Business Continuity Steven S. Keleman, CPM

Emergency Management Prevention Response Preparation Mitigation Recovery

Preparation Policies / Procedures Emergency Operations Plans Department Operations Plans Incident Action Plans

Objectives of COOP Planning Ensure continued performance of essential functions and operations. – Reduce loss of life. – Minimize damage and losses. – Ensure successful succession.

Objectives of COOP Planning – Reduce or mitigate disruptions. – Ensure the provision of alternate facilities. – Protect agency assets.

Continuity of Operations, National Security Presidential Directive 51 Homeland Security Presidential Directive-20 (NSPD-51/HSPD-20) National Continuity Policy Implementation Plan (NCPIP), is an effort within individual departments and agencies to ensure that Primary Mission Essential Functions (PMEFs) continue to be performed during a wide range of emergencies, including localized acts of nature, accidents and technological or attack- related emergencies.

Elements of Viable Continuity Capability The Continuity Plan is the roadmap for the implementation and management of the Continuity Program The Continuity Plan is the roadmap for the implementation and management of the Continuity Program

Essential Functions – functions that are determined to be critical activities Essential Functions – functions that are determined to be critical activities Orders of Succession – who assumes the authority and responsibility (incapacitated) Orders of Succession – who assumes the authority and responsibility (incapacitated) Delegations of Authority – who has the right to make key decisions during a continuity situation Delegations of Authority – who has the right to make key decisions during a continuity situation Continuity Facilities –Essential Functions in a threat-free environment. Continuity Facilities –Essential Functions in a threat-free environment.

Continuity Communications – availability and redundancy of critical communications systems Continuity Communications – availability and redundancy of critical communications systems Vital Records Management – identification, protection and ready availability of electronic and hard copy documents Vital Records Management – identification, protection and ready availability of electronic and hard copy documents Human Capital – guidance to emergency employees and other special categories of employees (Declare Campus Wide Emergency) Human Capital – guidance to emergency employees and other special categories of employees (Declare Campus Wide Emergency)

Tests, Training, and Exercises (TT&E) – identification, training, and preparedness of personnel capable of relocating to alternate facilities Tests, Training, and Exercises (TT&E) – identification, training, and preparedness of personnel capable of relocating to alternate facilities Devolution of Control and Direction – capability to transfer statutory authority and responsibility for essential functions. Devolution of Control and Direction – capability to transfer statutory authority and responsibility for essential functions. Agency’s and organization’s primary operating staff and facilities to other agency and organization employees and facilities

Back in Business Reconstitution – the process by which surviving and/or replacement agency and organizational personnel resume normal agency operations from the original or replacement primary operating facility. Reconstitution – the process by which surviving and/or replacement agency and organizational personnel resume normal agency operations from the original or replacement primary operating facility.

Know your Operations All Hazards All Hazards Department Business Functions / processes Department Business Functions / processes Items of Significance Items of Significance Critical operations Critical operations Essential personnel Essential personnel List dependencies List dependencies  Internal  External (Domino effect) Financial Transactions Financial Transactions Contingencies in place? Contingencies in place?

Assess IT / Data Needs Critical Technology Vulnerability to disaster Accessibility Network Security / Data Security Relocation site – test plan

Sandy IT Issues Locking of doors for academic Buildings Freezers and experiments Data networks / / VOIP – loss (reduced ways of communicating) Communications – Cell Carriers – reduce data on systems – cell towers on generators running out of fuel Newark campus phone systems down

Develop the plan Facility and infrastructure requirements (data connections, wattage requirements, space) by person; by location; by overall needs Equipment list (hardware, software, specialty equipment, phones, faxes, etc.) Minimum supplies lists (office, lab, production materials, etc.) Off-site storage materials Vital records lists –The list should include records necessary to support resumption of services and disaster recovery documentation (mutual aid agreements, memo of understanding for services & Products, and contracts) Include procedures and checklists to reference during recovery Other information as needed

Think outside the box Lecture Via the internet Third party platform Limits to University Network

Communicate Provide access to the plan (paper and electronic) to appropriate personnel Inform team leaders of responsibilities Inform employees of existing University protocols including emergency response, evacuation and shelter-in-place procedures

Coordinate with external departments/units Inform other University departments/unit of your dependency Request coordination and understanding of their BCP Ensure that external departments can meet the needs based on your recovery and resumption plans (including turn-around time, physical needs and supplies, etc.)

Test Test the newly developed plan upon completion and on an annual basis. Validation provides training and the best assessment of the plans viability. Examples include tabletops, notification drills, simulations, full rehearsal, etc. Evaluate test outcomes a nd incorporate "lessons learned"

Maintaining the plan Keep the plan current through periodic review and updates. Assign responsibility for periodic review. Update plan for major changes in the department such as changes in services, location, or organization structure. Ensure appropriate personnel review and approve plan updates. Include the BCC and Department Head within the review and approval process Communicate plan changes to affected personnel Store plans in a manner that allows access by BCC, alternate and other key personnel if the department's facility or network is NOT available. The manner in which business continuity plans are stored should reflect the sensitivity of the data the plans contain (Location of vital records, personal data, etc.)

Recommendations

Perform an operational review. Take the time to perform an assessment of your department’s critical operations and identify key resources to support the maintenance of those areas that require minimal to no disruption. Categorize basic operational needs (power, water, personnel, fuel, etc.) that you will require in order to function. Determine if your department’s ability to perform operations will have an impact on health and/or safety.

Be familiar with the University’s Emergency Action Plan(s). The University’s Emergency Action Plan(s) are available online. Please visit emergency.rutgers.edu for this and other valuable information.emergency.rutgers.edu

Have a communications plan and share that plan with relevant parties. Reliance on one form of communication may limit or completely disable your ability to impart essential information to students, staff and other members of the University community. Ensure that your plan is accessible in the event of a loss of power or network connectivity. Create a phone tree for your unit and have paper copies available.

Plan for the possible disruption of IT resources. During severe weather conditions you should be prepared for loss of network connectivity, access to electronic data/files, phone service, etc. Create a plan to be able to have data/files available remotely (if possible and permissible) via an external hard drive, alternate workspace, and/or use of cloud technology. In the event VoIP phones are not functioning, landlines (such as those used for fax machines) may serve as an alternative.

Prepare for the resumption of operations. Determine what actions are reasonable and practical to take before, during and after the storm/event to ensure a timely recommencement of services. Assess damages (if any) and report those damages to the appropriate party (Facilities, Public Safety, etc.). Utilize previously identified alternate work locations if necessary and available.