Government’s Year 2000 Challenge

1. Government’s Year 2000 Challenge

2. The Role of Government • How bad will it be? • It is not just a 2000/01/01 problem • Economic Implications • Y2K Risk Management • Contingency Planning & Emergency Management • What we should do - a need for partnership

3. 0 No real impact 1 Local impact for some enterprises 2 Significant impact for many enterprises 3 Significant market adjustment (20%+ drop); some bankruptcies 4 Economic slowdown; rise in unemployment; isolated social incidents 5 Mild recession; isolated supply/infrastructure probs; runs on banks 6 Strong recession; local social disruptions; many bankruptcies 7 Political crises; regional supply/infrastructure probs, social disruption 8 Depression; infrastructure crippled; market collapse; local martial law 9 Supply/infrastructure collapse; widespread social disruptions and martial law 10 Collapse of U.S. government; possible famine How Bad Will It Be? Let’s See What Washington Experts Think...

5. Government’s Challenge Government has an obligation to ensure the health, safety, and economic vitality of the public. As a result, government year 2000 efforts will need to look beyond its own systems problems and ensure that the community can conduct "business as usual" through 2000.

6. Government Must Understand the Year 2000 Reality • It must be fixed quickly in the face of dwindling resources • It is a risk to our power, water, sewer, and telecommunications systems • Not enough is being done by government to prepare for possible service and supply-chain disruptions

7. Where do things stand? Recent surveys of large companies indicate that: • Only 15% of companies and government agencies expect to have their critical systems more than three-quarters tested and compliant by 1999/01/01 • 40% have already experienced failures • 84% are missing Y2K milestones • Local government is far behind - 55% of cities surveyed by the ICMA don’t realize it is a problem Sources: Cap Gemini America and ICMA

8. Why is Y2K a Problem for the Economy and Society? • Infrastructure Failures - power, telecommunications, and transportation disruptions may lead to significant impacts on daily life activities including shortages of critical supplies. • Economic Slowdown - system failures can cause supply chain disruptions, business failures, unemployment, revenue shortfalls, and recession.

9. More Reasons to Worry Many simultaneous and complex IT projects must be completed at the same time • IT projects are often behind schedule • IT projects are often over budget • IT shops are suffering staff retention problems and staff shortages • Little if any project management skills or experience dealing with large and complex problems

10. International Concerns • No country has a comprehensive plan (with funding) to deal with the problem (U.S., U.K., Canada, and Australia are closest) • Japan, Western Europe now estimating cost • Most countries are still assessing the problem or doing nothing at all • As a result, significant problems can be expected

12. Global Economic Impact • “I believe there is a 70% chance of a global recession that could be at least as severe as the global economic downturn in 1974 and 1974” - Ed Yardeni • "Inevitable difficulties are going to emerge. You could end up with...a very large problem. Before we reach the year 2000 there is economic loss." - - Federal Reserve Chairman Alan Greenspan • Global businesses will be impacted most ; Asia is already in a recession, perhaps a depression

13. Businesses Survival The Local Economy Depends on it! • Most small and medium size organizations have done little to prepare for Y2k • Resources may become scarce • Most experts expect 10-15% of small and medium size businesses to fail • Those without contingency plans will suffer • Economic impact will be felt in many ways • Impact will depend on absorption of business and employees by surviving firms

14. Potential Economic Implications What are the implications that an economic slow-down could present? • Recession • Shortages • Unemployment • Deflation • Lower stock prices • Revenue shortfalls • Reduced demand for good and services

15. With recession a possibility, we can’t assume a continuation of the 1990’s income tax growth rate.

16. It is Not Just a 2000/01/01 Problem Only 4 Months to 1999!

17. Timeline for ProblemsNot Just a 2000 Problem The 99 Problem The Big “00” FY2000 Starts 366th Julian day One Year THF GPS Rollover 8/21/99 1999 2000 2001 99th Day 99th Year What’s 9/9/99? Leap Day 02/29/2000 10/10/2000 Blows Buffer

18. Post 2000 Problems The Issue of the Epoch • If no date is set externally (There is no means to input actual time at the turn-on point), the system defaults to its "epoch" date. This could be the design date, the manufacture date, or some other date. • This means that some non-compliant systems are subject to failure not on 2000/01/01 but at some later time when the internal date reaches 2000/01/00.

19. If it is working fine after 2000/01/01 it is not guaranteed to be compliant • Due to delays in the production life cycle and shelf life, most of their failures will occur after 2000/01/01 - Some systems may not fail for years. • The inability to roll the dates of these internally date sensitive chips forward is an impediment to testing for compliance. • Integrated circuits may be from the spot, gray or black markets.

20. Epoch Conclusions • There may be fewer disruptions at 00:01 on 2000/01/01 • There may be nagging system failures for years after 2000/01/01 • Only testing will tell… • But, testing requirements exceed time available • It is difficult to determine the likelihood of failures

21. Risk Management is a Must This is going to have implications in the world and in American society we can't even comprehend." - Deputy Defense Secretary John Hamre before a Senate Committee; June 5 1998, Reuters

22. Risk Management Process • Risk Identification • Risk Assessment • Risk Control • Risk Transfer • Risk Finance

23. Risk Management Issues • Biggest Risk is not knowing all the risks • Biggest Problem - much risk is out of your control • Best Practices? • Triage • Contingency Plans • Business Continuity • Business Recovery • Disaster Planning

24. Create a Risk Management Team • Lead by Top Management • Project BoD Monitors • Separate from Y2K Project Management Team • Regular Status Reporting to Management • Broad-based • Awareness for Everyone Key Players • Elected Officials • Internal Audit • Risk Management • Legal • Finance/Budget • Procurement • Public Health/Safety

25. Time is ShortTarget Resources and Services • Quickly Identify and Triage All Risks • Evaluate and Assess Risk Likelihood and Risk Impact • Develop Risk Monitoring Procedures • Identify Actions That May Eliminate Risks in Advance • Identify Actions Necessary to Minimize the Impact of Risks That May Materialize

26. Prioritize Risk Factors • Personal Safety Risk • Services Risk • Operational Risk • Revenue Risk • Liability Risk • Good Will (Societal) Risk • Replacement Cost (today & 2000+)

27. Y2K Program Assessment • Perform benchmarking and gap analysis. • Perform independent verification of project. • Assess triage efforts and review contingency, fallback, disaster recovery, and business continuity planning. • Review all electronic linkages, supply chains, and other businesses that impact the enterprise.

28. Contingency Planning "...Virtually everything from supply, generation, and distribution is controlled by hardware and software...there will be power disruptions if things are not fixed." - David Mann, President of Nova Scotia Power

29. Contingency Planning Objectives • Public Safety • Minimal Economic Harm • Status Quo for Services • Business as Usual

30. Contingency Planning Issues • Power and Telecommunication Failures • Supply Chain Disruptions • Public Response to Failures • Triage Requirements • Fire Drills - Desktop Exercises

31. It’s Not Enough Just to Plan • Use focus groups and brainstorming • Seek “what can go wrong” • Find innovative solutions to risks • Contingency plans must be exercised • Hold table top exercises • Conduct “fire drills” • Train staff for action • Constantly assess your project

32. Contingency Planning • Develop alternate plans • Review manual work arounds • Create fall back procedures • Identify public safety issues • Update disaster plans

33. Due Diligence in Contingency Planning • Prioritization by Criticality • Dilemma: Don’t Leave Anything Out • Document, Document, Document • Fire Drills

34. External Risks "The state of year 2000 readiness of the utility industry is largely unknown." - Head of the Federal Energy Regulatory Commission, James Hoecker. MSNBC, June 12, 1998

35. What Are External Risks? External Risks are risks presented by factors outside the enterprise; these include risk present in the possible failures of business partners, suppliers, public utilities, transportation, telecommunications, governments, and other businesses. Due Diligence requires a complete assessment of external risks

36. Risk Areas High Business Partners Risk Infrastructure Applications Low Threat Areas

37. Review External Dependencies Infrastructure Dependence (power, telecom, etc.) System Compliance (computing, data,networks, etc.)

38. One Business Failure Can Shut You Down If you rely on one supplier for a critical part or service, the impact of their non-compliance could be catastrophic. Examples: • GM Parts Manufacture strike shuts down assembly line • Satellite snafu impacts millions • UPS strike hurts many using “just-in-time” • Railroad computer problems hit shipping

39. Managing External Business Dependencies Dealing With Business Partners • Evaluate supplier compliance • Assess business partner data issues • Plan for alternative suppliers • Address outsourcing concerns • Develop contingency plans

40. Vendors Are Your Partner • How are they doing? • Establish clear testing and certification strategy • Certification process varies with risk: • Joint Testing • Third-party test • Certificate • Hope for the best • Do you need to find some new ones?

41. Business Continuity "The problem's going to be pretty bad." - Andrew S. Grove, chief executive of Intel Corp, on Y2K. Washington Post, April 24, 1998

42. What is Business Continuity Planning? Planning to ensure the resumption of operations in the event of a catastrophic event. Business continuity planning goes beyond contingency planning to include the actions to be taken, resources required, and procedures to be followed to ensure the continued availability of essential services, programs, and operations in the event of unexpected interruptions.

43. Dealing with Dependency • Identify & prioritize dependencies • Get compliance statements • Conduct face to face negotiations • Change resource dependencies? • Look at the level of dependency • Contractual guarantees • Contingent business interruption insurance

44. Business Continuity Plan • Identify Risks - Triage Everything • All business functions • EDI/EBD • Suppliers • Infrastructure • Develop Plans for Everything • Test and Exercise the Plans • Layer Business Plan & Disaster Plan

45. Emergency Management "We're concerned about the potential disruption of [International] power grids, telecommunications and banking services. There is very little realization that there will be a disruption. As you start getting out into the population, I think most people are again assuming that things are going to operate the way they always have. That is not going to be the case.'" - Sherry Burns, Central Intelligence Agency, May 3, 1998

46. Infrastructure Issues • What will we do if there is no power? • No phone service? • No Water? • Will government open? • How will the public react?

47. Emergency Management Planning • Work with local and regional disaster agencies • Assess special problems with Y2k • Loss of Heat, communications • Supply-chain impacts • Review and revise existing disaster plans • Look for new areas for disaster plans • Include Disaster Recovery Planning • Keep the public informed

48. Use Local Emergency Management Groups • EMGs should form a Year 2000 Task Force • Assess the readiness of critical public safety systems and suppliers • Evaluate various Y2k scenarios (extended power outages, food shortages, etc.) • Review and update existing disaster plans • Establish relationships with key suppliers of potentially scarce resources • Develop contingency plans where needed

49. A Layered Approach toPublic and Private Sector Cooperation "The year 2000 problem is one of the great challenges of the Information Age in which we live. My Administration is committed to working with the Congress and the private sector to ensure that we minimize Year 2000-related disruptions in the lives of the American people." -  President Clinton

50. International Y2K Compliant Community Initiative • Minimizing Y2K problems will require an unprecedented public/private partnership and phenomenal leadership • We need a layered approach: • International – Global Alliance • National – Public/Private Y2K Task Force • State/Regional – Interdependency Assessments • Local – A Y2K Compliant Community