| Taking Care of Business RisKey |
|
|
 |
| RisKey |
|
Business Continuation Planning for the Year 2000
Snow, ice, wind, flood, mud, pestilence.... Any peril can strike with little warning causing major disruption in business operations. Sometimes, a peril strikes elsewhere but causes your office to be without power or other essential services. A unique pestilence – the Year 2000 bug – lurks near your desk now, waiting to strike. The time remaining to remediate all software applications before the new century is running out.
Business Continuation Planning changes the Year 2000 threat into an opportunity to minimize risk with thoughtful planning. It helps you demonstrate due diligence in the face of pending lawsuits. And, it is a condition for expanded self-insurance coverage against the Year 2000 bug and similar perils.
This RisKey describes a process to assess threats to your business and plan alternatives to keep working in the face of crisis. It focuses specifically on the Year 2000 problem, but the process applies to any threat facing your organization.
Definitions As used in this RisKey:
Disaster Recovery Planning usually envisions running existing programs or systems in a different location. They depend upon the triggering event being local in nature and causing only a few hours or days down time.
Contingency Planning includes developing alternate plans, manual work-arounds, fallback procedures, and such for affected systems. They usually only deal with critical technology systems. The Year 2000 problem may cause lengthy disruptions in non-information technology systems, too. Planning for supply chain disruptions and communication problems are especially important.
Business Continuation Planning goes beyond contingency planning to document actions to be taken, resources required, and procedures to be followed to ensure continued availability of essential services, programs, systems, and operations in the event of unexpected interruptions. It focuses on activities you should take to resume and continue managing operations after a catastrophic event.
Due Diligence means you gave careful attention to the serious problem at hand. Lawyers speak of demonstrating due diligence meaning documenting actions taken to manage the Year 2000 problem showing you used the same care any reasonable person would use to care for their own concerns in similar circumstances.
Program means an agency program to provide some service or achieve some aspect of the agency mission. It is NOT an information technology program.
System means an information technology program or application.
Critical Date means the date you will know if a key system is likely to fail in the year 2000. It is also the date you must put an alternative plan in operation to keep a key program from failing because of the impending system failure.
Name a planning team. Those most able to find and implement alternative solutions that take care of business in strained circumstances are those doing the essential work in your organization. We recommend the business continuation planning team include the following positions.
-
Agency Chief Information Officer
-
Agency Year 2000 Project Manager
-
High level agency executive who understands agency mission and political influences
-
Budget and business manager or staff
-
Computer & networking support team representatives
-
Embedded technology and facilities team representatives
-
Representative personnel in the trenches, using the technology to provide services
If multiple divisions or agencies may be involved, each must be represented and participate actively in plan development. If you are planning for non-Year 2000 problems, substitute personnel in similar key functions.
Give the planning team decision-making authority. They will need it now, while planning for continued operations; and later when some event triggers their plan.
The assessment. Not every program or function requires a business continuation plan. We recommend a three-part process to decide which programs pose the greatest risk yet must continue no matter what.
-
Internal Threat Assessment: What agency resources are likely to fail because of this threat?
-
External Threat Assessment: How will this threat impact those I rely upon?
-
Documentation and Planning: Blazing a paper trail leading to a good plan to continue business when systems fail.
Document the process. Sometimes, your best efforts can’t avert tragedy to some citizen. When that happens, you may be called upon to demonstrate your actions were reasonable and prudent. Set the stage for demonstrating due diligence by
-
Recording the information you relied upon to decide which agency programs must continue operating after disaster strikes;
-
Explaining why some programs can be set aside for a time; and
-
Planning how you will communicate your plans for continued operations.
The sample forms included with this RisKey capture what’s important.
The Business Continuation Plan outlines what you’ll do to continue important business operations until the effects of a particular disaster or system failure are repaired. It describes:
-
Who the key players are in the contingent operation.
-
What resources are necessary to continue business as usual.
-
What events or triggers will activate the continuation plan.
-
How long operations can continue under the alternative plan and what must occur to provide for orderly return to normal operations.
-
Where your continued business operations will be located.
-
Why you’ve made this decision and what will trigger its activation.
-
How you’ll communicate this change to your employees, your executives, and those you do business with.
On the following pages, we provide detailed instructions and sample forms for completing an assessment and a business continuation plan. If you need help building contingencies for the Year 2000, or any other disaster, contact the Statewide Projects Risk Manager (503) 378-5519 or the Risk Management Division (503) 373-RISK. You’ll also find helpful information and examples on our website.
History: New July 1998
Resources & Authority: See joint DAS/IRMD & RMD policy regarding business continuation planning.
See Executive Order EO-97-13
Internal Threat Assessment
We are faced with a threat to software, firmware, and hardware applications that manipulate dates to make some decisions or carry date data along some path. Some of those systems will fail when trying to interpret date data in the new century. Teams across state government are working to remediate or replace errant systems before they fail. But resources and time are running out and some systems will not be ready in time. Therefore, you must plan how you will continue essential programs within your organization until the systems you use are ready.
-
Identify critical business programs relying on non-compliant technology.
Start with existing lists of Mission critical programs relying on technology. Don’t overlook embedded chip technology in smart equipment. If not sure if technology is Year 2000 compliant, include here.
Prevent loss of life/personal injury – provide for public safety.
Preserve quality of life for state’s citizens.
Generate revenue for government operations.
Failing to perform function will lead to lawsuit, fines, and penalties.
Decide which category is most important to your agency and develop a system to weight the priority among competing programs. Don’t overlook the political aspects of any rankings you make.
-
Prioritize remediation efforts.
Unlikely to be Year 2000 compliant before December 1999.
These systems must have a plan to continue business until it can be fixed.
Will be tested and back in production by September 1999.
Will be tested and back in production by January 1999.
These systems only need a plan if you doubt the validity of your projected completion dates or failure of the system will have such a huge impact on your agency or others that we cannot afford to do without it.
Already compliant or will be tested and back in production by July 1999.
These systems only need a plan if you believe others feeding into them may cause disruptions in the new millennium.
How long can you afford to work without the system?
What are the cascading effects of continued unavailability of the system?
-
Set critical dates and define triggers.
When will system fail if not remediated?
How long will it take after failure to repair damage and bring back into production?
What foreseeable events will give you advance warning the system is failing to achieve Year 2000 goals?
-
Select alternatives that will continue programs in Year 2000 without systems which are likely to fail. Begin with systems supporting the most critical programs. Some options to consider:
-
Can I hire someone else to do this for me? Can I hire a vendor who is willing to certify compliance to run payroll checks for a year?
-
Can I make do by using the existing software and manually correct errors it produces? Can I let people buy an extra year on their license now and manually correct the few that can’t be rolled over.
-
Can I avoid using the system for six months or more? Can I manually renew licenses or extend their life by administrative rule?
-
Can I create backup files or reports that will serve for several months? Do I really need management reports on efficiency of operation every Friday?
-
Can I do some work in advance? Can I run a backup on December 29 or complete work in December that is usually done in January? Can I postpone start-up of some routine projects until March?
-
Compare the cost of alternative solutions against the cost of system failure. Recognize the resource needs and limitations your organization has for planning and developing a business continuation plan. That, too, is a factor in choosing the best alternative solution.
Sometimes the best, most economical solution is to do nothing. If that is your choice, clearly document WHY you chose to do nothing.
External Threat Assessment
It’s not enough that Year 2000 bug threatens our internal systems, it also impacts those we rely upon for resources and data. Even if every system we operate is fixed and managing data in full compliance with Year 2000 requirements, our suppliers and business partners may not be ready. So, we need to evaluate who may fail us and how we can continue operating without them.
-
Review programs and systems prioritized in the internal threat assessment process. Identify resources you need to accomplish high priority programs and suppliers of those resources.
Don’t overlook key infrastructure resources such as personnel, power, water, and sewer. Review key systems you use that don’t rely upon your technology, but may rely upon someone else’s.
-
Prioritize resource needs by necessity to achieve key functions. Consider how long you can work without key functions giving highest priority to those you can least afford to do without:
Can achieve goals without it for 48 hours.
Can achieve goals without it for 1 month.
Can achieve goals without it for 6 months.
-
Identify key suppliers of high priority resources identified above. Beginning with those most critical to continued operations, begin a dialog to determine their efforts to beat Year 2000 problem.
-
If supplier is another state agency or public utility, assume for now their Year 2000 impacts will be minimal. The statewide Year 2000 office is addressing this issue for all of us. But, consider how important that resource is to continuing your business. Example: DAS is working to make the state telephone system compliant for all of us. But, if the whole telecommunications network functions erratically in January 2000 how will you work around it?
-
For all others, focus on establishing a dialog and cooperation, not an adversarial relationship, to solve the Year 2000 threat together. Ask questions like these:
-
Does the product or service you provide me have any hardware, software or embedded devices? If the answer is no, then there is no Year 2000 problem. If the answer is yes, keep asking questions.
-
If the product or service itself may have a year 2000 problem,
-
Ask for descriptions of test methodologies and specific results of those tests.
-
Do you have a written plan for addressing the Year 2000 problem in your organization?
-
Who is involved in the process?
-
How can we work together to beat the Year 2000 problem?
-
Describe alternatives to achieve goals without these resources. Determine how you can cope without them for varying lengths of time.
-
48 hours – May already be contained in a disaster recovery or emergency response plan.
-
1 month – Identify alternative suppliers or resources you’ll rely upon.
-
6 months – Can you postpone remediation efforts on these functions and redirect resources to other, more vital functions?
-
Select best alternative to work around key external threats so your agency programs will continue. Some examples:
-
Key data interchange partner cannot be Year 2000 compliant in time. Can you build a software bridge to manage their data into the future? If so, how long will you support that bridge?
-
Key paper form you need to operate comes from a supplier whose factory won’t be ready. Can you stockpile that resource? If so, where will you store it, how will you finance purchase? How long after the Year 2000 strikes will the supplier be unable to fill orders?
-
Key resource you need, such as groceries, may not be consistently available in 2000 because of sporadic infrastructure failures. Can you strengthen your relationship with key suppliers to give you priority over other customers? Or, can you spread your orders among several suppliers who offer similar products?
-
Data interchange partner has not responded to requests to test upgraded systems. How will you monitor that interface to prevent corruption of your system when the critical date is reached?
Document the Process
The Year 2000 problem represents a huge drain on financial and human resources. It brings with it many unknowns and even more opportunities to blame someone else. As we move closer to the critical delivery date, the threat of second guessing, system breakdown, and lawsuits grows ever greater.
Our hope of minimizing the impact of Year 2000 problem in the courtroom or other public forum lies in good documentation of plans made, modified, and carried out.
Since we can’t possibly do everything demanded by the Year 2000 problem or achieve perfection in every system touching state business, choices must be made. Reasonable, knowledgeable people like you and me will make these choices. But it’s our written memorials of those choices that will convince a stranger in years to come that we did act reasonably based upon information and resources then available. To a lawyer, our good documentation demonstrates due diligence.
So, build a paper trail of key decisions made along your Year 2000 path. Keep meeting notes; write progress reports to key agency executives. Be honest and factual in each writing: Tell only what you know to be true today, not what you hope will be true tomorrow. When you prepare a summary about your year 2000 efforts, refer to source information and assumptions used in creating the summary. Keep source information in a central location, well-known to your entire team.
In brief, demonstrate your reasonable actions to beat the Year 2000 with these steps.
-
Document choices made at each step in the process to Year 2000 readiness. Include:
WHO made the choices and when.
WHAT made the choices necessary.
WHY the choices were right for your organization today.
Include names of others using similar methodologies and processes. Identify who’s recommending it and document their expertise. Have a knowledgeable, independent party verify your options and choices.
If resource availability is an issue, clearly describe your efforts to determine why resources were limited; alternatives you considered; and the impact of limited resources on your ultimate decision. Unbudgeted or no spending limitation, by itself, is not adequate documentation. You need to document resources limits now to convince a skeptical jury in years to come.
-
Get it in writing! Use contracts, interagency agreements, meeting minutes, white papers, interim project reports, to memorialize actions and choices you make today.
-
Report the facts of your plan and progress toward goals:
To your agency Year 2000 coordinator,
To your agency executives, and
To the Statewide Year 2000 office.
When appropriate, report to the Governor and other elected officials.
-
Communicate openly and accurately to the public depending upon you, Other agencies, businesses, and suppliers you interact with.
Maintain good documentation of press releases, articles, and other information
you release as evidence of your good stewardship.
Make a Plan
A contingency plan is an outline of what you’ll do to continue important business operations until the effects of a particular disaster or system failure are repaired. It describes:
-
Who the key players are in the contingent operation.
-
What resources are necessary to continue business as usual.
-
Where your continued business operations will be located.
-
Why you’ve made this decision and what will trigger its activation.
-
When the contingency plan will be activated and how long operations can continue under the alternative plan, and provide for orderly return to normal operations.
-
How you’ll communicate this change to your employees, your executives and those you do business with.
-
How you will practice the plan to find any gaps before you really need it.
Who plays. Name a team of personnel who will develop the Business continuation plan, manage it when crisis strikes and conducts post-crisis evaluation used to improve plan for next time.
Identify the positions and the persons on the team and their specific roles throughout the crisis. Key roles to consider:
-
Team leader – responsible for overall coordination of the business continuation plan.
-
Crisis Spokesperson – responsible for communicating official, accurate information and when appropriate, meeting with the media.
-
Team Secretary – someone who answers inquiries during the crisis, records decisions made and actions taken, facilitates communication among various divisions, agencies, and guests.
-
Security & Safety – someone who manages security needs and coordinates safety of all on the site.
-
Human Resources – someone knowledgeable in human resource & labor relations for organization to address issues arising from employees.
-
Legal counsel and/or risk management – someone to advise on legal ramifications of options facing team during the crisis.
-
Financial counsel – how will we pay the bill?
-
Back up team members – if the team leader or spokesperson is unavailable when trouble strikes who will step into their shoes?
Keep a current list of team members including home and work phone numbers. Have access to all employees who may be affected when a business continuation plan is activated. Keep a current list of key resources inside and outside the organization you will need if the plan must be activated.
What triggers the business continuation plan? Describe the event(s) that will cause you to implement your plan. It may be a critical date such as four weeks before the new year. It may be coming to the office and discovering there is no power. It may be reviewing a certain report and realizing the calculation results are garbage.
If there are multiple factors involved in implementing the plan, set out now what process you will use to decide when to activate your plan, who will make that decision and when.
What resources. Identify what you will need to run your alternative business continuation plan. What items, supplies, software, desks, etc. will you take with you or reuse and which will you need to purchase, rent, or lease? What training is needed, who can provide it, who needs it, what can be taught now?
What arrangements must be made in advance? What can you do now to make activating the plan easier tomorrow? What written agreements with sister agencies, suppliers, and other resources can you enter into now to help you in the future?
Are others planning to use the same resource? For example, if you plan to move operations to the state fairgrounds, how many other agencies have the same plan? How will you share scarce resources in a crisis?
Where will your business continue? Will you move to another site? Who makes decisions about finance and facility? Who will negotiate the lease or rent of the space, put in the furniture and make the physical move? Who will string cable and install equipment? How will you finance the alternative site move? What arrangements can be made in advance? Are other state agencies making similar plans that need to coordinate with you?
Will you rent or borrow computer space somewhere? Who will physically operate that equipment and be responsible for moving your systems there? What personnel or other resources will the owner provide? How will you pay for it? What arrangements must be made in advance?
Orderly return. How long can you continue to operate under your business continuation plan without losing business efficiency? What will you do during that time to hasten return to business as usual? What plans do you have for an orderly return to business as usual?
Talk about it. Who needs to know about your business continuation plan? What will you tell them? By rehearsing the message you give now, you present a better image to those around you when the chips are down. How you communicate what you are doing and why goes a long way to defusing a situation and changes front page news to lunchroom chit chat.
A good business continuation plan includes a well-researched outreach program which states the facts and reasons clearly and communicates your action plans in a positive light. Good planning includes making everyone aware of who has the full story on the situation and who can best answer questions.
Rehearse. Practice each step of your plan before you need it. Emergency planners often use tabletop exercises as a cost effective, low risk option to debug their plans. You can do the same. Bring together the players in your plan, sketch out a scenario, and talk through what you’d do if that happened.
One sample scenario: It’s January 3, 2000, despite your best efforts, one benefit system keeps calculating everyone as ineligible. Many citizens rely on these benefits to continue working. What does your business continuation plan recommend in this situation? What else must be done to keep this key program operating until the technology system can be debugged?
Conclusion. Is all this a lot of effort for little gain? Risk Managers around the world get that question often. It is best answered with another question: If our effort averts one lawsuit, one banner headline, or retains the goodwill of those depending upon us, can we afford not to do it?
Please send us a copy of your plan. We’d like to see it and share best practices with others so they can take care of business in the new century.
Forms:
Year 2000 Internal Threat Assessment (pdf)
Year 2000 External Threat Assessment (pdf)
Agency Summary of Business Continuation Planning (pdf)
Business Continuation Plan (pdf)
|
|
| |
|
|
