Agenda item

Objective : To consider the robustness of CBC business continuity arrangements.

Claire Hughes, Corporate Director and Monitoring Officer

The Corporate Director and Monitoring Officer presented a summary of Business Continuity arrangements, which sets out how the council will maintain and recover critical business services in the event of a major incident – not only cyber-related but also, for example, any loss of the building, pandemic, or disruption in the supply chain.  She said each service already has its own plan, and has been looking at prioritising its services, and these updated service-level plans will be used to create a more comprehensive template. 

She said the next stage will be to create a Business Impact Analysis, to look at the whole business, understand the potential impacts and risks, and try to make pre-emptive decisions on the best way to respond. These decisions will be captured in the high-level Corporate Recovery Plan which includes setting up a corporate recovery team, and how to redeploy staff to different areas.

A lot of work has already been done on the cyber side of the Business Continuity Plan, and a timetable in the report sets out how we will review other areas, with a view to completing the plan by the end of February and then starting to develope the Corporate Recovery Plan.  After the election and in line with best practice, a test of the plans will be scheduled, to check that they work.  She will keep Members updated on progress. 

In response to Member questions the following responses were given :

-        CBC was part of a county wide business continuity group which provided opportunities for sharing best practice

-        A good level of assurance was received from a recent cyber audit

-        In terms of emergency planning, CBC fed into the Local Resilience Forum to ensure it was compliant with civil contingencies and through this Forum would be able to access mutual aid in the event of an emergency. There was confidence that CBC could manage in the event of two civil emergencies occurring simultaneously.

Members recognised the internal audit opinion of the robust ICT service delivered by Publica in its effort to keep the council’s systems safe. Lessons could be learned from the incident experienced by Gloucester City and reference was made to a report submitted to its O&S committee which would be circulated to Members for information. (ACTION BT).

The Monitoring Officer presented a summary of Business Continuity arrangements, which sets out how the council will maintain and recover critical business services in the event of a major incident – not only cyber-related but also, for example, any loss of the building, pandemic, or disruption in the supply chain.  She said each service already has its own plan, but we are looking to update these having developed a more comprehensive template. 

She said that once all the service level plans had been reviewed the next stage will be to create a Business Impact Analysis, to look at the whole business, understand the potential impacts and risks, and try to make pre-emptive decisions on the best way to respond. These decisions will be captured in the high-level Corporate Recovery Plan which includes things like setting up a corporate recovery team, and how to redeploy staff to different areas.

The timetable in the report sets out the proposed timescale for the review.  After the election and in line with best practice, a test of the plans will be scheduled, to check that they work.  She will keep Members updated on progress. 

In response to Member questions the following responses were given :

-        CBC was part of a county wide business continuity group which provided opportunities for sharing best practice

-        A good level of assurance was received from a recent cyber audit

-            In terms of emergency planning, CBC fed into the Local Resilience Forum to ensure it was compliant with civil contingencies and through this Forum would be able to access mutual aid in the event of an emergency. There was confidence that CBC could manage concurrent events. 

Members recognised the internal audit opinion of the robust ICT service delivered by Publica in its effort to keep the council’s systems safe. Lessons could be learned from the incident experienced by Gloucester City and reference was made to a report submitted to its O&S committee which would be circulated to Members for information.