HUIT Business Continuity December 20, 2016

Types of Crises Type Definition Examples University (non-IT) Significant risk to life and safety. Severe weather Active shooter Pandemic IT Substantial disruption to critical business and academic operations. PeopleSoft unavailable for payroll Major email outage University-wide DNS outage IT Security Severe compromise of university data/systems and privacy. DDOS attack Accounts hacked on large-scale Any type may also pose a threat to the university’s reputation.

The Big Picture Crisis Process Containment Business Continuity People Space Technology Physical Assets Recovery & Resolution Disaster Recovery Overall coordination of organizational response to minimize damage Plan and response to continue business operations at acceptable predefined level Recovery or continuation of infrastructure, systems, and applications vital to organization

HUIT Areas of Focus Business Continuity: Managing our own organization during a crisis Impact Analysis Plan Development Emergency Planning Disaster Recovery: Bringing back our services during/after a crisis Critical Services Analysis Testing

HUIT’s Role: Business Continuity (BC) vs. Disaster Recovery (DR) Crisis Type HUIT Response Other Departments’ Response HUIT Role University BC How does everyone continue business operations? IT BC/DR If applicable, what alternative (e.g., email system) does HUIT provide? How does HUIT recover the affected service? IT Security DR How does HUIT remediate the issue?

Harvard Emergency Management: Business Continuity Approach Impact Analysis Fall\/Winter 2016/2017 Business Continuity Planning Spring 2017 Emergency Planning Summer 2017

Business Continuity Planning Two Phases for FY17 Phase 1: Impact Analysis (3-4 months) Determine key departments/lead BC planners Review department functions Add functions to Fusion and score them Map dependencies Phase 2: Plan development (3-4 months) Update general information Create teams Customize procedures and steps

Business Continuity System: Fusion Procedure-based Plans Criticality assessment Function risk ranking (e.g., mission, financial, reputational) Impact analysis

HUIT Approach Goal Impact assessments and BC plans for all HUIT departments in Fusion Next Steps Pre-populate HUIT Departments and underlying functions based on service catalog (or organizational structure, e.g., Administration) Enables other CADM departments to identify dependencies on HUIT services (vs. making up their own) Validate and target key services (primarily categories) initially: IT Provider Services (includes IAM) Information Security Email and Calendars / Collaboration Services Identify point people Conduct impact assessment for these services/groups In partnership with Harvard Emergency Management