BUSINESS CONTINUITY PLANNING Business Continuity Exercise Program (BCEP) Information Packet This exercise program was developed by the Texas Engineering Extension Service (TEEX) A Member of the Texas A&M University System
TEEX BUSINESS CONTINUITY PLANNING SOLUTIONS Given the recent lessons learned from the economic impact of hurricanes Katrina and Rita, TEEX is developing tools to decrease the impact of the next disaster on businesses. Disasters as well as the small disruptions affect your business, your customers, and your profits. According to U.S. Department of Labor Statistics, over 40% of all companies that experience a disaster never reopen and over 25% of the remaining companies close within two years. TEEX OFFERS THESE SOLUTIONS TO BUSINESSES IN TEXAS AND THROUGHOUT THE NATION Business Continuity Planning Course The Business Continuity Planning Course provides organization managers the information necessary to plan for, respond to and recover from catastrophic events. Built upon the concepts of risk analysis and business impact planning, this course is designed to provide the roadmap to organizational emergency response for the coordinated response during and after a catastrophic event in which company facilities and processes are interrupted. The 16-hour course provides the organizational managers with the critical decision making process and some key factors to be considered in the trans-, and post-event periods. Business Continuity Planning Technical Assistance The Business Continuity Planning Technical Assistance provides hands on development of the Business Continuity Plan for the requesting agency. The technical assistance commences with an on-site visit to determine the level of existing continuity planning, business processes and the scope of the organizational complexity. Through facilitated hands on development with the organizational Emergency Response Planning Team, the business continuity expert will assist in conducting a business impact assessment, risk analysis and will assist the ERT in development of the BCP for the organization. At the completion of the technical assistance the organization will have made the decisions and been equipped with the tools to manage a successful Business Continuity Program. Business Continuity Exercise Program The Business Continuity Exercise Program provides on site realistic disaster exercises to assess your continuity plan using field tested exercise and simulations incorporating Homeland Security Exercise and Evaluation Program (HSEEP) methodologies and the National Incident Management System (NIMS)/Incident Command System (ICS) principles. Planners work in a collaborative manner with your staff to fashion an exercise that achieves your goals and objectives. At the conclusion of the exercise, a formal After Action Report (AAR) and recommended Improvement Plan (IP) will be provided to the organization. 1
Exercise Objectives The Business Continuity Plan Exercise Program is designed to help prepare companies, corporations, jurisdictions or other entities to assess their continuity of operations response and recovery plans using field tested exercise and simulations developed by the National Emergency Response and Rescue Training Center (NERRTC). The exercise provides organization managers the opportunity to: 1) Test and review existing plans and procedures developed to ensure continued operations during and subsequent to a catastrophic event and 2) Provide useful information and feedback to tailor or revise these plans and procedures based on issues observed and learned as a result of the exercise. 3) Apply a format for the exercise that supports the organizations needs (e.g. tabletop, functional, or full scale as desired). The BCPEP is modeled after proven Homeland Security Exercise and Evaluation Program (HSEEP) methodologies and upon both the National Incident Management System (NIMS) and Incident Command System (ICS) principles. Exercise planners work in a collaborative manner with your staff to fashion an exercise that achieves your goals and objectives. Through an interactive tabletop, functional or complex full scale exercise, the BCPEP provides critical decision makers a rare opportunity to assess the organization s business continuity plan and implement with confidence necessary improvements identified during the exercise. The exercise focuses on the exchange of information between participants at various levels and often from a variety of agencies with strong emphasis on information acquisition, sharing, assessment and subsequent decision making. Subject matter experts (SMEs) with real world experience provide valuable assistance and feedback to the participants throughout the exercise and will aid in identification and documentation of strengths and weaknesses in the business continuity plan and decision making processes. At the conclusion of the exercise, a formal After Action Report (AAR) and recommended Improvement Plan (IP) will be provided to the organization if desired. All information obtained during the planning and exercise design and development stages, as well as the results of the exercise itself, are handled in accordance with the wishes of the organization to be exercised. Non-disclosure, trade secrets, sensitive information, proprietary data or information, and similar documents or information will be carefully and strictly handled in accordance with the guidance provided by the customer. Documents, disks, CDROMs, pictures, hard copy and any other electronic media utilized or developed will also be handled confidentially as directed and agreed. 2
Exercise Methodology/Process Phase 1 Exercise month minus 90 days Conduct Exercise Orientation Meeting Phase 2 Exercise month minus 90 to 60 days Conduct Exercise Planning Meetings Phase 3 Exercise month Conduct the Exercise Conduct After Action Reviews Phase 4 Exercise month plus 30 to 60 days Submit Post Exercise Report Exercise planners provide information on format of exercise, role of participants and controllers and facilitate development of exercise goals and objectives. Exercise planners work with company personnel to formulate relevant scenarios, timeline and scale of exercise. Simulated disaster incident with company staff working in roles they would play in actual event, facilitated by observer/controllers. Facilitated discussions during key phases of the exercise to review lessons learned, reinforce strengths in the plan/execution and identify areas of improvement. Per the customer s request, exercise planner provides a report highlighting the exercise events, training observations of facilitators and recommended improvement areas. Intended Audience The course should bring together representatives from the multiple departments that have responsibility to plan for, respond to, recover from and mitigate against any incident of such significance that the business continuity plan is implemented. The participants should include senior administrators, policy makers, decision makers, and selected management or supervisory level personnel of the business being exercised and other critical personnel identified by the business. The participants that will be invited will be at the discretion of the agency. The below listing identifies potential participants that might be selected to participate. Chief Operating Officers, Chief Executive Officers, and other Decision Makers Chief Financial Officer/Finance/Audit Internal Review Risk Management Business Continuity Legal Technology personnel, including Information Management, Network Services, etc. Human Resources/Personnel Communications Training Operations and Related Maintenance and Related 3
Quality Assurance/Control Sales/Marketing Inventory Management and Control Records Management Environmental Services Emergency Responders Facilities/Engineering Physical Security Public Information/Media Relations Customer Relations Emergency Management Contracted/supporting agencies/entities (as applicable and invited) Regulatory Agencies (as applicable and invited) Public sector agencies that might be involved in response; city, county/parish, state, and federal agency personnel who would work with the entity and aid in resolution during a business continuity incident (as applicable and invited) Like/similar entities (as applicable and invited) Other potentially involved professions or disciplines unique to the threat/risk (as applicable and invited) Resource Requirements The following items are provided by the customer for the delivery of the exercise: Classroom/facilities capable of handling sufficient tables and all exercise participants for the requested exercise format Projection screen Flip chart and/or whiteboard or chalkboard Flip chart markers and/or whiteboard markers or chalk Others The following items are provided by TEEX for delivery of the exercise: Exercise materials Facilitators to support requested exercise format Facilitation equipment 4