The BCP needs to be developed by a team representing all functional areas of the organization. A formal project needs to be established, and activities are normally commenced once the project has been approved by the executive management.

An Executive statement will normally be issued to all line management informing them of the project. This statement would also include the nomination of a specific individual to undertake organisation wide responsibility for the project and will also instruct the organisation's line management to both give full support to the project and to nominate a responsible official from their area/department/division to provide the necessary input into the development of the disaster recovery plan.

Suggested Statement
"The Executiive Governing Body (change as appropriate) recognises the need to formalise the organization's Business Continuity Planning process. It recognises that there are significant risks to its essential business processes through potential and unexpected disruptive events. The increasing development in technologically based processes and the related high level of dependence upon these technological processes in order to conduct our business has made it necessary to initiate a Business Continuity Planning project with immediate effect. This project will be placed under the overall control of Appointee and all management and staff are expected to fully support this process. Heads of divisions and departments are instructed to nominate a responsible official to co-ordinate the Business Continuity Planning process in respect of that Division's or Department's activities."

Take It Seriously!
Underestimating the short and medium term impact of a Security Incident can result in an inappropriate response towards building a suitable BCP. Do not regard BCP as merely an 'exercise' or a 'waste of resources'. Give it the priority it deserves