1. HUIT Business Continuity
December 20, 2016

2. Types of Crises Type Definition Examples University (non-IT)
Significant risk to life and safety.
Severe weather
Active shooter
Pandemic IT
Substantial disruption to critical business and academic operations.
PeopleSoft unavailable for payroll
Major outage
University-wide DNS outage
IT Security
Severe compromise of university data/systems and privacy.
DDOS attack
Accounts hacked on large-scale
Any type may also pose a threat to the university’s reputation.

3. The Big Picture Crisis Process Containment Business Continuity People
Space
Technology
Physical Assets
Recovery & Resolution
Disaster Recovery
Overall coordination of organizational response to minimize damage
Plan and response to continue business operations at acceptable predefined level
Recovery or continuation of infrastructure, systems, and applications vital to organization

4. HUIT Areas of Focus
Business Continuity: Managing our own organization during a crisis
Impact Analysis
Plan Development
Emergency Planning
Disaster Recovery: Bringing back our services during/after a crisis
Critical Services Analysis
Testing

5. HUIT’s Role: Business Continuity (BC) vs. Disaster Recovery (DR)
Crisis Type
HUIT
Response
Other Departments’ Response
HUIT Role
University BC
How does everyone continue business operations? IT
BC/DR
If applicable, what alternative (e.g., system) does HUIT provide?
How does HUIT recover the affected service?
IT Security DR
How does HUIT remediate the issue?

6. Harvard Emergency Management: Business Continuity Approach
Impact Analysis
Fall\/Winter 2016/2017
Business Continuity Planning
Spring 2017
Emergency Planning
Summer 2017

7. Business Continuity Planning
Two Phases for FY17
Phase 1: Impact Analysis (3-4 months)
Determine key departments/lead BC planners
Review department functions
Add functions to Fusion and score them
Map dependencies
Phase 2: Plan development (3-4 months)
Update general information
Create teams
Customize procedures and steps

8. Business Continuity System: Fusion
Procedure-based Plans
Criticality assessment
Function risk ranking (e.g., mission, financial, reputational)
Impact analysis

9. HUIT Approach
Goal
Impact assessments and BC plans for all HUIT departments in Fusion
Next Steps
Pre-populate HUIT Departments and underlying functions based on service catalog (or organizational structure, e.g., Administration)
Enables other CADM departments to identify dependencies on HUIT services (vs. making up their own)
Validate and target key services (primarily categories) initially:
IT Provider Services (includes IAM)
Information Security
and Calendars / Collaboration Services
Identify point people
Conduct impact assessment for these services/groups
In partnership with Harvard Emergency Management