• Section 1 - Introduction
• Section 2 - Audience
• Section 3 - Purpose
• Section 4 - Scope
• Section 5 - Business Continuity Management Life Cycle
• Section 6 - Identify
• Section 7 - Analyse
• Section 8 - Plan
• Section 9 - Activation and Response
• Section 10 - Validate
• Section 11 - Improve
• Section 12 - Related Documents

Section 1 - Introduction

(1) Business Continuity Management (BCM) is a University of Newcastle (University) wide capability that supports organisational resilience by enabling the University to sustain delivery of critical services during and following a disruption.

(2) BCM focuses on understanding the impact of disruption to the University's teaching, research and operational activities, and establishing arrangements to maintain or restore those services within acceptable timeframes.  

(3) Disruptions may arise from a range of events, including natural disasters, pandemics, infrastructure failure, loss of systems, cyber incidents, and other incidents that may impact the University's ability to operate.

(4) The safety of students, staff, contractors and visitors remains the University's first priority. Following this, BCM supports the continuity and recovery of critical services. 

Section 2 - Audience

(5) This Framework applies to all of the University and its controlled entities.

Section 3 - Purpose

(6) This Framework provides the structure, processes and tools required to implement Business Continuity Management across the University.

(7) It supports the Business Continuity Management Policy and establishes a consistent approach to identifying critical services, assessing disruption impacts, and developing continuity arrangements.

Section 4 - Scope

(8) This policy applies to all areas and locations of the University and its controlled entities, and to all activities that support the continuity of critical services in the event of disruption, including dependencies on people, systems, facilities and third parties and services provided by Digital Technology Solutions and external partners.

Section 5 - Business Continuity Management Life Cycle

(9) The University applies a structured lifecycle to business continuity management comprising:

1. Identify – determine critical services and key dependencies;
2. Analyse – assess likely impacts of disruption;
3. Plan – develop Business Continuity Plans and strategies;
4. Activation and response – implement continuity arrangements to sustain or restore critical services during a disruption;
5. Validate – test and exercise plans and arrangements; and
6. Improve – implement lessons learned and enhance capability.

Section 6 - Identify

(10) Business continuity management begins with the identification of critical services and the resources, dependencies and arrangements required to support their delivery. 

(11) Critical services may rely on people, facilities, information, technology systems, suppliers, third-party providers and other supporting resources.

(12) Disruption-related risks are identified and managed in accordance with the University's Risk Management Framework.

Section 7 - Analyse

(13) Business impact assessments (BIAs) are the foundation of the BCM program and are used to identify critical services and assess the impact of disruption.

(14) BIAs consider dependencies including people, infrastructure, systems, suppliers, third-parties, and information.

(15) Leaders of Colleges, Divisions, business units and controlled entities are responsible for completing and maintaining BIAs for the services within their area of responsibility.

(16) BIAs should be reviewed periodically to ensure they remain current and reflect changes to critical services, dependencies and operating environments. Reviews may be triggered by significant organisational, operational, technology or service delivery changes, following a disruptive incident, or as part of scheduled BCM activities.

(17) BIAs define recovery priorities, including maximum acceptable outage and recovery time objectives, which inform continuity planning and system recovery priorities. 

Section 8 - Plan

(18) Business Continuity Plans (BCPs) are informed by BIAs and document the arrangements required to sustain or restore critical services during and following a disruption.

(19) Leaders of Colleges, Divisions, business units and controlled entities are responsible for developing and maintain BCPs.

(20) BCPs should include:

1. critical services and priorities;
2. activation and escalation arrangements;
3. continuity strategies and workarounds; 
4. roles and responsibilities;
5. communication requirements;
6. key internal and external dependencies; and
7. recovery arrangements.

(21) BCPs should be maintained in a manner that supports accessibility during disruption, including consideration of scenarios where normal ICT systems may be unavailable.

(22) Continuity strategies should be proportionate to the criticality of the service and consider the arrangements necessary to sustain or restore service delivery during a disruption.

(23) Depending on the nature of the service, continuity strategies may address matters including:

1. personnel and workforce availability;
2. facilities and alternate work locations;
3. information, records and data recovery;
4. technology systems and supporting infrastructure;
5. suppliers, contractors and their-party providers;
6. communications and stakeholder engagement;
7. legislative, regulatory or contractual obligations; and
8. health, safety and wellbeing considerations.

(24) BCM operates in conjunction with:

1. the Incident Management Framework, which governs operational response to incidents;
2. the Crisis Management Plan, which governs coordination and decision-making during critical incidents; and
3. Information and Communications Technology (ICT) Disaster Recovery arrangements, managed by Digital Technology Solutions.

Section 9 - Activation and Response

(25) BCPs may be activated where a disruption impacts, or is likely to impact, the delivery of critical services.

(26) During a disruption, BCPs support the continuation or restoration of critical services while incident response activities are managed in accordance with the University's Incident Management Framework and, where required, the Crisis Management Plan.

(27) Activation may occur:

1. as directed through the University's incident or crisis management arrangements where broader coordination is required; or
2. at a local level, by the responsible business area, with notification to Risk Services. 

(28) BCPs should remain active until critical services have been restored to an acceptable level or alternative arrangements have been established.

Section 10 - Validate

(29) Risk Services coordinates training and exercises to validate and develop business continuity capability.

(30) Colleges, divisions, business units and controlled entities must participate in testing and maintain awareness of their roles and responsibilities.

(31) Validation activities may include exercises, walkthroughs, reviews and activation of continuity arrangements.

Section 11 - Improve

(32) Post-incident reviews and exercise outcomes are used to identify lessons learned and opportunities for improvement.

(33) BCM capability will be progressively developed in alignment with the University's BCM Roadmap, under the oversight of the Chief Operating Officer.

(34) As capability matures, a structured review approach will be introduced for priority services, with review frequency determined based on service criticality and risk.

(35) Business Continuity Plans and associated artefacts will be reviewed periodically to ensure they remain current and may require updating following:

1. significant organisational change;
2. changes to critical services or dependencies;
3. technology or infrastructure changes; 
4. outcomes from exercises or testing activities; or
5. a disruptive incident.

(36) Continuous improvement will be informed by BIAs, testing, exercises and post-incident reviews.

Section 12 - Related Documents

(37) Business Continuity Management Policy

(38) Incident Management Framework

(39) Crisis Management Plan

(40) Risk Management Framework