Business Continuity and the Association of Contingency Planners

1. Bonnie Canal
SELA Chapter of the ACP
Chapter President
ACP National Board Member, Information Chair
HOMELAND SECURITY STUDIES
HMLS 7250 – EMERGENCY MANAGEMENT
Continuity Planning 101

2. Main Goal
The goal for Business Continuity
Planning is –
to return to revenue-producing
activity as quickly as possible
2

3. Definition of Business Continuity Planning:
“Identifies an organization's exposure to
internal and external threats and synthesizes
hard and soft assets to provide effective
prevention and recovery for the
organization, while maintaining competitive
advantage and value system integrity.”
Continuity Planning 101

4. COOP vs. BCP
• COOP Defined: An effort within individual executive
departments and agencies to ensure that Primary Mission
Essential Functions (PMEFs) continue to be performed
during a wide range of emergencies.
• BCP Defined: The ability of an organization to ensure
continuity of service and support for its customers and to
maintain its viability before, during, and after an event.

5. Some Quick Definitions
• Emergency planning are those procedures and steps
done immediately after an interruption to business.
• Disaster recovery are the steps taken to restore some
functions so that some level of services can be offered.
• Business continuity is restoration planning, completing
the full circle to get your organization back to where it
was before an interruption

6. Where did Business Continuity Planning begin?
During the 1960’s and
70’s, financial
institutions were the
first to utilize Business
Continuity Planning to
back up and duplicate
critical data.

7. What is Business Continuity Planning?
During the late 1970s, the height of the mainframe era, a
number of visionaries in the US, UK and other parts of the
world realized that they had to develop ways not only to
protect their massive investments from potential
disasters, but also to devise procedures for recovering and
restoring systems and data to their original pre-disaster state.

8. We’re not just talking Catastrophe...
•Natural Disaster/Extreme
Weather
•Power Outage
•IT Failure
•Telecommunication Failure
•Fire
•Flood
•Utility Outage
•Environmental Accident
•Pandemic Influenza
•Supply Chain Disruption

9. • Protect people and property
• Resume critical business operations
• Minimize downtime
• Preserve reputation
• Meet obligations
Objectives of Business Continuity
Planning

10. When is it a Disaster?
• When critical services aren’t happening.
• Can all employees recognize what a disaster
is and what they should do?
• In the event of an emergency, all personnel
should know what their roles are, and where
they should go.

11. Key Planning Issues
• Emergency/Crisis
Management
Structure
• Human Factors
• Communications
• Security (physical and
logical)
• Reputation (PR)
• Technology
• Supply Chain
• Legal
• Public/Private
Partnerships
• Facilities
• Stakeholders
11

12. Examples of business continuity risks
• Have you considered financial, legal, regulatory penalties that could be
imposed if you fail to provide a critical service which you are contracted to
do?
• Consider how each of your critical services could continue during a
prolonged power loss. ...Now think about a loss of power lasting for 24
hours.
• Which of your critical services would be jeopardized if your building was
evacuated for a week with all access denied?
• What services would be affected if access were denied for a whole month?
• How many staff would be needed to continue to cover critical tasks and
how would you accommodate them?
12

13. Examples of business continuity risks
• Do you have sufficient back-up for your data, both electronic and
paper?
• Do you have an alternative building or premises in which to work
effectively? Is this sufficient? Can staff work from home?
• Do you need access to any services not currently available at your
temporary site?
• Do you use any special software or stationery? How long can you
manage without that specific equipment and how long would it
take to replenish stocks?
13

14. Business Continuity Planning- Organization
Approach
1. Succession Plans
2. Accounting for Employees
3. Communications
4. Alternate Work Facilities
5. Essential Functions

15. •Who do we depend on?
•Who depends on us?
Primary Question:

16. To be completely Organizational Resilient,
ASK ALL VENDORS
in your Supply Chain IF THEY ARE RESILIENT.”
What About the Supply Chain?

17. Keep in Mind
• You can’t possibly plan for every scenario; it
would take all of one’s time and the plan would
never get done.
• The goal is not to create a separate plan that
addresses every risk, but to create one plan that
address all risks.
• In other words, you don’t create one plan for a
tornado, one for a flood, and one for a blackout.

18. • Almost 80% of businesses affected by a major incident either
never reopen or close within 18 months
• Most 40% of small businesses that close due to a disaster event
never re-open; an additional 25% fail after 2 years
• Of those businesses that experience a disaster and have no
emergency plan, 43 percent never reopen; of those that do
reopen, only 29 percent are still operating two years later.
• Businesses without a Business Continuity plan have less than 10%
survival rate after a disaster
The Effects of Disruption on
Businesses

19. NFPA 1600
Standard on Disaster / Emergency Management
and Business Continuity Programs
“ …a common set of criteria for
preparedness, disaster management, emergency
management, and business continuity.”
(2007 and 2010 editions)
DHS Standards

20. BS 25999
Business Continuity Management
“…defines requirements for a management
systems approach to business
continuity, and integrates risk management
disciplines and processes.”
DHS Standards

21. ASIS SPC.1-2009
Organizational Resilience:
Security, Preparedness, and Continuity
Management Systems
“…defines requirements for a management
systems approach to organizational resilience.”
DHS Standards

22. National standards have recognized the personal
resilience gap and have evolved to address a more
dynamic model of planning that addresses needs
before, during and most importantly after an event.
In other words – they have evolved from readiness to
resilience.
The Standard is Changing

23. Private Sector Responsibilities
Planning must consider the Maximum Allowable
or Acceptable Down Time before the continued
existence of a business is threatened, and must
identify resources required to maintain or resume
business activities at an acceptable level.

24. Organizational Resilience
depends on the resilience of
the people you rely on.
Think about it…

25. 25
Risk Analysis
Personal Risk Analysis
Identify Dependencies
Recovery
Strategies
Response Plans
Recovery Plans
Personal Continuity Plans
Annual Testing &
Evaluations
Improved
Continuity
Planning
Model

26.  Mitigation of loss of life or injury
 Business survival
 Minimizing impact of business disruptions
 Improved supply chain resilience
 Satisfying customer business continuity requirements
 Improved internal processes
 Improved employee relations
 Improved external relationships
 Satisfy customer, shareholder, and stakeholder expectations
 Potential advantage over unprepared competition
 Lower operating expenses
 Protection of brand and reputation
Benefits of Preparation

27. 10 Steps to Preparedness
1. Assess Your Risk – Both Internally and Externally
2. Know Your Operations
3. Know Your IT Capabilities & Back Up Your Data
4. Prepare Your Supply Chain
5. Prepare Your Employees
6. Create a Crisis Communications Plan
7. Assemble Emergency Supplies
8. Identify an Alternate Location
9. Know Your Insurance Coverage & Finances
10.Test Your Plan

28. Focus on Resilience
• Recognize – government can’t do it all.
• Stress –citizens need to be involved, engaged and prepared
(managed expectations).
• Focus – on community-level efforts to
prepare, protect, respond, and recover.
• Benefit – if done properly can speed up recovery process.
• End Game – lessen the time between response and
recovery.

29. DRI International: DRI International (originally known as Disaster Recovery Institute) is
a non-profit organization and a global BCM education and certification body.
• There are over 8000 active business continuity professionals from various
industries and business sectors maintaining DRI International certifications
worldwide. These certifications ensure employers that candidates understand the
tenets of business continuity and maintain their level of knowledge through
continuing education.
• DRI International offers education in BCM at major industry events and through
the corporate training program. The organization's International Affiliates insure
that BCM best practice is taught and available throughout the world.
Certifying BCP Bodies

30. Business Continuity Institute:
• The Business Continuity Institute (BCI) was established in 1994 to enable individual
members to obtain guidance and support from fellow business continuity
practitioners. The BCI currently has over 7000 members in 100+ countries active in
an estimated 2,750 organizations in private, public and third sectors.
• The BCI is the world’s most eminent BCM institute and our name is instantly
recognised as standing for good practice and professionalism.
• Statutory membership of the BCI in the grades of FBCI, MBCI, AMBCI or SBCI
provides internationally recognised status as our valued certification demonstrates
the members’ competence to carry out business continuity management (BCM) to
a consistent high standard.
Certifying BCP Bodies

31. • The ACP currently has 44 chapters around the United
States with 2700 members.
• Association of Contingency Planners members comprise of
professionals who work in business continuity
planning, enterprise risk management, incident command
and emergency management, contingency planning, and
disaster recovery for both information technology and total
business enterprise.
About the ACP

32. • Discounts for major conferences and training
opportunities
• Members-only educational content including
webinars, white papers and training material
• Access to special interest group discussions
• Opportunity to voice your opinions on business continuity
standards and receive specialized standards training
• Assistance for job seekers and those looking to fill staffing
positions in our industry
Membership Benefits

33. Institute for Business and Home Safety
http://www.ibhs.org/
http://www.disastersafety.org/
Disaster Resources
http://www.disaster-resource.com/
Government Sites
http://www.ready.gov/
http://www.LABEOC.org
http://www.gohsep.la.gov/
Resources

34. Questions?
Bonnie Canal
Chapter President
SELA Chapter of the ACP
www.sela.acp-international.com
email: selaacp@gmail.com
ACP National Board Member, Information Chair
www.acp-international.com
email: info@acp-international.com
phone: 504-874-5474