business continuity Disaster Recovery RESILIENCE PLANNING Incident Mgt. COOP Crisis Mgt. preparedness management EMERGENCY MGT. I NCIDENT R ESPONSE C ONTINGENCY PLANNING

KNOW YOUR ROLE IN CONTINGENCY PLANNING / DISASTER RECOVERY AZ ARMA CHAPTER April 19, 2012 Monique Hafler Katherine Jonelis

1. Overview of BCP 2. Contingency Planning/BCP 3. Recovery Planning 4. Business Impact Analysis (BIA) 5. Vital Records Protection

 Disaster Recovery OR Business Continuity?

 Phases

 Contingency Planning –  Strategy to minimize the effect of disturbances and to allow for timely resumption of activities for an organization.  Often combines several different sub- plans providing detailed instructions regarding how to conduct the company in the face of several different emergency situations.

 Contingency Planning –  Focuses on continuing operations in the face of some sort of natural disaster, man-made, security violation, intentional or accidental disruption that affects normal operations.  Examples from SCF Arizona and Central AZ Project

 Disaster -  Sudden, unplanned calamitous event  Makes it impossible to perform functions for some period of time

 Disaster -  Types:  Class 1 – Most severe  Class 2 – Local/regional affect  Class 3 – Major destruction during work hours  Class 4 – Destruction off hours  Class 5 – 1 or 2 functions affected  Class 6 – Sub function affected  Class 7 – Lost document

 Disaster Recovery Planning -  Advance planning & preparation  Minimize loss  Ensure continuity of critical business functions

 Recovery – “When the smoke clears and the waters recede”  Recovery Checklist  Annually – Confirm vendor agreements  Benefit of a RIM and Retention program

 Business Impact Analysis (BIA)

 Business Impact Analysis (BIA) -  Evaluate critical operations for the organization and determine resources needed to run them.  Basis for management to make strategic decisions about recovery.  Crucial to know exactly where all critical information resides and to plan for its recovery should the need arise.

 Business Impact Analysis (BIA) -  Recovery Time Objective:  Period of time within which systems, applications, or functions must be recovered after an outage.  Recovery Point Objective:  Point in time to which systems and data must be recovered after an outage.

 Vital Records Protection Program–  Ensures continued viability  Can resume operations quickly  Re-establishes financial and legal status  Fulfills obligations  ID’s records needed immediately following a disaster  2-8% are Vital

 Vital Records Protection Program–  What does it Include?  Start with Inventory  Define & Identify Priority  After disaster, records needed may not be same as organizational vital records

 Vital Records Protection Program–  Common Vital Records after Disaster:  Emergency Plans & Directives  Delegation of Authority  Building Plans & building system operation manuals  Emergency Staffing Assignments

 Vital Records Protection Program–  Protection Methods  Fire-resistant safes or cabinets  Vaults  Duplication  Cloud  Microfilm or Digital copies

 Vital Records Protection Program–  Electronic Protection Methods  Magnetic Back Up Tape  Electronic Vaulting  Mirroring – Redundancy  Hot Site – Warm Site – Cold Site

 Resources –  Records Emergency Planning and Response Webinar – FEMA,  Association of Contingency Planners – AZ Chapter,  Disaster Resource Guide,  NFPA 232, Standard for the Protection of Records – NFPA,  Vital Records & Business Continuity – ARMA, Online courses  BCP Seminar - AIIM, March 2003 Presentations, ChapterID=20&WebArticleID= ChapterID=20&WebArticleID=26308

 Contact Information:  Monique Hafler, Central AZ Project  Katherine Jonelis, SCF Arizona