service supply chain business continuity risk management

Size: px

Start display at page:

Download "service supply chain business continuity risk management"

Ira Bradley
8 years ago
Views:

1 What works: Services and service supply chain business continuity risk management Don Hall, CBCP Cisco Systems, Inc. March 31, 2014 (Business Continuity Institute, 2012) Cisco Public Information 2 1

2 Agenda The Challenge The Solution Scope Methodology Metrics and Reporting Supporting Contracts Lessons Learned Questions & Answers Cisco Public Information 3 Cisco Public Information 4 2

3 If I always appear prepared, it is because before entering an undertaking, I have meditated long and have foreseen what might occur. It is not genius where reveals to me suddenly and secretly what I should do in circumstances unexpected by others; it is thought and preparation. (Napoleon Bonaparte) Cisco Public Information 5 If you wish to be a success in the world, promise everything, deliver nothing. (Napoleon Bonaparte) Cisco Public Information 6 3

It is not genius where reveals to me suddenly and secretly what I should do in circumstances unexpected by

4 About Cisco Services Types of Services Professional (Advanced) Services: assist customers in transforming their businesses for today s competitive marketplace Technical Support Services: speed issue resolution, ensure business continuity, maintain network performance and improve operational efficiency Smart Service capabilities: provide actionable intelligence gained from secure visibility into the health of a customer s network. Types of Support Phone Support Support Field/On-Site Support Web Chat Support Web Self-Service Support Community Support Center Locations Global Technical Assistance Center (TAC) locations: San Jose, CA (USA); Richardson, TX (USA); Raleigh, NC (USA); Boxborough, MA (USA); San Jose, Costa Rica; Brussels, Belgium; Krakow, Poland; Amman, Jordan; New Delhi, India; Bangalore, India; Sydney, Australia Regional TAC locations: San Bruno, CA (USA); Houston, TX (USA); Mexico City, Mexico; Rio De Janeiro, Brazil; London, UK; Oslo, Norway; Munich, Germany; Kortrijk, Belgium; Moscow, Russia; Istanbul, Turkey; Seoul, Korea; Tokyo, Japan; Beijing, China TAC Support Capabilities: 180+ countries, 24 TAC facilities, 17+ languages Cisco Public Information 7 Cisco Services Business Continuity Team This presentation represents the Supplier Business Continuity Risk methodologies employed by Cisco Services and does not include manufacturing or other business functions within Cisco Systems, Inc. Small team to provide: Business Continuity Program Management Business Continuity Training Subject matter expertise for Services Business Continuity teams and Supplier Business Continuity Risk Management. Business Continuity Plans are managed using in-house templates and document management controls. Cisco Public Information 8 4

5 Cisco Services Suppliers Cisco Services employs Suppliers in virtually every business function. There are hundreds of contracts for Suppliers ranging from temporary workers to fully outsourced services. Many of these Suppliers support critical business processes. Cisco Public Information 9 Supporting Programs Cisco Services has a large global Supplier network to ensure resiliency of operations and this program augments those capabilities. Other programs within Cisco perform periodic on-site visits, such as Business teams (Cisco Vendor Managers) Trade-compliance and other auditing teams These teams can be helpful for Raising additional areas of concern from site visits Validating key business continuity elements during site visits Raising awareness of the Supplier Business Continuity Risk Assessment Identifying Supplier service outages that may indicate gaps in plans Cisco Public Information 10 5

Cisco Public Information 9 Supporting Programs Cisco Services has a large global Supplier network to ensure resiliency of operations and this program augments those capabilities.

6 Cisco Public Information 11 The Solution Cisco Public Information 12 6

7 Scope Goal: Ensure the continuity of critical business processes One Assessment per Supplier (not coupled to contracts) Excluded temporary worker contracts (covered by Cisco BCP) Scope Guidance: Minimum Annual Contract Value Minimum Time Remaining on Contract Representative sample of locations Exceptions are made when deemed essential to operations Cisco Vendor Managers must approve Suppliers removed from scope Cisco Public Information 13 Assessment Methodology <10% Supplier Sites Questionnaire Evidence Files Initial Report Tool generated Provides focus Verify Evidence Open a dialog Supplier Vendor Manager Validated Assessment Perceived risk Cisco Public Information 14 7

to operations Cisco Vendor Managers must approve Suppliers removed from scope Cisco Public Information 13 Assessment Methodology <10% Supplier Sites Questionnaire

8 Questionnaire All questions are based on best practices for Business Continuity 5 Corporate governance questions Does the Supplier have a comprehensive Business Continuity program? 14 Site-specific questions (identical for each site) Has the Supplier completed a Business Impact Analysis (BIA)? Does the Supplier have a current Business Continuity Plan (BCP)? Has the Supplier conducted a BCP exercise within the past year? Note: The specific question language is included in the handouts Cisco Public Information 15 Evidence Requirements Evidence is required to support responses and prioritize risk dialogue. Corporate governance questions The BCM policy Site-specific questions BIA (within 2 years) BCP (within 12 months) Exercised (within 12 months) Cisco Public Information 16 8

Has the Supplier conducted a BCP exercise within the past year?

9 Delivery & Reporting Tools Third-party web-portal based solution to gather data Cisco Services defined d Question Set Cisco Services defined Evidence Requirements Tool-generated initial assessment report Provides a number of reports, that can be exported to Excel Excel spreadsheet Tracking Cisco Vendor Manager contact information i Track history of interactions with Supplier Historical tracking of assessment scores and status In-house reporting Cisco Public Information 17 Assessment Tool Scoring and Status The tool provides a risk status for each Supplier. The combination of site risk levels, corporate governance risk, and supporting evidence determines the overall Supplier s risk status. Cisco Services uses the risk status to focus Supplier risk discussions. Site 1 Corp Site 2 Risk Status Cisco Public Information 18 9

tracking of assessment scores and status In-house reporting Cisco Public Information 17 Assessment Tool Scoring and Status The tool provides a risk status for each Supplier.

10 Evidence Validation - General Balance the need to verify a Business Continuity program and plans against the needs of an organization to protect sensitive and proprietary information. Generally we accept a minimum level of evidence that a document exist, is current, and meets the standards. Cisco Public Information 19 Cisco Public Information 20 10

11 Risk Dialog with Suppliers Goals of dialog Collaborate with the Supplier to validate responses and level l of risk Identify gaps in Business Continuity practices or plans Have Supplier provide timeline to close identified gaps Track and monitor progress to plan The risk dialog is always conducted by an experienced Business Continuity practitioner as the responses to questions may raise other concerns. Cisco Public Information 21 Assessment Reporting and Metrics Monthly and Quarterly risk status reporting to management team. Metrics tracked include: Assessments completed by Supplier Evidence validated Evidence gaps identified and closed Risk status improvements Cisco Public Information 22 11

practitioner as the responses to questions may raise other concerns.

12 Assessment Reporting and Metrics Cisco Public Information 23 Supporting Contract Language Vendor shall implement and maintain a business continuity program designed to ensure the continued availability of essential business functions during any event that would otherwise materially affect Vendor s ability to deliver services. Vendor shall implement and maintain a Business Continuity Plan ( BCP ). The BCP shall be documented in writing and shall include, without limitation, evidence of a Business Impact Analysis (BIA) that identifies essential business functions and establishes their Recovery Time Objectives (RTO), Crisis Management Plans (CMP) to coordinate and communicate appropriate continuity actions, and Disaster Recovery Plans (DRP) for all essential business functions necessary to meet contractual obligations with Cisco under this Agreement and all SOWs. The BCP shall be reviewed, revised and tested/exercised by Vendor at least once every twelve (12) months. Vendor shall provide evidence of the BCP within ten (10) business days of the Effective Date. Vendor agrees to complete a Vendor BCP assessment using the tools and processes prescribed by Cisco within thirty (30) days of a written request, not to exceed two (2) assessments within a twelve (12) month period. Cisco Public Information 24 12

Vendor shall implement and maintain a Business Continuity Plan ( BCP ).

13 Lessons Learned Cisco Public Information 25 Lessons Learned A significant effort will be required in the first quarter. We had to assist 80-90% of the Suppliers complete the assessment. Validating evidence files for selfreporting low risk Suppliers is as important as validating higher risk categories. Evidence gaps in 70-80% of assessments over the past 2 years. Adjust risk status when evidence files do not support a response. Supplier risk metrics will drop as you validate evidence prepare your management team for the changes in status. Cisco Public Information 26 13

Validating evidence files for selfreporting low risk Suppliers is as important as validating higher risk categories.

14 Cisco Public Information 27 Summary Gather Supplier data to obtain an initial risk status Use the risk status to focus efforts on highest risk Suppliers first Validate all critical Suppliers including low risk Have an open risk dialog with the Supplier Keep the Vendor Management team informed and engaged Cisco Public Information 28 14

Validate all critical Suppliers including low risk Have an open risk dialog with

15 Results Achieved Cisco Public Information 29 Thank you. 15

Disaster Recovery Journal Spring World 2014

Disaster Recovery Journal Spring World 2014 What works: Services and service supply chain business continuity risk management Don Hall, CBCP, Cisco Services Business Continuity Analyst Cisco Systems, Inc.