RBTC: Business Continuity 101

1. RBTC: Business Continuity 101 July 18, 2013

2. What is Business Continuity? • Scenario Part 1 • Why is BC important? • What types of plans are needed? • How do you create them? • Scenario Part 2 • Questions

3. Business Continuity Defined The ability of an organizationto ensure continuity of service, to support its customers and to maintain its viability before, during and after an event.

4. Purpose of Business Continuity • Ensure continuity of time-critical business processes • Safeguard corporate assets • Minimize effects of an interruption • Train personnel to handle emergency conditions

5. Respond vs. React Confidential

6. Scenario 1: How prepared are you? • Hurricane Derick is powering through the coastal Carolinas. • Significant impact is expected • Severe flooding • Power disruptions • Internet disruptions • Storm will hit 2 a.m. on Saturday.

7. Scenario 1: What do you do now? Pick a representative organization at your table. It is Thursday morning: • Based on what you know, would you recommend activating your Emergency Management Team. Who would be on it? • What are you top 2 priorities? • Do you have resources in place? USE YOUR TIP CARD

8. Exemplar Disruption Timeline Systems & Applications Recovery Path OperatingSystemRestoration ApplicationRestoration Backlog/Data Synch Telecommunications Recovery Path Voice NetworkRestoration Vital Records EmergencyResponse DataNetworkRestoration StandaloneSystemRestoration ResumeBusiness(AlternateSite) ResumeBusiness(Home Site) UnplannedInterruption Business Unit Recovery Path BusinessUnitRelocation ManualOperations Backlog/Data Synch Transaction Backlog

9. Why isBusiness Continuity Important?

10. Reason #1: Disasters really do occur

11. Reason #2 It’s good business • 43% of businesses that experience a disaster never reopen. 29% of such businesses close within two years, and businesses whose information systems fail due to a disaster lose, on average, 40% of daily revenues. (Contingency Planning & Management) • Of those businesses that lost their records in a fire, 44% NEVER reopened their doors again, and 30% of those that DID reopen failed to survive beyond three years after the fire. (ARMA)

12. Costs of Downtime

13. What Types of Plans are Needed?

14. Four Types of Plans Used at Time of Disaster • - Other (Legal, Secretary, CFO) • IT RecoveryTeam • HR Crisis Team • Identifies senior management team’s roles and actions required to mitigate the impact of crisis • Crisis Communications Team • Tells all staff what to do when specific emergency events happen • Emergency Response Team Crisis Management Plan Life Safety Plan Business Process Recovery Plans • Focuses on the recovery of IT systems based on business requirements Disaster Recovery Plan • Helps to ensure that essential business processes continue following a disaster, determines the “who, where, and when” of recovery

15. What is the Process for Creating Business Recovery Plans?

16. Business Recovery Planning Overview Understanding the organization Determining Recovery strategies • Create BCM Framework and Governance Exercising, maintenance and review Developing and implementing a response plan

17. Elements of a BRP • Where do I go? What do I do today? What do I do in 3 days? What do tell my employees? Who is in charge? • Disaster Declaration Procedures • Emergency Evacuation Procedures • Detailed Task Lists over time (what to do on day 1, day 2, day 3 etc) • Notification Procedures • Contact information for all internal and external dependencies • Recovery locations (primary and secondary) • Team leaders and alternates • Manual workarounds and work procedures • This may be the only document the Business Process Manager has at time of disaster

18. Your recovery strategy should not be a secret….

19. Scenario Update: Hurricane Derick +24 hrs • Storm stalls: • Severe flooding (impact similar to the Flood of 1985) • Rain expected for another two days • High winds expected to die down by end of Sunday.

20. Scenario Update: Hurricane Derick +24 hrs • General infrastructure failure – public services off line. • Most CRC buildings are uninhabitable. • Power substation in Blacksburg fails • Appalachian Power estimates 10 days until restoration. • Gas shortage.

21. What to do? Assume your building is unavailable, the power is off and your generators will not have enough gas to get through to Monday. Your EMT is already activated. • Based on what you know and what plans, procedures and equipment you have in place right now: • Discuss the likely impact of the hurricane on your business. • Discuss your top 2 priorities for recovery • What was the most important thing you learned here today?

22. Key Take-Aways • Business Continuity Management is not rocket science • Business Continuity Management is a process that mitigates and/or reduces risks • This is not a project, but rather an on-going process that touches every part of the organization • BCM requires the cooperation of all the lines of business

23. What worked? What did not work? • Based on your experience in these exercises: • What worked about your plans? • What could have worked better? • What are some action items you’ll take back to your team? QUESTIONS?

24. Helpful Information • Business Continuity Institute – thebci.org • DRII – drii.org • FEMA’s preparedness site – ready.gov Plans are of little importance, but planning is essential. - Winston Churchill