slide 1 - oregon.gov home page
DESCRIPTION
TRANSCRIPT
From Start to Finish: A Business Continuity Plan
Katie BechtelBusiness Continuity AnalystSecretary of State’s Office
Background
Developed and tested the first draft of the Oregon Youth Authority BCP (July 2006-June 2007)
Currently working at the Secretary of State’s Office We are about 1 year into the 2 year
Project Plan We expect to start testing Spring 2009
The Process
Step 1: Create Project Plan Step 2: Conduct Business Impact
Analysis Step 3: Draft Business Continuity
Plans Step 4: Complete BCP support work Step 5: Test and Exercise Plan
Step 1: Create Project Plan
Decide how to organize your work OYA: Around locations (Facilities, Field Offices,
Central Office) SOS: By Division By Critical Business Function
Create a plan that outlines timelines, resources needed, expected participation
Have project plan approved by Management Council or Steering Committee AND participating business sections
Step 2: Conduct Business Impact Analysis
Goal: Identify business processes, RTOs, associated computer systems, essential records, and dependencies
Develop questionnaire and meet with business divisions to complete it
Divisions then complete the Questionnaire Compile information into BIA Report
This report will outline current recovery capabilities and detail ways to improve the situation (i.e. implement off-site data storage)
Don’t start a BCP until these problems have been addressed
Business Process PrioritizationELECTIONS DIVISION BUSINESS PROCESS CRITICALITY RANKING
RTO “1”0 to 1 week
RTO “2”1 to 2 weeks
RTO “3”2 to 3 weeks
RTO “4”3 weeks to 1 month
RTO “5”1 month +
Manage OCVR Administration (3 hours)
Campaign Finance Transaction Filings (4 hours)
Manage Initiative/Referendum filings (24 hours)
Provide Customer Contact (1 day)
Conduct Investigations for violation of Oregon Election Laws (48 hours)
Produce and Publish State Voters’ Pamphlet (3 days)
Manage and Process Voter Registration (OCVR, HAVA, NVRA) (5 days)
Manage HAVA Administration (5 days)
Create, Write, and Update Administrative Rules (1 week)
Manage State Candidate Filings for Office/Qualifications (1 week)
Manage State Candidate Filings for Vacancies in Office (1 week)
Conduct of Elections—County Elections Officials/Citizens (1 week)
Manage and Schedule Fiscal Impact/Explanatory Statement Committees (2 weeks)
Manage Filings for Minor Political Party formation (1 month)
Produce and publish Publications (Calendars, Manuals [15], Brochures, Forms) (1 month)
Manage State and Local Recall Petitions (1 month)
Business Process PrioritizationHUMAN RESOURCES DIVISION BUSINESS PROCESS CRITICALITY RANKING
RTO “1”0 to 1 week
RTO “2”1 to 2 weeks
RTO “3”2 to 3 weeks
RTO “4”3 weeks to 1 month
RTO “5”1 month +
Emergency/Temporary Staffing
Receive request for temporary staffing
Contact temporary staffing vendor
Receive temporary staffing
Policy Administration Write and Revise Policies Approve Policy changes Implement Policy ChangesRecruitment Process “Requests to Fill” Post open positions Review and grade applications Schedule interviews Clear to Hire Extend offers Conduct New Employee OrientationTraining Process Requests for training Procure vendors Schedule trainings Communicate Training Conduct Training Conduct Training Evaluations Approve Payment to VendorsRecords Management Receive employee related records and files Organize, maintain, and store recordsSystem Administration Input Employee Related Information
Step 3: Draft Business Continuity Plans
Use the templates! Why reinvent the wheel?
The BIA Questionnaire will give you most of the information to complete the plans, but you’ll need the business section to review it and fill in blanks after a good draft
Checklist from TemplateRecovery Steps –
Summary Step 1 – Contact BCP Executive Lead Team members and arrange for
a meeting. Step 2 – Executive Lead Team meets and reviews plan; activates BCP
Crisis Management Teams. Step 3 – Alert alternate site location to begin setting up for incoming
staff. Step 4 – Contact DAS Phones to redirect phone lines. Step 5 – Meet with Alternate Site Management to review operating
procedure. Step 6 – Contact Alternate Site Staff and IT Team with directions for
deployment. Step 7 – Contact IT and determine when computer services will be
available Step 8 – Contact customers, vendors, etc. and inform them of possible
delays. Step 9 – Public Information Team announces relocation to media
outlets. Step 10 – Establish communication with customers at Alternate Site. Step 11 – Complete priority Business Processes at Alternate Site. Step 12 – Relocate remaining staff as needed, as space and capability
become available, to complete the CBF “Emergency and Temporary Staffing” at the Alternate Site.
Big Checklist from Template
Step Number Step Step DetailAdditional Resources
Required:Responsibility
Date Completed and
Initials:
1. Contact BCP Executive Lead Team members and arrange for a meeting
Contact team members (See BCP Team page for contact numbers) or their alternates and arrange a meeting.
TelephoneBCP Team contact
information
BCP Coordinator
2. Executive Lead Team meets and reviews plan; activates BCP Crisis Management Teams.
Meet with BCP team members and assess the situation. Review the plan and determine whether or not all steps need to be taken. Based on the situation, do other steps need to be implemented? If so, document and assign responsibility.
Meeting locationTelephone
BCP Coordinator
Step 4: Complete BCP Support Work
IT Disaster Recovery Plan Crisis Management Teams Policy and Procedures
BCP Activation and Control Maintenance Program
OYA Crisis Management Team Structure
Crisis Management Team
Primary Site Teams Alternate Site Teams Public Information Teams BCP Development Teams
Damage Assessment and Salvage
Insurance
Physical Security
Disaster Recovery
Telecommunications
Disaster Recovery
Staff Transportation
Physical Security
Telecommunications
Public Information
Family and Foster Care Communication
BCP Steering
BCP Development
Step 5: Test and Exercise Plans
Table tops tests are a great way to familiarize your teams with the plan and make corrections
Exercises force the execution of your plan
These are used to test your plan as well as to train your teams
Findings from OYA Test #1 March 29, 2007
The initial meeting site for the Executive Lead Team was made consistent with building evacuations
A server had been replaced and relocated since the first draft of the Plan
An IT staff member was added to the Public Information team to update the agency website
The role of coordinating the physical relocation of salvageable equipment and supplies was delegated to the Facility Manager
Findings from OYA Test #2April 27, 2007
OYA staff are unaware of the existing Emergency Exit Strategy
Loss of power, and therefore lighting, may hinder evacuation
Preliminary space planning at the Alt. Site will speed transition
Critical phone lines should be identified Each BCP team should document
decisions and actions
The Process
Step 1: Create Project Plan Step 2: Conduct Business Impact
Analysis Step 3: Draft Business Continuity
Plans Step 4: Complete BCP support work Step 5: Test and Exercise Plan
Templates or Completed Examples
Project Plan and Dashboard BIA Questionnaire BIA Report BCP BCP Crisis Management Teams Test Scenarios Test Reports