Business Continuity Planning for a small organization

1
Business Continuity Planning for a small
organization

• Lynn Beaton and Katie Bechtel
• April 1, 2009

2
Agenda

• BCP 101 for a small board
• Statewide policy still applies boards need to
  have a business continuity plan by June 30, 2009
• However, most smaller agencies and boards will
  have a simpler process, because you will
  generally have fewer services to restore

3
What do you need to do?

• First Identify your Critical Business Functions
  (CBFs)
• Second Document your functions
• Third Identify your Recovery Time Objectives
  (RTOs)
• Fourth Develop recovery procedures

4
Essentially, ask yourself these questions

• What do you do?
• How long can you go without doing it?
• What steps would you take to bring back your
  functions?

5
First What are your Critical Business Functions?

• Definition
• Business functions or information that could not
  be interrupted or unavailable for one month or
  less without significantly jeopardizing the
  mission of the agency, and the health, welfare or
  safety of Oregonians.
• Your BCP should restore those functions you
  identify as critical to your organization

6
Second Document those functions

• Statutory requirements
• Processes that support your functions
• Associated computer systems
• Essential records
• Key staff
• Dependencies
• Vendors
• Required Office Equipment

7
Third Identify Recovery Time Objectives

• This is the point at which your functions must be
  recovered in order to
• Comply with statutory requirements
• Maintain needed revenue or
• Protect the health and welfare of the public.
• Ask yourself What is the maximum amount of time
  your function can be down?
• Dont make this goal as short as possible give
  yourself as much time as you can.

8
Fourth Develop Recovery Procedures

• These are the steps your organization would take
  to recover your functions
• Just use common sense to identify these steps!
• Ask another staff person to review the steps to
  ensure that they are clear.

9
Recovery Steps

• For example
• Step 1 Ensure staff and public safety
• Step 2 Assess the situation
• Step 3 Notify staff, commissioners, etc.
• Step 4 Activate BCP
• Step 5 BCP Recovery Team meets at alternate site
• Step 6 Staff relocates to alternate site

10
Testing Requirements

• By June 30, 2009
• Desk Check Testing for all critical business
  functions
• By December 2009
• Tabletop Tests for all critical business functions

11
Reminders

• Website
• http//www.oregon.gov/das/eispd/bcp
• Next Meeting
• Tuesday, June 2nd, 9-1130am
• LI Building, Room 260

12
Contact us

• Lynn Beaton
• Manager, Enterprise BCP Program
• [phone]
• lynn.beaton_at_state.or.us
• Katie Bechtel
• Planner, Enterprise BCP Program
• [phone]
• katie.bechtel_at_state.or.us
• http//www.oregon.gov/das/eispd/bcp