[OR] [PM] [P3] [T] [A] Sustain Phase Master Checklist

Sustain Phase Appendices

• • Introduce Change Management
  • Develop Communication Strategy 
  • Implement Training and Awareness
  • Provide Self-Assessment
    
  • Conduct an Independent Quality Review

The templates should be adapted to reflect the organisation’s size, complexity, regulatory environment, risk profile, governance structure, and operational resilience maturity.

Appendix A: Sustain Phase Master Checklist

This master checklist provides a consolidated view of the five stages of the Sustain Phase.

It can be used by management, operational resilience teams, service owners, risk functions, and assurance teams to evaluate whether the Sustain Phase has been established and is operating effectively.

Stage 1 — Introduce Cultural Change

• Senior management visibly supports operational resilience.
• Desired resilience behaviours are defined.
• Resilience responsibilities are included in relevant role descriptions.
• Critical business service owners understand their accountability.
• Employees understand that operational resilience is a shared responsibility.
• Employees are encouraged to escalate vulnerabilities and concerns.
• Cultural maturity has been assessed.
• Resilience is considered in strategic decisions.
• Resilience is incorporated into change management.
• Resilience is considered in project management.
• Procurement and outsourcing decisions consider resilience.
• A resilience champion network exists where appropriate.
• Incident and exercise lessons are shared.
• Positive resilience behaviour is reinforced.
• Cultural performance indicators are monitored.

Stage 2 — Develop Communication Strategy

• Operational resilience communication objectives are defined.
• Internal stakeholders are identified.
• External stakeholders are identified.
• Stakeholder information needs are documented.
• Key messages are established.
• Primary communication channels are defined.
• Alternative communication channels are available.
• Contact details are current.
• Business-as-usual communication is scheduled.
• Incident communication procedures are documented.
• Escalation thresholds are defined.
• Customer communication arrangements are established.
• Regulatory communication arrangements are established.
• Supplier communication arrangements are established.
• Communication templates are available.
• Communication channels are periodically tested.
• Communication effectiveness is measured.

Stage 3 — Implement Training and Awareness

• Training governance is established.
• Training needs analysis has been completed.
• Role-based training requirements are defined.
• Board and executive training is provided.
• Critical business service owner training is provided.
• Operational staff training is provided.
• Specialist training is provided.
• General employee awareness is conducted.
• New employee induction includes resilience.
• Refresher training is scheduled.
• Scenario-based learning is used.
• Crisis teams participate in exercises.
• Deputies and alternates are trained.
• Competency requirements are documented.
• Competency is assessed.
• Training records are maintained.
• Training effectiveness is measured.
• Incident and exercise lessons are incorporated into training.

Stage 4 — Provide Self-assessment

• A self-assessment framework exists.
• Assessment scope is defined.
• Assessment criteria are documented.
• Evidence requirements are established.
• Assessment frequency is defined.
• Trigger-based assessments are established.
• Scoring methodology is documented.
• Finding severity criteria are defined.
• Governance is assessed.
• Critical business services are assessed.
• Interconnections and interdependencies are assessed.
• Impact tolerances are assessed.
• Scenario testing is assessed.
• Cultural change is assessed.
• Communication is assessed.
• Training and competency are assessed.
• Third-party resilience is assessed.
• Technology resilience is assessed.
• Findings are risk-rated.
• Root causes are identified.
• Actions have owners and target dates.
• Closure evidence is required.
• Significant findings are reported to management and the Board.

Stage 5 — Conduct Independent Quality Review

• An independent review authority is established.
• Reviewer independence is protected.
• Reviewer competency is demonstrated.
• Review scope is risk-based.
• Critical business services are included.
• Management assertions are independently tested.
• Evidence quality is reviewed.
• Service maps are independently challenged.
• Impact tolerances are reviewed.
• Scenario testing is independently evaluated.
• Self-assessment conclusions are validated.
• Findings are risk-rated.
• Systemic themes are identified.
• Management responses are documented.
• Remediation is tracked.
• High-risk overdue findings are escalated.
• Significant findings are independently validated before closure.
• Retesting occurs where appropriate.
• Board assurance reporting is established.

"Sustain" Phase of the OR Planning Methodology