Monthly newsletter Weekly news roundup Breaking news notification    

Incident management checklist

Get free weekly news by e-mailThis checklist has been provided by SunGard Availability Services. Please note that it is not designed as a substitute for a comprehensive incident management team plan; nor does it contain recovery procedures specific to your organisation. This material suggests high-level tasks that you should consider if you are in threat or response mode. SunGard Availability Services is providing this as a public service.


Incident management team

The incident management team provides direction and support to all affected business units. This centralised approach ensures that recovery requirements for affected business units are met while minimising confusion and duplication of effort.
The incident management team is responsible for:
- Managing internal and external communications
- Directing response and recovery activities
- Monitoring the recovery progress
- Providing or reallocating recovery resources.

The Incident Management Team is composed of:
- Executive management
- Staff support department representatives
- Department heads whose departments have been directly affected by the incident.

Incident management checklist

1. Threat response:
If there is a high probability of an event occurring, consider the following:
- Identify incident management team members, including an incident manager, and alternates
- Identify business and information technology recovery team leaders and alternates
- Update all critical internal and external contact lists. Include the following information:
* Home address
* Home telephone
* Cellular phone
* Pager
* Blackberry
* E-mail address
- Establish a conference bridge. Provide all incident management team members the conference bridge number and pass code
- Establish a voice mail box for employees to monitor for status updates
- Determine if you should place third party business continuity and disaster recovery service providers on alert if you are a subscriber
- Ensure that monitoring service vendors (e.g., alarm company) have current contact information
- Develop procedures to account for employees
- Provide employees with threat response procedures, if appropriate (e.g., bomb threat, evacuation)
- Create backup tapes and ship off site
- Identify a crisis command centre outside of the anticipated impact area
- Top off emergency generators and arrange for additional fuel deliveries
- Acquire battery-operated radios with spare batteries.

2. Incident detection and preliminary assessment:
- Follow company emergency response procedures
- Conduct a preliminary damage assessment, if it can be done safely. No recovery activities should be undertaken if personnel are placed in danger
- Notify the incident manager and provide a detailed report.

3. Activate incident management team:
The incident manager will determine if the incident management team should be activated and if necessary:
- Notify Incident Management Team Members
* Provide a description of the event
* Request that they assemble at the crisis command centre or participate via a conference call
- Activate the crisis command centre.

4. Evaluate disaster impact:
- Determine if the severity of the impact requires implementation of the recovery plan
- Determine recovery objectives including:
* Priorities
* Recovery strategies
* Action plans
* Assignments.

5. Activate recovery plan:
- Notify recovery team leaders and members (See personnel notification guidelines below)
- Brief recovery team leaders and alternates regarding:
* Priorities
* Strategies
* Action plans
* Assignments
* Reporting and communications procedures
- Declare a disaster with your third party business continuity and disaster recovery service provider if you are a subscriber.

6. Implement support procedures:
As directed by the incident manager, incident management team support personnel will provide recovery support to all affected business units.

- Consult/provide advice on changes to standard operating procedures to be implemented during the recovery effort
- Ensure that the following policies and standards are maintained during the recovery effort:
* Financial security and control policies
* Anti-fraud policies
* Information security standards
- Provide reports and recommendations to the IMT as required
- Provide additional resources to other business units during the recovery effort as needed.

Corporate communications
- Establish a media briefing centre
- Coordinate all media communications
- Review and approve all statements regarding the incident
- Develop both internal and external communications
- Coordinate recovery related advertising with external vendors
- Instruct employees to direct all media inquiries to corporate communications.

Environmental and safety
- Ensure the health and safety of employees
- Ensure that response activities to address fire, spills and/or medical emergencies are performed in accordance with regulatory guidelines
- Notify regulatory agencies of the incident as required
- Enlist the assistance of vendors and agencies to assist in support activities as appropriate.

- Conduct detailed damage assessment
- Conduct salvage and restoration activities
-Acquire replacement office space if necessary
- Notify tenants of the incident and provide periodic updates regarding the condition of their affected office space.

- Ensure funds are available for recovery
- Ensure that all recovery expenditures are properly documented
- Set up a recovery cost centre
- Estimate the impact of the incident on the company’s financial statement.
Food Services
- Provide foods services to recovery personnel at the alternate operating locations.

Human resources
- Account for all personnel
- Assist public authorities in handling casualties (i.e., identification of victims, family notifications, etc.)
- Monitor the condition and location of the injured
- Coordinate employee communications with corporate communications
- Coordinate additional or temporary staffing for recovery effort
- Provide counselling services as required
- Administer company personnel policies as they apply to response and recovery
- File Worker’s Compensation claims
- Assist employees with incident related benefit administration
- Complete and submit HSE Reports as required.

- Coordinate with insurance broker on the preparation and filing of all insurance claims
- Document proof of losses
- Submit claims and monitor payments
- Establish a debris management programme.

Information technology
- Conduct computer system and telecommunications damage assessment
- Activate alternate operating locations (for system recovery)
- Recover computer systems and network environment(s)
- Acquire and install replacement desktop computer equipment
- Re-establish data network connections to external resources (branch locations, vendors)
- Implement all telephone response plans (re-routing critical telephone numbers)
- Arrange for all alternate site telephone installations
- Ensure all system security devices and procedures are in place.

- Manage all required regulatory notifications
- Provide legal counsel for response and recovery operations
- Review and approve new contracts acquired as a result of the event, before implementation.

Offices services (mailroom, shipping/ receiving)
- Re-establish mail and shipping services
- Re-direct all mail and parcel receipts to alternate operating locations.
- Manage all incident related purchasing
- Acquire office supplies, forms and equipment for affected business units
- Implement any necessary short-term financial tracking controls, using designated cost centres.

Records management
- Coordinate with information technology to ensure the recovery of the records management system
- Coordinate with business units in retrieving all off site backup records
- Lead records reclamation and reconstruction efforts.

- Coordinate onsite security for affected facilities and all alternate operating locations
- Control access to affected facilities
- Monitor equipment and records being removed from facilities.

- Provide local transportation during response and recovery activities as required
- Provide travel arrangements and accommodations for employees travelling to remote recovery locations.

7. Track incident status and recovery progress:
- Conduct periodic debriefing sessions with recovery teams to monitor progress and determine problem areas
- Reallocate and/or provide resources.

Personnel notification guidelines
Once recovery has been officially ACTIVATED, use this guideline to alert personnel.

Important Notice: By using the following instructions, you will not alarm members of a family unnecessarily if the employee is working at the time of the disaster.

Procedure: Place call. Record status of the call.

1. If contact is made, ask “MAY I SPEAK WITH (Individual)?” and then provide the following information:
- Brief description of problem
- Location of the crisis command centre
- Telephone number at the crisis command centre
- Any immediate action required
- Tell personnel to make no public statement regarding the situation
- Tell personnel that no calls are to be made to other employees
(This will avoid premature notification to families of personnel working at the time of the disaster).

2. If not available, ask “WHERE MAY I REACH (Individual)?”
- If at any location other than work, get phone number, make call and provide the above information.
- If individual is at work, indicate you will reach the individual at work.
- Notify the Incident Manager immediately.

3. If there is no answer:
- Record the time attempted contacts were made
- Periodically recall until contact is made.

4. If contact information is invalid (i.e. wrong number, phone disconnected, etc.):
- If person has moved try to get new telephone number and contact the individual
- Notify the incident manager of incorrect information.

For more information about SunGard’s range of Information Availability and business continuity services: 0800 143 413, or

Date: 7th December 2004 •Region: UK / World •Type: Article •Topic: Crisis management
Rate this article or make a comment - click here

Copyright 2005 Portal Publishing LtdPrivacy policyContact usSite mapNavigation help