Business Continuity

Common Business Continuity Considerations

The probing questions in each section are intended to give an idea of the questions Business Continuity planners ask about business operations. These types of impacts are usually considered during the risk & business impact assessment activities, at which time businesses determine the appropriate mitigation strategies based on their individual risk & exposure. 

The items in this list are taken from industry best practices as defined by organizations such as Disaster Recovery International (DRI) and the Business Continuity Institute (BCI). This is not intended to be a exhaustive list of all possible BC considerations and probing questions, so the reader is encouraged to visit their respective websites for more complete information.

Potential Disruption Impacts to Critical Functions

• Loss of employees or employees unable/unwilling to come to work
• How could you continue to run your business if more than 30% of employees are unavailable to work for an extended period (2 weeks? 4 weeks? 3 months?)
• Are you able to quickly source and train an alternate work force if necessary?
• Is succession planning in place for key staff?
• Loss of a site – short-term and long-term duration
• Are you able to continue operations at an alternate work site or using remote teleworkers?
• Would a work site closure impact your ability to continue supplying key customers?
• Is the source of specialized equipment & tooling required at an alternate facility pre-identified & kept current as the business environment changes?
• Are alternate manufacturing facilities capable of ramping up in an acceptable timeframe?
• Loss of external infrastructure – short-term and long-term duration
• Are mitigation strategies in place to minimize the impacts of a power disruption? If back-up generators are part of the mitigation, how long can they run?
• Do your operations need to ensure filtered or potable water is available in case of local water supply/sewage disruptions?
• Do you have alternative communication technologies that can be used in case telecommunications are disrupted? Do your crisis communication plans incorporate & test all of these options?
• Loss of computing capability – Applications or infrastructure – short-term and long-term duration
• Are critical datacenters protected from physical threats? Is access restricted and monitored?
• Are UPS machines or back-up generators used to minimize the impact of power disruptions on critical datacenter operations?
• Do all critical applications have the appropriate disaster recovery plans in place? Do the business groups which rely on those applications have business recovery plans in place? Are manual workarounds available and exercised periodically?
• Loss of vital records (data and documents)
• Are data back-ups conducted on a routine basis and stored safely at an off-site facility?
• Does your business have an information security strategy in place to protect critical systems against malware and cyber attacks?
• Transportation disruptions/inability to ship products
• Have you considered secondary warehouses, shipping lanes and alternate carriers?
• Are there any restrictions on your ability to adjust freight arrangements imposed by local government or customs officials?
• Critical suppliers unable to deliver their products as planned
• Have you discussed business continuity with your critical suppliers?
• Do you have contingency plans in place if they cannot deliver to you?
• Are secondary sources available for critical suppliers? How quickly could these be activated during an emergency?
• Do your inventory and spare parts strategies allow sufficient buffer to ensure operations are not disrupted?
• Are engineering workarounds an option for extended supplier outages?

Supplier/Intel Business Continuity Discussion Framework

This page is designed to help facilitate discussions between Intel and its key suppliers regarding the operational resilience and business recovery capabilities of Intel’s supply chain. 

Crisis Escalation, Management & Communications

• Do you have emergency management structures and defined roles & responsibilities in place to respond to a crisis?
• Is there a defined communication plan to notify your employees, customers and suppliers of a crisis event?
• What is the escalation path & anticipated timeframe from your crisis management team to Intel? Have this been exercised in a real event or business issue?

Business Continuity (BC) Considerations

• What kind of business functions are considered critical and do they have BC plans associated with them?
• What kinds of impacts are considered by your risk mitigation & recovery planning activities?
• How does senior management support the BC program? What management review and corporate governance mechanisms exist?
• Does your BC program ensure that all business processes/functions that are "critical" to your company are identified and documented?
• Does the BC documentation cover the components that make/support critical processes to an "appropriate" level of detail to ensure single points of failure can be identified?
• Does your BC program ensure that business interruption risks are understood, prioritized and their impacts are comprehended? Have your business groups taken steps to reduce risks? How frequently is the risk and impact assessment refreshed so that changes to your business are reflected in the BC program?
• Does your BC program ensure the BC plans in place are well-documented and current? Do these BC plans provide an effective crisis response and ensure that critical operations continue to be operational during a crisis?
• Is the BC plan documentation readily available to the people who need it and maintain it?
• What kinds of exercises and drills are done to ensure the completeness of the plans? Is the organization prepared to perform effectively during a crisis?
• Can your senior management confidently answer "Yes" when asked if everything reasonable and prudent has been done to be able to respond and recover from an emergency?

Supply Chain Business Continuity / Disaster Recovery Questionnaire Elements

When preparing your business continuity plan, here are some simple questions to consider to develop your plan and to prepare for recovery. 

Business Management Policy:

• Please confirm that your company has a written and enforced Business Continuity Management (BCM) policy that applies to all primary sites.
• Please confirm that your company's senior management has reviewed the Business Continuity Management (BCM) program to ensure necessary processes have been established and maintained in the last 12 months.
• Please confirm that your company has a written pandemic plan in place that covers all primary sites.

Risk Assessment:

• Please confirm that in the last 12 months, the supplier/sub supplier sites you are considering in your BC plans have performed appropriate risk assessments that prioritized key risks to the site, estimated the business impact of an outage of critical activities, and appropriate actions to mitigate the risk were implemented.

Crisis Management:

• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have conducted a test of the emergency response procedure in the last 12 months (including initiating Emergency Response Team, evacuation drill, etc.).
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written crisis management procedures showing a designated management team responsible for crisis communications and decision making.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedures for timely notification of customers for issues that impact quality or delivery commitments.

Recovery:

• Please confirm that there is a written recovery plan describing the steps and timing for resuming 100% of critical site activities within a stated recovery time after a disruption
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have tested their time-phased recovery plan in the last 12 months and have processes to address findings identified in the testing
• Please confirm that written plans exist for the recovery of 100% of the supplier/sub supplier sites you are considering in your BC plans for product/service output to an alternate site(s) within a stated recovery time in the case of complete loss of this site and its contents. Answer yes only if the plan addresses 100% of this site's output, all necessary equipment, skilled labor, information technology and critical supplies.
• In the event of complete loss of the site and/or its contents, how many weeks would it take to recover 100% of site product/service output at an alternate site(s) or by rebuilding this site? Include the weeks to acquire equipment, skilled labor, information tchnology and critical supplies, but exclude customer qualification time.

Supply Chain Continuity:

• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have approved definitions and lists of critical suppliers and subcontractors and they have assessed the potential business impact of disruption of their products/services.
• If the response to the previous question is yes, list the approximate number of critical suppliers and subcontractors for this site.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have programs to assess business continuity of all its critical suppliers and subcontractors and has a managed process to address identified risks

Supply Chain Security:

• Does the supplier/sub supplier sites you are considering in your BC plans have any customs authority approved certifications for supply chain security (e.g. C-TPAT (USA), PIP (Canada), AEO (EU), STP (Singapore) or other)?
• If yes, list which customs authority approved certifications are currently active for this site. For each one, list the certification number or code as well as the latest certification or revalidation date.
• If the supplier/sub supplier sites you are considering in your BC plans have no customs security certification but does have written and enforced customs security procedures, please provide a brief summary of the procedures.

Social Responsibility:

• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced labor and wages policy and they have reviewed policy compliance in the past 12 months.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced environmental policy and has reviewed policy compliance in the past 12 months.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced health and safety policy and has reviewed policy compliance in the past 12 months.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced ethics policy (or code of conduct) that forbids bribery/corruption and has reviewed policy compliance in the past 12 months.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have a program to manage and continuously improve its environmental impact, worker health, safety and ethical business conduct.
• Do the supplier/sub supplier sites you are considering in your BC plans have a written and enforced policy and due diligence plan to forbid purchasing metals containing tin, tantalum, tungsten or gold from sources that directly or indirectly finance conflict in the Democratic Republic of the Congo or an adjoining country?

Security:

• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced policies for safeguarding confidential customer Intellectual Property (IP), information and documents.

Fire Prevention:

• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedures to manage the safe-handling of hazardous materials (e.g. flammable liquids, aerosols, poisonous gases) as well as storage in a separate and dedicated area.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedure to authorize and control hot work activities (brazing, grinding, welding, cutting using oxy-acetylene torch, etc.) for non-production activities in the facility (e.g. facility repair, equipment repair, plumbing, construction).
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have an automated fire suppression system (e.g. sprinkler, chemical or gas-based automated system) that protects all critical site activities.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans maintain and tests their fire protection equipment and electrical equipment on a regular basis at least annually. Fire protection equipment includes pumps, sprinklers, extinguishers, detectors and alarm systems. Electrical equipment includes switchgear, circuit breakers, batteries, etc.

Power:

• Please confirm that there is a backup power source (in addition to a UPS) that enables continued operation of critical Information Technology, facility security systems and fire control equipment used by this site.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans backup power source is load tested (at least 80% load) on a semi-annual basis.

IT:

• Please confirm that there is at least a daily data backup and at least weekly offsite storage for all electronic data required to support all critical site activities.
• Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written Information Technology (IT) recovery plans covering all IT resources needed to support all critical site activities.
• Please confirm that all Information Technology (IT) recovery plans covering all IT required for all critical site activities have been tested in the last 12 months.