Development and Implementation of Contingency Plans for Small

1
Development and Implementationof Contingency
Plans for Small Medium Size Companies
Al Berman SVP National Practice Leader
2
The Challenge

• Creating Effective Business Continuity Plans(BCP)
  For Small to Medium Sized Companies
• Reacting Safely to Emergency Situations
• Defining Recovery Needs
• Resources
• Time
• Data
• Implementing Cost Effective Strategies
• Testing
• Maintenance

3
The Differentiator

• Limited Resources
• Staff
• Time
• Budget
• Limited Experience

4
Relative Impacts
Smaller Companies Suffer Greater Impacts from
Disasters of Similar Size Than Do Larger Companies
n
Impacts
n
0
Company Size
5
Start At The Top

• Ensure That There Are Clearly Defined Corporate
  Recovery Objectives
• Levels Playing Field for Recovery Sequence
  Resources
• Governance for Cost-Effective Recovery
• Create Effective BCP Organization
• Technology
• Business
• Support
• Well Defined Incident/Crisis Management Model
• Evacuation
• Assembly Points (Primary and Alternate)

6
Defining the Needs - Stay Focused

• Risk Assessment vs. BCP
• Cause vs. Effect
• Risk Assessment - Reducing Causal Implications
• Identifies Risk (Facility, Environmental,
  Climatic, Geopolitical, Personnel, Business,
  Technology, etc)
• Recommends Mitigation
• Probability
• Cost of Mitigation
• BCP - Deals with Effects
• What are the Implications of failing to mitigate
  or prevent
• Preparation
• Structure, planning, resources, testing
• Execution
• Relocation, operating under duress

7
Defining the Needs - BIA

• Business Impact Analysis (BIA) Questionnaires
• Recovery Time Objectives (RTOs)
• How Soon Do I Have To Be Back In Business
• Resources
• Facilities, Equipment, Technology, Supply Chain
• IT Recovery Plans
• Business Relocation Plans
• Manual Workaround Processes
• Data Restoration Processes

8
Defining the Needs - BIA

• Dependencies
• Internal
• External Supply Chain - Products, Services
  Technology
• Third Party (Outsourced)
• Provides for End-To-End Recovery

9
Defining the Gaps

• Resource Gaps - Difference Between BIA Resource
  Requirements and Actual Available Resources.
• Time Gaps - Difference Between Recovery Time
  Objective and Actual Demonstrable Recovery Time
• Data/information Gaps - The Amount of Data That
  Is Lost When IT Restores Systems From Backups.

10
Closing The Gaps - Strategies

• Two Types of Costs
• Preparation
• Costs Incurred Whether or Not A Disaster Occurs
• Hot Site Subscriptions
• Dedicated Sites
• Spare Equipment
• Conditioning Conference Rooms
• Execution
• Costs Incurred in Responding to a Disaster
• New Equipment (drop shipped)
• Temporary Facilities
• Travel, Lodging, etc.
• May Be Covered By Extra Expense Insurance

11
Closing The Gaps - Strategies

• Lessening the Cost Burden
• Seek Internal Solutions - Relocation
• Other Company Sites
• Displacement Strategy
• Disperse Personnel
• Centralize Communications
• Key Vendor Sites (Best Effort)
• Outside Counsel
• Bank
• Audit Firm
• Insurance Broker
• Hardware/Software Suppliers

12
Closing The Gaps - Strategies

• Lessening the Cost Burden - Continued
• Seek Internal Solutions - IT
• Data Backup
• LAN/PC
• Combine with
• Drop Ship from Vendors (lower subscription cost)
• Rental of PC/Servers
• Removable Disks
• CD-ROM's
• CHALLENGE IS TO MAINTAIN DILLIGENCE AND CONTROL

13
Closing The Gaps - Strategies

• Remember
• 1/T
• The Faster the Recovery Resources Are Required,
  the More Expensive the Recovery Becomes
• Deferment Reduces Cost
• Prioritize
• Customers
• Products and/or Services
• Analysis (Not BCP Software) Saves Money
• Provides Information To Allow for Cost-Effective
  Decisions
• Allows for Cost Effective Insurance Coverage

14
Testing

• Types of Tests
• Action
• Walkthrough
• Mobilization
• Execution - Difficult in a Manufacturing
  Environment
• Extent
• Element
• Component
• Process
• Test Scripts
• A Disaster is A Terrible Time to Test Your Plan
  (because it wont work and its too late to find
  out)

15
Maintenance

• Maintenance Management Strategy
• Centralized Monitoring
• Maintain Control of Standards
• Access all Plans and Components
• Monitor Maintenance
• Decentralized Creation and Maintenance
• Update
• Tasks
• Resources
• Personnel

16
Maintenance - Toolkit

• Utilize Microsoft Suite
• Excel
• MSWord
• Reduces need to invest in specialized BCP
  software
• Reduces need for special software training and
  maintenance
• Reduces need for Help-Desk function of BCP staff

17

• Thank You