Request for Proposals Attachment 18 BCP SCP Continuity Plans

ATTACHMENT 18

Business and Supply Continuity Plans
Business Continuity Plan (BCP). The Contractor must develop and submit a comprehensive Business Continuity Plan (BCP) that provides a plan that focuses on continuity of delivery of product and support services to internal and external customers in the aftermath of a catastrophic event. The primary objective of a BCP is to minimize interruption in the event of a catastrophic event in manufacturing operations. The plan must also address events of lesser severity such as a power outage, local area network disruption, and bomb threats. The Contractor is encouraged to align their BCP with recognized industry standards such as ISO 22301:2019, NFPA 1660, or equivalent frameworks.
An effective BCP should cover many types of business interruptions, such as: • Biocontamination
• Bomb/Terrorist Threat
• Cybersecurity Incident / Ransomware Attack
• Critical Supplier / Supply Chain Disruption
• Fire/Explosion
• Hazardous Material Spill
• Information Management Interruption
• Infectious Disease
• Injury/Illness
• Product Contamination/Recall
• Theft/Vandalism
• Natural Disasters such as Tornado, Flood, Hurricane, Earthquake, etc. Supply Continuity Plan (SCP). The SCP may be submitted as a standalone plan or incorporated into the BCP. The SCP must address strategic, sole source, and critical suppliers, subcontractors, vendors, or other third-party providers whose manufacturing interruptions could disrupt Contractor performance.
The Contractor must articulate in both plans the methodology for addressing risk management, emergency response, incident management, and operations recovery, all integrated into a continuous timeline starting with the onset of a catastrophic event and continuing until functionality is restored.
1. Risk Management (prior to event occurrence): Proactive measures that can be taken to prevent or minimize catastrophic events from occurring. 2. Emergency Response (0-1 hour after event): Actions that occur at the onset of a disaster to protect life and property. This includes accounting for all personnel and bringing the event under control.

Business and Supply Chain
Continuity Plans – v202606

3. Crisis Communications Plan (1 hour – 4 calendar days after event): Focuses on proactive communications and initial activities necessary to establish the path towards operations recovery. The expectation is as part of the communication process you will notify your Contracting Officer (CO) and Contracting Officer's Representative (COR) within