Bonnie CanalSELA Chapter of the ACP

Chapter President

ACP National Board Member, Information Chair

HOMELAND SECURITY STUDIESHMLS 7250 – EMERGENCY MANAGEMENT

Continuity Planning 101

Main Goal

The goal for Business Continuity Planning is –

to return to revenue-producing activity as quickly as possible

2

Definition of Business Continuity Planning: “Identifies an organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention and recovery for the organization, while maintaining competitive advantage and value system integrity.”

Continuity Planning 101

COOP vs. BCP

• COOP Defined: An effort within individual executive departments and agencies to ensure that Primary Mission Essential Functions (PMEFs) continue to be performed during a wide range of emergencies.

• BCP Defined: The ability of an organization to ensure continuity of service and support for its customers and to maintain its viability before, during, and after an event.

Some Quick Definitions

• Emergency planning are those procedures and steps done immediately after an interruption to business.

• Disaster recovery are the steps taken to restore some functions so that some level of services can be offered.

• Business continuity is restoration planning, completing the full circle to get your organization back to where it was before an interruption

Where did Business Continuity Planning begin?

During the 1960’s and 70’s, financial institutions were the first to utilize Business Continuity Planning to back up and duplicate critical data.

What is Business Continuity Planning?

During the late 1970s, the height of the mainframe era, a number of visionaries in the US, UK and other parts of the world realized that they had to develop ways not only to protect their massive investments from potential disasters, but also to devise procedures for recovering and restoring systems and data to their original pre-disaster state.

We’re not just talking Catastrophe...

•Natural Disaster/Extreme Weather•Power Outage•IT Failure•Telecommunication Failure•Fire

•Flood•Utility Outage•Environmental Accident•Pandemic Influenza•Supply Chain Disruption

• Protect people and property• Resume critical business operations• Minimize downtime• Preserve reputation• Meet obligations

Objectives of Business Continuity Planning

When is it a Disaster?

• When critical services aren’t happening.

• Can all employees recognize what a disaster is and what they should do?

• In the event of an emergency, all personnel should know what their roles are, and where they should go.

Key Planning Issues

• Emergency/Crisis Management Structure

• Human Factors• Communications• Security (physical and

logical)

• Reputation (PR)

• Technology• Supply Chain• Legal• Public/Private

Partnerships• Facilities• Stakeholders

11

Examples of business continuity risks

• Have you considered financial, legal, regulatory penalties that could be imposed if you fail to provide a critical service which you are contracted to do?

• Consider how each of your critical services could continue during a prolonged power loss. ...Now think about a loss of power lasting for 24 hours.

• Which of your critical services would be jeopardized if your building was evacuated for a week with all access denied?

• What services would be affected if access were denied for a whole month?

• How many staff would be needed to continue to cover critical tasks and how would you accommodate them?

12

Examples of business continuity risks

• Do you have sufficient back-up for your data, both electronic and paper?

• Do you have an alternative building or premises in which to work effectively? Is this sufficient? Can staff work from home?

• Do you need access to any services not currently available at your temporary site?

• Do you use any special software or stationery? How long can you manage without that specific equipment and how long would it take to replenish stocks?

13

Business Continuity Planning- Organization Approach

1. Succession Plans

2. Accounting for Employees

3. Communications

4. Alternate Work Facilities

5. Essential Functions

•Who do we depend on?

•Who depends on us?

Primary Question:

To be completely Organizational Resilient,

ASK ALL VENDORS

in your Supply Chain IF THEY ARE RESILIENT.”

What About the Supply Chain?

Keep in Mind

• You can’t possibly plan for every scenario; it would take all of one’s time and the plan would never get done.

• The goal is not to create a separate plan that addresses every risk, but to create one plan that address all risks.

• In other words, you don’t create one plan for a tornado, one for a flood, and one for a blackout.

• Almost 80% of businesses affected by a major incident either never reopen or close within 18 months

• Most 40% of small businesses that close due to a disaster event never re-open; an additional 25% fail after 2 years

• Of those businesses that experience a disaster and have no emergency plan, 43 percent never reopen; of those that do reopen, only 29 percent are still operating two years later.

• Businesses without a Business Continuity plan have less than 10% survival rate after a disaster

The Effects of Disruption on Businesses

NFPA 1600Standard on Disaster / Emergency Management

and Business Continuity Programs

“ …a common set of criteria for preparedness, disaster management, emergency management,

and business continuity.” (2007 and 2010 editions)

DHS Standards

BS 25999Business Continuity Management

“…defines requirements for a management systems approach to business continuity,

and integrates risk management disciplines and processes.”

DHS Standards

ASIS SPC.1-2009Organizational Resilience: Security,

Preparedness, and Continuity Management Systems

“…defines requirements for a management systems approach to organizational resilience.”

DHS Standards

National standards have recognized the personal resilience gap and have evolved to address a more dynamic model of planning that addresses needs before, during and most importantly after an event.

In other words – they have evolved from readiness to resilience.

The Standard is Changing

Private Sector Responsibilities

Planning must consider the Maximum Allowable or Acceptable Down Time before the continued existence of a business is threatened, and must identify resources required to maintain or resume business activities at an acceptable level.

Organizational Resilience depends on the resilience of the people you rely on.

Think about it…

25

Risk Analysis

Personal Risk Analysis

Identify Dependencies

Recovery Strategies

Response Plans

Recovery Plans

Personal Continuity Plans

Annual Testing & Evaluations

Improved ContinuityPlanning

Model

Mitigation of loss of life or injuryBusiness survivalMinimizing impact of business disruptionsImproved supply chain resilienceSatisfying customer business continuity requirementsImproved internal processesImproved employee relationsImproved external relationshipsSatisfy customer, shareholder, and stakeholder expectationsPotential advantage over unprepared competitionLower operating expensesProtection of brand and reputation

Benefits of Preparation

10 Steps to Preparedness

1. Assess Your Risk – Both Internally and Externally

2. Know Your Operations

3. Know Your IT Capabilities & Back Up Your Data

4. Prepare Your Supply Chain

5. Prepare Your Employees

6. Create a Crisis Communications Plan

7. Assemble Emergency Supplies

8. Identify an Alternate Location

9. Know Your Insurance Coverage & Finances

10.Test Your Plan

Focus on Resilience

• Recognize – government can’t do it all.

• Stress –citizens need to be involved, engaged and prepared (managed expectations).

• Focus – on community-level efforts to prepare, protect, respond, and recover.

• Benefit – if done properly can speed up recovery process.

• End Game – lessen the time between response and recovery.

DRI International: DRI International (originally known as Disaster Recovery Institute) is a non-profit organization and a global BCM education and certification body.

• There are over 8000 active business continuity professionals from various industries and business sectors maintaining DRI International certifications worldwide. These certifications ensure employers that candidates understand the tenets of business continuity and maintain their level of knowledge through continuing education.

• DRI International offers education in BCM at major industry events and through the corporate training program. The organization's International Affiliates insure that BCM best practice is taught and available throughout the world.

Certifying BCP Bodies

Business Continuity Institute:

• The Business Continuity Institute (BCI) was established in 1994 to enable individual members to obtain guidance and support from fellow business continuity practitioners. The BCI currently has over 7000 members in 100+ countries active in an estimated 2,750 organizations in private, public and third sectors.

• The BCI is the world’s most eminent BCM institute and our name is instantly recognised as standing for good practice and professionalism.

• Statutory membership of the BCI in the grades of FBCI, MBCI, AMBCI or SBCI provides internationally recognised status as our valued certification demonstrates the members’ competence to carry out business continuity management (BCM) to a consistent high standard.

Certifying BCP Bodies

• The ACP currently has 44 chapters around the United States with 2700 members.

• Association of Contingency Planners members comprise of professionals who work in business continuity planning, enterprise risk management, incident command and emergency management, contingency planning, and disaster recovery for both information technology and total business enterprise.

About the ACP

• Discounts for major conferences and training opportunities

• Members-only educational content including webinars, white papers and training material

• Access to special interest group discussions

• Opportunity to voice your opinions on business continuity standards and receive specialized standards training

• Assistance for job seekers and those looking to fill staffing positions in our industry

Membership Benefits

Institute for Business and Home Safetyhttp://www.ibhs.org/http://www.disastersafety.org/

Disaster Resourceshttp://www.disaster-resource.com/

Government Siteshttp://www.ready.gov/http://www.LABEOC.org http://www.gohsep.la.gov/

Resources

Questions?

Bonnie CanalChapter President

SELA Chapter of the ACPwww.sela.acp-international.com

email: selaacp@gmail.com

ACP National Board Member, Information Chairwww.acp-international.com

email: info@acp-international.com

phone: 504-874-5474