Business Continuity. Port environment

Transcription

1 Business Continuity Port environment

2 DEFINE BUSINESS CONTINUITY WHAT IT IS NOT RECOVERY FOCUS: PEOPLE PROCESSES TECHNOLOGY DELIVERABLES

3 INFRAGARD DEFINITION MANAGEMENT PROCESS DEVELOPING ADVANCE PROCEDURES ENABLING THE ORGANIZATION TO COPE ALLOWING CRITICAL BUSINESS FUNCTIONS TO CONTINUE

4 HOW IT FITS TOGETHER Emergency Mgmt. Crisis Mgmt. Business Resumption Plan IT - Disaster Recovery Plan PEOPLE Evacuation Procedures Emergency Response PEOPLE RECOVERY OF FACILITIES Corporate & Local Crisis Management Teams Command, Control, Communications & Collaboration BUSINESS PROCESSES INFORMATION SYSTEMS PROCESS CONTINUITY TECHNOLOGY AVAILABILITY B U S I N E S S C O N T I N U I T Y

5 Key Components Comprehensive Program Emergency Response Focus: People Action: Emergency Responders Escalated Response Communications Personnel Accountability Personnel Evacuation Employee Education Transition to Crisis Mgmt Team Crisis Management Focus: Decision Processes Action: Crisis Mgmt Team Activation Notification Incident Containment Initial Assessment 800# recorded Web Banner rolls Transition to Business Continuity Team Preparedness Critical Process Id Recovery Strategies Approved by Mgmt. Plans Tested & Improved Vital Records Program IIS, Telecom, Facilities Partner Support Alternate sites selected Business Resumption Focus: Business Revenue Action: Business Continuity Team Recovery Alternate site announced Owners Notified Plans initiated Mail / phone switch redirected Web banner info updated Resumption (to pre-event condition) Site(s) announced Executive Protection Owners Notified Plans Implemented Web banner info updated

6 Security System Model Situational Awareness Risk/Vulnerability Assessment Mitigation Preparedness Response Recovery Business Continuity

7 Business Continuity Program (BCP) BCP Structure SITE EMERGENCY RESPONSE PLAN (Linked to HAZMAT and Fire Prevention Plans) ESCALATED RESPONSE COMMUNICATIONS PERSONNEL ACCOUNTABILITY PERSONNEL EVACUATION EMERGENCY RESPONSE EMPLOYEE EDUCATION FOCUS: PEOPLE OSHA REQUIREMENTS SITE CRISIS MANAGEMENT PLAN TRANSITION TO BUSINESS CONTINGENCY TEAM INITIAL ASSESSMENT INCIDENT CONTAINMENT RESPONSIBILITIES NOTIFICATIONS ACTIVATION FOCUS: DECISION PROCESSES SITE AND/OR FUNCTION/ IPT BUSINESS RESUMPTION PLANS PROCESS CONTINGENCY PLANS (FOR CRITICAL PROCESSES) RECOVERY STRATEGIES APPROVED BY MANAGEMENT CRITICAL PROCESS IDENTIFICATION MANAGEMENT GUIDANCE & ANALYSIS FOCUS: BUSINESS REVENUE VITAL RECORDS PROGRAM INFORMATION SYSTEMS, TELECOMMUNICATIONS, AND FACILITIES BUSINESS IMPACT ANALYSIS RISK ASSESSMENT & VULNERABILITIES ANALYSIS EXECUTIVE PROTECTION CORPORATE AND SECTOR REQUIREMENTS

8 PROGRAM GOALS LIFE SAFETY OF THE EMPLOYEES CONTINUE CRITICAL BUSINESS FUNCTIONS RETURN TO STATE OF NORMALCY? QUICKLY EFFICIENTLY

9 SCOPE OF THE PROGRAM? PORT AUTHORITY FACILITIES REGIONAL INFRASTRUCTURE WATERWAYS TERMINAL OPERATIONS SUPPLY CHAIN AMERICAN ECONOMY

10 ISSUES? AUTHORITY JURISDICTION GOVERNMENTAL UPSTREAM LEGAL AND CONTRACTUAL BUSINESS COMPETITION PRIVACY STAKEHOLDER POLICY

11 DHS DIRECTIVE ON RECOVERY MARITIME INFRASTRUCTURE RECOVERY PLAN PROTECT AMERICAN ECONOMY RESTORATION OF PASSENGER AND CARGO FLOW, SPECIFICALLY CONTAINER CARGO DOES NOT ADDRESS LONG TERM INTERRUPTIONS NOT A PLAN FOR THE PHYSICAL RECOVERY OF A PORT PROVIDES GUIDANCE FOR THE REDIRECTION OF CONTAINER CARGO EXPERIENCE AT POLB/POLA LABOR ACTION OF 2002

12 COAST GUARD INTEREST PAST EXERCISES LEAD SHIELD ROGUE X WORKSHOP CRITICAL PATH UPCOMING SYMPOSIUM

13 CA ENHANCEMENT PLAN INITIATIVE 5: ENHANCE PORT SECURITY PROJECT 5: REGIONAL BUSINESS & GOVERNMENT CONTINUITY PLANNIING PROGRAM MANAGEMENT: DAMAGE AND SAFETY ASSESSMENTS STRUCTURAL INSPECTIONS MITIGATION AND CONSTRUCTION ACTIVITIES PERSONNEL AVAILABILITY BUSINESS PROCESSES, VENDORS, SUPPLIERS UTILITIES RESTORATION LAND AND WATER TRANSPORTATION RESTORATION PRIORITIZED RESTORATION OF BUSINESS AND GOVERNMENT

14 CRITICAL PATH NUMEROUS STAKEHOLDERS BINDING RELATIONSHIPS? UNSTRUCTURED ENTERPRISE INDEPENDENT INTERESTS BUSINESS HUMAN

15

16 STAKEHOLDERS HOW MANY? WHO?

17 RISK ASSESSMENT BUSINESS IMPACT ANALYSIS CRITICAL PROCESSES CONSEQUENCES HUMAN PHYSICAL PSYCOLOGICAL ALL STAKEHOLDERS FINANCIAL COSTS DAMAGE CASHFLOW DOWNTIME/OVERTIME MAXIMUM ALLOWABLE OUTAGE & RECOVERY TIME OBJECTIVES TIME BEFORE IMPACT IS UNACCEPTABLE SHORTAGE ALLOWABLE OUTAGE RESTORED FIRST ESTABLISH DIFFERENT RECOVERY TIME OBJECTIVES COST OF ALTERNATIVE PROCEDURES VERSUS WAITING FOR RESTORATION

18 RTO AND RPO Recovery Time Objective (RTO) is the length of time a business process can be unavailable before the overall business is severely impacted. As part of the impacts reviewed, the Recovery Point Objective (RPO) was included in the BIA update. Recovery Point Objective (RPO) is the timeframe where information must be recovered or it will be become useless due to outdating or volume levels exceeding recovery capabilities.

19 PORT OF LONG BEACH 3,300 acres of land 33% of all CA port cargo 2 nd Busiest port in U.S. Significant HazMat handling Passenger handling 8.1 million population within a 25 mile radius 10 piers 80 berths 7 container terminals 71 gantry cranes 76-foot-deep main channel 5,300 vessel calls in 2005

20 SAN PEDRO BAY: ONE HARBOR TWO PORTS

21 BUSINESS CONTINUITY PORT AUTHORITY ORGANIZATION FACILITIES PROCESSES INFRASTRUCTURE VENDORS AND SUPPLIERS IT SYSTEMS

22 ORGANIZATION TOP LEVEL POLICY PROTECT PEOPLE, PROPERTY & BUSINESS INTERESTS OWNERSHIP OF SYSTEMS, PROCESSES AND RESOURCES MANAGEMENT STRUCTURE DECISION MAKING: QUORUM SUCCESSION PLANNING PERSONAL PROTECTION TRAVEL BRIEFINGS KITS EVACUATION PLANS INSURANCE SOS MEDICAL PPQ S

23 ORGANIZATION (cont d) KEY EMPLOYEES TRACKING AVIAN FLU NO SINGLE POINT FAILURES CROSSTRAINING DOCUMENTED JOB FUNCTION DESK TOP PROCEDURES TELEWORK POLICY DOCUMENTED PRACTICED EXPEDITED EMERGENCY REPLACEMENT POLICY TEMP AGENCIES PRE- IDENTIFIED EMPLOYEE SKILL SURVEYS BEYOND JOB FUNCTIONS SHELTER IN PLACE?

24 FACILITIES BACKUP LOCATION PRE-IDENTIFIED LOGISTICAL SUPPORT WITHIN AREA OF THREAT? SAME POWER GRID? TRANSPORTATION FOR EMPLOYEES REDIRECTION OF MAIL AND DELIVERIES

25 PROCESSES CRITICAL FLOWCHARTED INTERPERSONAL AND INTERDEPARTMENTAL RELIANCES KEY OPERATIONAL SUPPORT BUSINESS RECORDS CAVEAT: IF NOT CRITICAL?

26 INFRASTRUCTURE WATER POWER SANITARY SEWER TELESYSTEMS ROADS BRIDGES

27 VENDORS AND SUPPLIERS KOBE EARTHQUAKE SINGLE SOURCE? JUST IN TIME VULNERABILITY ASSESSMENTS SITE VISITS VALIDATED BC PLANS REQUIREMENT IN K

28 IT SYSTEMS SEPARATE PLAN PLUG AND PLAY BACKUP SITES COLD V. HOT LOCATION

29 ALTERNATIVES ATTAINABLE HIGH PROBABLILITY OF SUCCESS VERIFIABLE THROUGH TESTS AND EXERCISES COST EFFECTIVE APPROPRIATE FOR THE SIZE AND SCOPE OF THE OPERATION

30 CONSIDER PRIVATE SECTOR CAPABILITIES EQUIPMENT SUPPLIES TECHNICAL EXPERTISE LOGISTICAL CAPABILITIES GOVERNMENT DOES NOT UNDERSTAND BUSINESS MODELS AND ECONOMIC IMPACT

31 CRITICAL SOCIETAL FUNCTIONS FOOD TRANSPORTATION SHELTER HEALTH AND SANITATION BANKS FAMILIES

32 MEDICAL PLANNING FIRST RESPONDERS STOCKPILES OF MEDICINES PROPHYLACTIC TREATMENT PSYCHOLOGICAL SUPPORT GRIEVING AREA? LONDON EXPERIENCE

33 BUSINESS CONTINUITY OPERATIONS CENTER CONTENTS TEAM ACTIVATION LOCATION

34 BUSINESS CONTINUITY CULTURE ASSESSING DESIGNING AND DELIVERING EXERCISING OF PLANS MAINTENANCE AUDITS SELF EXTERNAL

35 DESIRED END RESULT RESILIENCY ORGANIZATION INFRASTRUCTURE PROCESSES QUICK DECISION MAKING ADAPTABILITY PRE-IDENTIFIED ALTERNATIVES

36 BUSINESS CONTINUITY Business Continuity Plan PEOPLE BUSINESS PROCESSES PROCESS CONTINUITY Comprehensive and documented plan utilized in the event of a disaster, focus solely on the business operations. Plan defines resources, actions, tasks and data required to manage the recovery effort in the event of a business interruption. Identifies: Primary location Alterative Recovery Sites (Alt 1 and Alt 2) Interdependencies (internal and external) RTOs and RPOs Critical People Applications Data Vendors Vital Records 800 numbers Web sites (internal and external)

37 CHALLENGE NATIONAL PRIORITY SYMPOSIUM LOCAL PLANNING IDENTIFIED SCOPE SUPPLY CHAIN CRITICAL PATH INTEGATION OF ALL STAKEHOLDERS