RPI Employee s Federal Credit Union Business Continuity/Disaster Recovery Plan. January 23, 2012

Transcription

1 RPI Employee s Federal Credit Union Business Continuity/Disaster Recovery Plan January 23, 2012 Purpose and Objectives 2 Disaster Recovery Organizational Structure 3 Appendices: Disaster Recovery Emergency Response Team 4 Disaster Recovery Subteams and Membership Page 1 Recovery Team 5 2 Damage Assessment Team 7 3 Restoration Team 9 4 Public Relations Team 11 5 Logistics Team 13 Appendix A: Disaster Categories 15 Appendix B - Record of Disaster Recovery Occurrence 18 Appendix C - Product Service Providers and Contacts 19 1

2 PURPOSE AND OBJECTIVES Plan Purpose: The objective of the RPIEFCU s Business Continuity/Disaster Recovery Plan is to minimize financial loss and ensure a timely resumption of operation in the event of a disaster. A disaster is any event resulting in damage to equipment, damage to the physical location, and/or injury to personnel, to the extent of which it is serious enough to require action for recovery, and is outside the authority of those initially aware of such an event. This plan addresses a course of action that will be taken in the event the organization experiences a disaster as described above. The Business Continuity/Disaster Recovery Plan will be tested at a minimum, annually. This test will include a review of the plan by the board of directors and a simulated disaster. Plan Objectives: 1. PROTECTION OF PERSONNEL: The first objective of the Business Continuity/Disaster Recovery Plan will be to provide for the protection of personnel during and after a disaster situation. 2. PROTECTION OF ASSETS AND RECORDS: The second objective will be the protection of assets, records, documents and vital statistical data, and the preservation and safekeeping of our property. 3. CONTINUITY OF MANAGEMENT: In a disaster, executives, or vital staff members could be killed or incapacitated. This plan will provide for the continuity of management and personnel requirements. It will also define the lines of authority and responsibility during and after a disaster. 4. MINIMIZE LOSSES AND RECOVERY TIME: In some disasters, a business as usual environment will not always be lost; thus, another objective will be to recover the critical business functions at an alternate location within 24 hours. 5. RESUMPTION OF NORMAL OPERATIONS: Our reputation and the client s confidence in the stability of the organization are important resources, and a lengthy interruption in service could erode or destroy the confidence and reputation. The final objective of the Business Continuity/Disaster Recovery Plan will be to resume operational status of the critical business functions within 24 hours and to maintain operational capabilities status at the alternate locations until normal support and operational capabilities can be re-established in a permanent environment. 2

3 3

4 DISASTER RECOVERY EMERGENCY RESPONSE TEAM The emergency response team will meet at the following location to determine whether or not to declare a disaster, assess the damage, and implement whatever activities are necessary: Folsom Library lobby Alternate location TEAM MEMBERS: Hilton Garden Inn lobby 235 Hoosick Street Troy, New York Team Member 1 - Joanne Esposito, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Warren Wallin Work Phone Home Phone Cell Phone Team Member 3 - Paul J. Galbraith Work Phone Home Phone Cell Phone

5 SUBTEAM MEMBERS Recovery Subteam Team Member 1 - Jacqueline Farmer, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Terrance Burns Work Phone Home Phone Cell Phone Team Member 3 - Bill Mielke, Secretary, Logistics Rep Work Phone Home Phone Cell Phone Recovery Team Responsibilities The responsibilities of the Recovery Team during a disaster situation are to: Authorize Business Continuity Disaster Recovery plan activation Ensure the safety of all employees Authorize the initiation of alternate site notification procedures Notify all affected employees Authorize and evaluate the extent of the damage Develop the recovery directive according to the type of situation Provide overall direction to all employees Notify regulatory agencies as required Implement effective security measures Document all activities during the recovery effort 5

6 Coordinate all purchasing activities Coordinate the distribution of equipment, furniture and supplies Coordinate activities with insurance adjusters Coordinate activities with contractors Maintain communication with the Disaster Recovery Emergency Response Team Leader Joanne Esposito Work Phone Home Phone Cell Phone

7 Damage Assessment Subteam SUBTEAM MEMBERS (Continued) Team Member 1 - Mary Alice O Brien, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Phylis Federici Work Phone Home Phone Cell Phone Team Member 3 Eleanor Burns Work Phone Home Phone Cell Phone Damage Assessment Responsibilities This team will perform a damage assessment and salvage activities at the damaged facility: Determine the extent of personal injury to personnel at the damaged facility If there is a personal injury, notify emergency services immediately Determine the extent of the damage to facilities, electronic equipment, furniture, vital records, forms, supplies and documentation Assess the need to implement security procedures to insure proper access controls to all work areas and that salvageable items are safeguarded Take appropriate steps to minimize further loses to personnel and facilities 7

8 Report the extent of personal injury and physical damage to Recovery Team Leader Jacqueline Farmer Work Phone Home Phone Cell Phone Determine, based on the extent of the damage, the need to declare a disaster Prepare written documentation detailing the finding to support the need to declare a disaster Coordinate the move, storage or on-site protection of salvageable items Coordinate all vendor activities at the damaged facility Assist and support team leaders to relocate critical functions at the appropriate alternate location Document all activities Maintain communication with the Disaster Recovery Emergency Response Team Leader Joanne Esposito Work Phone Home Phone Cell Phone

9 SUBTEAM MEMBERS (Continued) Restoration Subteam Team Member 1 - Terrance Burns, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Earl DeVito Work Phone Home Phone Cell Phone Team Member 3 Theresa Testo Phone Restoration Responsibilities After the extent of the damage is determined by damage assessment personnel, the Restoration Sub Team will assess what resources are necessary to secure the exposed assets of the corporation, including personnel Notify internal and external security personnel and inform them of the actions to be taken to secure the corporation s assets Obtain telecommunications equipment to allow communication between the security personnel and the recovery team Contact security personnel to meet at the damaged facility and the temporary facility to protect the assets of the corporation Request to acquire new security equipment for installation at the appropriate location to properly monitor the corporation s assets Appoint additional personnel to the location where business functions will be conducted and instruct them to implement all daily security procedures as documented in the security policy manual Coordinate the installation of newly acquired devices at the alternate location where business functions are being conducted. Document all activities 9

10 Maintain communication with the Disaster Recovery Emergency Response Team Leader Joanne Esposito Work Phone Home Phone Cell Phone

11 Public Relations Subteam SUBTEAM MEMBERS (Continued) Team Member 1 - Sandra Redemann-Butcher, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Theresa Testo Phone Team Member 3 - Joanne Esposito Work Phone Home Phone Cell Phone Public Relations Responsibilities This team is responsible for notifying Rensselaer Polytechnic Institute administration, the press, and other news media. It is imperative that the message is clear that Credit Union members monies are safe (insured), that the Business Continuity/Disaster Recovery Plan is being implemented Formulate a press release to be issued to the press. Control all responses to the press. Authorize only those responses that will emphasize positive reinforcement of the corporation s position and its ability to protect client s assets. Whenever dealing with the media follow the basic rules as listed below: Have one company spokesperson; be careful of reporters a. Say as little as possible b. If you speak to the media; tell the truth c. Do not say anything Off the record d. Never say No comment e. Emphasize the positive, communicate the corporation message f. Provide accurate information and correct inaccuracies. Initiate a press release to all members, business will operate as usual and to inform them of where member s services are being performed and how to contact the Credit Union. 11

12 Be prepared to hold periodic press conferences to inform members of the status of recovery efforts. Document all activities Maintain communication with the Disaster Recovery Emergency Response Team Leader Joanne Esposito Work Phone Home Phone Cell Phone

13 SUBTEAM MEMBERS (Continued) Logistics Subteam Team Member 1 - Bill Mielke, Team Leader Work Phone Home Phone Cell Phone Team Member 2 - Warren Wallin Work Phone Home Phone Cell Phone Team Member 3 - Joanne Esposito Work Phone Home Phone Cell Phone Logistics Responsibilities The Logistics Team is responsible for procurement of supplies and replacement of assets, insurance claim filing, employee payroll, and an account of recovery efforts as well as maintaining daily financial matters. Implement administrative and clerical support capabilities, including coordination of communication methods to subteam members. The Logistics Team Leader is the secretary to the Recovery Team and is responsible to document each and every action and decision made by the Recovery Team Members and all decisions being made by other Team Leaders in an events log. Include date, time, subject, follow-up actions, and personnel responsible to follow through. Maintain personnel work schedules, locations, out of pocket expenses, transportation arrangements, etc. Coordinate all transportation requirements for the Recovery Team, including travel advances, travel arrangements, hotel accommodations, itineraries and work schedules. Instruct all Team Leaders to complete and deliver their general supplies request form to prepare to order necessary items. 13

14 After the Recovery Team has determined what equipment, furniture, supplies, forms, etc. are needed to recover its critical functions, order replacement items from the appropriate vendors. Coordinate the distribution of newly acquired items to the appropriate areas. Document all activities. Maintain communication with the Disaster Recovery Emergency Response Team Leader Joanne Esposito Work Phone Home Phone Cell Phone Reviewed and Approved 1/23/

15 APPENDIX A RPIEFCU DISASTER CATEGORIES The Business Continuity/Disaster Recovery Plan addresses the following risks: 1. FIRE: The probability of a fire is an ongoing concern for any financial institution. Since the Credit Union is in an office building administered by Rensselaer Polytechnic Institute (currently located in West Hall on the Rensselaer Campus), a fire could occur outside the Credit Union office and still affect the Credit Union. The Credit Union has smoke detectors, fire extinguishers, and sprinklers in the Credit Union Office. The building (referred to as West Hall) also has similar equipment, as well as fire alarms. The Troy Fire Department is less than a mile from the Credit Union Office. Fire hydrants are located adjacent to West Hall. A fire alarm box is located on the third floor of West Hall, across from the Credit Union entrance. Vital records are stored in fire resistant containers located in the Credit Union office. Cash and checks are stored in the safe. If a fire occurs during work hours, staff safety comes first. If time permits, the Manager will lock the safe. Employees will lock fire resistant containers. Windows will be shut and each employee will shut down their equipment. The office will be secured when vacated by the employees. If the Credit Union office became inoperable from a fire, the Credit Union will start relocation procedures. The Credit Union estimates it will take 12 to 48 hours before the Credit Union is relocated at another location. FIRE DRILL Rensselaer Polytechnic Institute conducts fire drills semi-annually. The RPIEFCU, as occupants of Rensselaer owned and administered buildings, must participate in the drills and follow Rensselaer regulations regarding vacating the building. At the time of said fire drills: 1. Each employee will shut down their equipment, including computers and printers. 2. The Office Manager/designee will close and lock the safe. 3. Each employee will secure their area and leave the office promptly. Securing an area includes locking all file cabinets, shutting all windows and doors. 4. All employees will assemble in the parking lot of the Credit Union for a head count by the Office Manager/designee. 15

16 5. The Office Manager/designee will secure the main entrance to the Credit Union upon departure. 2. ELECTRICAL FAILURE: Electric failure must be reported by the Office Manager to the Physical Facilities office of Rensselaer, ext. 6238, immediately. A request for emergency power generation until restoration of power should be made to Physical Facilities to ensure the continued operation of the Credit Union during business hours. If it is determined that the electrical failure is beyond the control of RPI (such as brownouts, blackouts, weather) the Credit Union office should be promptly secured and closed until further notice. The Office Manager is to contact the Disaster Recovery Emergency Response and Public Relations Team Leaders. Proper signs should be posted at the Credit Union entrance by the Office Manager. 3. EARTHQUAKE: The Credit Union, which is located in the Hudson Valley of New York, is near a fault line. A serious earthquake has not occurred in over 200 years. Depending upon the damage, the initial relocation will be either at the Folsom Library lobby or the Hilton Garden Inn, 235 Hoosick Street, Troy, New York FLOOD: An external flood is a very remote probability with the geographic location of Rensselaer Polytechnic Institute. There is a higher probability that the Credit Union office will flood due to broken water pipes or broken steam lines. All CPU units are located 30 above the floor. However, in the event of internal flooding, floor drains are located within 150 ft. of the Credit Union office. 5. HIGHWAY CLOSURES STORM DAMAGE: The probability of a snow or ice storm closing highways in Rensselaer County is low. If the County closes all highways, the Credit Union will be closed. In the event that a snow or ice storm closes major routes to Troy, the Credit Union will be closed until routes are passable. 6. WAR ATOMIC BOMB, TERRORIST ATTACK: The Credit Union has no plans to recover operations in case of an atomic attack. Such an attack would be totally devastating to this State. In a conventional war and a terrorist attack, and except for road closures, the Credit Union will be operational, unless military/government officials deem it is unsafe. 7. LOSS OF HEAT: If the Credit Union office temporarily loses heat, electric heating units may be purchased or rented from a number of local vendors. However, in the event of a long-term heat loss, the Credit Union will set up temporary quarters at the Folsom Library lobby or the Hilton Garden Inn, 235 Hoosick Street, Troy, New York Signs will be posted at the 16

17 Credit Union Office and s will be sent to direct members to the temporary location. 8. LOSS OF WATER: The Credit Union will function without water. Employees will be given bathroom breaks. Normal operations are expected to return within 24 to 48 hours. 9. TELEPHONE LINES DEAD: If the telephone lines are inoperable, the Credit Union will continue to service member accounts with the in-house computer systems and will coordinate phone services with DOTCIO 10. COMPUTER FAILURE: The RPIEFCU has an extended maintenance agreement with AMI covering both hardware and software. The software service is called The Ultimate CURE (Credit Union Disaster Recovery Enhancement). This service transits a daily backup of the RPIEFCU member s information via the internet to AMI s secure servers located in Racine, WI. The back up system is completely automated and runs nightly. There is an sent daily verifying that the system was backed up and that it has verified its integrity. Should it be necessary, the AMI system can be run over a dial up phone line or high speed internet connection until a suitable location can be found. AMI s toll free number is AMI has a 24-hour, 365-day maintenance agreement with RPIEFCU. The address is: [email protected]. AMI can print checks from the on-line station. 17

18 APPENDIX B RPIEFCU Record of Disaster Recovery Occurrence Date: Disaster Category: Description: Actions Taken: Signature: Date: 18

19 APPENDIX C - RPIEFCU List of Product/Service providers 1. AMI ( ) 2. Rensselaer Polytechnic Institute Physical Facilities Office (ext. 6238) 3. Citizens Bank, 1818 Fifth Avenue, Troy ( ) 4. Rensselaer s DOTCIO Help Desk (ext. 7777) a. Help desk to notify service provider, if necessary 5. Rensselaer Polytechnic Institute s Vice President of Administration (ext. 6601) 6. Members United Bridge Corporate Federal Credit Union ( or ext. 3833) 7. National Credit Union Administration ( Albany Office) 8. CUNA Mutual Insurance Company ( ) 9. New York State Credit Union League ( or ) 19