Business continuity planning for museums and galleries
Guidance from DCMS on how museums, galleries and other public buildings can prepare for an emergency or disaster.
Overview
A business continuity plan (BCP) is a documented strategy for avoiding or minimising adverse impacts on your business operation should a disaster or failure occur.
This guidance on business continuity planning is for the Department for Culture, Media and Sport’s sponsored bodies.
Benefits of business continuity planning
Effective business continuity planning (BCP) ensures an organisation is prepared for emergencies or disasters. By limiting damage and having a recovery plan, disruption to normal operations can be kept to a minimum.
For museums and galleries, the BCP might include a list of exhibits in order of importance, and have a dedicated recovery team available to evacuate those exhibits to a safe location in the event of an incident.
In the event of a major catastrophe, for example nuclear war, a different response would be required. Carrying out a risk assessment as part of creating the BCP ensures appropriate measures would be in place.
Alternatives to commercial insurance
Public bodies are not normally permitted to take out commercial insurance. The civil service estate covers a vast number of buildings and assets, and no insurance could cover its estate adequately. Instead, civil service buildings are covered by the Government Indemnity Scheme.
The scheme also covers the contents of national museums and art galleries, where insurance costs would normally be prohibitive.
A similar situation exists for smaller museums that house items of national importance. Trying to insure those exhibits would prove costly and potentially ineffective (as the artefacts themselves are usually irreplaceable).
Evacuation plans
The decision to evacuate items from a museum or gallery should be made by public bodies themselves, not DCMS. This process should be considered through the risk management process, including an assessment of the likelihood of an incident which would trigger the evacuation.
A full evacuation of ‘national treasures’ might only be necessary - or practicable - if war were declared, as there would at least be time to carry out an organised evacuation.
In the event of sudden nuclear, biological or chemical attack, little warning would be given. It is unlikely there would be time for an organised evacuation. In addition, the building(s) would need to be evacuated and decontaminated, which would require a security presence. Guarding specific items may be necessary due to the lack of policing in the contaminated environment. It may be useful for public bodies to co-operate on a mutually beneficial solution.
Information systems security
Organisations which use electronic information systems should have security measures in place to protect their data from threats including system failure, natural disaster and cyber-crime.
We publish Information security guidance for sponsored bodies, which offers guidance on introducing and managing secure systems.
More guidance is available as follows:
- IS 17799, IS 27001, BS 7799-3, IS 27005 and IS 18044 can be ordered from the British Standards Institution (BSI)
- the Department for Business, Innovation and Skills (BIS) publishes best practice security guidance
- Get Safe Online - a joint initiative between government, law enforcement, leading businesses and the public sector - publishes guidance for home users and small businesses
You can contact the following for further information:
- Des Livings, DCMS Head of Information Systems - des.livings@culture.gsi.gov.uk
- Robin Moses, Moses Security Services Limited - robin@moses-security.wanadoo.co.uk
Keeping staff records
Employers have a duty of care to their staff. They should possess next-of-kin data for all permanent, casual and temporary members of staff. A copy of this information might be kept off-site in case of a disaster. However, this information must be kept in accordance with the Data Protection Act 1998. Written agreement will be needed to keep anyone’s details in this way.
Collaborative working group
We have set up a group to share and promote best practice and procedures around evacuation, conservation and restoration of national art treasures.
For more details or to register, please contact Gerry Boulton:
- email - gerry.boulton@culture.gsi.gov.uk
- tel - 020 7211 2055
Registered individuals and organisations can visit the Emergency planning group web pages (password required).
Guidance
The following documents (Microsoft Word format) contain guidance on completing forms and templates listed in the next section:
- Common business areas step-by-step approach (Word 39kb) - processes/elements common to those sponsored bodies with a basic knowledge of business continuity
- Common business areas - practitioners’ approach (Word 38kb) - processes/elements common to those sponsored bodies with a working knowledge of business continuity
- Documents, templates and guidance (Word 39kb) - as referred to in guides
- Business continuity strategy options (Word 155kb) - guidance on considering options
- Business continuity strategy report (Word 465kb) - guidance notes on finalising recommendations and preparing the report
- Business impact category guidelines 1-10 (Word 56kb) - guidelines for potential adverse business impact analysis interviews
- Checklist (Word 156kb) - checklist to compare organisations current business continuity arrangements with guides and AGORA material
- Risk and risk-reduction controls (Word 107kb) - guidance on risk assessment
Forms and templates
- Implementation plan for the agreed risk reduction and business continuity plan supporting measures and controls (Word 89kb) - template for implementation plan and guidance notes
- Business continuity plan template (Word 222kb)
- Business continuity strategy report template (Word 90kb)
- Business continuity test evidence report (Word 26kb) - templates and guidance notes
- Business continuity test plans (Word 50kb) - template and guidance notes
- Business impact analysis form (Word 35kb)
- Template for guidance notes on business impact analysis and business recovery requirements (Word 63kb)
- Business impact analysis results (Word 60kb)
- Business recovery requirements (Word 91kb) - template for document / letter recording interview results
- Business recovery requirements form (Word 76kb) - form for recording results
- Business recovery requirements summary report template (Word 130kb)
- Possible business continuity strategy options form (Word 212 kb) - with guidance notes
- Consolidating business recovery requirments by business area and location form (Word 183kb) - example of completed forms together with template for short report (including guidance notes)
- Logistical elements of business continuity strategy (Word 55kb) - form and guidance notes for considering requirements
- Risk reduction controls report (Word 135kb)
- Testing strategy (Word 50kb) - template and guidance notes
Examples
- Awareness reminder plus emergency card for staff (Word 52kb) - format suggestion and example of an emergency contact card
- Example business impact analysis form (Word 68 kb)
- Example business recovery requirements form (Word 114kb)
- Example disaster-failure alert, alert tracking and alert closure forms (Word 53kb)
- Example introductory letter to senior managers completing the business impact analysis and business recovery requirements forms (Word 175kb)
- Example preparatory actions (Word 48kb)
Workshop materials
We run regular workshops with our public bodies to help them develop individual business continuity plans.
These workshops explore the 5 stages set out in the Business continuity planning guide (PDF 938kb) which explains how to introduce and maintain a business continuity plan.
The aim of the workshops is to give participants an individual, quality-tested business continuity plan in place to protect the business interests of their organisation.
The main materials used are available for download as follows:
- Workshop 2 - identifying the business recovery requirements and draft risk-reduction controls:
- Introductory presentation (PDF 80kb)
- Reading materials (PDF 44kb)
- Case study documents 1 (PDF 133kb)
- Case study documents 2 (PDF 209kb)
- Case study documents 3 (PDF 157kb)
- Answers to exercise 1: completed business recovery requirements forms (PDF 455kb)
- Answers to exercise 2: possible risk reduction controls (PDF 37kb)
- Workshop 3 - business continuity strategy formulation, and confirming risk reduction controls (part 7 business continuity planning stage)
- Workshop 3 agenda (PDF 20 kb)
- Introductory presentation (PDF 116kb)
- Reading materials (PDF 45kb)
- Case study and exercises 1 (PDF 134 kb)
- Case study and exercises 2 (PDF 1.3mb)
- Case study and exercises 3 (PDF 75kb)
- Answers to exercise 1: a possible business continuity strategy solution (PDF 434kb)
- Answers to exercise 2: example business continuity organisation (PDF 28kb)
- Workshop 4 - business continuity plan production:
- Workshop 5 - business continuity plan testing, awareness, and maintenance: