The University of Texas at San Antoniofacilities.utsa.edu/wp-content/uploads/2017/02/UTSA-Business-Continuity-Plan.pdfman-made disaster. The UTSA Business Continuity Plan (BCP) is

The University of Texas

at San Antonio

Annex J – Business Continuity &

Recovery Plan

The University of Texas at San Antonio Business Continuity & Recovery Plan

2

Letter of Promulgation The University of Texas at San Antonio (UTSA) strives to provide a safe and secure environment for our faculty, staff, and students to teach, work, and learn. In order to achieve this mission, the university has developed a comprehensive Business Continuity Plan to assist departments address emergencies affecting their operations. When implemented, this plan will provide timely, effective, and efficient emergency response for the benefit and protection of the entire university community. The purpose of this plan is to provide the framework for an effective business continuity strategy, utilizing an all-hazards approach. This plan, and correlating departmental business impact analyses, engages the following mitigation strategies:

• Department business impact analyses identify critical functions, inter-dependencies, and related processes.

• Vulnerability reduction through continuity planning; • Preparation for prompt and efficient response and recovery; • University recovery plan as identified by departmental business impact analyses; and • Provide a business continuity program highlighting preparedness, response, recovery,

and mitigation strategies. With the knowledge that the most timely and appropriate responses can best occur when a well-documented plan has been implemented and integrated throughout the University, it is my expectation that University stakeholders will utilize this document as a guide and will develop detailed plans to effectively organize, coordinate, and direct available resources toward emergency response and recovery. Personnel and units assigned specific emergency responsibilities must have a working knowledge of functions and actions to be prepared to act in accordance with a plan when emergencies occur. Although emergencies are unpredictable, this plan allows for an immediate response by university departments, thereby mitigating the effects of threats to our campus. The UTSA Office of Business Continuity and Emergency Management (BCEM) provides oversight of business continuity planning initiatives at all campuses. The University of Texas at San Antonio, Business Continuity Plan is hereby approved. This plan takes effect immediately and supersedes all previous editions. _____________________________ Dr. Ricardo Romo President The University of Texas at San Antonio


3

Table of Contents Letter of Promulgation .................................................................................................................................. 2

References .................................................................................................................................................... 4

Record of Changes & Confidentiality Disclaimer .......................................................................................... 4

Explanation of Terms .................................................................................................................................... 5

Authority ....................................................................................................................................................... 5

Executive Summary ....................................................................................................................................... 6

Planning Assumptions ................................................................................................................................... 6

University Threats & Hazards........................................................................................................................ 7

Table 1 - UTSA Hazard Impact Matrix ....................................................................................................... 7

Concept of Operations .................................................................................................................................. 8

Business Continuity Planning Process ........................................................................................................... 9

Business Impact Analysis ............................................................................................................................ 10

Roles and Responsibilities ........................................................................................................................... 10

University President ................................................................................................................................ 10

Director of Emergency Management ..................................................................................................... 10

Business Continuity Coordinators ........................................................................................................... 11

Direction and Control .................................................................................................................................. 11

A. Preparedness ................................................................................................................................. 11

B. Response ........................................................................................................................................ 11

C. Recovery ........................................................................................................................................ 11

D. Mitigation ....................................................................................................................................... 11

Critical Business Functions and Recovery Time Objectives .................................................................... 12

Table 2 – Critical Business Functions & Recovery Time Objectives ........................................................ 12

Key Dependencies ................................................................................................................................... 12

Table 3 – Critical Dependencies & Possible Alternative Solutions ......................................................... 13

Plan Development & Maintenance ............................................................................................................. 14

Appendix A – Glossary of Terms ................................................................................................................. 15

Appendix B – Upstream & Downstream Dependencies ............................................................................. 18

Appendix C – Proposed Vulnerability Reduction & Mitigation Projects ..................................................... 23

Appendix D – Critical Infrastructure/Key Resource Maps .......................................................................... 28


4

References The University of Texas at San Antonio, Business Continuity Plan, has been developed utilizing best practices and lessons learned within the higher education community. References for the UTSA Business Continuity & Recovery Plan include:

• Marquette University, Business Continuity Plan • The University of Texas at Austin, Business Continuity Plan Annex • Texas A&M University – San Antonio, Business Continuity Plan • Texas A&M University – College Station, Annex J – Institutional Continuity Plan

Record of Changes & Confidentiality Disclaimer

CHANGE DATE ENTERED

Plan Development December 2013 L. Sanchez C. Hawthorne

Confidentiality Disclaimer: In accordance with section 418.177 of the Texas Government Code, which states that information collected, assembled, or maintained by or for a governmental entity for the purpose of preventing, detecting, or investigating an act of terrorism or related criminal activity; and relates to an assessment by or for a governmental entity, or an assessment that is maintained by a governmental entity, of the risk or vulnerability of persons or property, including critical infrastructure, to an act of terrorism or related criminal activity, the following assessment is confidential and not to be released and may be shared internally only with those persons with a need to know.


5

Explanation of Terms Acronyms

BC Business Continuity BCEM UTSA Office of Business Continuity & Emergency Management BCP Business Continuity Plan BIA Business Impact Analysis CEMP Comprehensive Emergency Management Plan EOC Emergency Operations Center EOP Emergency Operations Plan ERT Emergency Response Team FEMA Federal Emergency Management Agency HAZMAT Hazardous Materials ICP Incident Command Post ICS Incident Command System NIMS National Incident Management System PEAC President’s Emergency Advisory Council PIO Public Information Officer RTO Recovery Time Objective SOP Standard Operating Procedures UTSAPD UTSA Police Department UTSA The University of Texas at San Antonio

Authority Federal

• Homeland Security Presidential Directive/HSPD-5, Management of Domestic Incidents • NFPA Standard 1600: Standard on Disaster/Emergency Management and Business Continuity

Programs • NFPA 1561 Standard on Emergency Services Incident Management System 2005 Edition • NFPA 72 Annex E Mass Notification Systems • National Response Framework • National Incident Management System

State

• Texas Administrative Code Title 1 Part 10 Chapter 202 Subchapter C Rule §202.74 • Texas Executive Order RP 57 • Texas Department of Information Resources: Business Continuity Planning Guidelines.

December 2004 • Joint Commission for Accreditation of Health Organizations: Standard EC1.4

University

• UTSA Comprehensive Emergency Management Plan


6

Executive Summary The purpose of the Business Continuity Plan (BCP) is to ensure that all major UTSA offices have a prescribed process for responding to sudden emergencies and for reestablishing mission essential functions during or after adverse operating conditions. The BC plan, in conjunction with departmental business impact analyses, will be implemented by each identified departmental Business Continuity (BC) Coordinator with oversight from the UTSA Director of Business Continuity and Emergency Management. The BCP provides guidance for continuity of services to the UTSA community in the event of a natural or man-made disaster. The UTSA Business Continuity Plan (BCP) is a component of the UTSA Comprehensive Emergency Management Plan (CEMP), serving as Annex J – Business Continuity & Recovery. In 2013, university leadership identified 33 Business Continuity (BC) Coordinators from across university disciplines to develop Business Impact Analyses (BIA) and identify essential functions of the university. BC Coordinators worked with their department leadership to identify critical department functions, interdependencies with other units, recovery processes, resource inventories, and related information. This document bridges the 33 departmental plans into a cohesive university-wide plan to address business continuity at UTSA.

Planning Assumptions UTSA has developed this document using the following planning assumptions:

• Proper implementation of these guidelines will reduce or prevent disaster-related losses. • Emergencies or threats/hazards can adversely impact the University’s ability to continue

essential functions and provide support to day-to-day operations. • There will be a sufficient number of available administrators with adequate supporting

personnel to continue the essential functions of the university. • Recovery of a critical subset of the university’s functions and application systems will occur and

allow critical infrastructure to continue. • A disaster may require students, faculty, staff, and the public to function with limited support

services and some degradation of service, until a full recovery is made. • Leadership and employees will continue to recognize their responsibilities to the university and

exercise their authority to implement this continuity plan in a timely manner when confronted with disasters.

• The university is able to reinstate academic classes within two weeks of the disruption whether through traditional or alternative methods/locations.


7

• In the event of disaster, the university will work in cooperation with surrounding jurisdictions and local emergency response personnel for recovery.

University Threats & Hazards What can happen that may disrupt university operations, and why plan? UTSA is faced with threats and hazards on a regular basis, mostly resulting with little to no impact on daily campus operations. However, emergencies do occur that can negatively affect university-wide operations further warranting large-scale and business functions to enact alternate plans for service delivery and to address a situation. Because emergencies do happen, UTSA has engaged in the business continuity process that allows academic, business, and community service functions to identify their critical functions and encourage them to develop recovery strategies. The hazard impact matrix (see table 1) illustrates the need for business continuity and disaster recovery plans at UTSA. Table 1 - UTSA Hazard Impact Matrix

Hazard Type Likelihood of Occurrence

Estimated Impact on Public Health & Safety

Estimated Impact on Property

Unlikely, Occasional, Likely, Highly Likely

Limited, Moderate, Major Limited, Moderate, Major

Natural Hazard

Drought/Heat Wave Highly Likely Limited to Moderate Limited

Earthquake Unlikely Limited Limited

Flooding Highly Likely Moderate to Major Moderate to Major

Hurricane/Tropical Storm Occasional Moderate Moderate

Tornado Occasional Moderate to Major Moderate to Major

Wildfire Unlikely Limited Limited to Moderate

Winter/Ice Storm Occasional Major Moderate to Major

Pandemic/Public Health/Biological Occasional Moderate to Major Limited to Moderate

Technological Hazard

Electrical System Failure Occasional Limited to Moderate Moderate

Hazardous Material Spill Occasional Moderate Moderate

Major Structural Fire Occasional Limited Moderate to Major


8

Water System Failure Occasional Limited to Major Limited to Major

Loss Information Technology Occasional Limited to Major Limited to Major

Security

Civil Disorder Occasional Limited to Major Limited to Major

Bomb Threat Occasional Limited Limited

Attack

Terrorism/Domestic Occasional Major Limited to Major

*Note: Hazard impacts are based on the assumption of a campus-wide emergency, and may not necessarily reflect localized incidents affecting a small group of people.

Concept of Operations Emergencies that result in operating disruptions can occur with or without warning, and the results may be predictable or unknown. It is important that the primary missions of teaching, research, and service are sustained during any emergency. First priority is always the safety of the staff, faculty, students, and visitors. The UTSA Comprehensive Emergency Management Plan addresses actions to protect life and property. This plan focuses on business operations and the sustenance of critical functions for the university. Business operations for the university must be resilient and the effects of disruptions in service must be minimized in order to maintain campus trust and confidence. Effective business continuity planning establishes the basis for the university to maintain and recover business processes when operations have been disrupted unexpectedly.

Business continuity planning is the process whereby the university and the subordinate components attempt to ensure the maintenance or recovery of operations, including services, when confronted with adverse incidents such as natural disasters, technological failures, human error, or terrorism. The objectives of this BCP are to minimize loss, financial, assets, research, academic, to the university or components; continue to appropriately serve students, staff, faculty, and visitors; and mitigate the effects disruptions can have on the university’s strategic plans, reputation, operations, and ability to remain in compliance with applicable laws and regulations. Changing business processes (internally to the university and externally to the broader community) and new threats require the university to maintain updated and viable BCPs at all times.

New business practices, changes in technology, and increased terrorism concerns, have focused even greater attention on the need for effective business continuity planning and have altered the benchmarks of an effective plan. This BCP will take into account the potential for wide-area disasters that affect an entire region and for the resulting loss or inaccessibility of staff. Additionally, this BCP also encourages discussion among university units, as well as infrastructure consideration to collaborate and address interdependencies of services/resources. In most cases, recovery time objectives (RTO) are now much shorter than they were even a few years ago, and for some units recovery time objectives are based on hours and even minutes.


9

Departments and agencies of the university should incorporate business continuity considerations into process development to mitigate the risk of service disruptions. In creating an effective BCP, university components should not assume a reduced demand for services during the disruption. In fact, demand for some services may increase.

This plan recognized that while technology was the primary basis for concern, an enterprise-wide, process-oriented approach that considers technology, business processes, testing, and communication strategies is critical to building a viable BCP.

Business Continuity Planning Process The university BC planning process reflects the following objectives:

• Business continuity planning is about maintaining, resuming, and recovering the business, not just the recovery of the technology.

• The planning process should be conducted on a university-wide basis. • Phase 1 – Development of business impact analysis and risk assessment are the foundation of

an effective BCP. UTSA functions engaged in this process throughout 2013. • Phase 2 – Expand department business impact analyses to include processes and alternative

solutions for each critical function identified in phase 1. BC Coordinators will be engaged in this phase in 2014.

• The BCP will be updated annually to reflect and respond to changes to the university organizational structure. The UTSA Office of Business Continuity & Emergency Management will provide annual updates and/or program enhancements to BC Coordinators for collaboration and action.

The university will conduct business continuity planning on a university-wide basis. UTSA offices developed business impact analyses throughout 2013, whereby they identified critical aspects of its business operations in creating a plan for how it will respond to disruptions. This plan is not limited to the restoration of information technology systems, services, or data maintained in electronic form, as such actions, by themselves, cannot always put a unit back in operation. Without a BCP that considers every critical business function, including personnel, physical workspace, and similar issues, the university may not be able to resume or maintain its teaching, research, and community service missions at an acceptable level. The university recognizes the systemic impact that service disruptions may have on the integrity of the university.

All BC Coordinators must update their BCPs as business processes change. For example, the university is increasingly relying on distributed network solutions to support business processes. This increased reliance can include desktop computers maintaining key applications. While distributed networking provides flexibility in allowing the university to deliver operations to where employees and customers are located, it also means that end-users should keep BCP personnel up-to-date on what constitutes current business processes and significant changes. Technological advancements are allowing faster and more efficient processing, thereby reducing acceptable business process recovery periods.


10

In response to competitive and customer demands, many units are moving toward shorter recovery periods and designing technology recovery solutions into business processes. These technological advancements increase the importance of university-wide business continuity planning. All university BCP’s focus on a process-oriented approach to business continuity planning that involves identifying critical departmental functions and key resources through a Business Impact Analysis (BIA). Business continuity planning should center on all critical business functions that must to be recovered to maintain operations. The BCP must be viewed as one critical aspect of the university-wide process. The review of each critical business function should include the technology that supports it.

Business Impact Analysis

In order to assist university departments meet their planning needs, BCEM developed a business impact analysis and recovery template tool to assist academic and administrative offices map their critical operations and begin the planning process. The components identified in the template document are applicable to any academic or administrative department. Departmental templates are designed to identify critical functions, policies, vulnerabilities, and recovery procedures.

Participation in the Business Continuity Program helps ensure the continued operation of services to The University of Texas at San Antonio. Departments are encouraged to discuss and identify core functions and recovery processes internally to best determine solutions and best practices. The UTSA Office of Business Continuity & Emergency Management assists departments throughout the planning process. As previously discussed in the university threats and hazards section, impact from various emergencies can range from those with a high probability of occurrence and low impact to the unit or university (e.g., brief power interruptions), to those with a low probability of occurrence and high impact on the institution (e.g., hurricane, terrorism). High probability threats are often supported by very specific plans, which are detailed in the UTSA Comprehensive Emergency Management Plan. However, the most difficult threats to address are those that have a high impact on the university but a low probability of occurrence.

Roles and Responsibilities University President This plan is promulgated under the authority of the President of the University. The President is the final approving authority of the UTSA Business Continuity Plan. The President, or an official designee, will make decisions concerning the discontinuation of university functions, cancellation of classes, or cessation of operations, and the President or the official designee will make the final decision when declaring a State of Emergency. Director of Emergency Management Provides oversight of the Business Continuity Program at UTSA, and guides plan development, training, and discussion with department BC Coordinators. The Director of Emergency Management will meet with BC Coordinators to update the university-wide BC plan, as well as provide updates to BC Coordinators regarding programmatic enhancements or new requirements.


11

Business Continuity Coordinators These positions have been tasked with participating in business continuity planning, development and implementation. BC Coordinators will lead department continuity initiatives, collaborate with staff to identify information needed for their BC plan, build staff awareness of preparedness efforts, serve as a liaison on the university BC planning team, and update their department/office BC plan annually.

Direction and Control Process from BIA development through activation of plans: A. Preparedness – Business Impact Analysis and Program Foundation

1. BIA Development – UTSA departments engaged in the development of their BIA’s throughout 2013.

2. BIA Content – Critical functions and interdependencies were identified by UTSA offices selected through university leadership. The Office of Business Continuity & Emergency Management maintains a master roster of university units with BIA’s and BC Coordinators.

B. Response – Activation of BC Plans and Recovery Procedures

1. Should an emergency occur, departments will enact their BIA and recovery procedures to mitigate the effects of campus emergencies on their operations.

2. All emergency contracts, processes, memorandum of understanding/agreements, utilization of space, key resources, and related procedures will remain in effect until the hazard/threat has dissipated.

3. Upon activation of BC plans, departments will address essential functions according to the following criticality levels:

a. Critical 1 – Must be continued at normal or increased service load. Cannot pause. Necessary to life, health, security. (Examples: inpatient care, police services)

b. Critical 2 – Must be continued if at all possible, perhaps in reduced mode. Pausing completely will have grave consequences. (Examples: functioning of data networks, at-risk research)

c. Critical 3 – May pause if forced to do so, but must resume in 30 days or sooner. (Examples: classroom instruction, research, payroll, student advising)

d. Deferrable – May pause and resume when conditions permit. (Examples: routine building maintenance, training, marketing)

C. Recovery – BIA Recovery Plan Enhancements

1. Departments are responsible for determining recovery processes for each critical function identified in their BIA. Phase 2 of the BC program engages BC Coordinators to continue developing and refining recovery strategies as part of their BC plans.

D. Mitigation – Engaging in Projects to Reduce Organizational Vulnerability

1. Departments identified mitigation projects that would reduce their vulnerability if funded. A full list is included in Appendix C – Proposed Vulnerability Reduction & Mitigation Projects.

2. All BC Coordinators will be engaged in ongoing training and programmatic enhancements to increase the level of preparedness and reduce the effects of campus emergencies on university operations.


12

Critical Business Functions and Recovery Time Objectives Departments/divisions will determine the functions that they must perform in order to continue to operate and provide necessary services. These functions are considered essential functions. During and after a disruption, it may be impossible to immediately perform all university functions at full capacity. The Recovery Time Objective (RTO) established for each of the UTSA Critical Business Functions is the maximum acceptable length of time that can elapse before loss of a business function severely impacts UTSA. The RTO is the time before and emergency is declared, during which time the impact begins, is recognized and is identified, and the tasks documented in the emergency recovery plan for resumption of the critical business functions are accomplished. A detailed list of Critical Business functions with resources required supporting the function, interdependencies, information resource requirements, and RTO’s is included in Department Business Impact Analysis. Table 2 – Critical Business Functions & Recovery Time Objectives

Critical Business Functions Recovery Priority Recovery Time Objective (RTO) Provide Building Security/Life Safety

1 < 1 hour

Information Technology Services 1 0 to 6 hours Provide Information to Students and Employees

1 0 to 12 hours

Utilities 1 0 to 12 hours Operate Facilities For Higher Education

1 12 to 24 hours

Offer Traditional Classes 2 12 to 24 hours Collect Tuition and Fees 2 12 to 48 hours Offer Online Classes 3 12 to 24 hours Enroll Students 3 12 to 24 hours Payroll 3 24 to 48 hours Mail Center 3 12 to 24 hours Key Dependencies

All Texas A&M University divisions/departments depend on other components of the University to continue their essential functions. Divisions and departments may also depend on external vendors in order to continue their essential functions. Each department/division will document their key internal and external dependencies in their continuity plan. These key internal and external dependencies may include:

• Services • Processes • Data • Employees • Equipment • Supplies


13

Table 3 further expands upon the common dependencies listed above. Furthermore, possible alternative solutions are provided for each of the core business functions of the university. Although not an inclusive list of university functions, the essential functions listed in table 3 warrant the highest level of attention by university departments to restore services to the UTSA community as quickly as possible. Table 3 – Critical Dependencies & Possible Alternative Solutions RTO

(Hours) Recovery Priority

Essential Function

Required Resources Dependencies Possible Alternative Solutions

< 1 1 Provide Building Security

PD Personnel Surveillance Equipment Radios Vehicles Mass Notification System

Operational Facilities Contract Part-time Security Personnel Contract part-time sworn peace officers Increase security force

0-6 1 Full Service Information Technology Services (ITS) Offering

Computer network Computer hardware AV capacity Data management Data backup services Exchange services Generator/Power

Facilities and Utilities Mobile Devices Alternate location for back-up

0-6 1 Provide information to students and employees

IT Resources Personnel Mass Notification Systems

IT Leadership

PR Firm Social Media Hotline Call Centers

0-12 1 Utilities Critical Infrastructure External Agencies Equipment for Repairs Personnel

SAWS CPS Energy External Utility Service Providers

Contracts for back-up power/fuel Potable water contract Emergency contracts for resources

12-24 1 Operate facilities for higher education

Generators Facilities personnel Contract custodial personnel. Access to facility

Security Activate various Facilities Emergency Response Procedures Contract with Disaster/Remediation Companies for Clean-up

12-24 2 Offer Traditional classes

Classrooms Research Facilities Support Services Parking, IT

Security Functional Facilities IT Services

Contract ITS Activate the “Higher Education Temporary Facilities Procedure” Convert Traditional classes into interactive online offering.

12-48 2 Collect tuition and fees (accounts receivable)

Business Office Personnel IT Resources Accounting systems Business Center


Contract ITS Contract Accounts Receivable

12-24 3 Offer online classes.

Faculty IT Resources

IT Services Online classes can be hosted off campus

12-24 3 Enroll students Enrollment and Advising Staff IT Resources Office space


Alternative registration site Manual enrollment Phone enrollment


14

12-24 3 Mail Center Mail Center Personnel Mail Center Vehicle Temp mail center

Security Access to Facilities Functional Facilities

Manual asset management Alternate receiving site

24-48 3 Payroll Payroll personnel. IT Resources Accounting systems

IT Services

Payroll process - sister institution

*Note: Tables 1 and 2 are not fully inclusive of all university essential functions, resources, or alternative solutions; however, they provide a campus-wide snapshot of recovery priorities up to 48 hrs.

Plan Development & Maintenance

During the planning process, the Director of Business Continuity & Emergency Management will act as the coordinator of the Business Continuity Planning Team in the development and/or review stages of the UTSA Business Continuity & Recover Plan and related departmental business impact analyses. Final approval of The University of Texas at San Antonio, Business Continuity & Recovery Plan rests with the President of the University or his designee. The BC Plan shall be reviewed and updated by the UTSA Office of Business Continuity & Emergency Management in accordance with University of Texas System policies and state statutes. Official copies of the BC Plan will be distributed in electronic version to Business Continuity Coordinators and related stakeholders before the start of each academic year. This plan is promulgated under the authority of the President of the University. This plan will be reviewed and updated annually, or as needed, to account for changes within the university organization structure.


15

Appendix A – Glossary of Terms Business Continuity: An ongoing process supported by senior management and funded to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies, recovery plans, and continuity of services.

Business Continuity Plan (BCP): A comprehensive written plan to maintain or resume business in the event of a disruption.

Business Impact Analysis (BIA): The process of identifying the potential impact of uncontrolled, non-specific events on an institution’s critical/essential business functions.

Business Resilience: An enterprise-wide state of readiness including people, processes, information, facilities, and third parties as well as technology to cope effectively with potentially disruptive events

Dependency: The reliance, directly or indirectly, of one activity or process upon another. Disaster/Emergency Management: An ongoing process to prevent, mitigate, prepare for, respond to, and recover from an incident that threatens life, property, operations, or the environment.

Disaster Recovery Plan: A plan that describes the process to recover from major processing interruptions.

Downstream Dependencies: A department that depends on your services. If your department fails to perform, the ability of the downstream stakeholder to carry out their mission will be impaired. Encryption: The conversion of information into a code or cipher.

FEMA: Acronym for Federal Emergency Management Agency. HVAC: Acronym for heating, ventilation, and air conditioning.

Incident Command System: A standardized on-scene emergency management concept specifically designed to allow its user(s) to adopt an integrated organizational structure equal to the complexity and demands of single or multiple incidents without being hindered by jurisdictional boundaries (ICS-010-1).


16

Incident Management System (IMS): The combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure designed to aid in the management of resources during incidents (NFPA 1600).

Media: Physical objects that store data, such as paper, hard disk drives, tapes, and compact disks (CDS).

Mirroring: A process that duplicates data to another location over a computer network in real time or close to real time.

Mitigation: Activities taken to reduce the severity or consequences of an emergency (NFPA 1600).

Mutual Aid/Assistance Agreement: A prearranged agreement between two or more entities to share resources in response to an incident (NFPA 1600).

Preparedness: Activities, tasks, programs, and systems developed and implemented prior to an emergency that are used to support the prevention of, mitigation of, response to, and recovery from emergencies (NFPA 1600).

Recovery: Activities and programs designed to return conditions to a level that is acceptable to the entity (NFPA 1600). Recovery Site: An alternate location for processing information (and possibly conducting business) in an emergency. Usually distinguished as “hot” sites that are fully configured centers with compatible computer equipment and “cold” sites that are operational computer centers without the computer equipment.

Recovery Time Objectives: The period of time that a service can be inoperable.

Resource Management: A system for identifying available resources to enable timely and unimpeded access to resources needed to prevent, mitigate, prepare for, respond to, or recover from an incident (NFPA 1600).

Response: Immediate and ongoing activities, tasks, programs, and systems to manage the effects of an incident that threatens life, property, operations, or the environment (NFPA 1600).

Server: A computer or other device that manages a network service. An example is a print server, a device that manages network printing.


17

Situation Analysis: The process of evaluating the severity and consequences of an incident and communicating the results.

Stakeholder: Any individual, group, or organization that might affect, be affected by, or perceive itself to be affected by the emergency. System Development Life Cycle (SDLC): A written strategy or plan for the development and modification of computer systems, including initial approvals, development documentation, testing plans and results, and approval and documentation of subsequent modifications.

Upstream Dependencies: An upstream dependency is a department that your department depends on. If the upstream department fails to perform, the ability of your department to carry out its mission may be impaired. UT Institutions: The University of Texas System’s nine academic teaching institutions and six health centers.

UT System Administration: The central administrative offices that lead and serve the UT Institutions by undertaking certain central responsibilities that result in greater efficiency or higher quality than could be achieved by individual institutions or that fulfill legal requirements.


18

Appendix B – Upstream & Downstream Dependencies Plan Upstream Dependencies Downstream Dependencies VPCS P-20 Initiatives Human Resources; Provost Office;

Admissions Office; Office of the VP of Community Services; Grants, Contracts, and Financial Services (GCFS); Disbursements and Fiscal; Services; Payroll; Purchasing and Contracts; Research Service Centers (RSC); and Accounting

Internal: Admissions; Advising; iTEC; Athletics; COEHD; CRPE; COE; COS; Development Office; Financial Aid & Scholarship; ITC; MAES; PREP; Testing Center; TRC; Transfer Center; and Undergraduate & Graduate Studies External: Alamo College; Café College; Communities in School; College Board; ESC Region 20; Big Brother and Sisters; HISPA; Judson ISD; Person; San Antonio Education Partnership; Southwest ISD; UT System; San Antonio ISD; Geneva School of Boerne; Northside ISD; Harlandale ISD; Bracketville ISD; Crystal City ISD; Eagle Pass ISD; Edgewood ISD; Medina Valley ISD; Southside ISD; Uvalde ISD; Southwest ISD; and TAMIU

Institute for Economic Development OIT Funding Agencies and Clients Institute for Texans Cultures (ITC) UTSA Facilities (Physical plant,

housekeeping); UTSA Police Department; UTSA Business Affairs (Business Administration, Financial Affairs, EHSRM); and Collection donors

UTSA (community outreach/cultural heritage component); Group tour operators; and Facility rental clients

Pre-freshman Engineering Program (PREP)

OIT; Grant’s Office; OSP; Purchasing Office; Accounting Office; Disbursements & Travel; Business Manager’s Office; Facilities; and Human Resources

SAPREP Sites; TexPREP Sites (limited); PREP-USA Sites (limited); and Sponsors

VPBA Office of Facilities OIT; Facilities Business Operations;

and Purchasing Entire Campus Community

Office of Facilities – Engineering and Project Management/Utilities

CPS Energy; SAWS; and WinSam personnel, for electricity, natural gas, water, sanitary sewer and expertise to operate plant equipment.

Campus facilities that require building cooling and heating. Other items include domestic hot water and process steam used for various processes. Note, this primary for the “core” Main Campus buildings.

Office of Facilities – Planning Development

OIT Facilities Engineering and Project Management and Facilities Operation and Maintenance

Office of Facilities – Business OIT Facilities Trades; Disbursements;


19

Operations

Purchasing; and Payroll

Office of Facilities – Customer Services/Housekeeping and Event Services

OIT; UTSAPD; EHSRM; CPS and SAWS; Human Resources; and Payroll Department

All Campus Departments

Office of Facilities – DTC/ITC OIT; Facilities Business Operations; and Purchasing

ITC and DTC Campus Community

Human Resources Payroll; OIT; UT Share (PeopleSoft) Payroll; Hiring Managers; UT Share (PeopleSoft); Safety Sensitive Areas requiring (labs, positions utilizing chemicals, etc.)

University Police Department OIT Students; Staff; Faculty; Visitors Environmental Health, Safety, & Risk Management (EHSRM)

Business Affairs – VP and AVP Administration; OIT – File Servers; OIT – Computer Network; OIT – Telephone Network; Facilities – Building systems; Facilities – Motor Pool; Financial Affairs – accounting and disbursements; Police Department – Public Safety, Access Services, BCEM; Purchasing and Distribution Services; and UT System – Office of Risk Management

Select Agent Research faculty; Research laboratory faculty; Teaching laboratory faculty; Facilities – Engineering and Project Management; Facilities – Operations and Maintenance; Business Auxiliary Services – CDL Drivers; UT System – Office of Risk Management; employees and Building occupants

Purchasing & Distribution Services OIT; Facilities (if structural or electrical repairs or maintenance are required

Procurement: Any department with a significantly urgent or emergency procurement request that could not complete the request through their own authority (i.e. small-dollar orders, Procard), or through an alternative method (Procard managed by the Emergency Response Team). Receiving: Any department that has procured commodities that cannot be directly delivered to the required site, and which must be received and delivered by a centralized, trained staff with access to necessary logistical equipment. These instances may occur because of the size and weight of the commodity, or because the shipper does not have adequate resources to deliver to directly to the site. Mail Services: Any department with a significantly urgent or emergency need to receive or send correspondence through the United States Postal Services system.


20

Business Auxiliary Services ARAMARK; Follett; Verizon Wireless; Facilities (Operations and Maintenance; Equipment; Utilities)

Community; Campus Residents (Dining)

Financial Affairs Define UT Austin System; PeopleSoft; Banner

UTSA employees for payroll and reimbursements; Students for registration, financial aid awards and tuition and fee payments; Researchers for financial data needed to manage grants; venders; and Bank for

VPAA Academics Libraries We rely on all UTSA business

systems Faculty and students rely on Library materials for research and teaching.

Office of Information technology (OIT)

All Facilities - Utilities; OIT Business Administration - Central OIT (if server(s) is/are down, OIT Business Office Administration (BOA) might not be able to process necessary documents); Client Services – IT (server access to systems and documents stored in the Share Points database), IT (Shibboleth authentication for all users), IT (Telephone services for all users); Online Learning and Engagement – IT (server success to Blackboard Learn system configuration documents stored in the Share Point database and on DL-LYNX), IT (Shibboleth authentication for all users), IT (Banner/Pancake data to feed Blackboard learn); Infrastructure – Outside Internet Services Providers (ISPs), UT System Office of Telecommunication Services (OTS), Security, DCO, and CIS

OIT Business Administration – University Colleges/Departments (if OIT Business Office Administration (BOA) cannot process a purchase request for certain equipment, that could possibly impact a college/department outside central OIT); Client Services – Faculty, staff, and students, Academic Technology, and Student Computing Services; Online Learning and Engagement – Faculty and students; Infrastructure – All campus departments, faculty and staff.

Office of Vice Provost - DTC Provost Office; OIT; UTSA Police Department; Facilities Services; Human Recourses; Payroll; and Communications

All Downtown Campus colleges; Academic and administrative departments

VPR Laboratory Animal Resources Center Faculties (Utilities) Department;

UPD and Access Control; OIT Faculty involved in animal research

Bioscience Laboratories Facilities; OIT; EHSRM; LARC; UTSA PD; and Access Control

Department of Biology, selected researchers; VPR; VPBA

Research Administration and Support Services


21

VPER Operations & Gift Services Accounting/Fiscal Services; Mail

Services; and OIT Development Departments; Alumni Programs; and Colleges

Alumni Relations VPER – Marjie French; VPER Development , Data Services Team ; OIT

NONE

Development Data Services Alumni Programs; Development; Communications; Marketing; and Colleges and Units

Advancement External Relations VPSA Office of the Registrar OIT is functional, servers are

functional and accessible; Ellucian Banner and Texas Connection Consortium software are accessible.

Registrar business processes are operational for students, faculty and staff.

Financial Aid OIT; Telephone; Services; Financial Affairs

Department of Education; Texas Higher Education Board; Students; Parents; Common Origination Record; various outside agencies

Admissions OIT is probably the area where reduced functioning would impair Admissions, Orientation, and Recruitment Information Systems

Financial Aid, Registrar, Academic Advising, Academic Departments and Schools, Housing, Business Auxiliary Services

Student Health Services Office supplies; Medical supplies; OIT; Registrar; International Programs

Students

Athletics Student Affairs; Financial Affairs; University Police; Facilities; OIT; Business Auxiliary Services; Housing; City of San Antonio CUSA; NCAA

University Communications; Student Life; Student Activities

Student Disability Services OIT; Banner; Police and Emergency Management; Parking; Human Resources; Purchasing/Disbursements; Payroll; Academic Affairs; Financial Aid & Enrollment Services; Access Control; Facilities Vice-President for Student Affairs (VPSA)

Academic Affairs and Facility; Students with Disabilities; Employees needing consultation; Legal Affairs (regarding compliance issues); Housing & Residence Life; VPSA; Advising; Orientation; Special Events

University Center Vice President of Student Affairs; Student Life; Registrar; Human Resources

Tenants; Student Organizations; University departments; Housing and Resident Life

Office of Counseling Services UTSA Police; OIT; Facilities; University Health Science Center-San Antonio

Student Disability Services; UTSA Police; Student Conduct and Community Standards; Students

University Career Center

Student Disability Services; OIT- Upload; Registrar; Financial Aid; WRP Government Jobs Program

Counseling Department (COU course) – academic platform to teach course; Center for Student Professional Development; DT Career Center


22

Campus Recreation UTSA Police; OIT; Facilities; Disbursements; Payroll

Students Faculty/Staff; Rowdy New “U” Program; Kinesiology Department; Music Department; External Stake Holders; and Environmental Safety Management

Housing & Residence Life TBD TBD


23

Appendix C – Proposed Vulnerability Reduction & Mitigation Projects Plan Action Item Title Cost Amount VPCS P-20 Initiatives Cross –train Staff Don’t Know P-20 Initiatives Utilize electronic backup for critical

data $1,000 - $10,000

P-20 Initiatives Utilize additional communication services

$10,000 - $100,000

P-20 Initiatives Install hardware for key administrative staff

$10,000 - $100,000

P-20 Initiatives Utilize a permanent storage device $100 - $1,000

Institute for Economic Development Reassign or purchase additional laptops as contingency for staff that are not currently assigned removable devices

Don’t Know

Institute for Economic Development Purchase hot-spot routers for each department

Don’t Know

Institute for Texans Cultures (ITC) Secure an off-site storage facility for ITC collections and historical documents

$10,000 - $100,000

Institute for Texans Cultures (ITC) Relocate staff to other locations $10,000 - $100,000 Institute for Texans Cultures (ITC) Install backups for local and

network servers housed at the UTSA HemisFair Park Campus

$10,000 - $100,000

Institute for Texans Cultures (ITC) Secure alternate facilities where ITC exhibits, programs, and special events can be conducted

$10,000 - $100,000


Install resources to ensure the data network at both the Main Campus and the Downtown Campus, and the connection to the internet remains available.

Don’t Know


Purchase secure and fireproof storage cabinets

$1,000 - $10,000


Cross-train staff Don’t Know

VPBA Office of Facilities Provide emergency generator to

FSA building More than $100,000

Office of Facilities Stockpile critical materials for hurricanes

$1,000 - $10,000

Office of Facilities – Engineering and Project Management/Utilities

Develop plant emergency operations plan

$1,000 - $10,000

Office of Facilities – Planning Development

Record Redundancy More than $100,000

Office of Facilities – Business Operations

TMA Cloud Don’t Know


Ability to temporarily raise Procard Limits

Less than $100


24


Temporary receiving area Don’t Know


Identify an area where emergency supplies and equipment are kept

Less than $100


Cross-train staff in custodial usage Less than $100

Office of Facilities – DTC/ITC Redundancy of necessary equipment

More than $100,000

Office of Facilities – DTC/ITC Backup sewage pumps More than $100,000 Human Resources Need temp agency list Less than $100 Human Resources Hard copy of Safety and Compliance

training Less than $100

University Police Department Install backup communication systems for police radio system

Environmental Health, Safety, & Risk Management (EHSRM)

Digitize Files $10,000 - $100,00

Purchasing & Distribution Services Install backup/emergency power sources for electricity and communication lines in CRW, including electricity to the refrigerated units that store research products, some of which are possibly hazardous

Don’t Know

Purchasing & Distribution Services Prepare for possible use of an alternative “material management” location for receiving and mail services, other than DTC, ITC or Facilities Receiving area.

Don’t Know

Purchasing & Distribution Services Develop plan for receipt of paper purchase requests and approval/distribution of paper purchase orders.

$100 - $1,000

Purchasing & Distribution Services Develop plan for remote purchasing activity.

$100 - $1,000

Business Auxiliary Services Outsource Food Provisioning More than $100,000 Financial Affairs Payroll Don’t Know Financial Affairs Paying Venders $10,000 - $100,000 Financial Affairs Issuing Travel Reimbursements Less than $100 Financial Affairs Collect tuition and fee revenue from

students and public Less than $100

Financial Affairs Cash Management Process – Grants $100 - $1,000 Financial Affairs Accounting/Bank reconciliation/

Cash positioning Less than $100

Financial Affairs Process federal student loan drawdowns, refunds and stipends to students

Less than $100


25

VPAA Academics

Libraries Prepare for work-from-home- emergency

Less than $100

Libraries Develop a version of the website the does not rely on access to the campus network to provide access to online resources

$1,000 - $10,000

Libraries Install backup power systems for all Special Collections locations (ITC, JPL, PNB) to ensure that cooling and dehumidifying equipment can continue operations to protect valuable and rare collections

Don’t Know


Establish Remote access standard us (recommend application)

$1,000 - $10,000


All electronic documents, procedures, and contact information on storage media

Less than $100


Authentication change Less than $100


Cross Training $10,000-$100,000


Install new generator that supports ONLY the JPL Data center

More than $100,000

Office of Vice Provost - DTC Request a warning notification system for the Downtown Campus

Don’t Know

VPR Laboratory Animal Resources Center Install backup generators Don’t Know Laboratory Animal Resources Center Ensure HVAC equipment

redundancy Don’t Know

Laboratory Animal Resources Center Backup computer files $100 - $1,000 Laboratory Animal Resources Center Establish constant supply of feed

and water $1,000 - $10,000

Bioscience Laboratories Memo of understanding with UTHSCSA

$10,000 - $100,000

Research Administration and Support Services

VPER Operations & Gift Services Purchase backup laptops with

necessary software $1,000 - $10,000

Operations & Gift Services Purchase manual receipt books Less than $100 Operations & Gift Services Purchase backup for Raiser’s Edge

server

Operations & Gift Services Fiscal Services Plan Alumni Relations Confirm all items are PDF on I Drive,

backup to the cloud, and a large external drive

$1,000 - $10,000


26

Alumni Relations Cross-Train more staff and have step by step processes written for preparing reoccurring tasks such as payroll, vacation/sick, check writing, processing memberships, etc.

$1,000 - $10,000

Alumni Relations Develop stronger relations across campus to help

Less than $100

Development Have all staff save work on network drives

Less than $100

Development Assure all staff are cross-trained Advancement External Relations VPSA Office of the Registrar Cross train staff and assure process

documentation is stored on cloud in a retrievable format.

Less than $100

Office of the Registrar Establish alternative way to communicate with RO staff if phones or cell towers in region are inoperable.

$100 - $1,000

Office of the Registrar Install backup/ emergency power source for all communication networks within Registrar’s Office.

Don’t Know

Financial Aid Cross train to do customer service or financial aid processing

Admissions Offsite center of operations (should access to the university be impaired) is about the only thing that we really do not have in place

$10,000 - $100,000

Student Health Services Stocking alternate facility $10,000 - $100,000 Student Health Services Portable diagnostic kits $100 - $1,000 Student Health Services Cross Training Students Health Services Medical Records Storage $1,000 – $10,000 Athletics Identify essential personnel Less than $100 Athletics Backup storage of critical

documentation $1,000 - $10,000

Athletics Facility Alternatives $10,000 - $100,000 Athletics Facility emergency backup systems

(i.e. generators) More than $100,000

University Center Upgrade to 25 Live $10,000 – 100,000 Office of Counseling Services Prepare an Emergency Kit Less than $100 Office of Counseling Services Access to update portable electronic

devices $1,000 - $10,000

Office of Counseling Services Establish a crisis hotline or online hotline

$10,000 - $100,000

University Career Center Information management $100 - $1,000 University Career Center Cross training of all staff Less than $100 University Career Center Transition COU 2103: Personal

Career Counseling Course to an online platform

$100 - $1,000

University Career Center Communication Less than $100


27

Grand Total: $3,501,100 *Based on highest totals for categories $100 - $100,000; Over $100,000, the average per project was calculated at $250,000. Projects noted as “Don’t Know” were not given a project total.

Campus Recreation Prepare an Emergency Kit Less than $100 Campus Recreation Access to update portable electronic

devices $1,000 - $10,000

Campus Recreation Lightening Detection System $10,000 - $100,000 Housing & Residence Life

Cost Mitigation Breakdown Less than $100 $100 - $1,000 $1,000 - $10,000 $10,000 - $100,000 More than $100,000 Don’t Know

21 9 14 16 7 15 $2,100 $9,000 $140,000 $1,600,000 1,750,000 0


28

Appendix D – Critical Infrastructure/Key Resource Maps UTSA Main Campus - Critical Infrastructure/Key Resources (CI/KR)


29

UTSA Downtown Campus - Critical Infrastructure/Key Resources (CI/KR)


30

UTSA Institute of Texan Cultures – Critical Infrastructure/Key Resources Map

Documents

The University of Texas at San Antoniofacilities.utsa.edu/wp-content/uploads/2017/02/UTSA-Business-Continuity-Plan.pdfman-made disaster. The UTSA Business Continuity Plan (BCP) is