Business Continuity

1

• Business Continuity
• PLEASE ask questions as we go.
• Colorado Fiscal Managers Association
• May 1, 2009

2
Well Be Talking About

• What is A Business Continuity Plan and why have
  one?
• The role of the Finance Department in the plan
• How to set up a plan (UNC Model)
• What to do with the plan
• Questions

3
Business Continuity is a second, but CRITICAL
PRIORITY

• Initial responses are completed
• Life safety has been addressed
• Damage has been evaluated
• Operations now need to resume and get back to
  normal

4
What is a Business Continuity Plan?

• A collection of policies, procedures, protocols
  and information that is developed, compiled and
  maintained in readiness for use in the event of a
  business interruption.
• Outlines steps your organization needs
  to take in order to quickly resume
  service delivery.

5
How Business Continuity Planning Differs from
Disaster Recovery and Crisis Management

• BCP focus is not on rebuilding or alleviating the
  effects of a disaster, emergency or catastrophe.
• BCP focuses on sustaining the delivery of
  services essential to the organizations
  survival.
• With a sound BCP, your organization can continue
  to provide mission-critical services, no matter
  what happens.

6
Why do we need a BCP?

• Having the BCP in place before the business
  interruption is critical otherwise, you may not
  be able to respond quickly enough to prevent
  service interruption.

7
California State University, Northridge, 1994

• Earthquake, magnitude 6.7
• Nearly every building on campus unusable

source D.Carver, U.S. Geological Survey
Classes resumed four weeks afterwards.
source Mary M. Finley, CSU Northridge
8
Oakland, CA, 2007.
Planning made a difference.
source Associated Press / Paul Sakuma
26 days later.
source San Francisco Chronicle / Paul Chinn
9
New Orleans, 2005.
source National Oceanic Atmospheric
Administration
Planning would have made a difference!
source Reuters / Jason Reed
10
Why do we need a BCP?

• You MUST
• Resume Critical Functions

11
What is a Critical Function?

• Those functions that are essential to the
  continued accomplishment of the organizations
  mission.
• Functions that would result in
• Irrevocable disruption of student education
• Irrecoverable loss of research data
• Irrecoverable loss of operational data, or
• Significant financial loss to the University

12
Finances Role in the plan

• Ensure that business operations are resumed and
  proper controls are being followed.
• Get bills and salaries paid
• Compliance will laws, rules, and other
  obligations (i.e. federal research money)
• Recover of losses and preparing the paperwork for
  insurance and reimbursements (i.e. up to 80 of
  could be recovered from FEMA)

13
Scenarios To Consider

• How would your office continue to deliver
  mission-critical services if normal business
  operations were interrupted?
• A fire destroys your office and you are unable to
  retrieve any materials.
• The sprinkler system malfunctions and soaks the
  office, damaging most of the computers.
• A bomb threat is received and an entire building
  must be evacuated.
• Several members of one department contract food
  poisoning and are unable to work.
• A hacker gains access to your organizations
  computer system and blocks access to data.

14
What would your organization do?

• How could you quickly resume functioning enough
  to continue delivering the services that are
  critical to the mission of your organization?

15
How to set up a plan (UNC Model)Lets refer to
the template for this section
16
What does the template look like?
Basic Information About the Unit Covered Under
This Plan
17
Tab 2 Risk Awareness

• General questions about risks the unit covered
  under this plan may be subject to, such as
• Has this Unit suffered a serious loss or
  disruption during the past 5 years?
• Does this Unit provide essential services or
  products to other University Departments?
  (purchasing, payroll, facility maintenance, etc.)
• Does this Unit maintain records essential to
  completing the mission of the University? (i.e.
  payroll, info tech, student serv) Do not include
  info maintained on the Banner System.

18
Tab 2 (continued)

• Additional questions such as
• Does this Unit utilize chemical or other
  hazardous materials to complete its educational
  research or maintenance purposes?
• Does this Unit process financial transactions,
  collect cash, or distribute payments in excess of
  1000 on a regular basis?

19
Tab 3 Assessing Unit Risk Probability and Impact
Probability of Occurrence some items have a
suggested minimum point already calculated.
Incidents with highest total calculated risk
should be the focus of your initial planning
efforts.
20
Tab 4 Critical Functions
Remember Critical functions are those
activities that are essential to the continued
accomplishment of the University mission.
A Critical function is an activity that must be
restarted and functioning within days after a
disaster occurs to enable teaching and research
to restart and function. EXAMPLES Classroom
instruction, Research, Payroll, Purchasing BE
VERY DISCRIMINATING! Visualize the Unit working
in temporary quarters with limited resources,
computers and other equipment. Which functions
MUST be completed?
21
Tab 4 Special Functions
Special functions are those functions a
particular Unit would not normally do but need to
be done in the event of a crisis.

• EXAMPLES
• Housing may be asked to provide
  isolation/quarantine facilities during an
  epidemic.
• Facilities may need to provide rapid facility
  inspections after a tornado.
• Health Insurance Office staff may be asked to
  assist with directing lines of people for triage.

22
Tab 4 Secondary Functions
Secondary, noncritical functions are activities
that should be restarted and functioning within
weeks after a disaster occurs to allow teaching,
research and administration to function
adequately.

• EXAMPLES Grade processing
• Admissions processing
• Financial reports processing

23
Tab 5 Critical Function Assessment
Brief description of this function
Titles and/or generic group names (VP
Administration, Senior Faculty)
24
Tab 5 Peak Periods and Dependencies
Identify periods of high activity by indicating
all months that the Unit expects high demand for
this function
What other Units or systems have to be
operational before this Unit can perform this
Function? What Units or systems will be
affected by failure of this function?
25
Tab 5 Critical/Special Function IMPACT to
University
If this function is not resumed quickly enough
following a disaster, which of the harmful
consequences might occur and when would they
occur?

• Potential Harmful
• Consequences (examples of those in list)
• Disruption of Teaching?
• Disruptions of research?
• Loss of students?
• Loss of faculty?
• Loss of staff?
• Reduced well- being of Students?

26
Tab 6 Critical/Special Function Key Staff
Identify each Critical/Special Functions Key
Staff. Envision this Unit 1-3 days after a major
disaster.
Identify the group of employees needed to PLAN
how to resume operations
27
Tab 6 Employees from Other Campus Units Vital
to this Function
What other campus units/staff members might this
Function need to contact within the first few
days after a disruption in order to plan how to
resume operations? Examples School of Nursing
may need to work with Scheduling to find
alternative classroom space to hold classes if
Gunter was destroyed in a tornado. Payroll may
need to work with IT to restore URSA access so
payroll can be processed.
28
Tab 6 NonUniversity Agencies, Vendors and Other
Organizations Vital to this Function
Who are the most important contacts for other
Non-University organizations that this Function
may need to contact within the first few days
after a disruption in order to plan how to resume
operations?
29
Tab 7 Continuity of Critical/Special Functions
Visualize the conditions that might exist in the
weeks or months following a disaster. List
ideas only, not detailed procedures. Provide
supporting documents if helpful or
necessary. Assume the University will resume
teaching, research and critical support functions
as soon as possible after a disasterregardless
of conditions. Assume key resources will NOT be
available such as

• Normally assigned space
• Staff members
• Certain equipment
• Access to Files
• Phone Service
• Network Access
• Access to other electronic data
• Access to other data
• Access to Vendors and Vendor Information

30
Tab 7 (continued)

• Things to consider include
• Would this Unit need to continue functioning
  if the Campus were closed?
• Can this unit perform this function with
  some/all staff working from home?
• If so, what equipment/supplies would be
  needed?
• How would this Unit carry out this Function if
  this Unit also lost ALL of its equipment?
• Show Stoppers Is there any resource thats
  so important that this Unit cannot restart its
  function without it?

31
Tab 8 Accessing Vital Records Supporting this
Unit/Function
Identify records vital to this Unit/Function. Lis
t records stored as individual documents in file
cabinets and/or stand-alone computers. Do not
list records stored by IT Services. Those will
be accounted for separately.
32
Tab 8 Software Applications and Systems
Supporting this Unit/Function
Identify software applications or systems that
support this Unit/Function.
Systems are where the software resides PCs,
McIntosh or Servers. DO NOT include servers
managed by IT, as they will be addressed later in
this section.
33
Tab 8 IT Servers Supporting this Unit/Function
Identify IT computer servers that support this
Unit/Function. NOTE Provide requested
information for each ITA Server used for this
Unit/Function.
This information is requested from and provided
by Information Technology
34
Tab 9 Restarting Data/Information and
Technology Systems
What will this Unit need to restart this Units
component? Assume this Units normal workplace
is destroyed or inaccessible. Assume new space,
furniture and Internet access have been provided
by others. This section may be completed for the
Unit as a Whole or separately for each
critical/special function. Examples of
Questions Where would this Unit quickly
purchase new workstations, services and other
hardware vital to this Unit/Function? Could
any of the IT requirements for this
Unit/Function be worked-around if necessary
by using paper forms, etc?
35
Tab 10 Communication Preparedness
Envision this Unit 1-3 days after a major
disaster. Identify the communication lists
necessary to contact employees and
students. Each Unit needs to keep its own list
of home and other contact information for
employees to be distributed as appropriate.
This list should be updated at least twice per
year. Examples of questions Who maintains
this Units/Functions faculty/staff emergency
home contact lists? Who maintains this
Units/Functions important e-mail address
lists? (describe) Who has the
ability/authorization to post messages on this
Units/Functions website?
36
Tab 11 Working from Home Preparedness
Many faculty/staff members could perform their
jobs (at least partially) from home. In this
section, list titles and current names of all
employees who complete significant work related
to EACH critical function.
Survey each employee to determine access to
adequate home computer resources for assisting
with the Critical Function should on-campus
computer access be lost during a crisis.
37
Tab 12 Action Plans
Most important part of the business continuity
plan. These are action items that can be
completed NOW to enable this Unit to recover in a
more timely manner should a disaster
occur. Action items are ideas, not
necessarily a commitment to act. BE
CREATIVE. Some of the Units action items may
outside of the Units direct responsibility
38
Tab 12 Critical Function Action Plan

• Items are brought forward from previous tabs to
  the Action Plan section.
• You will need to complete other information for
  each action item
• estimated cost
• one time or ongoing cost
• responsible person
• details
• status
• complete
• in process
• other
• THIS SECTION BECOMES THE TO DO LIST FOR YOUR
  UNIT OR OTHER UNITS

39
Tab 13 - Completion
Tab 13 Youve completed the Business Continuity
Template! Please keep a copy of the document for
your Units records.Forward the final copy
electronically to XXXXXXXXX_at_XXXXX.XXX
40
What happens once the business continuity
template is completed?

• As part of completing the business continuity
  plan, each unit will develop action items
• Once these items have been addressed, they will
  help your organization quickly resume operations
  after a major disruption
• Print it!
• Keep it up to date!
• Have available outside of your office / your
  office computer.

41

• ?

Questions
42

• The end

Contact Info Paul.Squillace_at_unco.edu George.Slack
_at_unco.edu