Resourcing the Incident Management Plan

The IMP should be resourced with the appropriate policies and plans that guide and support the implementation of responses, as well as the technology required to effectively operate the IMP. The IMP is largely a human resource—driven activity, so the correct selection of response managers, with associated training and education, is required to ensure that the IMP can be adequately managed during a crisis. The IMP will also rely on technology, and the company should consider whether the IMP has sufficient resources to be effective in the event of a crisis—notably through the use of varied communication mediums, which will form a core component of the success of the IMP. The company should ensure that sufficient communication mediums and redundancies are available to flow information, guidance, and decisions throughout the organization. Connectivity and compatibility to supporting agencies are also important. The IMP itself may be posted within the company intranet, or hard copies may be held at office locations for use.

In order to be effective, risk assessments, security surveys and plans, and other components of the Business Continuity Management Plan should be undertaken so that the IMP operates within a supported environment. The resource limitations should also be known to management, as these will determine what parameters the IMP will operate in. Resources should be considered in terms of ensuring that the IMP is applicable and relevant, has the correct level of corporate buy‐in and support, has adequate levels of practitioner education and training, has been correctly dispersed, and has the correct technological and physical materials required to make it work.

The Business Continuity Management Plan should also be resourced in terms of redundancy measures, materials, and protocols. Redundancies may apply to materials, infrastructures, or technologies. Companies may wish to ensure that information technology (IT) servers are located off the main site(s) to ensure that information storage is not directly affected by a facility crisis. Emergency or crisis response centers may also have secondary locations established, should the primary ones be within an affected area, and other crisis management resources may have backup components removed from normal facilities, including multiple‐medium access to crisis and response plans.