Implementation
Building usable plans
Implementation turns strategy into actionable plans. A typical architecture includes emergency response, incident management and coordination, business continuity plans for critical activities, IT disaster recovery, supplier continuity, communications and recovery plans. Plans should be concise and role-based, with activation criteria and authority, escalation levels, contact data, procedures, resource requirements and interdependencies. Use checklists, flowcharts and action cards rather than long prose. Assign owners, control versions, and distribute plans so they are accessible when needed but not uncontrolled.
Traps
Common traps include treating a contact list as a plan, lacking named activation authority, writing for auditors rather than users, using generic content that ignores the BIA, and failing to define maintenance triggers. Plans must link to incident management, communications and supplier arrangements. A plan that cannot be used in the first hour is a document, not a capability.
Worked example
A plan template might contain: purpose and scope; roles and responsibilities; activation and escalation; first-hour actions; continuity procedures; recovery steps; communications; resource requirements; appendices. A responder should locate their first three actions within 60 seconds.
Rule of thumb: write for the person who must act at 3 a.m., not for the person reading in an audit.