Questionnaire - Draft

How does your function fit into the Roadway Maintenance Section?

Fall, 2014 Draft – Version 1

Business Continuity Team

DEPARTMENT / BRANCH: ___________________________________________________ BUSINESS UNIT: __________________________

Team Member BCP Position/Title Work Phone Home Phone Cell Phone Email

Primary:<INSERT NAME>

Business Continuity ManagerResponsible for: Leading the Business Continuity

Team Planning and communications with

senior management during the creation of the plan

Liaising with management Oversight of plan activation Coordinating final BCP activities

following an incident Lessons learned and after-action

reporting processes

1st Alternate:<INSERT NAME>2nd Alternate<INSERT NAME>


Business Continuity Team – Cont’d




Business Continuity Team CoordinatorResponsible for: Establishing and overseeing BCP

activities Facilitating meetings of the

Business Continuity Team Selection of the appropriate

strategy to begin the recovery process

Identification of / notification to alternate location for resumption of business processes (assuming the regular site is not available)

Determination of the resources required

Ensuring that resources required are pre-positioned and current if applicable (e.g. hardcopies of plans etc.)

Providing updates on planning progress, incident status as required, to the Business Continuity Manager

Coordinating training activities and disseminating information within the organization

Coordinating the annual plan review and completion of appropriate amendments, including the distribution of copies if required







Security CoordinatorResponsible for: Arranging for security at the

alternate site of operations and at the damaged site in order to meet public safety requirements and to safeguard any remaining resources

Maintaining of a list of those organizations that can supply security resources or expertise as required

Developing security plans for both the damaged and new sites of operations

Establishing a personnel identification system

Liaising with the Infrastructure and Facilities Coordinator, the BCP Coordinator to implement appropriate security measures







Infrastructure & Facilities CoordinatorResponsible for: Establishing a site of operations.

Depending on the circumstances surrounding the incident, this may involve clean up and repair of the damaged site or relocation to an alternate site

Overseeing and coordinating the assignment of alternate facilities

Working with risk management representatives to ensure damage assessment and salvage operations are aligned with requirements

Locating and maintaining a list of potentials alternate sites

Maintaining a list of building inspectors

Maintaining a list of reliable and qualified contractors to:

Clean up and repair the damaged site to return it to use as quickly as possible

Make temporary repairs to the damaged facility to ensure that it is secure and to prevent damage from the elements or from theft

Assist in the establishment of the alternate site







Human Resources CoordinatorResponsible for: Overseeing all employees

concerns and manages a personnel pool that can be used to meet special needs caused by the incident

Maintaining an up-to-date contact list of all employees

Maintaining a list of agencies that can supply temporary staff including specialized personnel as required

Developing a system for managing a post event resource pool

Maintaining a list of sources for workplace health and safety advice and post-incident counselling

Planning for other anticipated personnel concerns (payroll, benefits etc.)

Maintaining a list of current job descriptions so that unavailable staff can be replaced if necessary

Reviewing existing HR policies to ensure they are sufficient to deal with human resource issues that may arise as a result of high probability hazards







IT CoordinatorResponsible for aspects of

information technology within the department, including:

Maintaining a list of local suppliers for all critical resources

Maintaining a list of alternate suppliers outside the region for all critical resources

Maintaining a list of qualified contractors for specialized installations

Maintaining a list of all current assts and their locations

Determining resources required to implement BCP

Providing the guidelines and framework within which operational areas can plan for continuity/recovery of IT resources tied to their specific services

Working with operational areas to ensure alignment between recovery time objectives for business functions and actual system or application restoration time







Communications CoordinatorAs part of the executive group works closely with the Business Continuity Team Coordinator and is responsible for: development and delivery of the

appropriate and accurate information to employees and the public

Developing an information program plan

Determining resources requirements for an information package

Ensuring that the primary and alternate spokespeople have sufficient training to undertake the tasks

Preparing for crisis communications messaging in advance, particularly for potential disruptions to critical and vital services within their department







Finance & Administration CoordinatorResponsible for: Authorizing funds in conjunction

with senior management of the Business Unit

Maintaining a list of all policies and contacts

Maintaining a list of current assets Ensuring appropriate personnel are

authorized to make emergency expenditures when required







Equipment & Supplies CoordinatorResponsible for: Maintaining a list of local suppliers

for all critical resources, including internal contacts for collective resources

Maintaining a list of alternate suppliers outside of the region that can provide any critical resources

Working with the BCP Coordinator to maintain lists of minimum material requirements for all critical and vital services

Liaising with the Infrastructure and Facilities Coordinator

Working with the Finance and Administration Coordinator to adhere to emergency expenditure and procurement procedures







Damage Assessment & Salvage CoordinatorResponsible for: Working with the Infrastructure and

Facilities Coordinator to conduct quick, initial estimate of the situation and report its findings to the ECC (After the assessment has been completed and reported, salvage operations can begin as directed by the ECC and the approval of emergency services)

Coordinating and training its members

The list of contractors who specialize in damage assessment and salvage

Developing & maintaining a list of contractors who can repair / replace damaged resources

Liaising with emergency officials and property managers to understand the duties and services of the damage assessment team

Identifying exactly what facilities, equipment, resources and vital records need to be assess and recovered

Coordinating aspects of site access with first responder agencies as necessary







Vital Records CoordinatorResponsible for: Identifying and prioritizing all

electronic and paper vital records that are critical to maintaining the function of the business unit

Pre-positioning and transferring (if necessary) vital records to alternate locations

Maintaining a list of critical personnel involved in vital records control

Working with operational areas to understand the impact on services due to the loss or destruction of records

Ensuring appropriate mitigating measures are in place to protect vital records



1.1 Contact Lists / Delegation of Authority

1.1.1 Senior Management and Alternates Contact List / Delegation of Authority

DEPARTMENT/BRANCH: ___________________ BUSINESS UNIT: __________________________

<Department / Branch / Section><NAME> - <POSITION>Bus:Res:Cell:Alternate (1) Alternate (2)<NAME> - <POSITION>Bus:Res:Cell:

<NAME> - <POSITION>Bus:Res:Cell:








1.1.2 Emergency Notification List

Name / Position Home / Cell Office

<Name / Title> <Number><Number> <Number>





1.1.3 Staff Contact List<(as of date)>

Name Position Office Residence Cell / Pager Personal Email Email (@edmonton.ca)

<Name> <Title> <Number> <Number> <Number> <email address> <email address>









1.2 Vital Information Worksheet

Business Unit InformationDepartment: Branch: Section:

Name of Business Unit:

Number of Staff:Full – Time:

Part – Time:Location of Offices, Facilities (structures only):

Primary mission of this Business Unit:

Primary Contact for this plan:

Name:

Contact Information (work, home, cell, pager, email):

Alternate Contact for this plan:

Name:

Contact Information (work, home, cell, pager, email):


1.3 Hazard Identification and Risk Assessment WorkbookLosses or disruptions can occur anytime and anywhere and can include injuries and death to employees and the public, property damage, environmental disasters and have a significant financial impact. They can be caused by a wide range of risks including human error, technical failure and natural disasters.

The Hazard Identification and Risk Assessment (HIRA) Workbook is a tool that can be used to identify the hazards and assess which threats pose the greatest risk in terms of how likely they are to occur and how great their potential impact may be. It is not intended to be used as a prediction tool to determine which threats and hazard will cause the next emergency.

The hazard identification and assessment are done to determine the internal and external hazards that could cause a loss or disruption to your business unit. The risk assessment and analysis will identify the controls that are currently in place to reduce the impact of the hazard and will assist the business unit in assessing the cost for additional controls to mitigate particular risks.

A control is a process, device or procedure that: Deters a hazard from occurring Mitigates impact of a hazard Reduces the effect of a hazard

All locations and facilities of the business unit should be included in the risk analysis. The analysis should provide for the “worst case” situation: destruction or inaccessibility of the facility. Rather than attempting to determine exact probabilities of each disaster, a general relational rating system is used which identifies the hazards with the highest probability through the use of extreme, high, medium and low indicators.

The HIRA Workbook is available from the Office of Emergency Management and can be obtained through them.


Department / Branch: _________________________________ Business Unit: ___________________________________

Location: ___________________________________________

Assumptions:<Prior to conducting the Risk Assessment, any critical assumptions should be listed.>1. This Risk Assessment addresses the worst-case scenario of complete disruption of <insert business unit location> critical

services or destruction of a specific site(s) or facilities but will also apply to less severe situations.2. Specific emergency response plans, e.g., building evacuation, are found in site-specific emergency plans and are not part of

the BCP process; however, emergency plans may be included as supporting plans.3. Regardless of circumstance, some key personnel will not be available to participate in continuity activities within the first 24

hours of a disruption incident.4. The offsite storage locations at <list geographically separate locations> housing critical backed-up data are intact and

accessible. 5. The Risk Assessment will be based on the following locations:

a. <insert business unit location> b. <insert business unit location> c. <insert business unit location>

OVERALL RISK PRIORITY ASSESSMENT:Slight MINOR Moderate Severe Very Severe

Priority Ranking1 - 4





1. 1. 1. 1.2. 2. 2. 2.3. 3. 3. 3.4. 4. 4. 4.5. 5. 5. 5.6. 6. 6. 6.7. 7. 7. 7.8. 8. 8. 8.9. 9. 9. 9.10. 10. 10. 10.


Risk Assessment Worksheet - List the hazards in the appropriate Risk Priority.Department / Branch: ____________________________________ Business Unit: ___________________________Location: ________________________Note: ‘0’ implies not applicable, 1 = Low, 2 = Medium, 3 = High

HAZARD PROBABILITY IMPACT TOTALHUMAN PROPERTY BUSINESS

NATURAL HAZARDS 0 - 3 0 - 3 0 - 3 0 - 3 0 - 12Agricultural & Food Emergency- Farm Animal Disease - Food Emergency - Plant Disease & Pest Infestation Drinking Water Emergency Drought / Low Water Earthquake Erosion Extreme Temperatures- Heat Wave - Cold Wave Flood- River Flooding - Urban Flooding (Overland Flooding) Freezing Rain / Ice Storm Geomagnetic Storm Hail Human Health Emergency- Epidemic - Pandemic Interface Fire / Wildland Fire Land Subsidence Landslide Lightening Snowstorm / Blizzard Tornado Windstorm Other



TECHNOLOGICAL HAZARDS 0 - 3 0 - 3 0 - 3 0 - 3 0 - 12Building / Structure Collapse Critical Infrastructure Failure- Sewer - Water - Electricity / Power Supply - Natural Gas - Communications - Other Dam Failure Explosion / Fire Hazardous Materials Incident / Spill- Fixed Site Incident - Transportation Incident IT Infrastructure- System Software - Application Software - Hardware - Virus - Hacking / Intrusion - Network Connectivity - Third Party Failure (Vendor) - Operational Error (Operator use / error) Oil / Natural Gas Emergency Radiological Emergency Transportation Emergency- Aircraft - Railway - Roadway Other



HUMAN CAUSED HAZARDS 0 - 3 0 - 3 0 - 3 0 - 3 0 - 12Criminal / Civil Disorder- Bomb Threat - Sabotage - Terrorism / CBRNE* Incident - Theft - Vandalism Work Stoppage / Action Special Event / Mass Gathering Other

* CBRNE Incident = Chemical, Biological, Radiological, Nuclear, or Explosion Incident


1.4 Critical Service SummaryThis list will summarize all services provided by <insert name of business unit>.<Expand the list as required to include all services within each category. Each category is listed by priority>Department/Branch: Business Unit:Serial Critical Services (in order) Priority

(in order) Comments

1 12 23 34 45 5

Vital Services (in order)6 17 28 39 410 5

Necessary Services (in order)11 112 213 314 415 5

Desired Services (in order)16 117 218 319 420 5


1.5 Critical Functions / Systems / Applications<This section includes a list of the business unit’s prioritized critical functions and the resources required to support the. If used, reference and insert information from the worksheet.

Using the criteria established by the BCP Team, the department has identified critical functions and key personnel who have roles in performing those functions to meet its responsibilities to citizens.

The Unit has prioritized its functions by determining the critical functions recovery time objectives (RTOs). A listing of the department’s critical functions and their RTOs, along with all supporting resources including key personnel, vital records, systems and the equipment required to execute them, is shown below.>

Critical Functions

Priority Critical FunctionCritical Personnel & Alternates

Vendors, Suppliers & External Contacts

Vital Records Equipment Systems RTO


Loss of FacilityPeriod of unavailability(Time)

Location & type of facility

Staffing numbers

Work objective & key functions performed

Computers, telephone, furniture and other equipment

Contingency options (e.g. alternate sites, reciprocal agreements, etc.)

CriticalVitalNecessaryDesired

Loss of StaffCritical functions as identified in the BIA

Priority Ranking

Minimum number of staff required to undertake this role

Name(s) of person in job currently undertaking this role

Names of staff who have the skill sets required to cover this area of work

Loss of applications and processes (including IT)Business processes/applications

Identify critical functions impacted if processes/applications are unavailable

Contingency MTO* & RTO**

Instructions

* MTO - Maximum Tolerable Outage: is the period of time by which the business process must be restored.

** RTO - Recovery Time Objective: is the target set for recovering services to allow business processes to be resumed within the Maximum Tolerable Outage.


Loss of Suppliers, Vendors, or Service ProvidersSuppliers, vendors, or service providers

Services provided & required

Business impact if key supplier, vendor or service provider cannot provide service

Contingency Maximum Tolerable Outage (MTO)*

Instructions

* MTO - Maximum Tolerable Outage: is the period of time by which a business process must be restored.


Critical Systems / Applications

Application Back-Up/Recovery RTO


Shut Down of Non-Critical Services Part 1Department ___________________ Branch _______________________ Section __________________________

Prepared By ___________________ Approved By ___________________

Service – Brief DescriptionMain Customer<both internal &

external>Plan for Orderly Shut Down of Service – including timing


Shut Down Of Non-Critical Services – Part 2

Department________________________

Branch_____________________________ Section______________________

Prepared By________________________ Approved By _______________________

Critical Service Present Staffing Level

Minimum Staff Required to Meet Critical Service Level

Required Skills

Present Ability within Branch to Meet Minimum Staffing Requirements

What Skills & Services Must Be Provided by Outside Suppliers


Routine and Essential Products and Services Utilized

Product/Service Purpose Quantity Usage(daily-monthly)

Required for Critical

Services?Vendor Name Frequency

of Delivery

Existing Inventory

Quantity Required for

60 day stockpile


1.6 Business Impact Analysis

The BIA identifies how the business unit will be impacted in the event of a significant disruption, regardless of the cause, and establishes the departmental business resumption priorities. The analysis undertaken determines which of the department’s functions are the most critical; the resources needed to resume these functions, the required recovery timeframes and the functional / organizational interdependencies.

Once business functions and processes have been identified, assessed and prioritized, the BIA should identify the potential impact of events on these business functions and processes. Non-specific events should be identified so that management can concentrate on the impact of a variety of disruptions, rather than specific hazards that may never affect operations. At the same time, management should never ignore potential risks that are evident in the business unit’s particular area.

The BIA will provide estimates of the maximum allowable downtime for critical business functions and processes and identify acceptable level of losses (data, operations, financial, and reputation) associated with this estimated downtime. The result of this step will assist management in establishing Recovery Time Objectives (RTOs), Recovery Point Objectives (RPOs), and recovery of the critical path which represents those business processes that must receive the highest priority during recovery.


BIA Worksheet - <FUNCTION>

Department: Division: Branch:

Business Unit / Program: Location:Edmonton

Service:Service Category:

Critical – must be provided within 24 hours Vital – must be provided within 72 hours Necessary – must be resumed within two weeks Desired – could be delayed for two weeks or more

Specific Service: <Provide a 1- 2 sentence description of the service>>

Interruption Impact: <Brief description of the qualitative or quantitative impact of not continuing the service (may include damage/threat to safety/security, assets, reputation, finances, etc

Influencing Factors:Peak Periods / Specific Deadlines?

NO YES Details:

Regulatory Requirements?

NO YES Details:

Normal Standard Statement: <provide a detailed description of how the service is normally provided, to whom the service is provided and why if applicable>

Minimum Standard Statement:<State the minimum standard at which the service must be performed>

Human Resource Requirements:


Name Position/RoleWork PhoneCell Phone

Home Phone

Remote Access

Capability Y/N

Alternate Email (primary is name.name

@edmonton.ca)

Essential Skill Set/Required Certifications,

Accreditations, etc.

Infrastructure and Resource Requirements:ITEM DETAIL

(minimum number, minimum capability, minimum capacity, hours required per day, minimum size, etc…)Offices

FurnitureCommunication

IT (Software/Hardware)Other

Vital Records: What vital records are required to continue to provide this program or service?

Paper – Electronic – Are there any back-ups of these records? YES NO

If yes, where? <Electronically - on the departmental shared drive G:\Office of ………… Also available in paper as identified in the distribution list for the document>

Interdependencies:This Business Unit depends on the following service providers / contractors / government departments: N/A

Service Provider/Contractor Description of Interdependency Contact Name Phone #<IT> <Computer operations>

<Communications> <Telephone, Internet service>

The following other groups depend on this service or program: N/A


Dependent Organization/Group Description of Interdependency Contact Name Phone #City Management

Remote Access Viability:Can the function be

performed remotely? NO YES Details: Can Vital Records be accessed remotely? NO YES Details:

For BIAs of Necessary and Desired Services ONLY:

Could this service be voluntarily suspended? NO YES Maximum Tolerable Outage? <1 hour, 1 day, 1 week>Impact of the voluntary suspension? – <e.g. NOT APPLICABLE - The Department would be unable to manage the emergency or service restoration>

Available resources to augment other areas due to this suspension – NOT APPLICABLE

Type/Description of Resource (e.g. admin person, laptop, etc.) Number Available


To help determine and prioritize critical services, the following sample questionnaire may prove helpful.

What functions would have to be done immediately after a business interruption?What could be postponed?

What are your external requirements on a day to day basis?What do you need from outside your business unit in order to be able to continue to function?

What are your immediate internal requirements?Where do they come from?

How long can your critical business functions be inoperative?

Are there regulatory or other penalties that must be considered if you cannot fulfill your obligations due to an unplanned business interruption?

What is the financial impact of non-performance of a business function?How significant is the impact and is it measurable?

What are the costs to respond / recover versus the short-term lost revenue?


Are other organizations dependent on functions that your business unit provides?What legal or contractual obligations would arise if the activities were curtailed or shut down?

What would be the public relations implications of a curtailment of your activities?What if there was a shutdown of your business unit?

Would the safety or security of personnel and property be jeopardized if your operations were interrupted?

Which of your critical operations are dependent on IT support? Are there alternative manual operating procedures in place and how long could these operations be performed without IT support?

List important clients and contacts (external and internal).

Identify critical operating information for vital business functions and prepare a checklist of essential records.Are copies of essential records stored off-site and at what location?

Determine what essential office equipment is required. Specify any special IT hardware, software, databases, networks or other technology.


1.7 Vital Records Summary<A vital record is any information required to support key business processes in daily operations. Vital records are essential to the operation and recovery of a business unit. Vital records can be in many forms, i.e. tapes, microfilm/fiche, hardcopy, reports, reference materials etc. use multiple pages if needed.>

Vital Records Summary Sheet

Department/Branch: Business Unit:

Vital Record Format Location of Records Contact

Location of Back-up &

Contact

Service / Business Process the

Record is tied to (Critical, Vital etc.)

Comments


1.8 Alternate Facility Location<Insert name of department/branch - recognizes that normal operations may be disrupted and that there may be a need to perform critical functions at an alternate facility location. An alternate facility is a location, other than the normal facility used to carry out critical functions in a BCP activation.>

Department: Branch: Section / Unit:

This location is only used if the Principle location is not availableAlternate Location________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Building Owner/Manager: _________________________________________________________________________

Phone: ___________________________ Alternate Phone: __________________________

Pager: ____________________________ E-mail: __________________________________

Directions to alternate location: (i.e. map and directions):________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Business functions to be performed at the primary alternate location:________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Employees who should go the alternate location: ________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Telecommunications Requirements and Telephone Numbers: ___________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Space Requirements: _____________________________________________________________________________

________________________________________________________________________________________________

________________________________________________________________________________________________

Recovery Notes: _________________________________________________________________________________

________________________________________________________________________________________________

_________________________________________________________________________________________________


1.9 Supply / Service Vendor Contact InformationThe City of Edmonton relies on a variety of products and services to maintain daily operations of the various business units. In the event of a service interruption, however caused, shortages in essential supplies or a disruption in the transportation system could affect some business units. Contact information for each department’s supply and service vendors should be identified and documented along with alternate vendors that could be used should the need arise. The attached template will assist in the identification, of routine and essential products/services utilized by the City and should be attached to the department’s plan.

SUPPLY / SERVICE VENDOR

Company name: ____________________________________________________Address: ____________________________________________________Telephone: ____________________________________________________Fax: ____________________________________________________E-mail: ____________________________________________________Primary contact name: ____________________________________________________Alternate contact: ____________________________________________________Account/contract: ____________________________________________________Materials provided: ____________________________________________________Frequency of delivery: ____________________________________________________Notes: ____________________________________________________

____________________________________________________

If this company is unable to provide materials/services, they can be obtained from the following alternate organization(s):

Company name: ____________________________________________________Address: ____________________________________________________Telephone: ____________________________________________________Fax: ____________________________________________________E-mail: ____________________________________________________Primary contact name: ____________________________________________________Alternate contact: ____________________________________________________Notes: ____________________________________________________

________________________________________________________________________________________________________


Questionnaire - Draft

Documents

Transcript of Questionnaire - Draft