Business Continuity Overview Business Continuity Services, User Support Services, ITR California...
-
date post
20-Dec-2015 -
Category
Documents
-
view
218 -
download
4
Transcript of Business Continuity Overview Business Continuity Services, User Support Services, ITR California...
Business Continuity Overview
Business Continuity Services, User Support Services, ITR
California State University, Northridge
CSUN, 2006
Agenda—About BC
WSIC? WDINTK? WSID?
--Context of BC in Higher Ed, CSU--BC Program Components--BC Culture
Presentation Caveats and Disclaimers
Functionally agnostic: Not specific to IT, administration and finance, academic units, student services, financial aid, etc.
Overview of business continuity program components for your consideration and application
Emphasizes efficient, continuous approach to yield useful results (a comprehensive DRII methodology exists)
CSU Business Continuity Drivers
CSU Executive Order 921, Emergency Management Program (November 2004) Look for a new/superseding EO with more specifics on BC Planning, per system audit office
Governor’s Executive Order S-4-06 (April 2006) mandates compliance by all state agencies with Continuity of Operations/Continuity of Government plans and guidelines. (CSU requested to assist in implementation.)
All pre-mitigation and recovery grant monies are now tied to Federal Government Emergency Preparedness Standards.
Other BC Drivers
Common institutional standards:
--Protect people, buildings, and infrastructure
--Address potential threats and exposures to unit’s essential functions
--Minimize campus and unit disruption; loss; and costs due to delays, interruptions, outages
--Do the right thing
Regulations, competition stimulate constituent expectations/requirements:
--High availability of service, data accuracy, adaptability and flexibility...
Up a Creek?
Your Business Continuity Program to the Rescue!
Photo, slide text from Business Continuity Strategies content of UC Berkeley, Copyright © 2002, The Regents of the University of California.
Context of Higher Education BC Planning
HIGHER EDUCATION PAST
HIGHER EDUCATION PRESENT
Emergency management focusContinuum from
emergency response to operational continuity
Disjointed, short-term maneuvers/projects, written plans
Strategic, driven from the top, ongoing programmatic actions
Limited to individual areasInvolves all aspects of
the enterprise
Expense-driven Investment-oriented
It’s about IT and the IT organization.
It’s about all units, especially IT, and sustaining the institution.
Business Continuity Strategy at CSUN
Simultaneous, phased approach
Phase One: Facilitate plan/program development with high-priority units; opportunistic, high-need testing; support based on EO 921
Phase Two: Provide tools, outreach, and training to support independent unit-level development of program/plan; facilitate development of campus-wide program/plan; targeted, periodic testing, review, and improvement events; support based on Presidential Charter, Cabinet-level Executive sponsorship, EO 921
Unified, integrated across campus units (e.g., DPS, EHS, SHC, EOC)
Planning answers two questions: --What key functions need to be recovered by a unit during an emergency?--How will the unit recover and execute those functions?
Business Continuity
An ongoing program of advanced planning and preparation activities conducted by academic and business operational units to ensure continuation of mission-critical functions and maintain campus viability before, during, and after an adverse event
Sometimes called “continuity of operations...”
BC Program Elements You May Already Have in Place...
INFRASTRUCTURE ASPECTS
• Emergency Evacuation/Safety Protocols• Data Backup & Recovery Practices• IT Change Management Practices• Onsite/Offsite Data Storage, Replication• Alternate Site (Cold, Warm)• IT Recovery Processes
MANAGEMENT ASPECTS
• Validation and Testing Practices• RFP Practices• Campus-wide Emergency Operations
Center, Emergency Response Plan Forsythe
BC Program Components
Enact Personal/Emergency Preparedness, Building/Environmental/Work Safety
Assess Potential Disruptions Identify Critical Functions Determine Essential Resource/Asset Needs and
Resumption Approach(es) for each function Capture procedural info about how to recover each function Establish Concept of Operations and BC Program Calendar Compile and develop written plan Conduct maintenance (Train, exercise, revise plan, lather,
rinse, repeat.)
Risk Assessment
Describe causes, effects, consequences of disruptions (CAUSES--fire, flood, earthquake, aircraft/transportation accidents, landslides, pandemic, hazmat incidents, civil disorder, heat emergencies, drought, terrorism, sabotage; EFFECTS—area denial/contamination, personnel death/injury, property/structural damage, explosive/shock wave, fire, heat, flood, loss of food/water, loss of transportation, lack of medical care/surge capacity; CONSEQUENCES—operational viability, legal liability, damaged reputation/credibility, decreased safety, etc.)
Work involved in estimating consequences of each effect is enormous (for ex., for a power outage, flood, or malicious employee, estimate damages considering all prevention, mitigation, and SOPs that might reduce harm...)
GAK!!
Risk Assessment—Disruption-based Focus
Loss of people (local or area wide? executives, department decision-makers, key operational experts?)
Loss of facility, localized event Loss of facility, regional event Loss of a communication system/mode Loss of vital records, key databases Loss of specialized equipment, supplies, or systems (HW, SW
apps, servers, OS platforms, networks, email/Internet, etc.) Loss of key vendors services, other agency services
Risk Assessment—Disruption-based Focus
ID specialized risks are not addressed by one or more of the disruption scenarios
ID risks that are not contemplated or covered
Risk Assessment—Disruption-based Focus
Disruption scenarios help you determine resumption strategies—
If key resources (people, buildings, infrastructure) are not available, what alternatives exist to resume a given function?
If alternatives do not exist, what should be/can be put in place?
Critical Functions
What key functions need to be recovered by your unit during an adverse event?
What’s a critical function?
One that must or should continue under all circumstances, without significant interruption, because of safety or security.
One that is vital to the instructional, research, or service mission of the University.
One that provides vital support to another department, unit, organization that delivers essential functions.
Now, strategize...
Given a disruption, how will each critical function be recovered, and what functional level(s) are adequate?
Consider Alternate Ops
Build in internal backup(s) External backup(s) Restricted Ops Virtual Ops Parallel Capacity Like-kind exchanges (MOUs) Re-construct process at alternative site (warm, cold; staff work
at alt site, hotels, home locations) Substitute processes (for ex., w/communications: telephone,
email, Web site, cell phones, fax, in person meetings) CROSS-TRAINING
Analyze Resource Requirements, Recovery Approach(es) for each
Activities and tasks to be conducted Facilities/worksites (space, security, access) Communication systems Personnel Vital Records and Databases Systems (sw, other) and Equipment (hw, office, etc.) Key vendors; other agencies, organizations Key constituents Specific Recovery Instructions (maps, diagrams,
procedures)
Additional Considerations
RTOs—
For those very few under an hour, straight recovery with hot/warm backup
For the few under 24 hours, the several 72 hours to a week, scaled / layered recovery with limited recovery for <24 hours.
For those between 24 hours and a week, more extensive recovery, but perhaps not full, capability.
Scales and layers of disruption—unit-level, organization-, region-wide; factor in multiple recovery site options
Atchoo! Pandemic Planning
Understand the difference between seasonal flu, avian (bird) flu, and pandemic flu.
Implement remote work schedules: Practice working and communicating remotely with colleagues on a routine basis.
Cross-train today—BE THREE DEEP for essential functions and related processes.
Gear up and prepare systems and IT staff members for increased demand for service within framework of greatly reduced IT workforce and outside support...
For each essential function, establish service-level matrix when campus is closed or open and staff levels are normal, 70%, and 30%
Put your personal and family emergency preparedness plan in place—at home, at work, and on the road. Seriously.
Interest Areas for CSU Auditors?
What are risks specific to campus/general operational area (RA)? Assessment of realistic worst-case scenarios to determine what can cause disruption to critical function(s)? Potential impact of uncontrolled, non-specific events on an institution's business processes identified (BIA)?
Specific business continuity goals, objectives, and needs for operational area are enumerated?
Prioritized list of functions and assets critical for continuing operations after a disaster?
Budgetary requirements for operational restoration and continuity?
Plan Maintenance: A written plan with revision dates included exists and is reviewed, updated, exercised/tested at least annually?
Challenges—The Continuity Culture
No program or plan comes into existence fully completed and highly operational!
Deficiencies: Operational vulnerabilities, recovery inconsistencies, low readiness of teams, tribal knowledge, inadequate testing, poor awareness, lack of measurement to validate plan quality, poor links with vendors....
Anticipate that your plan will require upgrades/alterations to operations or to standby provisions so it can be effective...
Some changes may require many months, even years to alter practices, obtain funding, and satisfy needs...
Something is better than nothing—unless you’ve made the explicit decision to do nothing.
Success Factors —The Continuity Culture
Every mission-critical function has its recovery documented in a continuity plan
Essential personnel have been identified and know what to do
All personnel are familiar with their unit’s operational continuity plan
Plan is updated and exercised on a regular basis Executive level BC directive to management and abiding
BC commitment from executive leadership that is communicated to management and staff
Success Factors—The Continuity Culture
Operational continuity integrated into strategic planning—at campus and unit-level—and each employee’s job description
Campus meets, anticipates BC-related regulatory requirements
Unity of emergency preparedness, environmental health and safety, operational continuity programs, public health
Ready, routine assessment and mitigation against critical risk drivers
Provide BC leadership in your campus community
In a Jam?
Your Business Continuity Program to the Rescue!
THANK YOU!
Business Continuity Services, User Support Services, ITR
California State University, Northridge