1. Be the Change.

2. Information & Disaster Management
Continuity of Operations Planning 2011 AIRS Conference Dearborn, Michigan
Lee W. Foster, MS
Vice President
Information & Disaster Management
HandsOn Central Ohio

3. Outline This training is typically divided into 10 Modules
Module 1: Principles of COOP
Module 2: Essential Functions
Module 3: Human Capital Management
Module 4: Delegations of Authority
Module 5: Vital Records
Module 6: Alternate Sites
Module 7: Communications
Module 8: Reconstitution & Devolution
Module 9: Writing a COOP Plan
Module 10: Training & Exercising
Explain that this is a 90 minute presentation that was developed from a 4 hour training that I created from a 3 day training I attended.
Some modules will be longer or shorter then the others. I will attempt to leave time at the end of the seminar for questions.

4. Module 1: Principles of COOP
Module Objectives:
Define COOP and differentiate between COOP and other emergency plans
Identify the goals of COOP planning
Identify the initial tasks and personnel responsible for COOP planning.

5. Principles of COOP
The key to COOP planning is to be sure it addresses “All Hazards”
What are some of the Hazards you may face?
Floods
Severe Winter Storms (snow/ice)
Earthquakes
Terrorism
Wildfires
Infectious Diseases
Tornadoes/Hurricanes
Explain the Franklin County presentation. Contact their local EMA to see the most recent risk assessment.

6. Principles of COOP 8 Principles of COOP Essential Functions
Human Capital & Key Personnel
Delegations of Authority & Succession
Vital Records
Alternate Facilities
Communications
Reconstitution & Devolution
Tests, Training & Exercises
All 8 of these principles will be discussed today.

7. Principles of COOP
Without a COOP plan, agencies cannot function and provide essential functions
Good public relations
Consistency of services
COOP planning is just good business practices
All agencies present today provide vital services to their clients. Having a solid COOP plan helps agencies continue to operate and provide those essential services.
Being able to continue operations in the aftermath of the disaster will provide excellent PR and make create more business. Also an excellent document to show or discuss during funding applications.

8. Principles of COOP 6 Goals of COOP
Ensure timely and orderly continuous performance of essential functions during and after an emergency
Protect facilities, equipment, records and other assets that support essential functions.
Reduce or mitigate disruptions to operations
Discuss importance of mitigation. Fed’s provided extensive funds for Disaster recovery, but barely funded Disaster mitigation.

9. Principles of COOP 6 Goals of COOP (cont.)
Facilitate reconstitution and devolution after an emergency
Minimize loss of life, injury and property damage
Provide family support planning for agency personnel during an emergency.

10. Principles of COOP COOP plans should:
Be operational no later than 12 hours after activation
Be able to maintain sustained operations for at least 30 days.
This benchmark, being operational no later than 12 hours after activation should guide you in selecting your essential functions, which we will talk about in Module 2. What are your agencies functions that are most critical to be held to this standard?

11. Principles of COOP 7 phases of COOP development
COOP Program initiation
Identification of functional requirements
Plan design and implementation
Program implementation
Tests, Training and Exercises (TT&E)
Plan revision and updating
Plan execution
COOP Program initiation – identify the staff that is in charge of organizing the COOP process
Functional requirements – Determining which functions are essential to achieving the agencies mission.
Plan design – One over-arching plan or for agencies with many divisions or satellite offices, many different plans.
Program implementation – This phases sets the groundwork for the final three phases. This phase is where you take your plan and publish it for appropriate personnel.
- The final three bullets are key points in my mind. Spending time to develop a plan is one thing, testing, updating and re-executing the plan is the most important pieces of an all encompassing COOP plan.

12. Module 2: Essential Functions
Module Objectives:
Define essential functions
Identify the sources that specifically define agency functions
Identify critical processes and services supporting essential functions
Prioritize essential functions

13. Essential Functions What are essential functions?
Must be performed to achieve agency’s mission
Provide vital services
Maintain safety & well being of citizens
Sustain industrial/economical base
Should be resumed within 12 hours of disruption
Should be sustainable for up to 30 days
ASK: Where can we find essential functions?
1. Mission Statement
2. Legislative authority
3. Agency reports (annual report)
4. SOP’s
5. Current & former employees

14. Essential Functions 4 steps in identifying essential functions
Identify ALL functions
Identify essential functions as a subset
Determine resource requirements
Prioritize essential functions

15. Essential Functions What are critical processes or services?
Tasks that are completed as part of your essential functions
Identify early, will make prioritizing essential functions easier.
Will assist in defining how narrow or broad to focus your essential functions.
Perfect example of critical processes or services for 2-1-1’s? Your resource database.

16. Essential Functions Talking with your staff.
There may be some push back from employees if they are initially determined to be in a “non-essential” position. It is important for the COOP Manager to make sure that employees understand essential/non-essential are for emergency operations only.

17. Module 3: Delegations of Authority
Module Objectives:
Defining delegation of authority
Differentiate between emergency and administrative authority
Define orders of succession

18. Delegations of Authority
Emergency vs. Administrative
Emergency: The ability to make decisions related to an emergency, such as deciding whether to activate a COOP plan.
Administrative: The ability to make decisions that have effects beyond the duration of the emergency.
Example in the worksheet 3. The Disaster Coordinator is receiving Emergency authority. Must consult w/ COO or CEO to make budgetary (or administrative) decisions.

19. Delegations of Authority
Orders of Succession: Determining successors for each key position that performs essential functions.
Succession Triggers
Death
Emergency Event
Incapacitation through illness
Abduction
Unexplained Disappearance.
What is the most famous order of succession?
President
Vice President
Speaker of the House
President of the Senate
Secretary of State
Secretary of the Treasury
Defense Secretary AG
While the Presidential order of succession is determined by statue, your succession plan needs to take in many considerations.

20. Delegations of Authority
Succession Planning Considerations:
Geographical proximity
Organizational proximity
Skills
Experience
Knowledge & Training
Personality

21. Module 4: Vital Records Module Objectives:
Distinguish vital records for COOP purposes.
Identify key tasks in COOP planning associated with vital records.
Defining the RPO.

22. Vital Records Definition of Vital Records:
Records, systems and equipment that if irretrievable, lost or damaged will materially impair an organizations ability to carry out essential functions.
Vital records are only vital if they are NEEDED to perform essential functions.
Once again, your resource database.

23. Vital Records Emergency & Legal Records
Emergency Records: Essential to the continued functioning of an agency during and after an emergency to ensure continuity of operations.
Legal: Essential to the protection of the legal and financial rights of an agency and of the individual directly affected by the agency’s activities.
Emergency Record examples: Plans, directives, orders of succession and delegations of authority
Legal and/or Financial: Personnel records, payroll, insurance, 501.c.3
We must also consider the systems/software we use to access the above records. If all payroll is down electronically, the computers used to conduct payroll are “vital records” as well.

24. Vital Records Are those records really vital?
The National Archives and Records Administration estimates no more than 7% of records are vital (likely 3 – 5%).
Ask: how long do you keep your annual updates?

25. Vital Records What is RPO?
Recovery Point Objective (RPO) is the age of the data that an agency wants to recover.
For instance, if you back up your data every Friday afternoon, your RPO is 1 week.
Obviously, it is recommended that an RPO be 0, meaning that data is backed up in real time.
RPO will help in determining your risk to disaster. If you back up data in real time, your risk is much lower then someone that has an RPO or 1 or 2 weeks.
You do not need to have a low RPO for all records, part of the COOP planning process is to prioritize records and assign appropriate RPO’s. Perhaps payroll will have an RPO of 2 weeks.

26. Vital Records Building a Vital Record “Go-Kit”:
A hard copy of key personnel and disaster staff phone numbers.
Vital records inventory with precise locations.
Necessary keys or access codes.
Maps and blue prints of alternate facilities.
Access requirements and sources of equipment necessary to access records.
Lists of records recovery experts and vendors.
Copy of the agency’s COOP Plan.
This is something that you want to have easily accessible that a Senior Staff member can “grab and go”. Also a good idea to have these items stored at a Senior staff members residence.

27. Module 5: Alternate Sites
Module Objectives:
Identify factors in selecting an alternate site.
Outlining the differences between Hot, Warm and Cold Sites.
Discussing the positives and negatives of Tele-work.
Most common example are MOU(A) that allow other 2-1-1’s to handle calls for the effected Who has those in place. How close is your back up? Option “C” planning.

28. Alternate Sites Selecting an Alternate Site: Location Building Type
Space
Distance/Transportation
Communications
Security
Lodging/Food
Accessibility
Cost

29. Alternate Sites Let’s define a Hot Site
A “hot” site is an alternate facility that already has in place the computer, telecommunications, and environmental infrastructure necessary to recover the agency’s essential functions.
A hot site is basically like have an exact replica of your original building.
This is the most ideal situation, however, in these economic times, it’s highly unlikely that any organization can have a second, fully operational facility ready to go and waiting.

30. Alternate Sites Let’s define a Warm Site:
A “warm” site is an alternate work site equipped with some hardware and communications interfaces, as well as electrical and environmental conditioning capable of providing backup after additional software or customization is performed and/or additional equipment is temporarily obtained.
This is the more likely situation, a facility that has the ability to operate, but would need to have some phones/laptops.

31. Alternate Sites Let’s define a Cold site:
A “cold” site is an alternate facility that has the environmental infrastructure necessary to recover essential functions or information systems, but does not have preinstalled computer hardware, or telecommunications equipment. The agency must make arrangements for computer and telecommunications support within 12 hours of COOP activation to make a cold site viable.
Worst case scenario, a cold site is nothing but bricks and mortar. While it might have HVAC services, it has nothing else and the agency would be responsible for having agreements in place to make the Cold Site activated within 12 hours.

32. Alternate Sites Tele-work
Tele-work is another option for continuing operations if your facility is inaccessible.
Tele-work allows employees to work from home during a potential disaster.
Became the “go to” method of operations during the 2009 H1N1 outbreak (Social Distancing).
There are obvious disadvantages of tele-working as well.
1. Accountability – making sure that employees are doing the work they are getting paid to do.
2. Security – Making your servers and systems vulnerable because you are allowing outside access.
3. Infrastructure – Do your employees have the technological capacity to operate from home, or would that need to be provided?
I saw on the networker last week a discussion about remote operations. Who here has started that? How is it going?

33. Module 6: Writing the COOP Plan
Module Objectives:
How to use your provided worksheets
Identify appropriate storage for your COOP Plan

34. Writing the COOP Plan
The worksheets that have been provided to you will get you started on thinking about the concepts discussed here today.
By no means should an agency consider completed worksheets their COOP plan
COOP planning can take up to a year to complete.
There is an excellent FEMA template that would get you started. It was way too long to print, but if you me after the conference, I will send it to you.

35. Writing the COOP Plan Storing your COOP plan
Should be portable and easily accessible in your primary location.
An additional hard copy should be stored off site in a safe, fire/water proof location.
Electronic copies should be kept by Senior Management on work computers and backed up on CD’s or Flash Drives.
We have a copy of our Emergency Response Plan uploaded to our intranet.

36. Module 7: Training & Exercising
Module Objectives:
Discussing why its important to train and exercise
Different types of exercises
How to construct your own exercise
How to learn from your exercise

37. Training & Exercising Why Bother?
It’s important to train and exercise your plan. It helps to verify that the plan works and that staff are familiar with their expectations during COOP operations.
By effectively simulating a COOP situation, staff will understand how to react when the plan “fails”.
Even the best written plans usually never survive first impact. But having an understanding of what the plan looks like and implementing that vision into the current situation will help ease the burden of the COOP event.

38. Training & Exercising A few other points
Training and exercising provide excellent opportunities to update your plan.
Encourage cross training among departments. “Non-essential” staff could be asked to assist in essential function programs.
As we mentioned previously, talk with employees that “non-essential” is for COOP planning purposes only. Offer cross training to “non-essential” staff so that they can off administrative support to essential functions during COOP activation.

39. Training & Exercising Types of Exercises Discussion based exercises:
Seminars
Workshops
Table-Top
Operations based exercises:
Drills
Functional
Full Scale
We will only focus on TTX and Drills.
TTX – Are a discussion based exercise. Departments within your organization would come together and operate under a common, life like scenario that would require some sort of Emergency action. After a specific scenario is presented, the departments would talk their way through how the operations would look.
Drills- Much like a FSE, but only one agency is involved, testing one aspect of their response. Most appropriate form of EX for small organizations.

40. Training & Exercising How can you get involved with Exercises?
If you have a function that would aid in the response to an emergency or disaster (sheltering, providing food, medical care) contact you local Emergency Management Agency for more information on how you can become involved.
If you want to test your own plan, you can conduct a Drill. (A single agency, testing a single function)
Who here has had their be part of a Full Scale (boots on the ground) exercise? Would like to talk afterwards, we will be doing so in September with our major airport in Columbus.

41. Training & Exercising Developing a Drill
Once you’ve decided to conduct your own exercise, a drill, you will need to make sure your objectives are SMART
Simple: Easily understood
Measurable: can be gauged against a standard
Achievable: challenging, but not impossible
Realistic: Plausible for the agency
Task Oriented: tied to something you want to improve

42. Training & Exercising Improvement Planning
Once you’ve completed your Drill (or real life event) it is important to conduct an After Action Report / Improvement Plan (AAR/IP).
In the AAR/IP you will want to list what went well, what needs improving and lessons learned.
AAR/IP are vital documents. You won’t feel like rehashing the situation after all of the work you put in (H1N1) but it is vital for you to create an AAR/IP to guide improving your plan and making the next event better.

43. Training & Exercising Improvement Planning (cont)
You’ll want to use the items that need improving and construct your Improvement Plan
An improvement plan is a chart that lays out what was identified as needing improvement, how it will be improved, who is responsible for the improvements and when will the improvements be completed.

44. Conclusion COOP planning is intended to be an extensive process.
Do not rush through your COOP planning, your plan will fail if you do.
Be sure to test your plan whenever possible.
Seek outside resources, like HandsOn Central Ohio, for assistance.

45. Vice President, Information & Disaster Management
Questions/Follow Up
Lee Foster, MS
Vice President, Information & Disaster Management
x 168