1. Business Continuity Disaster Planning
Karen L. Green, CBCP, CBRM
State of California
Department of
Child Support Services
“Supporting California’s Children”
Child Support Directors Association
2007 Annual Child Support Training
Conference and Expo
September 20, 2007
Anaheim, California

2. Where do you begin? * COOP/COG PLAN Emergency Response Plan
Pandemic Response
Plan
Disaster Recovery Plan
Incident Management Plan
Business Resumption Plans
Crisis Communication Plan
Operational Recovery
Plan
* COOP/COG – Continuity of Operations/Continuity of Government

3. Map or Process?

4. Business Continuity Management Program (BCMP)
Ongoing management and governance process supported by senior management
Identifies the impact of potential losses
Identifies what you do to reduce risk before an event
Identifies process for responding during an event
Identifies what you do to recover after an event

5. BCM Program Purpose Protect Staff Organization Operations
Vital Records and Information
Physical Structures

6. BCM Program Objectives
Reduce potential effects of a disaster
Look at every part of the organization
Include every function
Define the critical impact areas of the organization
Prioritizing critical functions
Identifying key players in the organization
Identifying alternative working sites
Identify areas of the organization that are more critical based upon how they perform:
Their processes
Their function
Their services

7. BCM Program Goals
To create a well defined program structure that consist of:
Useable plans
Regularly scheduled updates
Regularly scheduled exercises
Employee awareness and training programs
Satisfy federal, state and other statutory requirements to provide for the continuity of operation

8. BCM Program Elements Business Continuity Management Program
Risk Management
Facilities Management
Technology Management
Project Management
Change Management
& Crisis Communications
Incident Management
Business Resumption
Emergency Response
Safety and Security
Disaster Recovery

9. Business Continuity Management Planning Process
Project
Management & Planning
Business Impact Analysis
Strategy Development
Plan Development
Awareness & Training
Testing & Exercising
Maintenance & Updating
Risk Assessment & Analysis
The Plan
Business Continuity Management Planning Process

10. DRII Professional Practices
1. Project Initiation and Management
2. Risk Evaluation and Control
3. Business Impact Analysis
4. Developing Business Continuity Strategies
5. Emergency Response and Operations
6. Developing and Implementing Business Continuity Plans
7. Awareness and Training Programs
8. Maintaining and Exercising Business Continuity Plans
9. Crisis Communications
10. Coordination with External Agencies

11. CA DCSS BCM Program Plan Components

12. Where do you start? Assessment of current Plans in organization
Identify and create key missing pieces such as:
Incident Management Plan
Crisis Communication Plan
Divisional/Branch Business Resumption Plans
Emergency Response Plans
Operational Recovery Plans
COOP/COG Plan
Staff Training
Exercises – Simulation, Tabletop, Operational, and Mock Disaster
Testing (Systems and Applications) – Integrated, Operational, Structured Walkthrough, and Standalone

13. Incident Management Plan
Organized and centralized approach that allows for:
Control
Coordination
Communication
Collaboration
Defines and documents how an organization will respond to a disaster or major business outages
Defines Leadership / Command and Control based on ICS model
Identifies the Emergency Operations Center (EOC)
Is a physical location for the Incident Management Team (IMT) to manage disaster response
Pre-defines roles and responsibilities of the IMT at the EOC
Identifies the Incident Commander who - Manages the Event
Provides direction and leadership
Makes decisions with strategic guidance from Executive Staff and reports status
Coordinates resumption of critical business processes

14. Crisis Communication Plan
Outlines process and procedures for effective timely release of information during a disaster or incident that exhibits:
Control
Concern
Clarity
Confidence
To stakeholders i.e..
employees, public, and media

15. Business Resumption Plans
Resume Critical Business Processes
Plans are business process / unit specific and focus on:
People
Processes
Resources
Technology
What’s in the Plans?
Activation / Notification Procedures
Phone trees / contact lists
Business process prioritization
Mitigation / workaround strategies / recovery tasks
Teams / Tasks / Procedures
Vital Records – Anything needed to continue the critical business processes

16. Emergency Response Plans
Life / Safety
Evacuation Plans
Response Procedures
Damage Assessment
Assess Infrastructure Damage
Measure Impact to Business
Facilities Management
Mitigation
Loss / Prevention

17. Operational Recovery Plan
Strategy for managing the recovery of critical Information Technology (IT)
systems and sub-systems
IT infrastructure
applications
software
hardware

18. Continuity of Operations/COOP Continuity of Government/COG
COOP – the federal planning concept that focus on government’s ability to continue essential functions during a wide range of potential emergencies.
COG – the preservation, maintenance, or reconstitution of civil government’s ability to carry out its constitutional responsibilities.
Emergency Response
Plan
COOP/COG
Elements
Disaster Recovery Plan
Operational Recovery
Plan
Pandemic Response
Plan
Succession
Plan
Crisis Communication Plan
Business Resumption Plans
Incident Management Plan

19. What if ? You don’t have staffing resources
You don’t have budget resources

20. Minimum Options Create a Recovery Plan
Identify critical applications/systems
Identify critical software and hardware
Priorities applications, systems ,SW,HW
Identify key staff needed to recovery critical applications, systems, SW, HW
Create a Data Backup plan
Store Data at off-site secure facility

21. Conclusions
Agencies must be willing to provide executive level support for Business Continuity Management Program
Agencies resources needed for BCM program staffing
Agencies must exercise due diligence in developing business resumption/continuity plans, and coordinate those plans with other state agencies where dependencies exist
Agencies should continue with enterprise Business Continuity Programs to ensure the following issues are addressed:
Business and system interruptions
Data protections and restoration capabilities
Alternate facilities and equipment replacement plans
Succession Plan for internal management and authority
A formal testing program

22. Child Support Services
Questions
Karen L. Green, CBCP, CBRM
Business Continuity Officer
State of California
Department of
Child Support Services
(916)