Business Continuity Disaster Planning Karen L. Green, CBCP, CBRM State of California Department of Child Support Services “Supporting California’s Children” Child Support Directors Association 2007 Annual Child Support Training Conference and Expo September 20, 2007 Anaheim, California

Where do you begin? * COOP/COG PLAN Emergency Response Plan Pandemic Response Plan Disaster Recovery Plan Incident Management Plan Business Resumption Plans Crisis Communication Plan Operational Recovery Plan * COOP/COG – Continuity of Operations/Continuity of Government

Map or Process?

Business Continuity Management Program (BCMP) Ongoing management and governance process supported by senior management Identifies the impact of potential losses Identifies what you do to reduce risk before an event Identifies process for responding during an event Identifies what you do to recover after an event

BCM Program Purpose Protect Staff Organization Operations Vital Records and Information Physical Structures

BCM Program Objectives Reduce potential effects of a disaster Look at every part of the organization Include every function Define the critical impact areas of the organization Prioritizing critical functions Identifying key players in the organization Identifying alternative working sites Identify areas of the organization that are more critical based upon how they perform: Their processes Their function Their services

BCM Program Goals To create a well defined program structure that consist of: Useable plans Regularly scheduled updates Regularly scheduled exercises Employee awareness and training programs Satisfy federal, state and other statutory requirements to provide for the continuity of operation

BCM Program Elements Business Continuity Management Program Risk Management Facilities Management Technology Management Project Management Change Management & Crisis Communications Incident Management Business Resumption Emergency Response Safety and Security Disaster Recovery

Business Continuity Management Planning Process Project Management & Planning Business Impact Analysis Strategy Development Plan Development Awareness & Training Testing & Exercising Maintenance & Updating Risk Assessment & Analysis The Plan Business Continuity Management Planning Process

DRII Professional Practices 1. Project Initiation and Management 2. Risk Evaluation and Control 3. Business Impact Analysis 4. Developing Business Continuity Strategies 5. Emergency Response and Operations 6. Developing and Implementing Business Continuity Plans 7. Awareness and Training Programs 8. Maintaining and Exercising Business Continuity Plans 9. Crisis Communications 10. Coordination with External Agencies http://www.drii.org/DRII/ProfessionalPractices/about_professional.aspx

CA DCSS BCM Program Plan Components

Where do you start? Assessment of current Plans in organization Identify and create key missing pieces such as: Incident Management Plan Crisis Communication Plan Divisional/Branch Business Resumption Plans Emergency Response Plans Operational Recovery Plans COOP/COG Plan Staff Training Exercises – Simulation, Tabletop, Operational, and Mock Disaster Testing (Systems and Applications) – Integrated, Operational, Structured Walkthrough, and Standalone

Incident Management Plan Organized and centralized approach that allows for: Control Coordination Communication Collaboration Defines and documents how an organization will respond to a disaster or major business outages Defines Leadership / Command and Control based on ICS model Identifies the Emergency Operations Center (EOC) Is a physical location for the Incident Management Team (IMT) to manage disaster response Pre-defines roles and responsibilities of the IMT at the EOC Identifies the Incident Commander who - Manages the Event Provides direction and leadership Makes decisions with strategic guidance from Executive Staff and reports status Coordinates resumption of critical business processes

Crisis Communication Plan Outlines process and procedures for effective timely release of information during a disaster or incident that exhibits: Control Concern Clarity Confidence To stakeholders i.e.. employees, public, and media

Business Resumption Plans Resume Critical Business Processes Plans are business process / unit specific and focus on: People Processes Resources Technology What’s in the Plans? Activation / Notification Procedures Phone trees / contact lists Business process prioritization Mitigation / workaround strategies / recovery tasks Teams / Tasks / Procedures Vital Records – Anything needed to continue the critical business processes

Emergency Response Plans Life / Safety Evacuation Plans Response Procedures Damage Assessment Assess Infrastructure Damage Measure Impact to Business Facilities Management Mitigation Loss / Prevention

Operational Recovery Plan Strategy for managing the recovery of critical Information Technology (IT) systems and sub-systems IT infrastructure applications software hardware

Continuity of Operations/COOP Continuity of Government/COG COOP – the federal planning concept that focus on government’s ability to continue essential functions during a wide range of potential emergencies. COG – the preservation, maintenance, or reconstitution of civil government’s ability to carry out its constitutional responsibilities. Emergency Response Plan COOP/COG Elements Disaster Recovery Plan Operational Recovery Plan Pandemic Response Plan Succession Plan Crisis Communication Plan Business Resumption Plans Incident Management Plan

What if ? You don’t have staffing resources You don’t have budget resources

Minimum Options Create a Recovery Plan Identify critical applications/systems Identify critical software and hardware Priorities applications, systems ,SW,HW Identify key staff needed to recovery critical applications, systems, SW, HW Create a Data Backup plan Store Data at off-site secure facility

Conclusions Agencies must be willing to provide executive level support for Business Continuity Management Program Agencies resources needed for BCM program staffing Agencies must exercise due diligence in developing business resumption/continuity plans, and coordinate those plans with other state agencies where dependencies exist Agencies should continue with enterprise Business Continuity Programs to ensure the following issues are addressed: Business and system interruptions Data protections and restoration capabilities Alternate facilities and equipment replacement plans Succession Plan for internal management and authority A formal testing program

Child Support Services Questions Karen L. Green, CBCP, CBRM Business Continuity Officer State of California Department of Child Support Services (916)646-5736 karen.green@dcss.ca.gov