Property Mgmt Forum 2005 Midyear.pdf by CharlieThhomas

VIEWS: 4 PAGES: 25

									NAR® 2005 Midyear Property
Management Forum


Business Continuity
and Disaster Planning:
Maintaining Your Peace of
Mind and Bottom Line




Forum Facilitators

Randy Woodbury, CPM®
Salt Lake City, Utah


Ray Venero, CPM®
Alexandria, Virginia




World Trade Center Attacks:
Response Effort
 Involved hundreds of groups
 – federal
 – state
 – local
 – private
 Knowledge
 Jurisdictions
 Interests




                               1
2
World Trade Center Attacks:
Response Effort
 No one group alone had all
 data needed
 – to complete job
 – to coordinate with others performing
   essential tasks




                                          3
World Trade Center Attacks:
Response Effort
 Debris from attack destroyed NYC’s
 Emergency Management Center
 – 7 WTC
 City forced to identify alternate
 command center to manage
 response efforts




                                      4
World Trade Center Attacks:
Response Effort
 New command center organized
 – Mayor’s Office of Emergency
   Management (OEM)
 – Police Academy at 20th Street
 No map of the (Ground Zero) site




World Trade Center Attacks:
Response Effort
 Available at Hunter College
 Destroyed in 7 WTC
 Inaccessible in City Planning Office
 and DOITT buildings
 Locked in buildings closed for
 the day




                                        5
World Trade Center Attacks:
Response Effort
 Entire Command Center transferred
 west to Pier 92
 – 52nd Street and the Hudson River
 Equipment and hardware assembled
 – NYC agencies
 – Compaq
 – Hewlett-Packard




       Meanwhile….




World Trade Center Attacks:
Response Effort
 AT&T Network Disaster Recovery Team
 (NDR)
 – activated morning of 9-11
 – in New Jersey
 Collateral damage disrupted
 – local
 – long distance
 NDR challenged to provide emergency
 telecom for Lower Manhattan




                                       6
World Trade Center Attacks:
Response Effort
 Emergency Communications Vehicle
 (ECV)
 – deployed to NYPD backup command
   center in lower Manhattan
 Damage to Verizon network
 – no regular telephone service in
   NYPD HQ




                                     7
World Trade Center Attacks:
Response Effort
 EVC provided 48 phone lines
 – administrative use
 – use by families of missing
   NYPD members
 EVC in service from September 12 - 21




                                         8
Imagine…
 Your office has suffered a major fire
 All of your contracts, leases and
 critical papers have burned or are
 now paper pulp
 Your computer, network, and media
 is completely water logged
 Your telephone system is toast
 AND….




…you don’t have the disaster
recovery capabilities

 NYC
 NY state
 US federal government




Questions
 What do you do?
 What do you do first?
 Who do you call beside your
 insurance agent?
 How do you sustain your business,
 keep your clients and your
 employees?
 How do you manage the public
 relations message?




                                         9
Continuity Planning
Structure:
Overview of Basic Concepts




Key Questions: Business Continuity/
Disaster Recovery Plans
 What measures have you taken to ensure
 business continuity readiness?
 What network and data security measures
 are currently in place?
 What Disaster Recovery Plans are in
 place for your critical work functions?
 What system and/or data storage back-up
 procedures do you have in place to
 recover your critical business
 applications/processes?
 How do you plan to deal with the loss of
 staff and/or idle staff?




Nature of Incidents
 They disrupt normal work processes
 They occur with or without warning
 Initial causal events can grow larger
 Severity or magnitude may not
 be obvious
 They can occur any time of day/week
 The senior executives available may be
 random - in number and in formal title




                                            10
Common Definitions




Response Phase
 Incident Detection
 Damage Assessment
 Initial Response
 Escalation
 Activation of Plan




Resumption Phase
Restore mission critical systems
 – voice and e-mail
Deal with initial “people issues”
Business is in survival mode




                                    11
Recovery Phase
 Determine viability of disabled facility
 Restore balance of systems
 Business now should be at around
 50% to 80% operating capacity




Restoration Phase
 Back in business “as before”
 – repaired facility
 – replacement facility




Recovery Time Objective
(RTO)

   The length of time from a service
 disruption (or declared disaster) until
    the disrupted process or system
 must be functioning at a service level
   sufficient to sustain the business.




                                            12
             An RTO for Every Activity
                 Identify and assess each critical area
                 of the business
                  – telecom, connectivity, voicemail
                  – data, e-mail
                  – other
                 Identify critical processes and systems
                 for each of the above
                 Establish RTOs for each of process
                 or system




              Crisis Event Timeline
              and Responsibilities
                              Activate Plan?

Communications
and Messaging &                         Damage
                                                      Crisis Response Management
 Command and              Incident
                                      Assessment
    Control              Detection,
                            Alert,
                          Reactive
 Recovery Support        Response,
                                                    Resume
                                                               Recover    Restore
Group (Facilities, IT,   Escalation
                                        Damage      Mission-
                                                                 All      Normal
Telecom, Insurance,                   Assessment    Critical
                                                              Operations Operations
       etc.)                                       Operations


                         Phase 1: Response Phase 2:             Phase 3:   Phase 4:
                                                   Resumption   Recovery   Restoration




              Crisis Event Timeline
              and Responsibilities
                              Activate Plan?

Communications
                                        Damage
and Messaging &                       Assessment
                                                      Crisis Response Management
 Command and              Incident
                         Detection,
    Control                 Alert,
                          Reactive
                         Response,
 Recovery Support        Escalation
                                                    Resume
                                                               Recover    Restore
Group (Facilities, IT,                  Damage      Mission-
                                                                 All      Normal
Telecom, Insurance,                   Assessment    Critical
                                                              Operations Operations
                                                   Operations
       etc.)

                         Phase 1: Response Phase 2:             Phase 3:   Phase 4:
                                                   Resumption   Recovery   Restoration




                                                                                         13
Disrupted Facility




        What would you do?
        Where would you go?




IT and Telecom Redundancy
 E-mail
 Website
 File servers
 Telecom
  – Switch Redirect
  – 800 Follow Me
 Fax
 Wireless




Business Continuity:
Organization
 Communications and Command
 Recovery Support Group
 – facilities
 – information technology
 – telecom
 – insurance
 – others




                              14
          Business Continuity:
          Organization
                                     Command Center
                                      ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
                   You are          Crisis Management
                    Here!           Communications &
                                          Messaging




                                                       Information
                             Facilites
                                                       Technology




                          Telecom &
                                                        Insurance
                         Conductivity




                                            Others




           Sample BCP Time Line
                      Phase1 - Response

 Communications                                          Crisis Response Management
                                                                  •Declare a Disaster
  and Command         Incident    Damage                  •Activate Business Continuity Org.
(This Means YOU)     Detection, Assessment                    •Relocate to Recovery Site
                        Alert,                              •Locate Absent Team Members
                      Reactive                                 •Begin Crafting Messages
                     Response,
                     Escalation
Recovery Support                  Damage                 •Notify Business Continuity Org
Group (Facilities,              Assessment               •Relocate to Recovery Site
                     DECLARE      Initiate               •Re-route Voice and Data
   IT, Telecom,      DISASTER Insurance                  •Reconstitute LAN
 Insurance, etc.)                  Claim                 •Start Cleanup and Salvage


                      0-Hour             +4 Hrs          +12 Hrs                    +24 Hrs




           Sample BCP Time Line
                     Phase 2 - Resumption

 Communications                     Crisis Response Management
  and Command        Contact Major Stakeholders
(This Means YOU)     Manage Recovery Group Resumption
                     Prioritize Taskings and Resources


Recovery Support      Estimate Scope of Damage and Restoration
Group (Facilities,                    Resume Critical Business Functions
                                      Initiate Repair of Affected Facilities
   IT, Telecom,
                                      Acquire and Install Servers, PCs etc
 Insurance, etc.)

                      +24 Hrs            +48 Hrs               +72 Hrs               +2 wks




                                                                                               15
              Sample BCP Time Line
                         Phase 3 - Recovery


 Communications                        Crisis Response Management
                         Keep Major Stakeholders Engaged
  and Command
                         Decide Ongoing Business Issues
(This Means YOU)         Manage HR Issues


Recovery Support
Group (Facilities,       Determine Need for Replacement Facility
                         Support Critical Business Functions
   IT, Telecom,
                         Bring Up Balance of Systems
 Insurance, etc.)

                         +2 wks                                        +4 wks




               Sample BCP Time Line
                         Phase 4 - Restoration

 Communications                        Crisis Response Management
                         Keep Major Stakeholders Engaged
  and Command
                         Decide Ongoing Business Issues
(This Means YOU)         Manage HR Issues


 Recovery Support        Restore Facility or Acquire Replacement Facility
Group (Facilities, IT,   Establish V & D at Repaired or Replaced Facility
Telecom, Insurance,      Move Business Ops to Repaired or Replaced Facility
       etc.)                                         Restore Normal Operations


                         +4 wks                                        +n wks




              Managing Crises and
              Emergency Responses




                                                                                 16
Communications
 Essential for all business operations
 – Failure to communicate can be a disaster
   in itself
 Communications are needed to
 – keep in touch with all stakeholders
 – coordinate response actions
 – keep families and off-duty staff informed
 Recovery Support Team advises
 – mission critical restoration activities
 – how to manage non-mission
   critical activities




Customer Communications
 Establish basic customer
 contact processes
 Initiate basic customer
 contact coverage
 Determine additional coverage
 as available




Employee Communications
 What should the employees be told?
 It is essential that there be flexibility
 in the rules of engagement during
 a crisis
 Getting back into business might
 require asking employees to operate
 in different roles




                                               17
Public Communications
 Media relations
 Most important link to the public
 – hopefully, a positive relationship exists
 Consider pre-briefing the media on
 your BC/DR Plan
 Establish procedures to ensure press
 releases are complete, accurate,
 and approved




Vendor Communications

 Prepare specific messages for
 target audiences
  – key revenue partners
  – key suppliers
  – key service providers
  – other vendors you may need for
    the recovery




Damage Assessment
 RSG has primary damage
 assessment/salvage responsibility
  – maintain current contact lists, as-built
    architectural drawings, wiring diagrams,
    damage assessment checklists, etc.
  – evaluate damage, estimate restoration
    effort, DA reports and salvage
  – current, multiple, copies at multiple
    accessible locations




                                               18
          Liability Documentation
             How will my property be valued?
             What perils or causes does my
             policy cover?
             What records will my insurance
             company want to see?
             What does my policy require me to
             do in the event of a loss?
             How will my BCP affect my rates?




          Best Practice
             BCP can be viewed as a cost center
              – more elaborate the plan, more expensive
             BCP should be viewed as a
             value add
              – means to seek continuous improvement
                in everything you do
              – integrally linked to strategy
              – a culture for doing business




          The Importance of Employee
          Awareness
                        Activate Plan?


 Communications
                                     Damage     Crisis Response Management
  and Command                      Assessment
(This Means YOU)
                       Incident
                      Detection,
                         Alert,
                       Reactive
Recovery Support      Response,              Resume
Group (Facilities,    Escalation                        Recover    Restore
                                     Damage Mission-      All      Normal
   IT, Telecom,                    Assessment Critical Operations Operations
 Insurance, etc.)                           Operations


                     Phase 1: Response Phase 2:          Phase 3:   Phase 4:
                                            Resumption   Recovery   Restoration




                                                                                  19
           Risk: Poorly Prepared
           Mission Critical Ops
                          Activate Plan?
 Communications
  and Command                       Damage
                                                    Crisis Response Management
(This Means YOU)      Incident
                                  Assessment
                                                  Resume
                     Detection,                  BCP-NOT
                        Alert,                     Ready
                                                  Mission-
                      Reactive                    Critical
Recovery Support     Response,                   Operations

Group (Facilities,   Escalation                                 Recover    Restore
                                    Damage        Resume
                                                 BCP-Ready        All      Normal
   IT, Telecom,                   Assessment      Mission-     Operations Operations
 Insurance, etc.)                                 Critical
                                                 Operations


                     Phase 1: Response Phase 2:                 Phase 3:         Phase 4:
                                               Resumption       Recovery         Restoration




            Contingency Planning
            for Human Capital




           Human Resources in
           Recovery/Resumption
                          Activate Plan?
 Communications
  and Command                       Damage
                                                    Crisis Response Management
(This Means YOU)      Incident
                                  Assessment
                     Detection,
                        Alert,
                      Reactive                 Availability of Staff & Vendors
Recovery Support     Response,
                                                 Resume
Group (Facilities,   Escalation                             Recover    Restore
                                    Damage       Mission-
                                                              All      Normal
   IT, Telecom,                   Assessment     Critical
                                                           Operations Operations
 Insurance, etc.)                               Operations


                     Phase 1: Response Phase 2:                 Phase 3:         Phase 4:
                                               Resumption       Recovery         Restoration




                                                                                               20
          Issue: Loss of Staff or
          Vendor Support
             Prepare for serious loss of significant
             numbers of staff
             Staff may be unavailable – on temporary or
             permanent basis – due to
              – severe weather
              – HAZMAT situation
              – illness
             What is needed
              – Identification of “mission critical” or key
                staff/vendors
              – Cross training where applicable
              – Documentation of key business
                processes, for rapid training
                of substitutes




           Issues that May Jeopardize
           Executive Team Effectiveness
                          Activate Plan?
 Communications
  and Command                       Damage
                                                  Crisis Response Management
(This Means YOU)      Incident
                                  Assessment
                     Detection,                  Human Resource Policies
                        Alert,
                      Reactive
Recovery Support     Response,
                                                Resume
Group (Facilities,   Escalation                            Recover    Restore
                                    Damage      Mission-
                                                             All      Normal
   IT, Telecom,                   Assessment    Critical
                                                          Operations Operations
 Insurance, etc.)                              Operations


                     Phase 1: Response Phase 2:              Phase 3:      Phase 4:
                                               Resumption    Recovery      Restoration




          Issue: Lack of HR Policies
              Do staff working a crisis get paid overtime?
              How do you instruct employees who are
              idled and whose business activities are not
              mission-critical?
              Are idled employees expected to take un-
              paid leave?
              How long do you retain idled employees
              before laying them off?
              What are the procedures for
              re-assigning staff?
              What are conditions for re-assigning staff?




                                                                                         21
          Issue: Lack of HR Policies
              Injuries
              – ensure proper medical care
                • may need to develop First Responder
                   capability
              – process to notify next-of-kin
              Trauma
              – provide counseling services - EAPs
              Death
              – family support
              – insurance




           Lack of Succession and Delegation
           of Authority Plans

                          Activate Plan?
 Communications
                                                  Crisis Response Management
  and Command                       Damage
(This Means YOU)      Incident
                                  Assessment
                     Detection,
                        Alert,
                      Reactive
Recovery Support     Response,
                                                Resume
Group (Facilities,   Escalation                            Recover    Restore
                                    Damage      Mission-
                                                             All      Normal
   IT, Telecom,                   Assessment    Critical
                                                          Operations Operations
 Insurance, etc.)                              Operations


                     Phase 1: Response Phase 2:             Phase 3:   Phase 4:
                                               Resumption   Recovery   Restoration




          Issue: Policies/Procedures for
          Leadership Contingencies
             Orders of succession
              – identified positions
              – identified responsibilities
              – qualifications for successor
              – conditions that define succession need
             Delegation of authority
              – responsibilities to be delegated
              – limitations on authority that is delegated
              – conditions for delegating authority




                                                                                     22
Wrap Up and Conclusions




Wrap Up and Conclusions
 It can happen       Environmental incident
 Fire                Loss of utility
 Cyber attack        Collateral damage
 Natural disasters   Disgruntled employee
    •   blizzard     or public
    •   hurricane    Terrorist act
    •   flood        Something for which
    •   mud slide    you cannot plan or
    •   wild fire    anticipate
    •   earthquake
    •   tornado




Wrap Up and Conclusions
 It can happen to you
 Improbable, but not impossible
 Insurance pays for loss income and
 increased expenses associated with a
 business interruption
  – insurance does not restore the loss
    of business
  – staff or partners resulting from the
    interruption




                                              23
Wrap Up and Conclusions
 Business Continuity Planning is painful
 It is less so if the BCP process is used
 to assess existing business processes,
 drive greater efficiency, and enhance
 organizational bench strength
 A well thought out plan, developed
 from the bottom up, widely
 communicated and regularly exercised
 ensures organizational survival




Resources
 Before Disaster Strikes: Developing an
 Emergency Procedures Manual (Third
 Edition), (Chicago: Institute of Real Estate
 Management, 2005). ISBN.1-57203-102-6

 NFPA 1600 Standard on
 Disaster/Emergency Management and
 Business Continuity Programs
 – http://www.nfpa.org/PDF/nfpa1600.pdf?src=nfpa

 FEMA (Are You Ready Site)
 – http://www.fema.gov/areyouready/

 OSHA-Emergency Evacuation Regulations
 – http://www.osha.gov/SLTC/
   emergencypreparedness/index.html




Resources
 American Red Cross Disaster Services
 – http://www.redcross.org/services/disaster/0,10
   82,0_501_,00.html

 Department of Homeland Security
 – http://www.dhs.gov/dhspublic/

 Emergency E-Mail & Wireless Network
 – http://www.emergencyemail.org/




                                                    24
Q&A




Acknowledgements
 WTC Photos
 – http://wtc.phatmax.net/main
 AT & T Photos
 – http://www.att.com/ndr/deployment1.html
 BCP Timeline Model
   Alton Penz, Ph.D., ABCP, RPA
   The Gimbal Group, Inc.
   2111 Wilson Blvd, Suite 700
   Arlington, VA 22201




                                             25

								
To top