Business Continuity Plan Version Description Date Author

Business Continuity Plan

When this plan is activated staff may only comment to the media

with the permission of a member of the Senior Management Team.

Version Description Date Author

1.0 Published on SPSO website 2010 Feb Senior Personal Assistant

1.1 Audited 2012 Jul Internal Auditor

2.0 Published on SPSO website 2012 Aug Senior Personal Assistant 2.1 Reviewed 2013 Jun Senior Personal Assistant 3.0 Published on SPSO website. 2015 May Senior Personal Assistant

Contents 1.  Policy 

2.  What to Do in the Event of a Disaster  3.  Specific Disaster and Failure Scenarios 

Business Continuity Plan

1. Policy

Introduction ... 2 

The Scope of the Plan ... 2 

Disaster Management Team (DMT) ... 2 

Activating the Plan ... 2 

Testing and Maintaining the Plan ... 3 

Alternate Office Accommodation ... 3 

Office Risk Assessment ... 3 

Assumptions ... 3 

Introduction

The Scottish Public Services Ombudsman (SPSO) provides a 'one stop shop' for people making complaints about organisations providing public services in Scotland. The SPSO maintains a Business Continuity Plan (the Plan) to enable it to:

 return to business as usual as soon as possible following any disruption to service;  secure prompt and efficient recovery of critical business operations.

It is acknowledged that there is very little that the SPSO does that is so critical that public life would be severely disrupted if that activity could not be undertaken for a prolonged period.

The Scope of the Plan

This Plan has been approved by the Senior Management Team (SMT) and is owned by the Ombudsman as Accountable Officer. Building floor plans are maintained and copies kept with the document.

A copy of the full Plan is held in the SPSO office, at the Scottish Parliamentary Corporate Body (SPCB) and is available to staff on the SPSO intranet site. A redacted version is published on the SPSO website.

This Plan outlines the process to be followed in the event of a major disruption to service affecting the normal business activities undertaken by the SPSO at 4-6 Melville Street, Edinburgh, EH3 7NS.

Disaster Management Team (DMT) The four members of the DMT are:

 DMT Leader - Director / Head of Complaint Standards (reserve)

 DMT Deputy - Senior Personal Assistant / Head of Complaints Standards (reserve)  Human Resources Officer

 Head of Policy and External Communications / Ombudsman (reserve) The areas of responsibility are:

 Disaster Management - The DMT has overall responsibility for management, control and activation of the Plan.

 Media and External Communications - The Head of Policy and External Communications is responsible for communicating with local and national media and for establishing a response centre. In her absence, the Ombudsman will assume this responsibility.

 Buildings and administration - The Senior Personal Assistant is responsible for finding alternative accommodation, establishing a replacement telecommunications network and IT service and emergency financial payments. In her absence, the Head of Complaints Standards will assume this responsibility.

 Human Resources and Internal Communications - The Human Resources Officer is responsible for staff welfare. In her absence, the Director will assume this responsibility. Activating the Plan

Any two members of the DMT can agree to activate the Plan. They will confirm activation by telephone, email, or text to all DMT members and the Ombudsman. Once the Plan is in operation the DMT will follow the procedures contained in the Plan. The DMT Leader will confirm when the Plan is deactivated via text or email.

During the period when the Plan is in operation, all staff must follow the instructions of the DMT and must avoid taking any unilateral action that may hamper or jeopardise recovery.

Business Continuity Plan Testing and Maintaining the Plan

The alternative accommodation arrangement with Scottish Government and the telephone lists will be reviewed and updated where necessary each year.

It is not possible to test the Plan in its entirety. However, the 'telephone call chain message' procedure and the assembly of the DMT will be tested and the results recorded in the problem/exception log (Annex 4).

Alternate Office Accommodation

In the event that the office is compromised, alternative office space would be identified through the Scottish Government. This can be done through the Help Desk accommodation line on 0131 240 8500 (option 3) or the Scottish Government Head of Business Continuity and Risk, Facilities and Estates Services.

Up to seven laptops are accessed from home by staff. Office Risk Assessment

The only disaster that would result in downtime of more than one week is likely to be the loss of the property. An office risk assessment is undertaken annually, with key findings and actions reported to the Director.

Assumptions

The following assumptions have been applied to this plan to measure how critical the loss of service is to the business:

 48 hours – serious implications for the performance measures of the complaints handling process and must be resolved without delay.

 Two weeks – a very serious position with potential long-term effects.

 One month – a critical position threatening the SPSO's ability to carry out its statutory function. It is vital that alternative arrangements are put in place immediately.

2. What to Do in the Event of a Disaster

Roles and Responsibilities ... 5 

Disaster Management Team (DMT) ... 5 

Staff Notification of Disaster ... 5 

Media and External Communication ... 6 

Key points ... 6 

Communication Principles ... 6 

Human Resources and Internal Communication ... 6 

Buildings, Administration and IT Service ... 6 

Annex 1 – Confidential Emergency Contact Details (not for publishing) ... 8 

Annex 2 – Draft Outline Initial Press Statement ... 10 

Annex 3 – Media Contacts ... 11 

Annex 4 – Problem /Exception Log ... 12 

Annex 5 – Telephone Call Chain Message Procedure ... 13 

Annex 6 – Melville Street Floor Plans ... 14 

Annex 7 – ICT System Document (Workpro) ... 18 

Business Continuity Plan

Roles and Responsibilities

The following areas of responsibility have been established:  disaster management;

 media and external communication;  buildings and administration;

 IT system and applications; and

 staff welfare and internal communication.

This section of the Plan defines the role and responsibilities of each area. Disaster Management Team (DMT)

The DMT is responsible for providing overall direction of the recovery operations. It must ascertain the extent of the problem or damage, activate the Plan, and monitor and report recovery progress. Specific responsibilities include:

 activation and deactivation of the Plan;  initiating business continuity procedures;  liaising with emergency services;

 evaluation of the extent of the problem and the potential consequences;  external public relations;

 monitoring recovery and assuring achievement of the Plan;  maintenance of security; and

 control of emergency expenditure. Staff Notification of Disaster

The Telephone Call Chain Message Procedure at Annex 5 will be initiated by the DMT Leader or the DMT Deputy. The process:

1. On receiving information regarding a serious business interruption the DMT Leader or Deputy will contact DMT members to activate the plan.

2. The Deputy will inform the Ombudsman and senior management of actions about to be initiated.

Initiating the call chain:

3. The Deputy will relay the initial instructions to Line Managers starting the telephone call chain. 4. Line Managers will contact all members of their team with the message.

5. All staff will confirm receipt of the message, by return message, to their Line Managers.

6. Line managers will confirm all staff have received the message to the Deputy, by return message.

Follow-up information:

7. The Human Resources Officer will contact Line Managers with further information and instructions for their teams, including an emergency contact number for staff.

8. The Deputy will ensure the external office users and business contacts are informed of the situation.

The DMT will meet at the designated location as soon as possible to implement further actions. In normal office hours the meeting place will be Thistle House, 91 Haymarket Terrace EDINBURGH EH12 5HD.

If out of office hours the meeting place will be agreed by DMT members and will be either a member of DMT's home address, or the Roxburghe Hotel, 38 Charlotte Square, Edinburgh, EH2 4HQ, Tel 0844 879 9063.

Media and External Communication

A disaster affecting the SPSO may attract interest from local and national media. This section of the Plan outlines how it would be handled by the Head of Policy and External Communications who will assemble an appropriate team to assist.

Key points

 Only the Ombudsman or spokespeople nominated by the Head of Policy and External Communications may liaise with the media.

 All staff are required to refer media interest to the nominated media co-ordinators.

 The Head of Policy and External Communications must be kept informed at all times of actions being taken by other DMT members.

 Telephone facilities to establish a response centre will be made available at SLCC.  A draft outline initial press statement is outlined in Annex 3.

 A list of key media contacts is in Annex 4.

Communication Principles

If the disaster involves an accident or other risk to health, staff and the concerns of their relatives will take priority. Local media can play a valuable role in providing reassuring information.

During the period that the BCP is activated, the Head of Policy and External Communications will:  keep all lines of communication clear and ensure all personnel dealing with the media have

the same information;

 refuse to comment on what has happened until the information has been verified by the emergency services;

 be positive and available when dealing with press and media enquiries;  log all media calls; and

 give all the media the same information and tell them when new information will be available.

Human Resources and Internal Communication

The Human Resources Officer will be responsible for maintaining staff communications during a recovery process. Other responsibilities include:

 dealing with any staff problems caused by the disaster;

 handling front-line communications with staff and their relatives. Buildings, Administration and IT Service

The Senior Personal Assistant is responsible for:

 the provision of standby accommodation facilities to the agreed level of service to business-critical users;

 the reinstatement of normal building services within the predetermined timescale; and  liaising with IT services providers to:

 provide standby IT facilities to the agreed level of service to business-critical users;  reinstate normal IT services with the predetermined timescale; and

 configure new hardware, software and communications facilities and ensure that the integrity of data is safeguarded.

 setting up and maintaining budgetary control procedures for emergency costs and maintaining records of expenditure for subsequent insurance claims.

Specific responsibilities include:

 contacting the appropriate authorities to ensure that the affected site is made secure to prevent unauthorised access by staff or the public;

 arranging transport and accommodation for staff, documentation and equipment;

 setting up and maintaining all administrative support services such as secretarial, telephone, fax, office equipment, stationery etc;

 contacting and liaising with suppliers of essential services; and  ensuring ICT Service providers do the following:

Business Continuity Plan  establish procedures and schedules for the operation of standby facilities;

 install operating systems, application software and data on standby and replacement IT facilities;

 retrieve documentation and media from backup storage;  implement interim processing and backup procedures;  enforce logical security at the standby site;

 prepare and review production schedules at the standby site;

 initialise and test standby hardware, operating systems and communications;  process restored IT systems in accordance with agreed production schedules;

 contact suppliers and order and configure replacement facilities; damage evaluation, identification of salvage, removal of re-usable equipment;

 provide information and support for interim IT facilities; and

 reconfigure the communications network as required and monitor performance.

Note: The Scottish Government ISIS BCP Team would be responsible for reinstating normal (lost) IT Services in identified SPSO premises. A request for the BCP for SPSO to be invoked can be made by contacting the ISIS Chief Technical Officer.

Annex 1 – Confidential Emergency Contact Details (not for publishing)

Disaster Recovery team (to be kept updated by team members)

Title Name Blackberry Personal Mobile Home

Director (DMT Leader) Senior Personal

Assistant (Deputy) Head of Policy and External Communications HR Officer Head of Complaints Standards (Reserve) Ombudsman

Main key holder contact details

Position Name Blackberry Personal Mobile Home

Senior Personal Assistant

Head of Policy and External

Communications

Business Continuity Plan

Emergency business contacts - Priority A

Company / Contact Telephone No Contract / Account Number ADT Alarms

Arthur Gallagher Insurance CAS – Workpro

G4S Building Access

Landlord SCOTS – IT Server and Hardware

Scottish Parliament

Emergency business contacts - Priority B

Company / Contact Telephone No Contract / Account Number Apex Rapid Clean

British (Scottish) Gas Eagle Couriers GB Telecom

Greenleaf Hygiene Solutions Law At Work (UK) Ltd

Muller Wiseman Milk Deliveries Office Papers

Office Team On-Site Shredding Otis Lifts

Pitney Bowes, Franking Machine Royal Mail - Collection Services Scottish Water

Annex 2 – Draft Outline Initial Press Statement

The following draft is to ensure each topic is addressed and will be updated in the light of the specific circumstances.

Statement following incident at the SPSO Edinburgh on (Date/Time)

At (time) today (date) (emergency appliances) attended an incident at the office of the SPSO at 4 Melville Street, Edinburgh.

We are working to restore services to the public and other stakeholders as soon as possible at the organisation’s alternative site (address).

The following statement provides up-to-date information on the circumstances.

Personal Safety

 SPSO staff and relatives seeking information should contact our emergency helpline on (xxx).

 Staff not currently involved in implementing our Business Continuity Plan have been sent home.

 The site is currently only accessible by emergency services.

Damage to property

 We anticipate that access to the building should be possible from (date) to obtain records and full work will be possible from (date).

Effect on business

 We are working to ensure that service will be restored as soon as possible.

 Our Business Continuity Plan involves key staff using the organisation’s alternative location in Edinburgh.

 Most services will be unaffected by the incident, although outside contact may limited today.  A helpline for the public is available on the main reception telephone line at [enter location

and number].

For further information, contact: xx Head of Policy and External Communications (cover - Ombudsman)

Business Continuity Plan

Annex 3 – Media Contacts

The media co-ordinator should consider contacting the following with any media statement.

Outlet First name Last name Position Email Office telephone / mobile

BBC TV Scotland Newsdesk [email protected] S/b 0141 338 2760 / 0131 557 5888

STV Newsdesk [email protected] S/b 0141 300 3000

BBC Radio Scotland Newsdesk [email protected] S/b 0141 338 2760

Forth 1 Newsdesk [email protected] S/b 0131 557 1005

Real Radio Newsdesk [email protected] S/b 0141 781 2206

The Herald Newsdesk [email protected] S/b 0141 302 7000

The Scotsman Newsdesk [email protected] S/b 0131 620 8620

Scottish Press Association Newsdesk [email protected] 0870 124 4188

Edinburgh Evening News Newsdesk [email protected] S/b 0131 620 8620

The Daily Mail in Scotland Newsdesk [email protected] Sb 0141 331 4700

Scottish Daily Record Newsdesk [email protected] S/b 0141 309 3000

Metro Newsdesk [email protected] S/b 0141 225 3336

The Daily Telegraph (Edinburgh office) Newsdesk [email protected] 0131 620 4214

The Herald Brian Donnelly Politics [email protected] 0131 718 6457 / 07803 970 113 The Scotsman Hamish MacDonell Politics [email protected] via S/b 0131 620 8620

Holyrood Magazine Mandy Rhodes Editor [email protected] 0131 272 2114 / 07968 049267

Sunday Herald Newsdesk [email protected] S/b 0141 302 7800

Scotland on Sunday Newsdesk [email protected] S/b 0131 620 8620

Sunday Times Scotland Newsdesk N/A S/b 0141 420 5100

Annex 4 – Problem /Exception Log

The problem/exception log should be used by each DMT member to provide a record of events or decisions not covered in the Plan. The completed logs will provide a source of data for subsequent analysis and management information.

Use the sheets as follows:

 Make an entry for each significant action, decision or event, noting the date and time.  Sign off entry made.

 Ensure that recovery staff use the sheets. DMT Member Name:

Sheet No.x - Title

Business Continuity Plan

Annex 5 – Telephone Call Chain Message Procedure

1. On receiving information regarding a serious business interruption the DMT Leader or Deputy will contact DMT members to activate the plan.

2. The Deputy will inform the Ombudsman and senior management of actions about to be initiated.

Initiating the call chain:

3. The Deputy will relay the initial instructions to Line Managers starting the telephone call chain.

4. Line Managers will contact all members of their team with the message.

5. All staff will confirm receipt of the message, by return message, to their Line Managers. 6. Line managers will confirm all staff have received the message to the Deputy, by return

message.

Follow-up information:

7. The Human Resources Officer will contact Line Managers with further information and instructions for their teams, including an emergency contact number for staff.

8. The Deputy will ensure the external office users and business contacts are informed of the situation.

Call Tree (reviewed May 2015)

Ombudsman

DMT Leader Director

Head of Policy and External Communications Team and IPA

managers

Team members DMT Deputy Senior Personal

Assistant

External office holders

and Business Contacts Media

Corporate Services Team

Annex 6 – Melville Street Floor Plans

Top Floor

t9a

Meeting room

Top Floor Kitchen

Male Toilet Lift Fe_{male T} o ilet t9b Photoc o p ier

10 DESKS

1 PHOTOCOPIER

11 DESKS

1 PHOTOCOPIER

Business Continuity Plan First Floor Boardroom Toilet Lift 1 DESK Photocopier PC

1 DESK

1 PRINTER

15 desks, 1 photocopier

Ground Floor Pod Lift Male T o ilet Locker s

12 desks

1 photocopier

7 desks

1 photocopier

1 fax machine

1 franking machine

Number 4

Number 6

Mail pigeonholes Photoc opier 146 D

Business Continuity Plan

Basement (opposite rotation)

2 computers Outre a c h Storage

Toilets/ Shower Room

Main Kitchen Disabled Toilet Meeting room

7 desks

2 photocopiers

Annex 7 – ICT System Document (Workpro)

Link to document: CAS Workpro ICT System Documentation v2.0 (06 Oct 2014)

3. Specific Disaster and Failure Scenarios

General Arrangements when Alternative Accommodation is Required ... 20 

Loss of access to network and systems for more than one day ... 20 

Loss of Utilities (water, electricity, gas) to the whole office ... 20 

Extreme Weather Conditions ... 21 

Denial of access to building prior to arriving at work ... 21 

Evacuation followed by denial of access to building ... 21 

Threatening behaviour or terrorist threat ... 21 

Loss of key staff ... 21 

Pandemic ... 21 

General Arrangements when Alternative Accommodation is Required At anytime the office is closed to the public:

 If the office equipment cannot be accessed by staff, the DMT would arrange for GB Telecom to install a message on the telephone line explaining the problem and asking urgent callers to contact by email.

 DMT would arrange for Royal Mail to ensure mail delivery was held or redirected.

 DMT would ensure contractors are informed of the change of arrangements when required. When required to vacate the SPSO office and move to an alternative site, the following arrangements would be put in place:

 DMT would identify with ISIS what alternative accommodation with access to the SCOTS network would be available for use in Edinburgh, for example, at Thistle House, Haymarket, and how many staff could be accommodated.

 Those staff with home working facilities could do so.

 Those staff closest to Glasgow could occupy the hot desks available there.

 Those staff working in Edinburgh would meet at the SPSO office to be transported to the alternative accommodation, unless notified prior to arriving at the office.

 The required case files into archive boxes secured with packaging tape and taxiing the material to the alternative worksite.

 Where possible, staff would ensure their telephones were diverted to voicemail and an appropriate message recorded.

 If required, the Advice Team would ensure at least one telephone was answered and mail was collected at the SPSO location.

 The ask@ inbox would be monitored from the alternative worksite.

 Travel time to and from the alternative worksite would be recorded as time worked. Loss of access to network and systems for more than one day

 If ISIS confirmed that reported problem with the network connection or IT system would not be fixed within two working days and was specific to the SPSO the general arrangements for alternative accommodation would be put in place.

 If the problem was widespread through all SCOTS sites or CAS confirmed the problem was with the case-handling application, the Ombudsman would request staff to work off-line to the best of their ability until the problem was rectified.

Loss of Utilities (water, electricity, gas) to the whole office Loss of electricity supply:

 If initial enquiries identify that the problem could be rectified within an hour, staff would be asked to take a break away from the office and return after an allotted time frame.

 If the problem would persist for less than one day but more than an hour the Ombudsman would announce that the office was closed and staff would be sent home.

 If the problem would persist for more than one day staff would be accommodated in alternative office space.

 If the power loss was widespread and likely to be more than an hour, the Ombudsman would announce that the office was closed.

Loss of water supply to the whole SPSO location for more than four hours:

 The Ombudsman would announce that the office was closed and staff would be sent home.  If the problem persists for more than a day, staff would be accommodated in alternative

office space.

Loss of gas to the whole SPSO location for more than three days in wintery conditions:

 As gas only affects the heating of the building, alternative accommodation would need to be sought if the problem persisted past three working days.

Business Continuity Plan

Extreme Weather Conditions

This scenario would cover severe winter conditions and extreme weather warnings that may occur before the working day or during the working day.

Before travel to work is undertaken: If an extreme weather warning is issued by the Scottish Government advising citizens to not undertake major travel journeys, the members of the SMT would work from home on laptops. Those staff that could safely make it to the Edinburgh office or the Glasgow hot desks would be expected to do so. If the minimum number of staff were available in Edinburgh to maintain normal operating conditions the office would be open for business as usual.

If a minimum number of staff were not able to make it to the office, the Ombudsman would announce that the office was closed to the public and the usual closure announcements would be placed on the ask@ inbox replies and the telephone messaging service. The incoming mail would be acknowledged in the normal expected timeframe by the staff available in the Edinburgh office. After arriving at work: If unexpected extreme weather warnings are issued after staff have undertaken travel to the office and are unable to make it home safely, the Ombudsman would approve the provision of accommodation and essential provisions for those staff members. The use of corporate credit cards will facilitate this.

Denial of access to building prior to arriving at work

The DMT would ensure all staff were informed that the office was not accessible and provide information on the alternative working arrangements.

Evacuation followed by denial of access to building

The Ombudsman would approve the DMT to ensure the provision of essential provisions to maintain the health and safety of all staff, provide communications channels for staff to contact friends or family and arrange transport home where required. Selected members of staff have corporate credit cards to facilitate this.

Threatening behaviour or terrorist threat

When a threat is received, the Ombudsman, SMT and Advice Team should be notified immediately. The Advice Team Leader or member of DMT will inform all SPSO and SHRC staff of the risk and the appropriate action to take.

 If the risk involves a visit to the office, close monitoring of CCTV and visitors to the building will be undertaken by the Advice Team.

 All staff will be requested to use back door entrance when entering or leaving the building until risk is averted.

 Additional staff will be posted in the Advice Team if required.  If warranted, the front door will be closed to the public.

 Police will be called by the Advice Team (or other staff member) immediately either by telephone or by activating the panic alarms if required.

 Notices will be placed on doors if required. Loss of key staff

If all persons listed on the Scheme of Delegation are no longer available, the SPCB will be notified immediately and will provide emergency Accountable Officer cover.

Pandemic