From Start to Finish: A Business Continuity Plan

Katie BechtelBusiness Continuity AnalystSecretary of State’s Office

Background

Developed and tested the first draft of the Oregon Youth Authority BCP (July 2006-June 2007)

Currently working at the Secretary of State’s Office We are about 1 year into the 2 year

Project Plan We expect to start testing Spring 2009

The Process

Step 1: Create Project Plan Step 2: Conduct Business Impact

Analysis Step 3: Draft Business Continuity

Plans Step 4: Complete BCP support work Step 5: Test and Exercise Plan

Step 1: Create Project Plan

Decide how to organize your work OYA: Around locations (Facilities, Field Offices,

Central Office) SOS: By Division By Critical Business Function

Create a plan that outlines timelines, resources needed, expected participation

Have project plan approved by Management Council or Steering Committee AND participating business sections

Step 2: Conduct Business Impact Analysis

Goal: Identify business processes, RTOs, associated computer systems, essential records, and dependencies

Develop questionnaire and meet with business divisions to complete it

Divisions then complete the Questionnaire Compile information into BIA Report

This report will outline current recovery capabilities and detail ways to improve the situation (i.e. implement off-site data storage)

Don’t start a BCP until these problems have been addressed

Business Process PrioritizationELECTIONS DIVISION BUSINESS PROCESS CRITICALITY RANKING

RTO “1”0 to 1 week

RTO “2”1 to 2 weeks

RTO “3”2 to 3 weeks

RTO “4”3 weeks to 1 month

RTO “5”1 month +

Manage OCVR Administration (3 hours)

Campaign Finance Transaction Filings (4 hours)

Manage Initiative/Referendum filings (24 hours)

Provide Customer Contact (1 day)

Conduct Investigations for violation of Oregon Election Laws (48 hours)

Produce and Publish State Voters’ Pamphlet (3 days)

Manage and Process Voter Registration (OCVR, HAVA, NVRA) (5 days)

Manage HAVA Administration (5 days)

Create, Write, and Update Administrative Rules (1 week)

Manage State Candidate Filings for Office/Qualifications (1 week)

Manage State Candidate Filings for Vacancies in Office (1 week)

Conduct of Elections—County Elections Officials/Citizens (1 week)

Manage and Schedule Fiscal Impact/Explanatory Statement Committees (2 weeks)

Manage Filings for Minor Political Party formation (1 month)

Produce and publish Publications (Calendars, Manuals [15], Brochures, Forms) (1 month)

Manage State and Local Recall Petitions (1 month)

Business Process PrioritizationHUMAN RESOURCES DIVISION BUSINESS PROCESS CRITICALITY RANKING

RTO “1”0 to 1 week

RTO “2”1 to 2 weeks

RTO “3”2 to 3 weeks

RTO “4”3 weeks to 1 month

RTO “5”1 month +

Emergency/Temporary Staffing

Receive request for temporary staffing

Contact temporary staffing vendor

Receive temporary staffing

Policy Administration Write and Revise Policies Approve Policy changes Implement Policy ChangesRecruitment Process “Requests to Fill” Post open positions Review and grade applications Schedule interviews Clear to Hire Extend offers Conduct New Employee OrientationTraining Process Requests for training Procure vendors Schedule trainings Communicate Training Conduct Training Conduct Training Evaluations Approve Payment to VendorsRecords Management Receive employee related records and files Organize, maintain, and store recordsSystem Administration Input Employee Related Information

Step 3: Draft Business Continuity Plans

Use the templates! Why reinvent the wheel?

The BIA Questionnaire will give you most of the information to complete the plans, but you’ll need the business section to review it and fill in blanks after a good draft

Checklist from TemplateRecovery Steps –

Summary Step 1 – Contact BCP Executive Lead Team members and arrange for

a meeting. Step 2 – Executive Lead Team meets and reviews plan; activates BCP

Crisis Management Teams. Step 3 – Alert alternate site location to begin setting up for incoming

staff. Step 4 – Contact DAS Phones to redirect phone lines. Step 5 – Meet with Alternate Site Management to review operating

procedure. Step 6 – Contact Alternate Site Staff and IT Team with directions for

deployment. Step 7 – Contact IT and determine when computer services will be

available Step 8 – Contact customers, vendors, etc. and inform them of possible

delays. Step 9 – Public Information Team announces relocation to media

outlets. Step 10 – Establish communication with customers at Alternate Site. Step 11 – Complete priority Business Processes at Alternate Site. Step 12 – Relocate remaining staff as needed, as space and capability

become available, to complete the CBF “Emergency and Temporary Staffing” at the Alternate Site.

Big Checklist from Template

Step Number Step Step DetailAdditional Resources

Required:Responsibility

Date Completed and

Initials:

1. Contact BCP Executive Lead Team members and arrange for a meeting

Contact team members (See BCP Team page for contact numbers) or their alternates and arrange a meeting.

TelephoneBCP Team contact

information

BCP Coordinator

2. Executive Lead Team meets and reviews plan; activates BCP Crisis Management Teams.

Meet with BCP team members and assess the situation. Review the plan and determine whether or not all steps need to be taken. Based on the situation, do other steps need to be implemented? If so, document and assign responsibility.

Meeting locationTelephone

BCP Coordinator

Step 4: Complete BCP Support Work

IT Disaster Recovery Plan Crisis Management Teams Policy and Procedures

BCP Activation and Control Maintenance Program

OYA Crisis Management Team Structure

Crisis Management Team

Primary Site Teams Alternate Site Teams Public Information Teams BCP Development Teams

Damage Assessment and Salvage

Insurance

Physical Security

Disaster Recovery

Telecommunications

Disaster Recovery

Staff Transportation

Physical Security

Telecommunications

Public Information

Family and Foster Care Communication

BCP Steering

BCP Development

Step 5: Test and Exercise Plans

Table tops tests are a great way to familiarize your teams with the plan and make corrections

Exercises force the execution of your plan

These are used to test your plan as well as to train your teams

Findings from OYA Test #1 March 29, 2007

The initial meeting site for the Executive Lead Team was made consistent with building evacuations

A server had been replaced and relocated since the first draft of the Plan

An IT staff member was added to the Public Information team to update the agency website

The role of coordinating the physical relocation of salvageable equipment and supplies was delegated to the Facility Manager

Findings from OYA Test #2April 27, 2007

OYA staff are unaware of the existing Emergency Exit Strategy

Loss of power, and therefore lighting, may hinder evacuation

Preliminary space planning at the Alt. Site will speed transition

Critical phone lines should be identified Each BCP team should document

decisions and actions

The Process

Step 1: Create Project Plan Step 2: Conduct Business Impact

Analysis Step 3: Draft Business Continuity

Plans Step 4: Complete BCP support work Step 5: Test and Exercise Plan

Templates or Completed Examples

Project Plan and Dashboard BIA Questionnaire BIA Report BCP BCP Crisis Management Teams Test Scenarios Test Reports