FTI Consulting Airport Operational Resilience Scott Corzine, Managing Director ACRP Report 93: Operational and Business Continuity Planning for Prolonged Airport Disruptions April 16, 2014
Agenda How Safety/Security/Emergency Management Complement Business Continuity ACRP 03-18 Project Background Premise Research Team Research Methodology Findings Deliverables Recovery Framework Guidebook Software Tool Implications for Airports 2
Solutions Across the Crisis Timeline Crisis Management Business Continuity Emergency Management Crisis Management 3
Emergency Management Overview Prevent, mitigate, respond to and recover from risks to life, property, physical assets and infrastructure. Causes Incidents Responses Focus: incident-specific to all-hazards, catastrophes, and disruptions: Natural, climatological, meteorological Intentional man-made; unintentional man-made Business Technological Objectives: Build sustainable internal capacity for safety & emergency preparedness for clients Support property & casualty insurance placement Deliverables: Emergency Management Plan Crisis Communication and Media Management Plan 4
Business Continuity and Disaster Recovery Planning Manage, restore and recover essential functions, processes and data during and after disruptions to operations. People Processes Plant and equipment Technology Focus: incident-agnostic functional recovery Objectives: Establish a predictable recovery priority that maintains a going concern Addressing contingent supply chain continuity risks Support business interruption and contingent business interruption insurance placement Deliverables: Business Continuity Plan IT Disaster Recovery Plan 5
ACRP 03-18
Project Premise - TRB Prolonged airport disruptions negatively impact the economy and the US transportation system. While many airports have strong emergency management plans, they lack operational and business continuity plans, which should complement their short term Emergency plans. 7
Research Team
Risk Solutions International LLC (Now FTI Consulting) Independent operational risk consulting/advisory firm: Business Continuity, IT Disaster Recovery Emergency and Crisis Management Market Expertise: Consumer Products Retail and Distribution Education Financial Services and Insurance Local, State Government Construction Pharmaceutical, Life Sciences, Biotech Manufacturing Hospitality and Gaming 9
Professional Certifications MBCP Master Business Continuity Professional CBCP Certified Business Continuity Professional SBCI Specialist Business Continuity Institute MBCI Member Business Continuity Institute CHEP Certified Healthcare Emergency Professional CHSP Certified Healthcare Safety Professional CEM Certified Emergency Manager MEP Master Exercise Practitioner CISSP Certified Information System Security Professional 10
Research Team Scott Corzine Project Director and Principal Investigator. Three senior, experienced certified BCP practitioners. Seven experienced airport operations executives. Three senior software developers. 11
Project Approach and Methodology
Project Scope Airport business and operating functions Not aviation operations Not IROPS Not DOGS Not downstream businesses Airport-responsible functions and those provided by FBO s, contractors, government agency or tenants. Non-aviation operations that contribute materially to airports financial viability. Cause-agnostic recovery focus. Biased: Toward smaller airports and FBO s Toward non-professional, non-certified users Deliverables: Guidebook Critical path framework Software tool 13
Research Methodology Literature Review Open literature search: news, websites, journals, white papers, standards and regulations, TRB content, etc. Relevant standards and guidance Available airport BCP plans Academic resources: refereed papers, aviation curricula Records of relevant legislative committees/subcommittees Issue: All Preparedness Mandates Addressed mainly Emergency Management Homeland Security Act (and derivative Directives 5, 7, 8) NIMS National Response Framework NFPA 1600 FAA AC 150-5200-31C FEMA Comprehensive Preparedness Guide ISO Standards Et al. 14
Research Methodology Continuity guidance FEMA Federal Continuity Guide 1 Continuity guidance Circular 1 ISO standards Data collection Industry conferences: auditing key issues, creating participant database of airports Industry interviews:industry stakeholder groups, trade associations, relevant government agencies, aviation schools, NASAO, relevant labor groups BCAP surveys:41 surveys to self-selected matrix of airport types, sizes and geography/dominant weather, shared infrastructure, FBO s, and airlines (85% response = 35) 6 Detailed Business Impact Analyses(BIA): Las Vegas, Salt Lake City, DIA, Louisville, Block Island, Fort Lauderdale Executive 15
BCAP Survey Matrix Large Hubs: DFW, JKF, SLC, DCA, DEN Medium Hubs: Cincinnati, New Orleans, San Antonio, Reno Small Hubs: Savannah, Moline, Wilmington, NC Non-Hubs: Juneau, Fort Wayne, Evansville, Grand Forks Commercial Service: Santa Fe, Block Island General Aviation: Ohio State University, Van Nuys, Chandler, Ft. Lauderdale Executive, Tulsa, Boeing Field Relievers: Teterboro, Worcester, St. Louis Regional Cargo: Louisville, Memphis, Miami, Sky Harbor FBOs: Signature Flight Support, Jet Aviation, Central Parking System, Meridian Air Group, Landmark Aviation, Shelt Air, Clay Lacey Aviation Airlines: UPS, Delta/Northwest, Jet Blue 16
Key Findings Lack of awareness. Not a strategic priority. Confusion with emergency management. Misconception that BCP is an incident-specific recovery recipe. BCP is uniquely challenging at airports. No existing federal mandate specifically for BCP at U.S. airports. Closest is DOT Advisory Circular 150/5200-31C focused on all-hazards emergency planning. Few states appear to mandate BCP for their airports. ACRP 03-18 deliverables are likely to have an impact. But adoption will require time and funding. 17
Deliverables
General Restoration Priority Framework 19
Recovery Priority Scale Score Value Definition Factors Resolution Priority 3 Critical Loss of these functions causes immediate closure of airport. FAA certification revocation, loss of core aviation capacity/infrastructure, terminal penalties. Must resolve immediately. 2 Important Loss of these functions causes significant negative impact and threatens long term airport viability. Significant revenue loss, penalties, unsustainably higher cost structure, serious reputation damage, violation of legal covenants and service level agreements. Must resolve within one week. 1 Convenient Loss of these functions causes modest or tolerable level of negative impact. Moderate but recoverable negative impact. Should resolve when feasible. 0 Non-Existent or Non-Essential These functions are not present at airport, or not at all essential. N/A N/A 20
Business Continuity Planning Guidebook Help airports and FBOs: Understand business continuity planning. Create a management structure to sponsor and support the process. Identify a team to develop a plan. Develop recovery priorities, and the resulting plan. Institute a process to create business continuity awareness and a preparedness culture throughout their organizations. 21
Business Continuity Planning Guidebook Stand-alone how to guide. Written to non-professional users. Primer on BCP. Guide to using the software tool. 34 areas of business and operations: 22
Business Continuity Planning Software Tool 23
Survey Architecture 24
Core BCP Methodology Built Into the Tool A data entry vehicle that documents important information about how every mission essential function works. Overlays a relative recovery ranking based on airport-specific circumstances. Captures the mix of resources necessary to operate each function and process at the threshold level: People Technology Plan, equipment, supplies Interdependent processes Describes how to operate the function in the absence or degradation of key resources manual work-arounds. Documents with whom airports must communicate when disruptions occur. Documents who takes over when functional specialists are unavailable. Adescription of how core functions and processes work, so intelligent people can craft an incident-specific response plan when disruptions occur. 25
Question Types 26
Question Types 27
Home Screen 28
Survey Index 29
Survey Screen Shots 30
Survey Screen Shots 31
Survey Screen Shots 32
Survey Screen Shots 33
Survey Screen Shots 34
Survey Screen Shots 35
Document Rendering 36
Document Rendering 37
Rendered Business Continuity Plan 38
Business Continuity Plan Components Introduction Organization Distribution and Access Mission Statement Scope Objectives Assumptions Concept of Operations Roles and Responsibilities Individual Plan for Functional Recovery Functional Recovery Prioritization Plan Activation and Deactivation Functional Recovery Plans Functional Description Mission Essential Functions and Recovery Priorities Business Recovery Teams Critical Resources Vital Records and Data Alternate Facilities Delegations of Authority Succession Planning Alert Notification Procedures and Call Lists Devolution Reconstitution Plan Testing, Training and Exercises 39
Conclusions
Airport Business Continuity Planning is Critical Disruptions create a cascading multiplier effect and impact on the financial ecosystem of airports: Business Tourism Hotels Car Rentals Restaurants Recreation BCP is an important element of: Business resilience planning Risk management strategy Meeting contractual obligations Complying with standards and guidance Liability management Having no regulatory mandate for BCP in a critical infrastructure sector is remarkable. Davos 2014 Risk Management Report specifically called on organizations to have BCP. Cited natural catastrophes, meteorological risks and Cyber-risks among Top 5 CEO/Board issues. DOT Advisory Circular 150/5200-31C barely skirts the topic. 41
Contact Scott Corzine Managing Director Office 212.651.7196 Cell 917.930.5300 Scott.corzine@fticonsulting.com April 16, 2014 Presented To: