Business Continuity and Disaster Recovery Tabletop Exercise

Transcription

1 Business Continuity and Disaster Recovery Tabletop Exercise Presentation Content Provided by the Association of Contingency Planners (ACP ACP) Dr. Ed Goldberg, CBCP ACP Education Director

2 Hurricane Isaac

3 Why worry these things happen so infrequently. Hurricane Katrina, 8/29/2005 Hurricane Isaac, 8/27/2012

4 Hurricane Katrina Simple Case study & timeline Landfall in southeast Louisiana as a category 3 hurricane 8/29/2005. Entergy New Orleans filed for bankruptcy 9/23/2005.

5 What went wrong? Why bankruptcy? The local utility is a great example: don t utilities plan and prepare for such things? A tale of a power company tells an underlying story.. When a system is damaged extensively, there s insurance, loans, recovery of prudent costs, etc. If the COMMUNITY is gone, there is no current or future source of revenue, therefore no loans and no resources The COMMUNITY is reliant on its businesses for its very existence There are 28 million small businesses in the United States. How many would survive a disaster? How many have continuity plans? The New Orleans community went out of business. Even the UTILITY went bankrupt.

6 For those of you with a quantitative leaning.. 9 out of 10 companies (90%) unable to resume business operations within 5 days of a disaster are out of business within 1 year Nearly 4 out of 5 (78%) businesses faced with a catastrophe without a contingency plan are out of business within 2 years (Original source unknown; cited in innumerable reports AT&T, Agility, SBA, etc.)

7 Let s proceed as if you re convinced of the need for contingency plans for your business/organization To make you really smart, in just 10 minutes, we ll cover: What are the buzzwords? So many new, similar terms. What kind of plan(s) do I need? What are the risks? How much work is it? How do I begin? What planning help is available? Will having a plan lower my insurance rates? How does preparing myself and my family contribute to preparing my business/organization? And we ll answer your questions, address concerns, give you some good resources, etc. (What smart looks like)

8 What are the buzzwords? Business Continuity (BC) Plan a plan for performing your business/organization s critical business processes during and after a disaster Disaster some event or condition/environment that challenges your business/organization s ability to perform its critical business processes Disaster Recovery (DR) Plan the IT (Information Technology) piece of your BC plan Continuity of Operations Plans (COOP), Business Resumption Plans, Business Resiliency Plans, etc. are often interchangeable, often used by vendors or large organizations to indicate some next step above and beyond basic BC/DR plans. Business Impact Analysis (BIA) what large companies do to gather the necessary information about their business processes to begin evaluating what they need in their BC and DR plans

9 What keeps you up at night? Risk! What are the risks that would interrupt your performing crucial business processes? First, define what processes NEED to continue Then evaluate threats/risks Risks can include. Fire, flood, etc. Violence Unknown substance Data breach & other IT attacks Weather events & solar storms Crime & terrorism Regulations/compliance Social media Economy and other environments Loss of personnel Pandemic Supply chain disruption including energy (oil, propane, gas, long term power outage, etc.) Chemical or nuclear accident Sabotage, etc.

10 What kind of plan do I need? Old paradigm: DR plan only What we ve learned: Business Continuity Plan. Loss of facility Alternate worksite Supplies Communications, etc. Loss of people Source for skilled workers Help from others including competition HR help Loss of systems Computers Media Services How can one plan deal with hurricanes, pandemics, fire, flooding, workplace violence, unknown substances, etc.? All-hazards approach: Loss of facility Loss of people Loss of systems Sometimes intangibles such as reputation For the vast majority and for those just getting started, you need the basics a business continuity plan and a disaster recovery plan.

11 How much work is it? For a small business less than, say, 25 employees, a decent BCP is probably just a couple of hours of work up front, and then an hour once or twice a year to keep it fresh. Business Continuity Plans BCP s are living documents. They require a little care and feeding or they won t be very useful when needed. One piece of care and feeding is to exercise the plan(s) at least once per year. A tabletop exercise an hour or so with everyone involved with the plan should be adequate. (Office Space, 1999, 20 th Century Fox)

12 How do we get started? Coming here was a great first step We can discuss what goes into a BC plan and we will but let s make it really easy and quick.with a free (really) template. Want it electronically? OpenForBusiness_new.pdf Or type in ibhs.org and click on the Open For Business link, then on the picture of the cover (same as ).

13 What s in a BC plan? Contact info for employees (either a list or a call tree); Key vendors & suppliers info contact info, perhaps some procurement info (contracts, PO numbers, etc.) Other key contacts such as investors and other stakeholders A list of critical business functions & processes Alternate work location, recovery location or plans to work from home, etc. Supplies including the whole supply chain and things like perishables, energy (oil, propane, etc.), components of your system/work/processes, etc. Systems, machines, vehicles depends on what you need Communications stuff What IT systems you need and this becomes your IT DR plan, either in house or 3 rd party, etc. Backup data/systems and instructions on how to use it

14 What s not in your plan? TRIBAL KNOWLEDGE aka Tacit Knowledge, intuition, closely held trade secrets, etc. Why is this mentioned? If a reasonably competent person with necessary basic skills can t perform a task or otherwise engage in the work needed to continue a process, the plan(s) will fail. Remember to plan for Loss of People! You need to somehow provide for the continuance of business processes, including passing on the recipes or other trade secrets. It s not likely that you would put such detail into your BC plan, but it needs to exist somewhere, even if only in more than one person

15 What planning help is available? There are lots of options to get this done, daunting as it may seem. Do it yourself and have it reviewed by an expert volunteer Become a bit of an expert or have someone in your organization do so Hire a consultant or otherwise outsource it Big organizations/businesses have people on staff who are expert at BC/DR planning. Those people are often willing to help through their professional organizations. No organizations compete on the basis of preparedness, and so they tend to share best practices. It s in all of our best interests to be prepared companies are only as resilient as their host communities. It doesn t mean that unlimited free consulting is readily available, of course. But just as I and my company want to see you all better prepared, so too do all the other larger organizations in your community. Help is available! Where can one get volunteers to review their plans, get educated on BC/DR, network and learn from others, and even meet those who do this professionally?

16 The Association of Contingency Planners (ACP) Not for profit 501C6; National network offers online education (webinars, etc.) 42 local chapters provides educational programs ~monthly Members will review plans, make recommendations for further help The best all-around BC/DR/EM organization, including thousands of members in 45 chapters across the US and

17 What good is all this if no one comes to work post-disaster? Preparedness begins at home Each of us, our coworkers and employees need.. a kit. a plan.a way to get information ( default.asp) Lots of resources available, and it doesn t cost much to make a kit. Can any of us afford not to be prepared?

18 Questions?

19 EXERCISE SET-UP: SPEED DISASTERING You have exactly 5 minutes to do all of the following action items right now: 1. Quickly but without getting hurt, take all of your belongings and move to the table designated by the number on your badge 2. Quickly introduce yourselves and pick your city or town (your table will become that one city/town) 3. Assign the following roles to yourself and your tablemates: Mayor/First Selectman Emergency Management Director Fire Chief/Public Safety Director Police Chief Sanitarian/Health Director/Social Services 4. Appoint a scribe for the table. This person must take notes for subsequent exercise debrief.

20 Today is Tuesday, September 30. Current Status / Situation It is week 4 of the nationwide H7N9 pandemic All organizations businesses, government agencies, etc. are experiencing across the board 30% absenteeism. This began 2 weeks ago and is expected to continue for 4 more weeks.

21 A small, fast moving Category 1 hurricane is expected to impact all of Connecticut tomorrow (Wednesday) from 8am until noon. Discuss for 2 minutes Take notes for subsequent debrief Updated Status:

22 Status update: Wednesday The hurricane has past. Winds in your town never exceeded 70mph, and were sustained over 50 mph for only an hour The power is on in 70% of the town, including the main roads and business district(s) 10% of the roads have downed tree issues Weather is unsettled overcast, 20mph wind with gusts to 35mph, some rain, thunder, etc. Discuss for 2 minutes. Remember to take notes.

23 As is often the case during/after hurricanes, a small funnel cloud touched down The funnel cloud derailed a train in the center of the city, overturning one tanker carcarrying 10,000 gallons of hydrazine and a truck carrying an unknown quantity of propane.. All of the hydrazine leaked out within minutes Status update:

24 Everything you ever wanted to know about hydrazine but were afraid to ask Colorless, smells like ammonia Highly flammable Used to make foams, pharmaceuticals, spandex, polymers, pesticides, dyes, rocket fuel, airbags and to reduce corrosion in power plants. Yes, it is truly hard to imagine life without hydrazine. Short-term exposure causes irritation of the eyes, nose, and throat, dizziness, headache, nausea, pulmonary edema, seizures, coma in humans. Long-term exposure can also damage the liver, kidneys, and central nervous system. The liquid is corrosive and carcinogenic. It is now in your town s air, groundwater, storm drains, underground vaults and conduits, nearby wetlands, basements, etc. Discuss for 10 minutes and, again, take good notes!