Service Continuity Maintaining Your Agency’s Ability to Respond What is Service Continuity? The ability of a service organization to continue to function under adverse conditions Service Continuity Planning Set of policies, procedures, and information developed and maintained for use in the event of a service disruption Purpose The purpose of Service Continuity is to maintain a minimum level of service while restoring your organization to “business as usual.” Why is SCP important? An organization which fails to provide a minimum level of service to its clients following a disaster may not have an agency to recover. Trust may be breached; Reputation damaged Funding may disappear Service may be re-evaluated and deemed unnecessary Clients may seek services elsewhere Also: Emergency Response agencies have a moral and professional obligation to be prepared to provide community assistance during an event Question? What specific event ignited the topic of business continuity? Y2K Y2K represented uncertainty. Questions were: What value is information if there is no system to put it on? What good is the system if there is no place to put it or no access to it? What good is the system if there are no skilled people to perform the work? Thus, Business Continuity was born… Service Continuity assists in…disasters Hurricane Katrina > 1,600 Deaths $75 Billion in damages $200 Billion estimated in economic impact Catastrophic Incidents September 11, 2001 2,750 persons perished 8,000 Intel-based servers and 5,000 UNIX servers lost Estimated that 45,000 – 50,000 securities positions (i.e. trading, sales, research, operations) were lost in WTC and adjacent buildings. Loma Prieta Earthquake 7.1 -- 15 Seconds 3,000 Injured 62 Deaths $7 Billion property damage $1.5 Billion highway repair 1,925 Businesses destroyed/damaged 414 Homes destroyed 18,306 Homes damaged 1906 San Francisco Earthquake April 18, 1906 8.3 Magnitude $500 Million Damage > 3,000 Deaths 375,000 population Fire was the greatest danger More common risks that we face: Communications Legal action failure Loss of key Computer crash personnel Fire Recession Electrical failure Reputation Flood Severe storm Hazmat incident Unscrupulous Inflation vendor Internet failure Ubiquitous “other” Where do the Hazards originate? External Nature Utilities & Suppliers Economic / Political forces Human nature Internal Facility problems Equipment failures Staff Development of a Service Continuity Program Approach A. Service Impact Analysis B. Risk Assessment C. Service Continuity Plans D. Disaster Recovery Plan E. Incident Management Plan Comprehensive Emergency Management Level of EVENT Effort Response Business as Usual Business Interruption Local Authority Recovery Risk Preparedness Community Recovery Assessment Mitigation Time Preparedness Plan Response Plan Mitigation Plan Municipal Recovery Plan Risk Assessment Business Continuity Plan Community Recovery Plan Effective Service Continuity Effective Service Continuity is built on 7 P’s: 1. Program – proactively managing the process 2. People – roles & responsibilities, awareness & education 3. Processes – all organisational processes 4. Premises – buildings & facilities 5. Providers – supply chain, vendors, outsourcing 6. Profile – reputation, image 7. Performance – benchmarking, Most important Resource? Answer: Personnel Although there are other critical resources, the service or product in almost all organizations depend on actions preformed by, and decisions made by, people. The difference between Service Continuity and Disaster Recovery Service Continuity is PROACTIVE. Its focus is to avoid or mitigate the impact of a risk Disaster Recovery is REACTIVE. Its focus is to pick up the pieces and restore the organization to business as usual after a risk occurs Three Phases of Continuity Planning 1. Risk 2. 3. Reduction Incident Recovery Producing a Service Activating the Service Using and closing Continuity Plan Continuity Plan down the Service Continuity Plan A. Service Impact Analysis Examines the impact of the service interruption. Impacts might include: Well-being of clients is reduced Public image; loss of reputation and community goodwill Loss of donor funding Additional Impacts: Excessive staffing Extra expense to costs replace supplies or equipment Legal - failure to meet contractual Customer obligations; fines services – or penalties reduction or termination of service, possibly when needed most B. Risk Assessment Risk Options 1. Avoid the risk – Leave location – Eliminate the service rendered 2. Transfer the risk – Contract out function or resource – Insurance 3. Mitigate the risk – Reduce the risk or its impact – Control the risk 4. Accept the risk – Should be calculated after full evaluation Not all risks present the same danger Risks can be rated: Probability of occurrence •frequency Consequence on the organization •impact Probability and Consequence Consequences 1 2 3 4 5 Probability Insignificant Minor Significant Major Catastrophic 5 Certain L M H E E 4 Likely L M H H E 3 Possible L M M H H 2 Unlikely L L M M M 1 Rare L L L L L L: Low risk M: Moderate risk H: High risk E: Extreme risk C. Service Continuity Plan Development 1. Obtain Management Support for SCP 2. Identify Essential Services 3. Identify Key Support Functions 4. Identify Critical Resources 5. Assure Workforce Considerations 6. Exercise and distribute the Plan Clarifications Services are those activities which are deemed vital to client well-being. Functions are those measures within the organization to support the critical services, i.e. management, administration, IT, logistics, etc. Resources are the materials, hardware/ software, and vendors that are necessary to achieve either the functions or service mandate. 2. Identify Essential Services Identify all services that my agency delivers Identify essential services Useful Tool: “Maximum Acceptable Downtime” Window of time after which there is a serious impact on my agency’s service delivery 3. Identify Key Support Functions List the functions within the agency that are necessary to support Essential Services Senior management IT Logistics Administration Human Resources Etc. Rank Function Activity Vital IT / Communications Restore communications Administration / BSU Restore building, utilities, etc. Transportation Restore transport links Important Operations Supervise / redirect staff Logistics Control / redirect relief supplies Human Resources Support staff in relief activities Non-critical Organizational Dev’t Staff redirected to relief (and Program staff) efforts 4. Identify Critical Resources List the resources that are necessary for Support Functions Utilities IT/Internet Communications Vehicles / Fuel Food / Water Etc. Critical Resource Considerations Relationship with vendors Multiple vendors and suppliers Systems redundancies Stockpiling supplies and materials 5. Assure Workforce Measures Manage Personnel during and after Event Protect Staff (e.g. H1N1) Decision-making authority Lines of authority Chain of command Staffing Plan Cross-training Call-out procedure 6. Service Continuity Plan Testing Exercise the Plan Exercise schedule endorsed by senior management Tabletop exercises with each service area in the agency Tabletop exercises with select functional teams (e.g. IT, logistics…) Coordinate with partner agencies Distribute the Plan Update and revise Plan Training To assure personnel will be able to effectively and efficiently respond after a disaster event To develop self-confidence in the ability to perform assigned functions SCP Plan Maintenance A plan that lacks maintenance quickly becomes a “Non-plan” Service Continuity Program D. Disaster Recovery Plan The Disaster Recovery Plan for provides the “game plan” for the recovery of services. Service Continuity Program E. Incident Management Plan The Incident Management Plan provides the EOC’s senior management and staff with a specific plan to “orchestrate” the recovery of business. Summary: Business Continuity is concerned with: People Assets Process Remember… “Always plan ahead. It wasn't raining when Noah built the ark.” Richard C. Cushing Questions? Business Continuity Plan Scenario… H1N1 Influenza …a challenging risk No infra- Serious economic structural interruption damage, but… Public ‘unknowns’ Long term have huge impact staffing Overwhelmed considerations facilities Quickly changing Limited outside event (decisions resources with partial information) Let’s review with a Flu Scenario… It has been reported on television that the pandemic flu has reached Canada. The Times Colonist is reporting flu sickness on the mainland and Vancouver Island. Week 1: Today You have noticed that staff absenteeism has been higher than normal yesterday and today. Week 1 A few staff are coughing and wheezing and complaining of feeling ill… Initial Reactions… What staff issues are there? What are the implications? Can any of the staff work from home? What is required to make this happen? Who will you communicate with? Other issues? Week 2 Staff absence is now 25% higher than is normal for this time of the year. A key supplier calls to tell you that they will not be operating for the foreseeable future because of staff absenteeism. Actions? What are the priorities? Who do you communicate with? Is your contact list up-to-date? Do you have a phone tree? What will be the implication of losing a key supplier for the service? Do any members of the team have unique skills or knowledge? What are the risks of this? How to reduce this risk? Week 2 The District has decided to close all schools in the area due to teacher shortages and also to limit spread of the flu. Half of your staff have phoned in to say that they will not be attending work this week. They are staying at home to look after their children. A few more questions… What issues does school closing raise? How will you deal with staff who don’t attend work to look after their children/dependants? How will you deal with the work load? Week 3 Following further staff absences, the number of staff in work has dropped by 75%. You have just been informed that one of your staff has died in hospital. A Times Colonist reporter has asked for your response on this and the effects of the outbreak. Actions of on-site team? Who do you communicate with? How will you manage your resources, and your workload, with only 20% of staff attending work? What are the implications for the team of a death of a colleague? How will the media enquiry be dealt with? Anything else? Week 5 You have located additional staff through an temp agency. Which areas of work would you prioritise for these extra staff? Do you work with any vulnerable groups? If yes, what are the implications of this group? How can you minimise the impact on this group? Week 8 The event has eased. Are there issues that need to be addressed? Are there any questions this scenario has raised that you will now look into? Are there any plans you’d now put in place in case a 2nd wave hits? What lessons have been learned? How can this knowledge be used to improve your Service Continuity Plans? Remember… “Always plan ahead. It wasn't raining when Noah built the ark.” Richard C. Cushing Additional Sources Business Continuity Institute http://www.thebci.org/ Business Continuity Plan glossary http://www.drj.com/glossary/glossleft.h tm Business Continuity Planners Association http://www.bcpa.org/ Natural Disasters preparedness http://www.colorado.edu/hazards/informer/inf ormerupdate.pdf Disaster recovery planning exchange http://www.drie.org/ Thank you!
Pages to are hidden for
"Purpose"Please download to view full document