1. Government’s Year 2000 Challenge

2. The Role of Government How bad will it be? It is not just a 2000/01/01 problem Economic Implications Y2K Risk Management Contingency Planning & Emergency Management What we should do - a need for partnership

3. 0 No real impact 1 Local impact for some enterprises 2 Significant impact for many enterprises 3 Significant market adjustment (20%+ drop); some bankruptcies 4 Economic slowdown; rise in unemployment; isolated social incidents 5 Mild recession; isolated supply/infrastructure probs; runs on banks 6 Strong recession; local social disruptions; many bankruptcies 7 Political crises; regional supply/infrastructure probs, social disruption 8 Depression; infrastructure crippled; market collapse; local martial law 9 Supply/infrastructure collapse; widespread social disruptions and martial law 10 Collapse of U.S. government; possible famine 0 No real impact 1 Local impact for some enterprises 2 Significant impact for many enterprises 3 Significant market adjustment (20%+ drop); some bankruptcies 4 Economic slowdown; rise in unemployment; isolated social incidents 5 Mild recession; isolated supply/infrastructure probs; runs on banks 6 Strong recession; local social disruptions; many bankruptcies 7 Political crises; regional supply/infrastructure probs, social disruption 8 Depression; infrastructure crippled; market collapse; local martial law 9 Supply/infrastructure collapse; widespread social disruptions and martial law 10 Collapse of U.S. government; possible famine How Bad Will It Be? Let’s See What Washington Experts Think...

5. Government’s Challenge Government has an obligation to ensure the health, safety, and economic vitality of the public. As a result, government year 2000 efforts will need to look beyond its own systems problems and ensure that the community can conduct "business as usual" through 2000.

6. Government Must Understand the Year 2000 Reality It must be fixed quickly in the face of dwindling resources It is a risk to our power, water, sewer, and telecommunications systems Not enough is being done by government to prepare for possible service and supply-chain disruptions

7. Where do things stand? Recent surveys of large companies indicate that: –Only 15% of companies and government agencies expect to have their critical systems more than three-quarters tested and compliant by 1999/01/01 –40% have already experienced failures –84% are missing Y2K milestones –Local government is far behind - 55% of cities surveyed by the ICMA don’t realize it is a problem Sources: Cap Gemini America and ICMA

8. Why is Y2K a Problem for the Economy and Society?  Infrastructure Failures - power, telecommunications, and transportation disruptions may lead to significant impacts on daily life activities including shortages of critical supplies.  Economic Slowdown - system failures can cause supply chain disruptions, business failures, unemployment, revenue shortfalls, and recession.

9. More Reasons to Worry Many simultaneous and complex IT projects must be completed at the same time – IT projects are often behind schedule – IT projects are often over budget – IT shops are suffering staff retention problems and staff shortages – Little if any project management skills or experience dealing with large and complex problems

10. International Concerns No country has a comprehensive plan (with funding) to deal with the problem (U.S., U.K., Canada, and Australia are closest) Japan, Western Europe now estimating cost Most countries are still assessing the problem or doing nothing at all As a result, significant problems can be expected

12. Global Economic Impact “I believe there is a 70% chance of a global recession that could be at least as severe as the global economic downturn in 1974 and 1974” - Ed Yardeni "Inevitable difficulties are going to emerge. You could end up with...a very large problem. Before we reach the year 2000 there is economic loss." - - Federal Reserve Chairman Alan Greenspan Global businesses will be impacted most ; Asia is already in a recession, perhaps a depression

13. Businesses Survival The Local Economy Depends on it! Most small and medium size organizations have done little to prepare for Y2k Resources may become scarce Most experts expect 10-15% of small and medium size businesses to fail – Those without contingency plans will suffer – Economic impact will be felt in many ways – Impact will depend on absorption of business and employees by surviving firms

14. Potential Economic Implications What are the implications that an economic slow-down could present? –Recession –Shortages –Unemployment –Deflation –Lower stock prices –Revenue shortfalls –Reduced demand for good and services

15. With recession a possibility, we can’t assume a continuation of the 1990’s income tax growth rate.

16. It is Not Just a 2000/01/01 Problem Only 4 Months to 1999!

17. Timeline for Problems Not Just a 2000 Problem 199920002001 One Year THF FY2000 Starts 366th Julian day Leap Day 02/29/2000 The Big “00” 99th Day 99th Year 10/10/2000 Blows Buffer What’s 9/9/99? GPS Rollover 8/21/99 The 99 Problem

18. Post 2000 Problems The Issue of the Epoch  If no date is set externally (There is no means to input actual time at the turn-on point), the system defaults to its "epoch" date. This could be the design date, the manufacture date, or some other date.  This means that some non-compliant systems are subject to failure not on 2000/01/01 but at some later time when the internal date reaches 2000/01/00.

19. If it is working fine after 2000/01/01 it is not guaranteed to be compliant K Due to delays in the production life cycle and shelf life, most of their failures will occur after 2000/01/01 - Some systems may not fail for years. K The inability to roll the dates of these internally date sensitive chips forward is an impediment to testing for compliance. K Integrated circuits may be from the spot, gray or black markets.

20. Epoch Conclusions There may be fewer disruptions at 00:01 on 2000/01/01 There may be nagging system failures for years after 2000/01/01 Only testing will tell… But, testing requirements exceed time available It is difficult to determine the likelihood of failures

21. Risk Management is a Must This is going to have implications in the world and in American society we can't even comprehend." - Deputy Defense Secretary John Hamre before a Senate Committee; June 5 1998, Reuters

22. Risk Management Process Risk Identification Risk Assessment Risk Control Risk Transfer Risk Finance

23. Risk Management Issues Biggest Risk is not knowing all the risks Biggest Problem - much risk is out of your control Best Practices? –Triage –Contingency Plans –Business Continuity –Business Recovery –Disaster Planning

24. Create a Risk Management Team Lead by Top Management Project BoD Monitors Separate from Y2K Project Management Team Regular Status Reporting to Management Broad-based Awareness for Everyone Key Players –Elected Officials –Internal Audit –Risk Management –Legal –Finance/Budget –Procurement –Public Health/Safety

25. Time is Short Target Resources and Services Quickly Identify and Triage All Risks Evaluate and Assess Risk Likelihood and Risk Impact Develop Risk Monitoring Procedures Identify Actions That May Eliminate Risks in Advance Identify Actions Necessary to Minimize the Impact of Risks That May Materialize

26. Prioritize Risk Factors T Personal Safety Risk T Services Risk T Operational Risk T Revenue Risk T Liability Risk T Good Will (Societal) Risk T Replacement Cost (today & 2000+)

27. Y2K Program Assessment Perform benchmarking and gap analysis. Perform independent verification of project. Assess triage efforts and review contingency, fallback, disaster recovery, and business continuity planning. Review all electronic linkages, supply chains, and other businesses that impact the enterprise.

28. Contingency Planning "...Virtually everything from supply, generation, and distribution is controlled by hardware and software...there will be power disruptions if things are not fixed." - David Mann, President of Nova Scotia Power

29. Contingency Planning Objectives  Public Safety  Minimal Economic Harm  Status Quo for Services  Business as Usual

30. Contingency Planning Issues Power and Telecommunication Failures Supply Chain Disruptions Public Response to Failures Triage Requirements Fire Drills - Desktop Exercises

31. It’s Not Enough Just to Plan Use focus groups and brainstorming –Seek “what can go wrong” –Find innovative solutions to risks Contingency plans must be exercised –Hold table top exercises –Conduct “fire drills” –Train staff for action Constantly assess your project

32. Contingency Planning Develop alternate plans Review manual work arounds Create fall back procedures Identify public safety issues Update disaster plans

33. Due Diligence in Contingency Planning D Prioritization by Criticality D Dilemma: Don’t Leave Anything Out D Document, Document, Document D Fire Drills

34. External Risks "The state of year 2000 readiness of the utility industry is largely unknown." - Head of the Federal Energy Regulatory Commission, James Hoecker. MSNBC, June 12, 1998

35. What Are External Risks? External Risks are risks presented by factors outside the enterprise; these include risk present in the possible failures of business partners, suppliers, public utilities, transportation, telecommunications, governments, and other businesses. Due Diligence requires a complete assessment of external risks

36. Risk High Low Threat Areas Applications InfrastructureBusiness Partners Risk Areas

37. Review External Dependencies Infrastructure Dependence (power, telecom, etc.) System Compliance (computing, data,networks, etc.)

38. One Business Failure Can Shut You Down If you rely on one supplier for a critical part or service, the impact of their non-compliance could be catastrophic. Examples: GM Parts Manufacture strike shuts down assembly line Satellite snafu impacts millions UPS strike hurts many using “just-in-time” Railroad computer problems hit shipping

39. Managing External Business Dependencies Dealing With Business Partners  Evaluate supplier compliance  Assess business partner data issues  Plan for alternative suppliers  Address outsourcing concerns  Develop contingency plans

40. Vendors Are Your Partner How are they doing? Establish clear testing and certification strategy Certification process varies with risk: –Joint Testing –Third-party test –Certificate –Hope for the best Do you need to find some new ones?

41. Business Continuity "The problem's going to be pretty bad." - Andrew S. Grove, chief executive of Intel Corp, on Y2K. Washington Post, April 24, 1998

42. What is Business Continuity Planning? Planning to ensure the resumption of operations in the event of a catastrophic event. Business continuity planning goes beyond contingency planning to include the actions to be taken, resources required, and procedures to be followed to ensure the continued availability of essential services, programs, and operations in the event of unexpected interruptions.

43. Dealing with Dependency  Identify & prioritize dependencies  Get compliance statements  Conduct face to face negotiations  Change resource dependencies?  Look at the level of dependency  Contractual guarantees  Contingent business interruption insurance

44. Business Continuity Plan Identify Risks - Triage Everything –All business functions –EDI/EBD –Suppliers –Infrastructure Develop Plans for Everything Test and Exercise the Plans Layer Business Plan & Disaster Plan

45. Emergency Management "We're concerned about the potential disruption of [International] power grids, telecommunications and banking services. There is very little realization that there will be a disruption. As you start getting out into the population, I think most people are again assuming that things are going to operate the way they always have. That is not going to be the case.'" - Sherry Burns, Central Intelligence Agency, May 3, 1998

46. Infrastructure Issues What will we do if there is no power? No phone service? No Water? Will government open? How will the public react?

47. Emergency Management Planning Work with local and regional disaster agencies Assess special problems with Y2k –Loss of Heat, communications –Supply-chain impacts Review and revise existing disaster plans Look for new areas for disaster plans Include Disaster Recovery Planning Keep the public informed

48. Use Local Emergency Management Groups EMGs should form a Year 2000 Task Force Assess the readiness of critical public safety systems and suppliers Evaluate various Y2k scenarios (extended power outages, food shortages, etc.) Review and update existing disaster plans Establish relationships with key suppliers of potentially scarce resources Develop contingency plans where needed

49. A Layered Approach to Public and Private Sector Cooperation "The year 2000 problem is one of the great challenges of the Information Age in which we live. My Administration is committed to working with the Congress and the private sector to ensure that we minimize Year 2000-related disruptions in the lives of the American people." - President Clinton

50. International Y2K Compliant Community Initiative Minimizing Y2K problems will require an unprecedented public/private partnership and phenomenal leadership We need a layered approach: –International – Global Alliance –National – Public/Private Y2K Task Force –State/Regional – Interdependency Assessments –Local – A Y2K Compliant Community

51. International Issues A Global Alliance International Leadership and Awareness Sharing Information and Solutions Providing Assistance to Other Nations Global Emergency Preparedness Ensure food and medical supplies Military Stability Economic Stability

52. National Task Force Needed There is no national effort to assess and plan for impacts of Y2K –National Leadership is MIA –The President’s Council on the Year 2000 Conversion is focused on federal agencies compliance activities –FEMA is waiting for an emergency to occur A successful national effort requires a task force with leadership, partnership, and funding

53. Regional Y2K Focus Areas Utilities Public Safety Health and Human Services Telecommunications Transportation Business, Trade, Information Interchange

54. Local Level Issues A Y2k Compliant Community Exchange Information with partners, employees, and community Address Interdependencies not covered in regional efforts Support Community Projects - Help with local awareness and preparation Share information and solutions Also, support regional and national efforts

55. How Will Politicians Be Judged? Did they understand and respond to the challenge? Did they inform and prepare their stakeholders? Did they plan for the impact of the problem? Did they survive and prosper after 2000?

56. Partnership is Key Local Community Groups, Churches, etc. Local Utilities, Telcos, and IT firms Business - Chamber of Commerce American Red Cross National Guard Not-for-Profits Health and Human Services

57. Summary A Rx for Government Success "I humbly ask you to please declare a national and global state of emergency because of the year-2000 (or century-date computer- processing) problem." - Prof. Leon Kappelman, Ph.D. Co-Chair, Society for Information Management (SIM) Year 2000 Working Group. Open letter to the President. Oct. 4, 1997.

58. What should government do? Provide Strong Leadership from the top Organize and Build Public/Private Partnerships between Federal Governments and: –Local Government –Business –Not-for-Profits –Utilities Provide Awareness and Assessment Information Share Resources, Solutions, and Knowledge Conduct Emergency Preparedness Activities

59. What more can government do to be successful? Develop a sense of urgency Triage! Make the best use of resources Consider a moratorium on all new projects Don’t make any legislative or administrative changes that will require computer revisions Constantly assess progress

60. Other Suggestions Conduct Y2K drills Create a newsletter and web site to inform the public on project status Make infrastructure assessment information available through regular updates. Create a Y2K Help Desk or Answer Line from questions from the public Work with all local organizations

61. Leadership is needed - Now! Leadership is key - Is anyone up to this? A “Manhattan Project” or “Marshall Plan” approach is needed - deal with this as a crisis Start local, regional, and national Year 2000 Projects with sufficient resources ASAP Perform infrastructure assessment and communicate status to the public Conduct contingency, continuity, and disaster planning Help those in the community that need help

62. Use the collective strength of government Government has a moral obligation to make this its top priority. All levels of government must provide unprecedented commitment, effort, and cooperation. Government must: –Show Strong Leadership –Organize and Build Partnerships –Share Resources & Information –Share Knowledge & Awareness –Share Solutions & Applications

63. For More Information Impact of the Year 2000 Problem http://www.erols.com/steve451/impact.htm Montgomery County Year 2000 Project http://www.co.mo.md.us/Year2000 Computer Professionals for Social Responsibility http://www.cpsr.org/program/y2k/ Best Practices for Local Government ($45) COG Information Center (202) 962-3265 https://ssl.worldweb.net/mwcog/form.html E-mail: steve451@erols.com