Business continuity planning refers to the process of creating a strategy and framework for an organization to effectively manage and recover from potential disruptions or disasters, ensuring the continued operation of critical business functions and minimizing the impact on stakeholders.

An Account / Site specific Business Continuity plan (BCP) should be developed and agreed upon with the Supplier when commencing work on any site or sites. 

Provide the Supplier with a copy of the Account / Site Specific BCP requirements and ensure that the Supplier aligns their BCP to these requirements.

RL-008 Ver 1.0 (Jan 24)

Confidential & Proprietary | 2024 CBRE Inc.

Useful Links

Introduction

Resource Library

Business Continuity Planning

Resource Library

Page 1 of  1

Key Points

Key Points to consider are:

• Supplier to create and maintain an appropriate BCP to mitigate risk and ensure the planned continuity of all Services delivered by the SOW
• The Supplier  is to provide the CBRE Account / Site Teams with a soft copy of the BCP
• A minimum of an annual review after updating plans to meet Account / Site specific CBRE / Client requirements and frequencies 
• Specific reviews shall be conducted ahead of known or anticipated events such as the enhanced risk of terrorism, flood or hurricane alerts
• BCP shall cover all reasonable potential incident eventualities about incidents and events impacting the Supplier, CBRE, the Client, or the site that may prevent the performance of the services
• Supplier shall use all reasonable endeavors to provide continuity of service to meet the SOW 

What is the process of implementing a BCP ?

1:

Risk Identification

2:

Impact Analysis

3:

Business Impact Analysis (BIA)

4:

Strategy and Plan development

5:

Plan implementation

6:

Testing and Exercising

7:

Plan maintenance and updates

8: 

Communication and Awareness

The first step is to identify and assess potential risks and threats that could disrupt the normal operations of a business. This includes both internal and external risks such as natural disasters, cyber-attacks, power outages, supply chain disruptions, pandemics, etc.

Once the risks are identified, an impact analysis is conducted to determine the potential consequences and impacts on the business. This involves assessing the potential financial, operational, reputational, and regulatory impacts of each identified risk.

BIA is a more detailed assessment of critical business functions and processes. It helps in identifying the dependencies, vulnerabilities, and recovery time objectives (RTOs) for each function. This analysis helps prioritize the allocation of resources and efforts during the planning phase. 

Based on the identified risks and their impact, strategies and plans are developed to mitigate the risks and ensure continuity of operations. This includes developing response and recovery strategies, defining roles and responsibilities, establishing communication protocols, and setting up alternative work locations.

Once the strategies and plans are developed, they need to be implemented across the organization. This involves training employees, establishing necessary infrastructure and resources, and integrating the plans into the day-to-day operations of the business.

Regular testing and exercising of the BCP is crucial to ensure its effectiveness. This includes conducting tabletop exercises, simulations, and full-scale drills to evaluate the readiness and effectiveness of the plans. The results of these exercises help identify any gaps or areas of improvement that need to be addressed.

Business Continuity Planning is an ongoing process, and plans need to be regularly reviewed, updated, and maintained to align with changes in the business environment, technology, and potential risks. This includes incorporating lessons learned from testing and exercising, updating contact information, and revisiting strategies and recovery procedures.

Communication is a critical component of BCP. Clear and effective communication channels need to be established to ensure that employees, stakeholders, customers, and partners are aware of the plans and their roles during a crisis. Regular communication and awareness programs help build a culture of preparedness and resilience within the organization.