From Start to Finish: A Business Continuity Plan

1
From Start to Finish A Business Continuity Plan

• Katie Bechtel
• Business Continuity Analyst
• Secretary of States Office

2
Background

• Developed and tested the first draft of the
  Oregon Youth Authority BCP (July 2006-June 2007)
• Currently working at the Secretary of States
  Office
• We are about 1 year into the 2 year Project Plan
• We expect to start testing Spring 2009

3
The Process

• Step 1 Create Project Plan
• Step 2 Conduct Business Impact Analysis
• Step 3 Draft Business Continuity Plans
• Step 4 Complete BCP support work
• Step 5 Test and Exercise Plan

4
Step 1 Create Project Plan

• Decide how to organize your work
• OYA Around locations (Facilities, Field Offices,
  Central Office)
• SOS By Division
• By Critical Business Function
• Create a plan that outlines timelines, resources
  needed, expected participation
• Have project plan approved by Management Council
  or Steering Committee AND participating business
  sections

5
(No Transcript)
6
Step 2 Conduct Business Impact Analysis

• Goal Identify business processes, RTOs,
  associated computer systems, essential records,
  and dependencies

• Develop questionnaire and meet with business
  divisions to complete it
• Divisions then complete the Questionnaire
• Compile information into BIA Report
• This report will outline current recovery
  capabilities and detail ways to improve the
  situation (i.e. implement off-site data storage)
• Dont start a BCP until these problems have been
  addressed

7
Business Process Prioritization
8
Business Process Prioritization
9
Step 3 Draft Business Continuity Plans

• Use the templates! Why reinvent the wheel?
• The BIA Questionnaire will give you most of the
  information to complete the plans, but youll
  need the business section to review it and fill
  in blanks after a good draft

10
Checklist from Template
11
Big Checklist from Template
12
Step 4 Complete BCP Support Work

• IT Disaster Recovery Plan
• Crisis Management Teams
• Policy and Procedures
• BCP Activation and Control
• Maintenance Program

13
OYA Crisis Management Team Structure
14
Step 5 Test and Exercise Plans

• Table tops tests are a great way to familiarize
  your teams with the plan and make corrections
• Exercises force the execution of your plan
• These are used to test your plan as well as to
  train your teams

15
Findings from OYA Test 1 March 29, 2007

• The initial meeting site for the Executive Lead
  Team was made consistent with building
  evacuations
• A server had been replaced and relocated since
  the first draft of the Plan
• An IT staff member was added to the Public
  Information team to update the agency website
• The role of coordinating the physical relocation
  of salvageable equipment and supplies was
  delegated to the Facility Manager

16
Findings from OYA Test 2April 27, 2007

• OYA staff are unaware of the existing Emergency
  Exit Strategy
• Loss of power, and therefore lighting, may hinder
  evacuation
• Preliminary space planning at the Alt. Site will
  speed transition
• Critical phone lines should be identified
• Each BCP team should document decisions and
  actions

17
The Process

• Step 1 Create Project Plan
• Step 2 Conduct Business Impact Analysis
• Step 3 Draft Business Continuity Plans
• Step 4 Complete BCP support work
• Step 5 Test and Exercise Plan

18
Templates or Completed Examples

• Project Plan and Dashboard
• BIA Questionnaire
• BIA Report
• BCP
• BCP Crisis Management Teams
• Test Scenarios
• Test Reports