Plan Development, Response Structures, and Incident Management
Plan development converts strategy into actionable documentation. Continuity plans should be concise, role-based, and usable under stress. Typical components: purpose and scope, plan activation criteria and authority, the incident management team structure, roles and responsibilities, communication protocols, recovery procedures and resource lists, dependency and contact information, and interfaces to other plans.
Incident management structures typically separate strategic, tactical, and operational levels. A crisis management team handles strategic decisions, stakeholder and media communications, and resource authorization; a tactical or business continuity team coordinates recovery across functions; operational teams execute procedures. Clear escalation triggers, delegated authority, and a single incident log prevent confusion. Communications planning covers internal staff, customers, regulators, media, and suppliers, with pre-approved templates and alternate channels.
Traps: writing plans as lengthy narratives that no one can use during an incident; omitting activation criteria and decision authority; failing to define who declares a crisis; and not addressing communication when primary systems are down. Candidates also confuse the emergency response plan (life safety, evacuation) with the continuity plan (service recovery) and the crisis communications plan.
Worked example: at 02:00 a fire disables the primary data center. The facilities team activates the emergency plan for life safety. The incident manager confirms the outage exceeds the predefined trigger, notifies the crisis team, and declares a disruption. The crisis team authorizes failover to the warm site and approves a customer statement. Operational teams execute recovery procedures, logging actions and decisions. The plan worked because triggers, authority, and communication channels were pre-defined.
Rule of thumb: a plan should let a competent person who is not the author take correct action at 2 a.m. If it cannot, simplify it.