| Business Continuation Planning |
|
|
|
 |
| Business Resumption |
|
Continuation Actions
Assume a disaster has occurred and disaster recovery actions have begun. Now, how will your agency resume its business? Which mission critical services must your agency resume right away? Which services can your agency wait to resume? Who, what, when, where, and how will you resume this business? Don’t go overboard. It is important to plan in advance. When a disaster has already occurred, it will be too late. Your agency should analyze the most probable types of disasters and develop simple, common sense Business Resumption Plans that are not burdensome and can be effectively carried out.
Remember, in a widespread disaster you will be competing for resources and funding. Many state agencies are, themselves, first-responders. It is likely they will receive priority for emergency funds, procurements, or resources. When assessing mission critical services, be sure you do so narrowly. It is easier to expand services as resources became available than have to, on the spot, cut back.
Your business resumption planning must consider two critical areas. First, which of your services are essential for the life/safety protection of your clients? Simultaneously, which are your essential business functions that allow you to provide those mission critical services? The restoration of business functions should not be short changed. Their efficient resumption is essential to maintaining your critical services and resuming the rest of your operations. Look for partners in state agencies who can assist in providing essential business functions.
Avoid worrying about extensive preparations for an endless list of potential crises. Concentrate, instead, on the immediate consequences of a disaster, such as the loss of key property, resources or information.
Consider These Steps:
- Communication with Workforce
- Safety, Health and Environment Concerns
- Key Personnel
- Alternative Location
- Equipment/Furnishings/Supplies
- Information/Data/Records
- Inventory
- Customer Notification
- Supplier Notification
- Business Partner Notification
- Emergency Procurement
- Emergency Operating Funds
- Secondary Service Resumption
- Shut down/Restructure/Resume
- Safe Storage of Your Plan
|
|
|
| Communication with Workforce |
|
In the event of a disaster, how will you get into contact with the employees in your Agency? Employees safely evacuate the premises. Everyone’s accounted for. But this is not a drill! You release them. They go home, to shelters, or to health care facilities. Then what? If well planned, your disaster recovery team will assemble and begin their activities (see Disaster Site Recovery Restoration Actions). Your business resumption team will also start up. But the majority of your employees will have no idea what to do. Should they report to work? If so, where? What will they be doing, regular work or clean up? What if the disaster affects their family? What if they can’t report? Who do they call? Will they be paid? Must they take leave? How long will this go on? Remember, not all disasters take place during business hours. A unit of your business resumption team should handle employee communications. A workforce prepared and trained in business continuation will know what to expect. Depending on the disaster you should plan for:
- Out of state call-in center if local phone lines go down.
- Standard telephone tree, to include cell phone numbers.
- Regularly updated, recorded message on agency information line.
- Emergency website with employee information.
- Radio, TV and print media for emergency notification.
- Regular status reports to employees.
Your agency should have a plan for who, what, when, where, and how you will communicate with employees in the event of a disaster. The plan should include or consider:
- Home telephone and cell phone numbers, residence addresses, and emergency contacts for all employees.
- Standard protocols for communication with employees.
- A process to update the information. This will ensure that the personnel assigned to carry out the communication plan and the employees to be notified have not left the agency, moved to another location, or changed telephone numbers. And, that the employees are still in the same positions, fully aware of their responsibilities in the plan.
- Types of information that will need to be shared with employees. Consider different kinds of probable disasters.
- A process to share and practice the plan with all agency personnel.
|
|
|
| Safety, Health & Environment |
|
Even for individuals not hurt in a disaster the uncertainty, rapid changes, reassignments, relocation, confusion, and complexities can cause people distress. “Accidents” such as slips and falls, cuts and bruises, and other minor injuries often increase as people are distracted and off balance. Sometimes, the injury can be more serious. Continual reminders for caution, careful observation, and empowering employees to speak openly about safety concerns help everyone get through this period.
- Get your “safety committee” back in operation ASAP.
- Move as quickly as possible to address safety and health related concerns in new locations or assignments.
|
|
|
| Key Personnel |
|
Prior to a disaster occurring, it is important to designate key personnel to carry out disaster recovery activities and business resumption goals for mission critical services and business functions. Initially disaster recovery may be a full-time assignment. Don’t think one team can do it all. In a widespread disaster, recovery and resumption are separate functions that must be closely coordinated.
Plan for backup personnel for each element. Team members should cross train. Recovery and resumption teams should be aware of each other’s plan. No plan should hinge on an individual. Map out the personnel. Look for alternatives.
The business resumption team works on activities that will get mission critical services operational, and the agency business functions back on line.
In your agency’s Business Resumption Plan, there will need to be a section that designates the key personnel to respond to disasters. The section should:
- Identify your mission critical services. What must your agency continue to do, even if a disaster occurs? An in-depth analysis of the agency’s mission, goals, and objectives should be done. Consider limiting the mission critical services to life/safety, protective, regulatory, or social service activities that must happen. If you identify too much of your agency’s business activities as “mission critical”, this may cause your business resumption plan to be complex and difficult to manage.
- Identify your essential business functions that enable mission critical services to get delivered. Can you plan for back-up or shared services in another agency?
- Identify key personnel integral to carrying out the agency’s mission critical services. Which personnel must be involved in order for the mission critical services to be accomplished? Are they and their managers aware they have been designated as key personnel? You will need a process to update this portion of your Business Resumption plan regularly to ensure personnel are still in the same positions with the same responsibilities.
|
|
|
| Alternative Location |
|
In the event your agency’s building(s) will be inhabitable for an extended period of time (or even a few days), where will your agency resume business?
- Close communication with your Disaster Recovery Team will give you an early indication of the extent of damage at your “event” site.
- Agencies with multiple locations can plan for re-deployment of functions or personnel to other branch offices. This may mean an “unaffected” branch will go on emergency alert to handle mission critical services or essential business functions.
Where are alternative locations where business (or at least mission critical services) can be resumed? What if your building is completely destroyed? Your Agency’s Business Resumption Plan should include or consider the following:
- Will your agency require a site where mission critical services can immediately resume? If so, you need what is called a “hot site”. A hot site may contain computer equipment that has the capability to communicate with state mainframes, back-up media of your agency’s electronic files, telephones, or other agency specific resources needed to continue business. Many vendors offer hot site services. DAS EISPD may be able to assist state agencies to obtain these services. Hot sites must be secured well in advance of a need, and require detailed planning to ensure appropriate resources will be available. Hot sites are expensive. Therefore, a hot site is a short-term solution to allow critical operations to resume. Make sure you can get to the site. What if the disaster affects roads, airlines, trains, etc.? You will need to make different provisions for getting to your hot site depending on the type of disaster you face. Your plan should identify where you will re-locate your agency´s business once this time is over, if your building(s) is still inhabitable.
- Will your agency’s business allow taking a few days or possibly up to a week to become operational after a disaster? Or, what if you cannot get back into your building once the hot site time period is over? Your agency´s plan should include arrangements for what is called a "warm site" or an alternative location. A warm site, or alternative location is pre-arranged space for your operations. This space can be quickly set up with equipment, furnishings, or supplies. Contracted sites may even contain equipment, furnishings, or supplies. DAS Facilities may be able to provide state agencies with assistance in arranging alternative sites or provide listings of potential sites. Also, consider working with other government and non-government entities that do the same or similar types of business, i.e., counties, cities, and non-profits to arrange alternative sites.
- What if your building is completely destroyed? Your plan should address any potential resources your agency could use to permanently re-locate your operations. Again, work with DAS Facilities, other governmental entities, or non-profits to identify potential sites for re-location.
- Do your leases contemplate business resumption needs? Will you be locked into rent payments? What controls do you have to assure a leased building is restored to your satisfaction before you reenter?
- Know your building. What are your agency’s needs? How much square footage will you require if you have to re-locate? How many restrooms? A Mailroom? Security systems? Meeting space? Laboratories? Classrooms? Any special workforce needs? As part of your plan, document workspace requirements for your agency’s operation.
|
|
|
| Equipment/Furnishings/Supplies |
|
What equipment, furnishings, and supplies will be necessary to continue mission critical services? Then, what will your agency need to get back to regular operations? Your Business Resumption Plan should include:
- Inventories of needed equipment, furnishings, and supplies. These inventories can be very helpful to provide supporting documentation for any State Self-Insurance claims for damaged or destroyed agency property. Inventories should be regularly updated and duplicated.
- Documentation of items needed for mission critical services versus normal operation.
- Documentation of special arrangements with vendors to keep special inventory or resources on hand to allow for the immediate purchase of items needed to resume agency mission critical services. Also, arrangements for procurement of items needed to get back to normal operations.
|
|
|
| Information/Data/Records |
|
Has your agency made arrangements for back-ups and off-site storage of your agency´s critical information, data and records? Your Business Resumption Plan should include or consider:
- Inventory and location of all information, data, and records used in the operation of your agency´s business.
- Identification of the information, data, and records that are critical to your agency´s operation, and/or require security.
- Arrangements for back-up and off-site storage of information, data, and records. State agencies should contact DAS EISPD for assistance with back-up and off-site storage of electronic information, data, and records.
|
|
|
| Inventory |
|
In the event of a disaster, complete, up to date, and comprehensive inventory records will assist your agency in replacing equipment, supplies, and furnishings as well as provide documentation for a State Self-Insurance Claim. Business Resumption Plans should include or consider:
- Inventory procedures for your agency´s equipment, supplies, furnishings, information, data, and records. How will the inventory be done? How often? Where will it be stored? How can it be accessed? How can it be utilized in the face of a disaster? Recovery in the event of a disaster will be more difficult if this information is not kept in a format or detail that is useful and accessible.
- Include details on the many ways in which an inventory can be used by your agency in the face of a disaster. For example, if your inventory is lost in a fire, it cannot be of use to you when replacing needed items or submitting a state property claim.
|
|
|
| Customer Notification |
|
In the event of a disaster, how will you notify your customers, clients, or whomever your agency serves? Your Plan should:
- Identify your agency´s customers, clients, or others served by your agency. Who are your critical customers? At-risk families, high-risk wards or probationers, acutely ill, or seriously disabled clients?
- Decide how quickly customers, clients, or others will need to be contacted in the event of a disaster. If this timeframe is short, or critical services must be delivered, your agency may need to gather addresses, telephone numbers, or determine alternative methods for contact.
- Assess the customer base that you need to notify. Can you use radio, television, newspapers, Internet, or other ways to communicate? How do these customers access information?
- Plan for secondary resources for the non-critical clients. Prepare a communications plan for them.
- Address how, when, and what information will be released under probable disaster situations. If communications with customers, clients, or others served by your agency is not handled appropriately it may cause panic, over-reaction, or misinformation.
|
|
|
| Supplier Notification |
|
How will your agency notify suppliers in the event of a disaster? Your Plan should include or consider:
- What if you need to stop deliveries or have them sent to another location? Gather contact information, including telephone numbers, addresses, e-mail addresses, etc., on your agency´s suppliers. You may need this information even if you can´t access your building(s).
- Does your agency have price agreements or pre-arranged contracts through DAS State Services Division (SSD)? If so, DAS SSD may be able to assist your agency notify these suppliers in the event of a disaster.
- Who are your routine suppliers? Bring them into your plan. These vendors may be able to assist you plan for the equipment, supplies, and fixtures you will need to recover from a disaster. The vendor may want to make your agency’s plan a part of their business resumption plan. If your agency’s vendors are not informed about your potential needs in the event of a disaster, they may not be fully prepared to respond.
- What if your routine local suppliers or transportation services are also affected by the disaster? Your plan should include provisions for obtaining equipment, fixtures, and supplies from other areas and/or alternative means of transportation.
- What about your incoming mail and telephone calls? Remember to contact telephone companies and postal services to transfer calls and mail to your agency’s alternate location(s).
|
|
|
| Business Partner Notification |
|
How will your agency notify business partners in the event of a disaster? Your Plan should include or consider:
- What if you need to cancel, coordinate, or have services moved to another location? Gather contact information, including telephone numbers, addresses, e-mail addresses, etc., on your agency´s business partners. You may need this information even if you can´t access your building(s).
- Who are your routine business partners? Bring them into your plan. These entities may be able to assist you plan for the coordination of services and/or changes in location or services. They may want to make your agency’s plan a part of their business resumption plan. If your agency’s business partners are not informed about your potential needs in the event of a disaster, they may not be fully prepared to assist you to respond.
- Use your business partners as a resource for alternative sites of operation (hot or warm sites), relocation assistance, equipment, supplies, and fixtures you will need to recover from a disaster.
- Consider the disaster that also affects your agency’s business partners. What if these partners provide your agency with critical services, supplies, etc? Has your business partner included your agency’s operations in their business resumption plan? Do they have a business resumption plan? Work with your agency’s business partners in advance to make arrangements that will aid in continuation of state business.
|
|
|
| Emergency Procurement |
|
How will your agency procure the needed services, equipment, supplies, fixtures, and other needs after a disaster? Will procurement statutes and rules apply? Your Plan should:
- Address the different types of procurement that would be available in a disaster. Include step-by-step instructions. Remember that these instructions should be written for someone that does not normally handle this type of duty. Be sure to research applicable statutes and rules pertaining to procurement of emergency equipment, supplies, fixtures, alternative sites, and other services for disaster recovery or business resumption.
- Consider borrowing from your agency’s business partners, other state agencies, or other entities. Many times others engaged in the same or similar types of business can help out.
|
|
|
| Emergency Operating Funds |
|
How will your agency obtain the needed emergency operating funds to recover and resume business? Your Plan should:
- Identify procedures for accessing needed operating funds in the event of the types of disasters likely to affect your agency. Consider providing access to agency funds at unusual times. Who will have the authority to access funds? How will emergency authorization occur?
- What if the sources of operating funds are also affected by the disaster? Provide access to several sources of funds. Consider several locations and/or sources of funds. Cash on hand? Checking accounts? Credit cards? ATM? When will the funds be available? What about security?
- Provide a method for prompt reimbursement of personal funds spent coping with an emergency situation.
- Work with the State Controller´s Division, Treasury, Secretary of State, and other agencies to determine the most appropriate methods for obtaining, disbursing, and accounting for emergency operating funds. And, don´t forget about accounting and documentation rules relating to federal funding.
- Provide a method to identify all damage-related costs. This may involve special processes to identify purchases, repair work, etc., that qualify as reimbursable expenses under the Self-Insurance Policy or other commercial coverage. Determine how your claims for property damage will be processed in advance of a disaster. Ensure that your agency’s claims can be filed with Risk Management quickly so they may be adjusted as soon as possible. Keep this information with the plan off-site. If it is filed in a building that cannot be accessed, it will not be helpful.
|
|
|
| Secondary Service Resumption |
|
Once you have taken care of your agency’s mission critical services, what about resumption of the remainder of agency business? Your Plan should:
- Identify your agency’s mission critical services up front when developing your overall Business Resumption Plan. In addition, you will need to categorize all other agency business according to need, compliance, or other appropriate criteria. The plan should contain a timeline for when these services or business must be delivered, accomplished, etc.
- For each item of business, plan who, what, when, where, and how this business will be resumed after a disaster. To be well rounded, you should contemplate the types of probable disasters situations for your agency.
- What are normal business operations for your agency? Who, what, when, where, and how will you resume normal operations? In order to have a complete plan, each of these areas will need to be addressed.
|
|
|
| Shut down/Restructure/Resume |
|
Once your agency´s operations have been shut down, resumption may look different. Your agency may need or want to restructure prior to or during resumption. What if it takes an extended period of time to resume business? This is the area where your agency may want to ask "why" questions about your operations. Your Plan should include or consider:
- What employees will be available to resume normal operations after a disaster? What if these employees are also affected by the disaster? What if the employees are deceased, injured, or not available to assist in the resumption of agency business? How can operations be restructured with fewer or temporary employees?
- What if a disaster changes the need for your agency´s business? What if your agency´s services are no longer needed? Your business operations may need to be restructured in the event of a disaster. Could your agency be called upon to provide a different type of service or function in the event of a disaster? Does your agency have plans for who, what, when, where, and how these additional or restructured services can be delivered?
- Can your agency completely shut down business for the necessary period of time after a disaster? If so, your agency will need to plan in advance. How will necessary regulatory, accounting, or administrative operations be taken care of?
- Will utilities, police, fire and other necessary public services be affected or over-burdened by a disaster? What if you cannot depend on these services to be available for extended periods of time? How can you resume operations considering these factors?
|
|
|
| Safe Storage of Your Plan |
|
Your agency´s Business Resumption Plan will contain several sections and involve many systems within your operations. The information obtained from these systems will be needed when the Business Resumption Plan is activated. Your Plan should include or consider:
- How will you access your plan? Just like your information, data, and records, you will need to have access to your Business Resumption Plan in the event of a disaster. The plan will need to be kept in a safe, accessible place away from your operations. Talk to other state agencies, government entities, and business partners about where they keep their plans.
- Where are the components to the plan? The components within the plan such as employee information, inventory, suppliers, and customers will need to be kept with the plan and updated periodically. If the components to the plan are not accessible in the event of a disaster, how can the Business Resumption Plan be activated?
- Can the information be kept electronically with back-up and off-site storage? Work with DAS EISPD to find solutions to accessing critical agency data in the event of a disaster.
|
|
| |
|
|
