Developing Continuity Plans: The VDEM Model David S. Calkins Virginia Department of Emergency Management 13 June 2013

Elements of Continuity Planning Mission Essential Functions Primary Business Functions Orders of Succession Delegations of Authority Alternate Facilities Essential Records, Systems, and Equipment Business Process Analyses

Identifying Mission Essential Functions What are Mission Essential Functions (MEFs)? The limited set of an organization’s functions that must be continued throughout, or resumed rapidly after, a disruption of normal operations. How do we begin to identify MEFs? Consider the following about your organization: Mission Purpose Goods and services provided to the public or to another organization MEFs are very high level and cannot be deferred during an emergency or disaster. Describe the number of functions identified for VDEM (around 132) by looking at the Code of Virginia, the VDEM Strategic Plan, and the VDEM Mission Statement. Prepare the class for the Functions Categorization activity.

Activity: Categorizing Functions An agency’s functions can be: Mission Non-mission Essential Non-essential Using the Easel Chart and marker (this should already be prepared), duplicate Figure A-4, Functions Categorization Model Worksheet on page A-5 of CGC-2. Have the class suggest functions of a local fire department and determine whether they are mission, non-mission, essential, or non-essential. Image Source: richmondgov.com

Primary Business Functions (PBFs) Many of the functions you identify will be Primary Business Functions (PBFs). PBFs are specific supporting activities that an organization must conduct in order to perform its MEFs. PBFs are typically enablers that make it possible for an organization to perform its mission. How do we distinguish between a MEF and a PBF?

Mission Essential Functions (MEFs) vs Mission Essential Functions (MEFs) vs. Primary Business Functions (PBFs) A Mission Essential Function (MEF)… Is something unique that the agency does. Is a product or service provided to the public or to another agency. Usually (but not always) supports one or more Commonwealth Essential Functions (CEFs). A Primary Business Function (PBF)… Is typically something that all agencies do, such as IT, Payroll, Human Resources, etc. A product or service that is provided to one branch or division by another within the same agency. Always supports one or more of the agency’s MEFs. A Primary Business Function will be anything that didn’t fall into the category of Mission Essential during the activity.

Conducting a Business Process Analysis 9 Steps to complete the Business Process Analysis: Identify MEF/PBF output. Identify input requirements. Identify leadership who perform and/or oversee the performance of the MEF/PBF. Identify staff who perform and support the MEF/PBF. 1. “MEF and/or PBF Output includes a list of the products and services that are produced or delivered to external partners or constituents. Performance measures, such as time and quantity, should be included if possible. For example, VDEM is tasked by the Code of Virginia to maintain a register of shippers of hazardous materials within the Commonwealth. This register is a product that can be delivered to law enforcement, first responders, or the Governor’s office.” Ask the class to provide other examples of MEFs or PBFs. “MEF and/or PBF Input should include the information, authorizations, supplies, and services required to perform the MEF or PBF. A brief description of how each input supports the overall process should be included.” Ask the class to provide examples of inputs that support the MEF/PBF outputs they described earlier. Leadership: “List the key senior leaders (by position or title) who are required to participate directly in the performance of the MEF or PBF.” Give some examples. Staff: “List the staff needed to accomplish the MEF (this includes the staff required for the PBFs that support the MEF) or PBF. Requirements for multiple shifts, back up personnel, certifications, and qualifications should be identified. Use position titles or capabilities instead of names.” Ask the class to provide some examples.

Conducting a Business Process Analysis 9 Steps to complete the Business Process Analysis (…cont.): Identify communications and information technology (IT) requirements. Identify facilities requirements. Identify resources and budgeting requirements. Identify partners and interdependencies. Describe process flow. 5. Communications and IT: “List general and unique communications and IT requirements. Use Tables C-1 and C-2 to assist you in identifying these requirements. It may also be a good idea to include IT staff when completing this section of the BPA.” 6. Identify facilities requirements: “What are the facility requirements for performing the function? Your agency, key personnel, or the function itself may have unique space, capacity, access, equipment, and support requirements.” 7. Identify resources and budgeting requirements: “Which supplies, services, capabilities (not already addressed) are required to perform the MEF or PBF? What are the funding sources?” 8. Partners and Interdependencies: “Who are the internal/external organizations that support/ensure MEF or PBF performance, and what information, supplies, equipment, or products do they provide? Are contingency plans in place for disruptions of normal operations? Are your agency’s partners aware of your dependency on their goods and services during a continuity event?” 9. Process Details: “This is the bread and butter of the BPA. This describes how the MEF or PBF is performed from start to finish. This will allow personnel who have not been cross-trained to understand what is expected of them should they be tasked with performing this MEF or PBF. Because this is an all-hazards plan, the narrative or diagram should describe the MEF as the agency performs it daily. Reference the Manual Workaround Worksheet or Phase 3: Continuity Operations for procedures involving alternate facilities or downed networks, servers, equipment, etc.”

Business Process Analysis Step 1: Identify MEF/PBF Output. List all products and services that are produced or delivered to external partners or constituents under this MEF/PBF. Include performance measures, such as time and quantity. Step 2: Identify input requirements. Information, authorizations, supplies, and services required to perform the MEF/PBF. Write a brief description of each.

Business Process Analysis Step 3: Identify leadership who perform and/or oversee the performance of the MEF/PBF. List key senior leaders. Use position titles. Step 4: Identify staff who perform or support the MEF/PBF. Multiple Shift requirements Cross-trained personnel Authorities Qualifications Certifications

Business Process Analysis Step 5: Identify communications and information technology (IT) requirements. Software Equipment Systems Networks Step 6: Identify facilities requirements. Office space Industrial capacity Supporting critical infrastructure

Business Process Analysis Step 7: Identify resources and budgeting requirements. Supplies, services, and capabilities not already addressed Funding sources Grant applications Step 8: Identify partners and interdependencies. Internal/external Private sector MOUs and MOAs

Business Process Analysis Step 9: Describe Process Flow. A detailed narrative or diagram For a MEF, list the Primary Business Functions that support it. For a PBF, list the tasks and processes that support it. Reference SOPs, manuals, training materials, etc.

Exercising Your Continuity Plan Use an escalating exercise program Develop an After Action Report (AAR) and Improvement Matrix HSEEP recommends an escalating exercise program, over, for example, a period of five years. During that time, an organization should conduct: A tabletop exercise A drill A semi-functional exercise A full-scale functional exercise AARs should be conducted following each exercise or continuity plan activation

Activity: Tabletop Exercise Scenario: Hurricane force winds have caused significant damage to the area overnight. The power in your primary facility is out (and is expected to remain out for at least 48 hours) and roads are impassible. Image Source: WTOP 103.5 FM

Activity: Tabletop Exercise Instructions: While considering the mission essential functions (MEFs) and primary business functions (PBFs) you identified for your organization, describe which functions you would perform during this scenario and how you would perform them.

Thank you. Are there any questions? David S. Calkins Virginia Department of Emergency Management david.calkins@vdem.virginia.gov