Business Continuity

At Intel Corporation we are relentless in our efforts to take action and achieve results. The last few years have been important reminders that earthquakes, fires, floods, tropical cyclones, chemical explosions, or other unexpected events can be disruptive to any supply chain; and how important it is that Intel Corporation is prepared to deliver an uninterrupted supply chain. We strive to assure our customers that we are evolving and maturing in our ability to mitigate, quickly manage and recover from unexpected events. As a result of Intel's Business Continuity Program requirements, we hold our suppliers to the same business continuity expectations and disaster recovery plans are in place, effective and actionable. 

 

To that end, a robust business continuity plan can help a company prepare for the unexpected and minimize the impact of business disruptions. We recommend that you assess your company’s particular business continuity risks and level of disaster recovery planning. The following information is general in nature and is intended to help guide productive discussions to determine how a company can best address its specific business continuity risks and disaster recovery plan. 

 

Elements of Robust Business Continuity Plans

A solid business continuity plan specifies the escalation plan, the communication plan, and the recovery plan.

  • Ensure senior management supports the BC program and that appropriate management review and corporate governance mechanisms exist.
  • Know, and have documented, business processes/functions that are "critical" to your company, as well as the next criticality level of processes.
  • Have documented the components that make/support these processes to an "appropriate" level of detail to ensure single points of failure can be identified.
  • Understand and prioritize what risks are possible and the likelihood for them happening. This includes understanding business impacts, taking steps to reduce risks and ensuring that changes to your business are reflected in the BC program.
  • Have documented and current BC plans in place to provide an effective crisis response and ensure that critical operations continue to be operational during a crisis.
  • Make available all necessary documentation to the people who need it and maintain it so that it can be summarized and rolled up as necessary.
  • Exercise and drill to ensure the completeness of the plans, and to prepare the organization to perform effectively during a crisis.
  • Be able to confidently answer "Yes" when asked if everything reasonable and prudent has been done to be able to respond and recover from an emergency.
 

The probing questions in each section are intended to give an idea of the questions Business Continuity planners ask about business operations. These types of impacts are usually considered during the risk & business impact assessment activities, at which time businesses determine the appropriate mitigation strategies based on their individual risk & exposure. 

The items in this list are taken from industry best practices as defined by organizations such as Disaster Recovery International (DRI) and the Business Continuity Institute (BCI). This is not intended to be a exhaustive list of all possible BC considerations and probing questions, so the reader is encouraged to visit their respective websites for more complete information.

Potential Disruption Impacts to Critical Functions
  • Loss of Employees or Employees Unable/Unwilling to come to work
  • How could you continue to run your business if more than 30% of employees are unavailable to work for an extended period (2 weeks? 4 weeks? 3 months?)
  • Are you able to quickly source and train an alternate work force if necessary?
  • Is succession planning in place for key staff?
  • Loss of a Site – short-term and long-term duration
  • Are you able to continue operations at an alternate work site or using remote teleworkers?
  • Would a work site closure impact your ability to continue supplying key customers?
  • Is the source of specialized equipment & tooling required at an alternate facility pre-identified & kept current as the business environment changes?
  • Are alternate manufacturing facilities capable of ramping up in an acceptable timeframe?
  • Loss of External Infrastructure – short-term and long-term duration
  • Are mitigation strategies in place to minimize the impacts of a power disruption? If back-up generators are part of the mitigation, how long can they run?
  • Do your operations need to ensure filtered or potable water is available in case of local water supply/sewage disruptions?
  • Do you have alternative communication technologies that can be used in case telecommunications are disrupted? Do your crisis communication plans incorporate & test all of these options?
  • Loss of Computing Capability – Applications or Infrastructure – short-term and long-term duration
  • Are critical datacenters protected from physical threats? Is access restricted and monitored?
  • Are UPS machines or back-up generators used to minimize the impact of power disruptions on critical datacenter operations?
  • Do all critical applications have the appropriate disaster recovery plans in place? Do the business groups which rely on those applications have business recovery plans in place? Are manual workarounds available and exercised periodically?
  • Loss of Vital Records (data and documents)
  • Are data back-ups conducted on a routine basis and stored safely at an off-site facility?
  • Does your business have an information security strategy in place to protect critical systems against malware and cyber attacks?
  • Transportation disruptions/inability to ship products
  • Have you considered secondary warehouses, shipping lanes and alternate carriers?
  • Are there any restrictions on your ability to adjust freight arrangements imposed by local government or customs officials?
  • Critical suppliers unable to deliver their products as planned
  • Have you discussed business continuity with your critical suppliers?
  • Do you have contingency plans in place if they cannot deliver to you?
  • Are secondary sources available for critical suppliers? How quickly could these be activated during an emergency?
  • Do your inventory and spare parts strategies allow sufficient buffer to ensure operations are not disrupted?
  • Are engineering workarounds an option for extended supplier outages?

This page is designed to help facilitate discussions between Intel and its key suppliers regarding the operational resilience and business recovery capabilities of Intel’s supply chain. 

Crisis Escalation, Management & Communications

  • Do you have emergency management structures and defined roles & responsibilities in place to respond to a crisis?
  • Is there a defined communication plan to notify your employees, customers and suppliers of a crisis event?
  • What is the escalation path & anticipated timeframe from your crisis management team to Intel? Have this been exercised in a real event or business issue?


Business Continuity (BC) Considerations

  • What kind of business functions are considered critical and do they have BC plans associated with them?
  • What kinds of impacts are considered by your risk mitigation & recovery planning activities?
  • How does senior management support the BC program? What management review and corporate governance mechanisms exist?
  • Does your BC program ensure that all business processes/functions that are "critical" to your company are identified and documented?
  • Does the BC documentation cover the components that make/support critical processes to an "appropriate" level of detail to ensure single points of failure can be identified?
  • Does your BC program ensure that business interruption risks are understood, prioritized and their impacts are comprehended? Have your business groups taken steps to reduce risks? How frequently is the risk and impact assessment refreshed so that changes to your business are reflected in the BC program?
  • Does your BC program ensure the BC plans in place are well-documented and current? Do these BC plans provide an effective crisis response and ensure that critical operations continue to be operational during a crisis?
  • Is the BC plan documentation readily available to the people who need it and maintain it?
  • What kinds of exercises and drills are done to ensure the completeness of the plans? Is the organization prepared to perform effectively during a crisis?
  • Can your senior management confidently answer "Yes" when asked if everything reasonable and prudent has been done to be able to respond and recover from an emergency?

When preparing your business continuity plan, here are some simple questions to consider to develop your plan and to prepare for recovery. 

Business Management Policy:

  • Please confirm that your company has a written and enforced Business Continuity Management (BCM) policy that applies to all primary sites.
  • Please confirm that your company's senior management has reviewed the Business Continuity Management (BCM) program to ensure necessary processes have been established and maintained in the last 12 months.
  • Please confirm that your company has a written pandemic plan in place that covers all primary sites.


Risk Assessment:

  • Please confirm that in the last 12 months, the supplier/sub supplier sites you are considering in your BC plans have performed appropriate risk assessments that prioritized key risks to the site, estimated the business impact of an outage of critical activities, and appropriate actions to mitigate the risk were implemented.


Crisis Management:

  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have conducted a test of the emergency response procedure in the last 12 months (including initiating Emergency Response Team, evacuation drill, etc.).
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written crisis management procedures showing a designated management team responsible for crisis communications and decision making.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedures for timely notification of customers for issues that impact quality or delivery commitments.


Recovery:

  • Please confirm that there is a written recovery plan describing the steps and timing for resuming 100% of critical site activities within a stated recovery time after a disruption
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have tested their time-phased recovery plan in the last 12 months and have processes to address findings identified in the testing
  • Please confirm that written plans exist for the recovery of 100% of the supplier/sub supplier sites you are considering in your BC plans for product/service output to an alternate site(s) within a stated recovery time in the case of complete loss of this site and its contents. Answer Yes only if the plan addresses 100% of this site's output, all necessary equipment, skilled labor, Information Technology and critical supplies.
  • In the event of complete loss of the site and/or its contents, how many weeks would it take to recover 100% of site product/service output at an alternate site(s) or by rebuilding this site? Include the weeks to acquire equipment, skilled labor, Information Technology and critical supplies, but exclude customer qualification time.


Supply Chain Continuity:

  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have approved definitions and lists of critical suppliers and subcontractors and they have assessed the potential business impact of disruption of their products/services.
  • If the response to the previous question is Yes, list the approximate number of critical suppliers and subcontractors for this site.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have programs to assess business continuity of all its critical suppliers and subcontractors and has a managed process to address identified risks


Supply Chain Security:

  • Does the supplier/sub supplier sites you are considering in your BC plans have any Customs Authority approved certifications for supply chain security (e.g. C-TPAT (USA), PIP (Canada), AEO (EU), STP (Singapore) or other)?
  • If yes, list which Customs Authority approved certifications are currently active for this site. For each one, list the certification number or code as well as the latest certification or revalidation date.
  • If the supplier/sub supplier sites you are considering in your BC plans have no customs security certification but does have written and enforced customs security procedures, please provide a brief summary of the procedures.


Social Responsibility:

  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced labor and wages policy and they have reviewed policy compliance in the past 12 months.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced environmental policy and has reviewed policy compliance in the past 12 months.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced health and safety policy and has reviewed policy compliance in the past 12 months.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced ethics policy (or code of conduct) that forbids bribery/corruption and has reviewed policy compliance in the past 12 months.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have a program to manage and continuously improve its environmental impact, worker health, safety and ethical business conduct.
  • Do the supplier/sub supplier sites you are considering in your BC plans have a written and enforced policy and due diligence plan to forbid purchasing metals containing Tin, Tantalum, Tungsten or Gold from sources that directly or indirectly finance conflict in the Democratic Republic of the Congo or an adjoining country?


Security:

  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced policies for safeguarding confidential customer Intellectual Property (IP), information and documents.


Fire Prevention:

  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedures to manage the safe-handling of hazardous materials (e.g. flammable liquids, aerosols, poisonous gases) as well as storage in a separate and dedicated area.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written and enforced procedure to authorize and control hot work activities (brazing, grinding, welding, cutting using oxy-acetylene torch, etc.) for non-production activities in the facility (e.g. facility repair, equipment repair, plumbing, construction).
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have an automated fire suppression system (e.g. sprinkler, chemical or gas-based automated system) that protects all critical site activities.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans maintain and tests their fire protection equipment and electrical equipment on a regular basis at least annually. Fire protection equipment includes pumps, sprinklers, extinguishers, detectors and alarm systems. Electrical equipment includes switchgear, circuit breakers, batteries, etc.


Power:

  • Please confirm that there is a backup power source (in addition to a UPS) that enables continued operation of critical Information Technology, facility security systems and fire control equipment used by this site.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans backup power source is load tested (at least 80% load) on a semi-annual basis.


IT:

  • Please confirm that there is at least a daily data backup and at least weekly offsite storage for all electronic data required to support all critical site activities.
  • Please confirm that the supplier/sub supplier sites you are considering in your BC plans have written Information Technology (IT) recovery plans covering all IT resources needed to support all critical site activities.
  • Please confirm that all Information Technology (IT) recovery plans covering all IT required for all critical site activities have been tested in the last 12 months.

Please contact your Intel Account Manager, Supplier Owner, or support personnel for help when preparing your plan.

BCP Information from Other Sources

Business Continuity Institute

Disaster Recovery Journal

World Health Organization

Centers for Disease Control

 

*Note: Any External links and/or sites are not under the control of Intel and Intel is not responsible for the content of any linked site or any link contained in a linked site. Intel reserves the right to terminate any link or linking program at any time. Intel does not endorse companies or products to which it links and reserves the right to note as such on its web pages. If you decide to access any of the third party sites linked to this Site, you do this entirely at your own risk.