Business Continuity Planning for Schools, Departments & Support Units

Transcription

1 Business Continuity Planning for Schools, Departments & Support Units 1

2 What is Business Continuity Planning? Examples Planning for an adverse, major or catastrophic event that would cause a disruption to our mission critical operations and services Environmental disasters Equipment or system failures Loss of facilities or utilities Deliberate acts of disruption Business continuity planning process is an ongoing process that includes crisis management planning, business recovery, disaster recovery, business resumption, and contingency planning 2

3 Why do we have to do this? To minimize disruptions and be prepared during an event that may impact our mission critical services: education/teaching research health care/patient services support to our community Over 20 agencies have regulatory or accreditation requirements for business continuity, contingency plans or disaster planning Obligations legal, regulatory, contractual Reputation to our stakeholders for reacting to events and our preparedness 3

4 Business Continuity Planning Team Composed of first responders that are called upon to evaluate initial assessments of safety and security of personnel, integrity of facilities, and damage to infrastructure 4

5 What is your role? As a mission critical and key support units you may be called upon during an event or incident to provide services in an alternate format, or you may be a victim of the event. You must: Identify your critical support services to the institution Identify your role in the event of a disaster that may be outside of the normal day-to-day operations Identify personnel, resources, information technology and supplies that you would need to continue operations or to minimize disruptions during a major event Identify alternate processes, procedures and work space locations, and dependencies on other support units if services are lost 5

6 Activation of Business Continuity Plans and Processes 6

7 Jurisdictions During Major or Catastrophic Events University Police has jurisdiction in the investigation of any disaster occurring on-campus. University Police should be notified immediately so the President s Office and other appropriate officials may be alerted. Office of Communications has the overall responsibility of providing the media with information about a major or catastrophic event. 7

8 Approach for Business Continuity Plan International Standard

9 Environmental Disasters All-Hazards Approach Organized and/or Deliberate Disruption Loss of Facilities & Utilities Equipment or System Failures Contamination & Environmental Hazards Acts of Sabotage (includes IT hacking/unauthorized intrusions) Cooling Plant Failure Communication services breakdown Drought Acts of Terrorism Electrical Power Failure IT Systems Failure Earthquake Active Shooter Emergency Power Failure Specialized Equipment Failures (includes health care equipment) Pandemic/Epidemic Arson Loss of Gas Supply Wild Fire Criminal Activities Loss of Water Supply Flood Workplace Violence Petroleum & Oil Shortage Freezing Conditions Labor Disputes/Civil Disorder Structural Failure Other Emergency Situations Hurricane Bomb Threats Loss of Drainage/Waste Removal Community Hazards Severe Storms Envelope Failure Tornado 9

10 Key Support Areas and Interdependencies Education Research Clinical Business Facilities Communication Office of Vice President for Academic, Faculty & Student Affairs Office of the Vice President for Research School Practice Plan Offices: - Dental - Medicine - Nursing Business Affairs - Accounting - Budget Office - Bursar - Material Mgt - Payroll - Purchasing - Sponsored Programs University Police President s Office Associate Deans for Academic/Student Affairs Offices: - Dental - Graduate - Health Prof - Medicine - Nursing Associate Deans for Research from Schools - Basic Research - Clinical Research Student/Employee Health Clinics Human Resources Environmental Health & Safety Office of Communications Counseling Services Laboratory Animal Resources Information Management & Services Facilities Planning & Operations Governmental Affairs Behavioral Intervention Team Institutional Review Board (IRB) Legal Affairs Facility Space Planning Institutional Animal Care & Use Committee (IACUC) Regulatory Affairs & Compliance 10

11 Institutional Stakeholders Employees Students, Residents, Fellows Patients Research Participants Affiliated Partners Community Vendors/Suppliers Regulators Accreditation Organizations Licensing Boards Financial Investors and Donors Sponsored Granting Agencies Board of Regents 11

12 Business Impact Analysis for Schools and Support Units Who are your stakeholders for education, research, health care and community service? What critical services do you provide? If the event impacts your operations, what priority resources do you need to recover to minimize disruption to your services and activities? - facilities or work sites - communication systems - key personnel - animals, biospecimen repositories - vital records and databases - vital technology and databases - specialized equipment for research or clinical care - key vendors and needed supplies, including pharmaceuticals Who is part of your recovery team and who has authority to make decisions? 12

13 Business Impact Analysis for Administrative Support Areas Determine the qualitative and quantitative impact of a disruption What is the maximum tolerable period of disruption and/or maximum acceptable outage that you could sustain before the event has an adverse impact and becomes unacceptable for you to provide services or perform activities? Prioritize recovery objectives - Summarize cumulative impacts of interruptions to all services and activities - Analyze relative impacts of interruption of each activity in order to rank them to time sensitivity and maximum tolerable period of disruption 13

14 Framework for Business Continuity Plans Facilities and Work Sites What facilities or work sites can serve as an alternate physical location for the prioritized activity? Which are the location requirements to ensure performance? Communication Systems What type(s) of communication systems are needed to support the activity? Include all forms of communication systems (land lines, cell phones, , internet, etc.) that are being used for communications. Key Personnel What type of personnel (specialized skills, knowledge, or training) are required to perform an activity? Other than executive positions, what is the level of staffing required to perform the prioritized activity? Vital Records and Databases What specific type of records and databases (both electronic and paper) are used in the performance of the activity? Vital records and databases include any documents, references, records and information systems that are needed to support the institution s prioritized activities, regardless of the form of media in which they are created. Vital Technology and Equipment What type(s) of systems and equipment are needed to perform the prioritized activity? In determining the requirements of specialized systems and equipment, it is important to distinguish between equipment that is used occasionally for a specific (but highly important) task and equipment that is used routinely. Disruption of the former may be, on average, not damaging, whereas disruption of the latter could be very damaging. Key Vendors What vendors or suppliers provide key goods or services required to perform the prioritized activity? Need to question whether these key vendors or companies also have contingency plans for disruption of their operations. Do we have service level agreements or memorandums of understanding in place with the vendors and suppliers in the event of a widespread disruption. 14

15 Levels of Severity and Impact Severity Levels Number Assignment Description Severe 4 Disaster An incident that has the potential or does seriously impair or halts university operations. Disasters require a coordinated response from all campus resources and outside emergency resources would be essential. The business continuity plan would definitely be implemented. High 3 Major Incident - The University operations would be disrupted for more than 12 hours. The business continuity plan would definitely be implemented. These incidents require a coordinated response beyond normal operating capabilities. External services may be required, as well as major efforts from campus support services. Medium 2 Medium Level Incident - Some activities may be interrupted, but the University could be operational within 12 hours. The business continuity plan might or might not be implemented. Low 1 Minor Incident - The University operations could continue with little or no interruptions. These incidents normally can be resolved with existing resources or limited external assistance. 15

16 Conduct Risk Assessment Template provided and following steps should be taken: Taking each of the incidents identified in the template and as part of the all-hazards assessment: 1. Determine and describe the threat scenarios for which continuity strategies and plans would need to be developed for your area. 2. Assess and identify the impact on your mission critical functions and processes. 3. What mitigating activities and strategies do you already have in place for recovery and to minimize disruption? Such as, back-up records at off-site location. 4. As part of your assessment you may identify additional activities and strategies that need to be considered and implemented. 5. Then, in the event of the specific incident, what are your general recovery strategies and options? 16

17 Scenario, Risk or Threat Description Example of Risk Assessment Process Impact on Mission Critical Functions/Processes Mitigating Activities/ Strategies Additional Activities/ Strategies to be Considered General Strategy Options for Recovery Does Scenario Warrant Business Continuity Plan? Example: Fire leading to a loss of building and contents, including vital records and equipment Building loss. Utilities and University supported network services are still intact at other campus locations. Information technology Data loss Equipment not recoverable 20% reduction in service; or, Halt all operations (all services provided within same area) Back-up tapes offsite Agreement with IMS for backup computer equipment Alternate location to set-up operations identified Vital paper records converted electronically and store off-site Implement a process to perform a backup restoration Relocate services to Exercise emergency rental agreement for equipment and workstation recovery to restore departmental operating capacity to initially 40% Prioritize educational, research and health care at alternate sites, or provide alternate service options Yes Other examples may include flooding, and storms that lead to the loss of utilities, loss of network, etc. Loss of utilities to building electricity and cooling. Impact on work force to perform duties. Disruption to research, teaching and patient care services Unable to access electronic databases to perform activities and services. Contact Facilities to activate back-up generators to building, if possible Manual work around procedures. Maintain documentation of manual procedures and forms to ensure the continuity of services. Develop recovery procedures for data entry that may have been impacted. Activate manual procedures for services. If building not operational for work, locate to alternate location. Identify key personnel for continuation of services and consider alternate plans for research, teaching and patient care. Yes 17

18 Scenario Examples of Strategies to Consider for Education Mitigating Strategies and Recovery Options to Consider As Part of Risk Assessment Loss of Facility/Building Reschedule courses to alternate site for teaching until new or existing site if functional alternate sites identified. Alternate equipment needs are identified. Off-site back-ups of paper and electronic student records. Notifications to accreditation and regulatory authorities if classes are postponed for a period of time (academic year-end may need to be expanded to meet State requirements) Loss of IT resources IT has back-up plan for recovery of educational records on Blackboard. But, if service delayed, what would you do? Evaluate alternate teaching settings/avenues for students. Loss of faculty/workforce (pandemic/epidemic) Evaluate alternate teaching settings/avenues for students. Example might be implement distance/on-line teaching plans. Develop a plan for fitness-for-duty criteria and priority clearance for teaching staff. If students impacted, develop clearance process for students. Loss of utilities Evaluate alternate teaching settings/avenues for students. Loss of communication systems Develop alternate communication plan for key academic/teaching personnel and students. 18

19 Examples of Strategies to Consider for Research (Basic Science and Clinical) Scenario Mitigating Strategies and Recovery Options to Consider As Part of Risk Assessment Loss of Facility/Building If specimen repositories all in one location, consider contract for storage with external organization. For non-emergent clinical research participant services, reschedule participants. For emergent care, identify alternate site for care. Reschedule research to alternate site until new or existing site if functional alternate sites identified. Alternate equipment needs are identified. Off-site back-ups of paper and electronic research records. Notifications to funding and regulatory authorities. Contamination & Environmental Hazards Isolate contaminated specimens. Enact quarantine for animals. Enact treatment plan for animals with exposure. Identify alternate locations for staff, research participants, etc. Loss of IT resources IT has back-up plan for recovery of research records on institutional server. But, if access delayed, what would you do? Evaluate alternate teaching settings/avenues for students. Loss of faculty/workforce (pandemic/epidemic) Evaluate alternate plans for continuation of critical research and postponement of non-critical studies. Develop a plan for fitness-for-duty criteria and priority clearance for research staff. Loss of utilities Evaluate alternate sites and plans for research. Evaluate alternate plans for continuation of critical research and postponement of non-critical studies. Loss of communication systems Develop alternate communication plan for key research personnel, research participants, students, animal personnel, etc. 19

20 Examples of Strategies to Consider for Clinical & Health Care Activities Scenario Mitigating Strategies and Recovery Options to Consider As Part of Risk Assessment Loss of Facility/Building For non-emergent patient services, reschedule patients or refer them to other care providers. Identify alternate site or providers for emergent patient care services (for example, chemotherapy for patients). Contracts with vendors and suppliers for clinical supplies and pharmaceutical needs. Identify alternate sites for resident and/or student training. Alternate equipment needs are identified. Off-site back-ups of paper and electronic patient records. Develop alternate plans for key clinical personnel. Develop plan and priorities for re-opening of facility. Loss of IT resources IT has back-up plan for recovery of electronic records on institutional server. But, if access delayed, what would you do? Evaluate alternate methods to treat patients if no access to patient records. Loss of faculty/workforce (pandemic/epidemic) Develop a plan for fitness-for-duty criteria and priority clearance for clinical staff. Contracts with third-parties for clinical staff back-ups. For non-emergent patient services, reschedule patients or refer them to other care providers. Loss of utilities Evaluate alternate patient care settings. For non-emergent patient services, reschedule patients or refer them to other care providers. Develop alternate plans for key clinical personnel. Loss of communication systems Develop alternate communication plan for key clinical personnel, patients, residents, community partners, etc. 20

21 Examples of Strategies to Consider for Community Service Activities Scenario Internal incidents, threats and events occurring on-campus (from all-hazards list) which may impact community service activities or outreach. Mitigating Strategies and Recovery Options to Consider As Part of Risk Assessment Have discussions with community partners on alternate coverage for emergent care for patients. For non-emergent patient services, work with community facilities to reschedule patients or refer them to other care providers. Rescheduling of educational and outreach activities or development of alternate plans Communication plans where there are multiple collaborating partners or organizations. Is there language in MOUs with community partners as to the stipulations when there is a natural or environmental event that would protect and minimize legal obligations of the institution? Have there been discussions with community partners regarding their business continuity plans and what their recovery strategies may be and how the process would be coordinated. Formal communication plans and status reports to community organizations and health science center staff. External - incidents, threats and events occurring off-campus which may impact community service activities or outreach. Same as above. 21

22 Selecting Team Leaders and Members Team Leaders Success of team depends on guidance of effective leaders and managers. Individual is familiar with technical and business process environment. Requires skills for possible organizational change. Motivates others to accept the changes. Team Members Need right balance of technical skills, business process knowledge, leadership and attitudes to successfully develop an effective plan. Can focus on prioritizing activities from the impact of a disaster. Technical understanding of technologies. Knowledgeable of the operational function. 22

23 Training of Business Continuity Employees Each department or unit will be responsible for training their employees on their Business Continuity Plans on an annual basis so all employees are ready to response to and implement any recovery activities in the event of an operational disruption, or an adverse, major or catastrophic event. Periodic testing of the plan will be conducted with oversight from the Business Continuity Planning Team. Maintenance of Plan Plans will be reviewed and updated annually, or as critical processes change. The plans will be approved by the appropriate unit management. Each unit management will also certify annually that the plans has been reviewed, tested and employees have been trained on the plan. Each plan will be certified annually through the institution s Business Continuity Planning Team. 23

24 What you need to do now? Complete template for business continuity plan. You can include attachments to the template of any vendors or other lists you have already prepared. Include any paper forms for business processes or checklists for recovery you already have in place. These items can be posted to the SharePoint site so you can access them in the event of incident. Submit your completed plan to the Office of Strategic Planning & Institutional Analysis. The plan will be reviewed by the Business Continuity Planning Team and a follow-up may be scheduled to discuss more specific information needed for IT requirements, suppliers, etc. 24

25 Resources and Support Gayle Knight, Certified Continuity Manager (CCM), FEMA Certified Professional Continuity Practitioner (PCP) Assistant Vice President for Strategic Planning & Institutional Analysis Business Continuity Program Manager Telephone: Lisa Espinoza, Project Support, Certified Continuity Manager (CCM) Project Manager Office of Strategic Planning & Institutional Analysis Telephone: