Agilient guided a national cultural institution from foundational continuity plans to a tested business continuity management system aligned with ISO 22301.
THE CHALLENGE
A national cultural institution looks after collections and heritage assets that cannot be replaced, and it welcomes a large number of visitors each year. It had business continuity plans in place, but an earlier review by Agilient found they were more complex than they needed to be and not well aligned with ISO 22301. Plans like that tend to stay on the shelf when an incident occurs. The institution wanted to move from a static set of documents to a business continuity management system that staff understood and could use under pressure, backed by clear governance and people with practical experience of responding to disruption.
OUR APPROACH
Agilient delivered the uplift in two phases. The first reviewed existing continuity documentation against ISO 22301:2019, identified where plans could be simplified, and delivered scenario-based training workshops to build practical skills among key staff. The second phase built the full framework with the institution’s own team. Agilient conducted a Business Impact Analysis to identify critical functions, dependencies and recovery time objectives, alongside a risk assessment of threats specific to the institution’s operating environment. These findings shaped a new overarching security incident and contingency planning policy, consistent with Commonwealth protective security expectations under the PSPF. Agilient then worked with staff to produce a new Crisis Management Plan and Business Continuity Plan written to be used in the first hours of an incident. The program closed with a desktop exercise that tested the new plans with the people who would rely on them.
THE OUTCOME
The institution now has a business continuity management system aligned with ISO 22301:2019, with governance, plans and trained people in place.
- A Business Impact Analysis and risk assessment that focus continuity effort on the institution’s most critical functions
- A new security incident and contingency planning policy, Crisis Management Plan and Business Continuity Plan
- Scenario-based training workshops and a desktop exercise that tested the new plans with the staff responsible for them
Related services: business continuity consulting, crisis management consultants, exercising and testing. Sector experience: public venue and event security and government security consultant. To discuss a similar project, contact Agilient.