1. Business Continuity 17 March 2015Presented by Adele Sands

2. The Department of Human Services

3. Page 3 The department provides: –policy/programme management, and –service delivery of payments on behalf of the Australian Government –for three master programmes: Centrelink Medicare Child Support

4. Page 4

5. Page 5

6. Page 6 401 service centres 26 smart centres 38 support or processing sites 13 Child Support Call Centres. ICT

7. Page 7

8. Page 8 DHS delivers $2.8 billion each week into the Australian economy. $148 billion per annum around 11% of Australia’s GDP We have to be smart in our delivery of Business Continuity

9. The First Round – lessons learnt

10. Page 10 2012 - A change in BCM This resulted in: a top down approach BCPs ONLY required for critical functions, assessed by: –MTPD is five days or less –the department would incur a major or extreme consequence within this time

11. Page 11 Complexities Considering the size and complexity of the department, the new process resulted in: confusion never ending questions regarding the different variables “Why’s” and “What if’s” frustration regarding duplication of work

12. The BCM Review – Accountability vs. Service Delivery vs. Service Continuity

13. Page 13 Accountability The policy or programme divisions are always ACCOUNTABLE for the function. They: are (usually) not responsible for service delivery are not responsible for the service continuity of the enabling ICT systems

14. Page 14 Accountability provide intelligence around associated service level agreements or legislative requirements incident manage disruptions to the delivery of the function liaise with and relationship manage key stakeholders as function “owners”, are best placed to determine RTOs and MTPDs

15. Page 15 Service Delivery The department’s Service Delivery Operations Group is responsible for the SERVICE DELIVERY of the majority of critical functions Service delivery is performed via multiple channels, from different sites all across Australia

16. Page 16 Service Delivery Some functions are delivered from multiple sites and are able to be easily shifted around depending on the type of disruption In the above situation there is no need to obtain detailed information on staffing resources

17. Page 17 Service Delivery If a function is identified as being delivered from four or less sites, it is classified as high risk High risk = more thorough analysis of resource dependencies

18. Page 18 Service Continuity The department’s CIO group is accountable and responsible for the SERVICE CONTINUITY of enabling ICT systems The BIA captures critical ICT dependencies and single points of failure for ALL critical functions This information is presented to the ICT BC team

19. Page 19 Service Continuity The ICT BC team will then: identify the responsible ICT teams analyse existing service continuity arrangements, including the capability to: Protect ~ Detect ~ Respond ~ Recover identify and report on gaps

20. Page 20 Service Delivery Incident/Programme Management of Critical Function Resource Availability (ICT Programme) Service Continuity of Resource CORE CRITICAL FUNCTION Accountability Critical Function Critical Function Inner Circle Function is always critical Outer Circle Function is only critical when the core function is disrupted

21. Page 21 Improvements Review and update templates Develop informative guides on different aspects of the process Develop step-by-step process documents to ensure transparency, and to provide assurance that staff deliver the programme consistently = data integrity

22. Page 22 Improvements Develop pre-populated templates for frequently used continuity procedures Having this work already prepared has streamlined the process, resulting in efficiencies and improved focus on strategic aspects.

23. The Second Round of BIA/BCPs – Strategic Focus

24. Page 24 Strategic Focus Business continuity management for the department now takes a more strategic approach with: improved and streamlined guides and templates a greater focus on identifying vulnerabilities and single points of failure

25. Page 25 Strategic Focus This enables us to: 1.Report significant risks to: our accountable executive level staff our risk management section our governance committee 2.Inform service delivery divisions of the criticality of the functions they deliver

26. Page 26 Strategic Focus 3.Provide intelligence to response and recovery committees about incidents impacting DHS Canberra sites 4.Provide intelligence to service delivery zones about functions delivered within their geographical footprint

27. Page 27 Strategic focus 5. I nform ICT of the systems that support critical functions ICT can then work to ensure that these systems have appropriate service continuity measures in place to support their availability and performance.

28. Questions?