operations as the Association returns to normal operating mode.
Location of Association Administration
The Association’s offices are based at Hampden Park, Glasgow which provides a base for the General Secretary, Treasurer and International Teams Secretary. All other Association work is conducted by volunteers based at domestic addresses and using personal computers. This is an important conditioning factor in developing response to any given disaster.
Plan Triggering Events
Key trigger issues that would lead to activation of the DRP are:
- at the Association offices – loss of power, major communications and IT failure or closure of Hampden park for unforeseen reasons
- financial management losses such as theft of funds, loss of cash, loss of cheque book and credit cards, loss of financial documents
- an event that might impair or prevent a volunteer using domestic facilities to conduct Association business
The Association regards this as carrying a particular risk for the continuity of its activities and thus recognises:
- the need for all computers being used to conduct Association business to have appropriate back-up facilities, this covering computers based at the Association’s offices and those in individual domestic settings – all volunteers will be requested to establish and retain back-up processes
- the benefit of business being conducted in a range of locations in that there is the prospect of recovering lost IT data relatively soon because of it having been shared according to the conduct of business.
Activation of Disaster Recovery Team
When an incident occurs a Disaster Recovery Team (DRT) will be activated by the General Secretary or President. The DRT will then decide the extent to which the DRP must be invoked. Responsibilities of DRT are to:
- respond immediately to a potential disaster and call emergency services.
- assess the extent of the disaster and its impact on the Association, data centre, etc.
- decide which elements of the DR Plan should be activated.
- establish and manage disaster recovery team to maintain vital services and return to normal operation
- ensure all those volunteers involved in managing the Association are notified and allocate responsibilities and activities as required.
Disaster Recovery Team
The team will be contacted and assembled by the General Secretary or in his absence the President and the team’s responsibilities include:
- establishing facilities for an emergency level of service
- restoring key services as soon as possible after the incident
- coordinating the activities of disaster recovery team, first responders, etc.
Recorded Messages / Updates
For the latest information on the disaster and the organisation’s response, individuals can call the General Secretary or the President. Information will also be posted on the website and via Social Media. Included in messages will be data on the nature of the disaster and updates on work resumption.
Personnel and Family Notification
If the incident has resulted in a situation, which would cause concern to an individual’s immediate family such as hospitalisation of injured persons, it will be necessary to notify their immediate family members quickly. That is the responsibility of the senior member of the DRT.
Any contact required with the media will be coordinated by the General Secretary or in his absence the President. The President, failing whom the Vice President, failing whom the senior Honorary Vice President available will act as Association spokesman.
As part of the Association’s disaster recovery and business continuity strategies a number of insurance policies have been put in place. These include property damage, errors and omissions, directors & officer’s liability, general liability, and business interruption insurance.
The DRT shall prepare an initial assessment of the impact of the incident on the financial affairs of the Association. The assessment should include:
- financial implications of loss and financial requirements of a recovery programme
- interim banking arrangements to enable continuity of business
The President’s Committee and if necessary an Association Lawyer will review the aftermath of the incident and decide whether there may be legal actions resulting from the event, in particular the possibilities of claims by or against the Association for regulatory violations or the consequences of other actions.