Association of Contingency PlannersDedicated to the evolution of Business Continuity

Greater Tampa Bay Chapter

Business Contingency Planning

Steve Elliot & Allen PatrickAssociation of Contingency Planners

Greater Tampa Bay Chapter

www.gtbacp.com

Association of Contingency PlannersDedicated to the evolution of Business Continuity

Greater Tampa Bay Chapter

The Association of Contingency Planners (ACP) is a national, not-for-profit professional association with members from the business continuity, emergency management, and disaster recovery professions. Our members represent the private and public sectors, as well as higher education, faith-based, and non-profit organizations across the country.

What is Business Continuity?

Business Continuity/Preparedness Planning – What’s Important

Overview – Planning Elements

1. Lay out a program plan… a vision

2. Management Support

3. Risk Analysis

4. Incident Response Planning

5. Recovery Planning

6. Training & Awareness

7. Exercises

8. Maintenance

9. Supplemental Info… resource links & suggestions

Continuity and Preparedness

Basic Definition:

A business preparedness and continuity program aims to prevent or mitigate,

respond effectively to, and recover from the effects of business disrupting

events.

Emphasize personnel safety!

Management Support

Key Points:– Secure support from the top level

manager/executive … Ask what keeps them awake at night;

– Obtain an executive level manager as a sponsor/champion and lead for a steering committee;

– Establish a budget and planning team;– Arrange for an announcement to the organization

endorsing the program, summarizing your role, and explaining the organization’s involvement expectations – both budget and participation.

Respect People’s Time

Even with upper management’s endorsement, respect people’s time and their need to balance

continuity/preparedness planning priorities with their primary business priorities!

Pragmatic approach…

Apply “practical due diligence” when establishing a business continuity program. Initially, program needs to focus on the key planning elements:

1) Reliable Communication2) Preparedness, Response, and Recovery

Teams3) Team Tasks and Responsibility Lists

(Recommend plan templates for consistency and clarity. Adapt plans to size or complexity of the organization.)

Pragmatic approach…

Apply “practical due diligence” when maturing a business continuity program:

1) Prioritize and implement projects in phases based upon the best use of time and money; defer capabilities of marginal use… Lay out a maturity roadmap;

2) Program should be scalable. Processes should be scalable;

3) Operational structure and tools should conform to day-to-day business model as much as possible.

Risk Assessment – Threat & Vulnerability Assessment

– Threat and Vulnerability Assessment• Keep it simple;• Develop a strawman assessment;• Engage stake holders such as: Facilities, Security,

HR, IT, Finance, Supply Chain, core business managers, etc. to build on the strawman;

• Target at a Site/Facility-level (or sites/facilities if in the same geographical area and similar in operation) if possible; Process level if necessary;

• For mitigation leverage basic prevention, early warning, and mitigation infrastructure, e.g. fire suppression, security, fire alarms, evacuation plans, data backups, backup power, etc.

Risk Assessment

– Threat and Vulnerability Assessment• Keep it simple• Site/Facility-level (or sites/facilities if in the same

geographical area and similar in operation) if possible

– Business Impact Analysis• Key info: What are the critical business

processes and what is their recovery order• What are the critical operational and

infrastructure processes that need to be recovered in order to recover the critical business processes… and what is their recovery order www.emsa.ca.gov/disaster/files/

kaiser_model.xls 

Above added as Comments in each Risk cell. Event label entered in comment to clarify relationship of comment to the risk to which it applies.

Risk Detail

Risk Assessment: Business Impact Analysis (BIA) - Before you start…

Understand how the results of the BIA are going to be used and make sure each question

relates to that purpose. • Primary objective: What are the critical core

business processes and recovery priorities;• Secondary: (RTO & RPO) Return Time

Objective & Return Point Objective;• Tertiary: Core business process dependencies

(Optionally, these can be identified in the recovery planning process.)

Risk Assessment: Business Impact Analysis (BIA) - Before you start…

Last thing you want to hear from management after you present the results is: “OK, now tell

us something we didn’t already know.”

Lesson learned – Find out what management doesn’t know up front. If they already know

what it is you need to know… get it from them before putting the organization through the

BIA process.

Response Plan

Based upon the Threat and Vulnerability Assessment, supplemented with regulatory requirements, establish an Incident Response/Emergency Plan– Establish an Incident Response/Management Team

(IRT);– Address the top level threats and regulatory

requirements;– Include contact information for the IRT and key

outside support organizations, e.g. law enforcement, fire & rescue, response & restoration suppliers, etc.;

Response Plan

– Include key infrastructure maps, e.g. water valves, electrical panels, gas shut-offs, HAZMAT & other emergency supplies, etc.;

– Provide employee-level response guidance, e.g. incident reporting, alarm activation, evacuation, employee accounting, etc.;

– Make the plan available at appropriate level to audience…

Samples: Campus or building flip charts and employee hang tags or wallet cards

Response to Recovery Transition

Response Recovery

Damage Assessment

Response & Recovery Oversight

Recovery Plan

Develop a strategy for each critical business and operational process…– Strategy could include more than one option… like

a football playbook… use the recovery option appropriate to the situation;

– Continuance doesn’t necessarily mean resuming in the same or a centralized alternate facility… For large enterprises could mean deferring to personnel performing the same function at another location; Temporarily outsourcing; Individuals working remotely with notebook computers & cell phones; etc. – TEST

Recovery Plan

Plan components…– Recovery team(s) with a team lead(s) and

alternates and contact information– Engagement process and communication methods– Meeting location w/alternates – team operation

center– Alternate operations options– Recovery responsibility & task lists

Awareness and Training…

Establish an awareness program for all levels, e.g. Execs, Planners and various teams’ members, employees, contractors, visitors…

Awareness and Training…

Key Points:– Employees as a whole, e.g. Newsletter

announcements, emails, and articles, posters, wallet cards & hang tags, workshops, on-line training, family preparedness (http://www.ready.gov), etc.

– Individual teams, e.g. walk-through exercises, team reviews, function-level incident exercises, rotate planning maintenance role, etc.

– Community responders, e.g. periodic meetings, facility walk-throughs, participation in awareness week-type activities, etc.

– Management

Engage Senior Mgmt.

Refresh Management Support…

Back to Step one

Association of Contingency PlannersDedicated to the evolution of Business Continuity

Greater Tampa Bay Chapter

Nationally, ACP represents 2700 members in 44 different Chapters around the United States. In addition we have a growing virtual population of members from around the globe.

Association of Contingency PlannersDedicated to the evolution of Business Continuity

Greater Tampa Bay Chapter

Our local Chapter is made up of 80 members from organizations like Raytheon, Raymond James, Franklin Templeton, HSN, TECO, Tech Data, Valpak, USF, County and City governments, credit unions, the Red Cross, the YMCA, various consulting firms and vendors, etc.

Association of Contingency PlannersDedicated to the evolution of Business Continuity

Greater Tampa Bay Chapter

Typical monthly programs include:County Emergency Operations CenterLocal Media OutletsNational Weather ServiceUS Coast GuardDHS / FEMA / State Emergency ManagementBehind the scenes at sports venues / museums / attractionsPublic Information Officer & Emergency Management leadersTable-top Training Exercise / Disaster Simulation GamePublic-Private Partnerships (Red Cross, United Way, Regional Planning Councils)Hospital / Healthcare Emergency ManagementTours of Interesting Local BusinessesLessons Learned from Econ. Dev. & Recovery Agencies

Questions?

For more information about the Greater Tampa Bay Chapter of the Assoc. of Contingency Planners, please visit: www.gtbacp.com

Resources…

Threat (Hazard) & Vulnerability template (Consider listing all threats in one worksheet to facilitate criticality rank comparisons.)

www.emsa.ca.gov/disaster/files/kaiser_model.xls

SafetyInfo.com - Response/Emergency Planning

4 STEPS IN THE PLANNING PROCESS - For Details See:

http://www.safetyinfo.com/guests/Emergency%20Planning%20-%204%20Step%20Planning.htm

Resources…

Flip chart model:

http://police.wvu.edu/emergency_flip_chart

Business Continuity Maturity Model – Virtual Corp’s free open access maturity and sustainability tool…

http://virtual-corp.net/html/bcmm.html

Leadership and the importance of communication in the midst of crisis interview with Rich Irwin, former Senior Special Operations Program Officer in the CIA:

http://www.bulletproofblog.com/2010/10/21/bulletproof-interview-special-%E2%80%93-richard-irwin-on-effective-crisis-management-and-preparedness/