Business Continuity PLEASE ask questions as we go. Colorado Fiscal Manager’s Association May 1, 2009

1. Business Continuity PLEASE ask questions as we go. Colorado Fiscal Manager’s Association May 1, 2009

2. We’ll Be Talking About • What is A Business Continuity Plan and why have one? • The role of the Finance Department in the plan • How to set up a plan (UNC Model) • What to do with the plan • Questions

3. Business Continuity is a second, but CRITICAL PRIORITY • Initial responses are completed • Life safety has been addressed • Damage has been evaluated • Operations now need to resume and get back to “normal”

4. What is a Business Continuity Plan? • A collection of policies, procedures, protocols and information that is developed, compiled and maintained in readiness for use in the event of a business interruption. • Outlines steps your organization needs to take in order to quickly resume service delivery.

5. How Business Continuity Planning Differs from Disaster Recovery and Crisis Management • BCP focus is not on rebuilding or alleviating the effects of a disaster, emergency or catastrophe. • BCP focuses on sustaining the delivery of services essential to the organization’s survival. • With a sound BCP, your organization can continue to provide mission-critical services, no matter what happens.

6. Why do we need a BCP? • Having the BCP in place before the business interruption is critical; otherwise, you may not be able to respond quickly enough to prevent service interruption.

7. California State University, Northridge, 1994 • Earthquake, magnitude 6.7 • Nearly every building on campus unusable source: D.Carver, U.S. Geological Survey Classes resumed four weeks afterwards. source: Mary M. Finley, CSU Northridge

8. Oakland, CA, 2007. Planning made a difference. source: Associated Press / Paul Sakuma 26 days later. source: San Francisco Chronicle / Paul Chinn

9. New Orleans, 2005. source: National Oceanic & Atmospheric Administration Planning would have made a difference! source: Reuters / Jason Reed

10. Why do we need a BCP? You MUST Resume Critical Functions

11. What is a “Critical Function”? • Those functions that are essential to the continued accomplishment of the organization’s mission. • Functions that would result in: • Irrevocable disruption of student education • Irrecoverable loss of research data • Irrecoverable loss of operational data, or • Significant financial loss to the University

12. Finance’s Role in the plan Ensure that business operations are resumed and proper controls are being followed. • Get bills and salaries paid • Compliance will laws, rules, and other obligations (i.e. federal research money) • Recover of losses and preparing the paperwork for insurance and reimbursements (i.e. up to 80% of could be recovered from FEMA)

13. Scenarios To Consider • How would your office continue to deliver mission-critical services if normal business operations were interrupted? • A fire destroys your office and you are unable to retrieve any materials. • The sprinkler system malfunctions and soaks the office, damaging most of the computers. • A bomb threat is received and an entire building must be evacuated. • Several members of one department contract food poisoning and are unable to work. • A hacker gains access to your organization’s computer system and blocks access to data.

14. What would your organization do? • How could you quickly resume functioning enough to continue delivering the services that are critical to the mission of your organization?

15. How to set up a plan (UNC Model)Lets refer to the template for this section

16. What does the template look like? Basic Information About the Unit Covered Under This Plan

17. Tab 2 – Risk Awareness • General questions about risks the unit covered under this plan may be subject to, such as: • Has this Unit suffered a serious loss or disruption during the past 5 years? • Does this Unit provide essential services or products to other University Departments? (purchasing, payroll, facility maintenance, etc.) • Does this Unit maintain records essential to completing the mission of the University? (i.e. payroll, info tech, student serv) Do not include info maintained on the Banner System.

18. Tab 2 (continued) • Additional questions such as: • Does this Unit utilize chemical or other hazardous materials to complete its educational research or maintenance purposes? • Does this Unit process financial transactions, collect cash, or distribute payments in excess of $1000 on a regular basis?

19. Tab 3 – Assessing Unit Risk Probability and Impact Probability of Occurrence – some items have a suggested minimum point already calculated. Incidents with highest total calculated risk should be the focus of your initial planning efforts.

20. Tab 4 – Critical Functions Remember: Critical functions are those activities that are essential to the continued accomplishment of the University mission. A “Critical” function is an activity that must be restarted and functioning within days after a disaster occurs to enable teaching and research to restart and function. EXAMPLES: Classroom instruction, Research, Payroll, Purchasing BE VERY DISCRIMINATING! Visualize the Unit working in temporary quarters with limited resources, computers and other equipment. Which functions MUST be completed?

21. Tab 4 – Special Functions Special functions are those functions a particular Unit would not normally do but need to be done in the event of a crisis. • EXAMPLES: • Housing may be asked to provide isolation/quarantine facilities during an epidemic. • Facilities may need to provide rapid facility inspections after a tornado. • Health Insurance Office staff may be asked to assist with directing lines of people for triage.

22. Tab 4 – Secondary Functions Secondary, noncritical functions are activities that should be restarted and functioning within weeks after a disaster occurs to allow teaching, research and administration to function adequately. • EXAMPLES: Grade processing • Admissions processing • Financial reports processing

23. Tab 5 – Critical Function Assessment Brief description of this function Titles and/or generic group names (VP Administration, Senior Faculty)

24. Tab 5 – Peak Periods and Dependencies Identify periods of high activity by indicating all months that the Unit expects high demand for this function What other Units or systems have to be operational before this Unit can perform this Function? What Units or systems will be affected by failure of this function?

25. Tab 5 – Critical/Special Function IMPACT to University If this function is not resumed quickly enough following a disaster, which of the “harmful consequences” might occur and when would they occur? • Potential Harmful • Consequences (examples of those in list): • Disruption of Teaching? • Disruptions of research? • Loss of students? • Loss of faculty? • Loss of staff? • Reduced well- being of Students?

26. Tab 6 – Critical/Special Function Key Staff Identify each Critical/Special Function’s Key Staff. Envision this Unit 1-3 days after a major disaster. Identify the group of employees needed to PLAN how to resume operations

27. Tab 6 – Employees from Other Campus Units Vital to this Function What other campus units/staff members might this Function need to contact within the first few days after a disruption in order to plan how to resume operations? Examples: School of Nursing may need to work with Scheduling to find alternative classroom space to hold classes if Gunter was destroyed in a tornado. Payroll may need to work with IT to restore URSA access so payroll can be processed.

28. Tab 6 – NonUniversity Agencies, Vendors and Other Organizations Vital to this Function Who are the most important contacts for other Non-University organizations that this Function may need to contact within the first few days after a disruption in order to plan how to resume operations?

29. Tab 7 – Continuity of Critical/Special Functions Visualize the conditions that might exist in the weeks or months following a disaster. List ideas only, not detailed procedures. Provide supporting documents if helpful or necessary. Assume the University will resume teaching, research and critical support functions as soon as possible after a disaster—regardless of conditions. Assume key resources will NOT be available such as: • Normally assigned space • Staff members • Certain equipment • Access to Files • Phone Service • Network Access • Access to other electronic data • Access to other data • Access to Vendors and Vendor Information

30. Tab 7 (continued) • Things to consider include: • Would this Unit need to continue functioning if the Campus were closed? • Can this unit perform this function with some/all staff working from home? • If so, what equipment/supplies would be needed? • How would this Unit carry out this Function if this Unit also lost ALL of its equipment? • Show Stoppers: Is there any resource that’s so important that this Unit cannot restart its function without it?

31. Tab 8 – Accessing Vital Records Supporting this Unit/Function Identify records vital to this Unit/Function. List records stored as individual documents in file cabinets and/or stand-alone computers. Do not list records stored by IT Services. Those will be accounted for separately.

32. Tab 8 – Software Applications and Systems Supporting this Unit/Function Identify software applications or systems that support this Unit/Function. Systems are where the software resides: PC’s, McIntosh or Servers. DO NOT include servers managed by IT, as they will be addressed later in this section.

33. Tab 8 – IT Servers Supporting this Unit/Function Identify IT computer servers that support this Unit/Function. NOTE: Provide requested information for each ITA Server used for this Unit/Function. • *This information is requested from and provided by Information Technology

34. Tab 9 – Restarting Data/Information and Technology Systems What will this Unit need to restart this Unit’s component? Assume this Unit’s normal workplace is destroyed or inaccessible. Assume new space, furniture and Internet access have been provided by others. This section may be completed for the Unit as a “Whole” or separately for each critical/special function. Examples of Questions: Where would this Unit quickly purchase new workstations, services and other hardware vital to this Unit/Function? Could any of the IT requirements for this Unit/Function be “worked-around” if necessary by using paper forms, etc?

35. Tab 10 – Communication Preparedness Envision this Unit 1-3 days after a major disaster. Identify the communication lists necessary to contact employees and students. Each Unit needs to keep its own list of home and other contact information for employees to be distributed as appropriate. This list should be updated at least twice per year. Examples of questions: Who maintains this Unit’s/Function’s faculty/staff emergency home contact lists? Who maintains this Unit’s/Function’s important e-mail address lists? (describe) Who has the ability/authorization to post messages on this Unit’s/Function’s website?

36. Tab 11 – Working from Home Preparedness Many faculty/staff members could perform their jobs (at least partially) from home. In this section, list titles and current names of all employees who complete significant work related to EACH critical function. Survey each employee to determine access to adequate home computer resources for assisting with the Critical Function should on-campus computer access be lost during a crisis.

37. Most important part of the business continuity plan. These are action items that can be completed NOW to enable this Unit to recover in a more timely manner should a disaster occur. Action items are ideas, not necessarily a commitment to act. BE CREATIVE. Some of the Unit’s action items may outside of the Unit’s direct responsibility Tab 12 – Action Plans

38. Tab 12 – Critical Function Action Plan • Items are brought forward from previous tabs to the Action Plan section. • You will need to complete other information for each action item: • estimated cost • one time or ongoing cost • responsible person • details • status • complete • in process • other • THIS SECTION BECOMES THE ‘TO DO’ LIST FOR YOUR UNIT OR OTHER UNITS

39. Tab 13 - Completion Tab 13 – You’ve completed the Business Continuity Template! Please keep a copy of the document for your Unit’s records.Forward the final copy electronically to: XXXXXXXXX@XXXXX.XXX

40. What happens once the business continuity template is completed? • As part of completing the business continuity plan, each unit will develop action items • Once these items have been addressed, they will help your organization quickly resume operations after a major disruption • Print it! • Keep it up to date! • Have available outside of your office / your office computer.

41. ? Questions

42. The end Contact Info: Paul.Squillace@unco.edu George.Slack@unco.edu