Business continuity and disaster planning for records
Your agency's business continuity plan (BCP) will need to include recordkeeping functions, considerations and requirements, and disaster preparedness and response planning for records.
Alternatively, you can develop a separate BCP for recordkeeping functions within your organisation.
Disaster preparedness involves:
- planning–identify and prioritise your physical and digital records
- prevention–establish a disaster preparedness and response plan to protect and recover your records
- response–initiate your plan and deploy resources to protect your records from significant impact
- recovery–salvage and restore affected records to resume business operations.
A formal disaster preparedness and response plan should form part of your business continuity planning.
To develop your plan, start by identifying which people or positions would be involved, and define their roles.
Do a risk assessment and gap analysis. You will need to know:
- what records you have and where they are
- what records are essential and vital and how you will formally identify and protect them
- what are the known and likely threats and scenarios that could cause a serious incident or disaster
- the potential risks to records and an assessment of the impact this would have on business
- what level of risk is acceptable
- what resources you have available and if they are adequate
- what arrangements and resources you need to manage incidents in-house
- if staff training is adequate.
To assess the level of risk, use the sample risk assessment framework .
You may need to look at:
- policies relating to or including information on disaster management
- resources needed to manage records in the event of a disaster
- the effect of access restrictions applied to records
- having agreements with other organisations in the event of a disaster (e.g. for storage or salvage space, temporary work space, or additional staff).
Your agency should have one or more backups of systems and records for business continuity and disaster. Find out about backups.
You may want to create an incident response kit (PDF, 64 KB) based on your level of risk.
Find disaster manual templates, guides, plans and tools that can be adapted to your needs.
Learn from others with experience in disaster and incident management.
Knowing what and where your agency's high-value, high-risk and vital records are will help your agency maintain or re-establish operations during or after a disruption.
Find out more about how to identify and manage your agency's high-value, high-risk and vital records.
Your disaster preparedness and response plan can include a risk mitigation action plan based on these lists, and your risk assessment.
Find out how to identify and manage vital records and how to protect your records in a disaster.
Identify what actions can be taken to prevent or mitigate incidents.
Use this to implement your risk mitigation action plan and then reassess the risks, particularly for vital records.
- Where and how the records are stored–are they in the best location and conditions?
- Does your agency have a backup of your vital records? If not, is it worthwhile duplicating or backing up your agency's vital records?
- In the event of a disaster, will the records you need be accessible?
- Do you need to change processes and procedures to reduce risks? (e.g. handling of records, when records are captured)
- Are security, detection and suppression systems like fire suppression systems and fire doors in place?
Finalise your preparations by gathering resources, formalising arrangements and increasing staff awareness and skills. Training and mock disasters will give you experience managing wet and damaged records.
Test your plan periodically, and document and review incidents or near misses.
Backups of entire systems and information in case of failure are usually done for disaster recovery or business continuity purposes.
Find out more about backups and managing them as records.