BACK TO BASICS BUSINESS CONTINUITY MANAGEMENT 101. June 11, 2013

Transcription

1 BACK TO BASICS BUSINESS CONTINUITY MANAGEMENT 101 June 11, 2013

2 Your Presenter Shanda Chronowich, CBCP, CRM Senior Manager MNP LLC 2

3 There cannot be a crisis next week. My schedule is already full. U.S. Secretary of State Henry Kissinger June

4 Overview It seems that there are more events occurring that could impact your ability to continue business. Is your organization s business continuity plan robust enough to handle any event? Do you need to change what you are doing to handle increasing demands? 4

5 Learning Objectives Throughout this presentation: You will see the necessity of business continuity planning You will learn the core fundamentals of business continuity planning You will discover that business continuity planning does not need to be complicated 5

6 Business Resiliency the development of strategies, plans and actions which provide protection or alternative modes of operation for those activities or business processes which, if they were to be interrupted, might otherwise bring about a seriously damaging or potentially fatal loss to the enterprise. 6

7 We plan for everything and hope for the best. Brian O Neill, Vice President Emergency Services, North Shore Long Island Jewish Hospital As quoted from the US News 5/1/06 The best approach, most experts say, is to plan for all Hazards, concentrating on the common elements shared by most disasters, rather than planning separately for an individual event. James James, Director of Disaster Preparedness for the American Medical Association As quoted from the US News 5/1/06 7

8 Is executive management willing to bet the business that something won t happen? 8

9 Corporate leaders have an obligation to the stakeholders of their organizations to ensure that everything that can reasonably be done to protect the business is done. Gartner Group - Real-Time Enterprise: Business Continuity and Availability October 22,

10 Business Resilience has Changed DRP became BCP became BCM which is now Business Resilience Risk Management Program Integration It s no longer Insurance or BCM The Risk Management scope has shifted - Environmental - Man-made (intentional and accidental) - Business Process - Supply Chain - Information Technology - Human Resourcing Increasing Regulatory Environment The Extended Enterprise Integration between Public and Private Entities 10

11 Each Organization is Unique Every organization has different intellectual property, utilizes different systems and processes therefore the risks and priorities associated with business continuity and the corresponding tasks should reflect that Each Program should be Unique 11

12 Regardless, the steps to business resilience have not changed 12

13 Methodology The following details MNP s Business Resilience Methodology which is consistent with leading practices Governance Assessment & Analysis Strategy Plans Sustainment Executive Level Engagement Objectives and Scope Policy Roles & Responsibilities Reporting Risk Assessment Business Impact Analysis Concept People Information Technology Facilities Resources Interdependencies Emergency Response Crisis Management Crisis Communication Disaster Recovery Business Continuity Maintenance Exercise Training Awareness Audit/Review 13

14 Why do it? Tornado Barrie ON A tornado swept through Ontario from Hopeville to Barrie leaving hundreds injured 800 homeless Estimated cost of $300 million Dates: 1985 Deaths: 12 14

15 Why are you doing it? Earthquake and Tsunami - Indian Ocean An undersea earthquake resulted in tsunamis (up to 30m high) that hit parts of India, Indonesia, Sri Lanka and Thailand Fisheries and the tourism industry were highly affected by the tsunami Dates: December 26, 2004 Deaths: url= Retrieved March 8,

16 Governance Purpose: Establish planning guidelines Key Tasks: Ensure executive level engagement Objectives and Scope Policy Roles and Responsibilities Reporting 16

17 Does a successful business continuity plan require a governance program? a) No, a governance program is not necessary b) If you know what you are doing, a governance program is a formality c) A governance program is very necessary, but it doesn t have to be the first step 17

18 What are your Risks/Threats? Volcanic Eruption Iceland A volcanic eruption in Iceland forced a large amount of ash into the air and in turn, caused extensive air travel disruption, affecting flight in and out most of Europe. Dates: April 2010 People affected: 10 million Costs: $200 million 1. url= Retrieved March 8, url= Retrieved March 8, url= Retrieved March 8,

19 Could it happen? What is the impact? Winter Ice Storm Canada and USA A series of winter storms that affected Central and Easter North America in the US and Canada Areas were affected with freezing rain, thunderstorms, sleet, snow, damaging winds and blizzard like conditions Power was lost to approx. 1.5 million customers Dates: December 8-18, 2007 Deaths: 38 url= Retrieved March 8,

20 Assessment & Analysis Risk Assessment Purpose: Assess the Risks, Threats and their impacts to your organization. Typically based on four categories of risk: Environmental Man-made Business process Information technology Key Tasks: Identify, document, and prioritize risk Establish existing controls and their effectiveness20

21 Priorities What are they? 21

22 Assessment & Analysis Business Impact Analysis Purpose: Establish time-sensitive priorities associated with key business processes Key Tasks: Assessment to establish mission critical systems and processes Financial Operational Legal/Regulatory Customer/Brand/Reputation Qualitative / quantitative analyses and determination of MAD (Maximum Allowable Downtime), RTO (Recovery Time Objective) and RPO (Recovery Point Objective) This information can affect the strategy, plan and response 22

23 What are you planning for? Rail Disaster Argentina An 8 carriage train failed to stop at station and hit buffers at the end of the line There were approximately 1000 passengers on the train and about 700 were injured Rescue was difficult due to the structure of the carriages Dates: February 22, 2012 Deaths: 51 url= Retrieved March 8,

24 Or. Flood Thailand Severe flooding in Thailand during monsoon season, triggered by a tropical storm Flooding spread through provinces of Northern, Northeastern and Central Thailand and reaching all the way to the city of Bangkok Economic losses for the first 9 months of 2011 represent 80% of the worlds economic loss Dates: July November 2011 Deaths: 815 (13.6 million people affected) Cost: $45.7 billion url= Retrieved March 8,

25 Strategy Purpose Develop process-specific strategy options to continue or recover key business processes, ensure appropriate resources, support functions and IT assets in accordance with stipulated recovery objectives Strategy should address loss of: essential personnel physical facilities information technology services and resources Key Tasks Identify alternate facilities and backup equipment Determine implementation and maintenance costs Perform cost benefit analysis (using the BIA results) 25

26 Can you go straight to the strategy phase? a) No You must have a current governance program, risk assessment and business impact analysis complete and in place before you can even think about a strategy b) Yes A strategy can be put in place for recovery, particularly for IT c) It depends If there is an urgent requirement you could, but you would need to eventually do the analysis and assessment and then adjust the strategy 26

27 When Tribal Knowledge is unavailable H1N1 Flu Pandemic Global An influenza pandemic first appearing in 2009 in Mexico Symptoms were deadly and deterioration was rapid, including respiratory failure in 24 hours (in severe cases) Dates: Deaths: 14, 286 url= Retrieved March 8,

28 Why different types of plans? Earthquake and Tsunami Japan Earthquake off the coast of Tohuku hit Japan and triggered a Tsunami reaching peak heights of 40.5m Caused a number of nuclear accidents and ongoing level 7 meltdowns Dates: March 2011 Deaths:15, 850 Cost: $235 billion url= Retrieved March 8,

29 Purpose: Plans Develop the response, recovery and restoration components of planning documentation Key Tasks: Develop team structures Document response, recovery and restoration procedures, and manual workarounds for each critical business process and IT asset to enable target recovery per your corporate guidelines: Emergency Response Crisis Management Plan (including Emergency Management and Crisis Communication) Business Resumption Plan (Work Area Recovery) IT Disaster Recovery Plan 29

30 Plans Integration of components Program components flow from actions taken from the Emergency Response Plan (ERP) to the Disaster Recovery Plan (DRP) and its connection to the Business Continuity Plan (BCP), and up to the Crisis Management Plan (CMP) Without the integration of all the components into an overall Program the individual programs will become disjointed and be ineffective 30

31 How many plans are required? a) One corporate plan is very effective during a response b) Multiple types of plans are required, you need a plan per team 31

32 Knowing what to do 32

33 Sustainment Purpose: Deploy the newly developed plans and response structure Ensure all employees named in the plan review the content and agree that it reflects the current business environment Key Tasks: Distribute plans to applicable employees Provide initial training sessions Validate plans with crisis management team and each process/technology recovery team Develop exercise scenarios based on the risk assessment Document measurable objectives and success criteria Measure against defined success criteria and document results 33

34 Planning should not be a secret Pandemics (The Avian Flu and SARS) established some key lessons regarding employees and their role and responsibilities Education of employees is key Identify reliable and accurate sources of information Provide clear communication and direction 34

35 Knowledge Transfer Purpose: Ensure that all employees are aware of their role and responsibility Ensure that all employees are aware of the communication methods Key Tasks: Develop an annual awareness program 35

36 How do you know when you are finished? a) Business Resiliency is never really finished b) Once the plans are written c) Once the software is in place 36

37 37

38 Shanda Chronowich Senior Manager MNP LLC 38

39 Thank You To learn more about the topics discussed, please contact: Shanda Chronowich Senior Manager