業務恢復流程包含四個關鍵元素。請根據業務影響分析中識別的重要商業活動考慮這些因素：

The business recovery process has four key elements. Consider these against your businesses critical business activities as identified in the business impact analysis:

1. 制定策略：針對每項在業務影響分析中識別的重要商業活動，考慮您將採取哪些策略或行動，以便在最短的時間內從各種可能發生的事件中恢復這些活動。

2. 確定資源：針對每項策略，確定企業恢復運營所需的資源。

1. Developing strategies: For each critical business activity, identified in your business impact analysis, consider now what your strategies, or actions, will be to recover the activities from a range of possible incidents in the quickest possible timeframe.

2. Identifying Resources: For each strategy, determine what resources your business will require to recover operations.

3. 恢復時間目標(RTO)：RTO是指在商業損失發生前預計需要的恢復時間，這一點在業務活動審查中已確定。

4. 負責人：指定負責每項行動或活動的員工，這可以是個人或團隊。列出每項任務的負責人和預計完成日期，並確保負責相關工作人員了解自己的責任。

3. Recovery Time Objective (RTO): The RTO is the forecasted period to recover before business losses occur, this was identified in the business activity review.

4. Responsible People: Which staff member/s will be responsible for each action or activity. This could be an individual or a team. List those who have responsibility for each task and the expected completion date. Ensure that responsible staff members understand what is expected of them.

與疏散和應急計劃不同，您可以選擇將責任指派給某個角色，而不是指定特定工作人員。如此一來，當員工離職或新員工加入企業時，恢復計劃仍然持續有效，無需進行更新。

Unlike the evacuation and emergency plans, you may choose to assign responsibility to a role rather than a named staff member. This way the recovery plan remains valid and doesn't require updating when staff members leave or begin working in your business.

恢復計劃

恢復是指回到緊急情況發生前的狀態。在重大事件發生後，您的首要任務是儘快恢復重要商業活動。建議您在制定恢復計劃時，針對「最惡劣」情況進行準備。之後再根據實際的商業損失程度對計劃進行調整。在許多情況下，恢復計劃都是必要的，且計劃可根據事件的不同而有所變化。

Recovery Plan

Recovery is the return to your pre-emergency condition. Performing your critical activities as soon as possible after a critical incident is your primary focus. It is recommended you complete your Business Recovery Plan with the intention of supporting the recovery in ‘worst case’ scenarios. Your plan can then be modified according to the degree of loss to your business. There are many instances where a recovery plan will be necessary. The plan can vary depending on the incident.

想了解為什麼恢復計劃如此重要嗎？👉請訪問昆士蘭商業局的 Disaster Hub 網站（英文），查看可能發生的事件。

Wondering why you need a recovery plan? 👉 Check out these possible incidents on the Business Queensland Disaster Hub website.

TITLE

CONTENT

CONTENT

請填寫《商業連續性計劃書》第五部分中的「恢復計劃」表格。

Complete the Recovery Plan table in Section 5 of your Business Continuity Plan.

填寫恢復計劃的提示

這部份著重於恢復，而非風險緩解，兩者有所區別。恢復是指事件發生後的應對行動，而風險緩解則是在事件發生前的預防措施或降低影響的策略。請考慮在事件發生後需要立即採取哪些行動，以儘快恢復運營。

從恢復計劃中獲得的經驗教訓可以為下一版本的風險緩解計劃提供重要參考。

Tip to complete the Recovery Plan

This part focuses on your recovery, rather than risk mitigation. There is a difference. Recovery is about responding after an incident, whereas risk mitigation is about preventing or minimising the impact of incidents before they occur. Consider what you will need to do immediately after an incident to restore operations as quickly as possible.

The learning from your recovery plan can then inform the next version of your risk mitigation plan.

《商業連續性計劃書》範本中提供了以下示例。請注意，此練習旨在幫助您從事件（示例中：暴風雨造成的停電和水災）中恢復，該事件對您的一項或多項重要商業活動造成了直接影響（即生產流程停止）。恢復行動（即與供應商協商）和所需資源（即尋找並確保臨時生產設施）將幫助您和您的組織縮短事件後的恢復時間。

恢復計劃示例：

重要商業活動	預防/恢復措施	所需資源/預期成果	恢復時間目標	負責人	完成
生產服務：停止	重新評估商業財務狀況，包括因收入中斷而受影響的現金流，以滿足基本營運開支降低營運開支：審查開支並制定行動計劃，以減少固定和可變開支，包括減少臨時員工和正式員工的工時與供應商協商，防止材料積壓，降低成本尋找替代生產地點使產品範圍與服務多樣化（如維修和翻新）	預留現金儲備以支付成本盡可能降低成本研究新產品和服務確定替代生產地點	兩週	企業主/經營者	__/__/__

此外，請考慮在恢復過程中可能需要聯絡哪些人提供幫助。請在《商業連續性計劃書》第五部份的「恢復聯絡人名單」中填寫這些詳細資訊。

The following example is provided in the Business Continuity Plan template. Be mindful that this exercise is to assist your recovery from an incident (i.e., loss of power and water damage caused by a storm) that has had a direct impact to one or more of your critical business activities (i.e., halted production processes). The recovery action (i.e., negotiate with suppliers) and the required resources (i.e., source and secure a temporary production facility) will enable you and your organisation to reduce the recovery time following the incident.

Recovery Plan Example:

Critical business activity	Preventative/Recovery actions	Resource requirements/ outcomes	RTO	Responsibility	Completed
Production services - halted	re-assess financial position of business including cash flows due to loss of revenue to meet minimal overheads minimise overheads – review expenses and develop plan of action to reduce fixed and variable overheads include reduction of casual and permanent staff hours negotiate with suppliers to prevent build-up of materials and reduce costs source alternative production site diversify product range and services offered (e.g. repairs and restoration).	put aside cash reserves to cover costs reduce costs where able research new products and services identify alternative production site	2 weeks	Business owner / operator	__/__/__

Also think about who you may need to contact to assist in the recovery process. Complete these details in the Recovery Contacts table in Section 5 of your Business Continuity Plan.

TITLE

CONTENT

CONTENT

自然災難 Natural disasters

重大健康事件 Major health events

重大健康事件：如大流行病、傳染病、局部疫情爆發、食物中毒和污染。

Major health events: Such as pandemics, epidemics, localised outbreaks, food poisoning and contamination

緊急情況 Emergency

緊急情況：生物安全威脅（如蟲害和動物疾病爆發）、工作場所事故或死亡、危險物質洩漏或爆炸、電力或基礎設施中斷、重大交通災害、恐怖事件或重大犯罪事件、氣候變化風險。

Emergency: Such as biosecurity threats (pest and animal disease outbreaks), workplace accidents or deaths, dangerous material spills, leaks, or explosions, loss of power or infrastructure, major transport disasters, terrorist or major criminal incidents, climate change risks

資訊技術(IT)威脅 Information technology (IT) threat

資訊技術(IT)威脅：如網絡攻擊、數據入侵或IT系統故障。

Information technology (IT) threat: Such as cyber-attack or data hacking, and IT failure

聲譽事件 Reputation incident

聲譽事件：如高度負面的媒體或社交媒體報導、謠言引發的危機、不當工作場所行為（如欺凌、騷擾）、組織不當行為和法律訴訟（如欺詐、盜竊）。

Reputation incident: Such as highly negative media or social media coverage, rumour-driven crisis, inappropriate workplace behaviour (e.g. bullying, harassment), organisational misdeeds and legal action (e.g. fraud, theft)