BCP – How to develop BCP strategies and Plans 2016.pptx

© 2016 Chevron Corporation
Business Continuity Planning
How to develop BCP strategies and plans
Ed Clayton, MBCP, MBCI
Center for Emergency Preparedness & Response

2
Objectives
Develop basic knowledge of Strategy and Plan Development
Understand method to develop BC strategies
Understand how to develop a BC Plan

3
Target Audience
 Emergency Management or Business Continuity Planning Process
Sponsors and Advisors
 Business Continuity Planning Coordinators
 Others interested in Business Continuity Planning

4
Corporate Standard OE Process
Business Continuity Planning (BCP)
BC Process Requirement 3
recovery strategies

5
Defining Recovery Strategies and Resources
Once the risk assessment and BIA are complete, the organization should define
and implement the appropriate recovery strategies for its critical business
processes. At a minimum, the organization should identify the key resources
needed to ensure continuation or recovery, including (but not limited to):
 Critically needed personnel
 Office space
 Desktop and laptop computers
 Communication tools
 Data
 Generators
 Emergency housing
 Raw materials

6
Process Strategies
Business Continuity strategies provide an acceptable level of performance
They must be operationally feasible to carry out during a disaster
Strategy Options
Do Nothing
Defer Action (Commence recovery and resumption plans after a disaster strikes)
Manual Procedures – processes completed without automation
Degrade level of service
Outsource (externally)
Transfer (internally)
Relocate
DRII BCLE2000

7
Location Strategies
• Alternate Facility - Locations, other than the primary facility, used to carry out
essential functions, particularly in a continuity event. “Alternate facilities” refers
to not only other locations, but also non-traditional options such as working at
home (“teleworking”), telecommuting, and mobile-office concepts.
• Cold site or shell - An alternate facility that already has in place the
environmental infrastructure required to recover critical business functions or
information systems, but does not have any pre-installed computer hardware,
telecommunications equipment, communication lines, etc. These must be
provisioned at time of disaster.
• Warm Site - An alternate processing site which is equipped with some
hardware, and communications interfaces, electrical and environmental
conditioning which is only capable of providing backup after additional
provisioning, software or customization is performed.
• Hot site - An alternate facility that already has in place the computer,
telecommunications, and environmental infrastructure required to recover critical
business functions or information systems.*
* DRII Glossary

8
Strategies
Process People Location Technology
Do Nothing Do Nothing Do Nothing Do nothing
Transfer Designate Work from Home Replicate
Manual work
around
Contractor Work from another
company location
Mirror
Reduce level of
service
Assign at time of
event
Work from a
vendor location
Use standard
process
Recovery location
(C,W,H)

9
Define recovery
strategies and resources
requirements needed
Establish service level
agreements and / or
contracts for critical
services.
Complete a Risk Assessment to
identify threats or risks to your
business (by office/facility location).
Conduct a Business Impact
Analysis (BIA) to identify
critical processes and recovery
time objectives.
Write the Plan,
including employee
communications
Conduct training
and exercises to
train personnel
and test viability.
Refresh the BIA when significant
changes occur in your organization.
1
2
3
5
7
4
6
Participate in multi-tenant,
multi-site planning.
Seven Requirements of the Corp. BCP Process

10
Business Continuity Plan
Graphical Course of Development and Planning
Staffing
Requirements
IT
Requirements
File System
Requirements
Telecommunication
Requirements
Resources
Dependencies
Disaster Recovery Plans should be aligned with the requirements
established in the Business Continuity Plan
BC
Procedure
Recovery Resource
Report
BC
Procedure
Recovery Resource
Report
BC
Procedure
Recovery Resource
Report
“Organization-level Plan”
“Team-level Plans”
Business
Continuity Plan
(BCP)
Input
Input
Business Continuity
Procedure
Path
Business Impact
Analysis
(BIA)
Path
Risk Assessment
Path

11
Importance of Good Data Collection
Food for Thought…
Understanding the key elements of data collection and in gathering the right
information is critical. This process sets the foundation for your business continuity
program!
• A good business impact analysis, while subjective, will help you determine the
most critical activities of your business.
• Using the outlined process in today’s workshop will enable you to establish a
good foundation to help you build recovery procedures that make sense for
your business; however, you must continue to build on learnings from
activations and annual exercises to continually improve on them and ensure
they will be successful.
• Once your BIA is complete, management review and approval is critical to
ensure you have the support and resources needed to build and implement
realistic recovery solutions that are tactical and realistic.
• Training and exercises are critical to a successful BC program
– Training ensures staff is familiar with the plan and their role
– Exercises help uncover gaps to improve your plan

12
CORA Tool – Forms
Recovery Procedures
In the Develop Recovery
Procedures section, define:
 Team-level Response Plans
 Recovery Procedures for
identified Business Critical
processes
 Recovery Teams
This section essentially defines how
functional teams will recover their
business critical functions.

13
CORA Tool – Forms
Team-level Response Plans (Phases 1 – 3)
The Team-level Response Plans
section allow for teams to define
Emergency Preparedness and
Recovery Tasks.
A phased approach list of common
tasks are supplied in editable
windows that teams can build upon:
 Phase 1: Elevated – team is
aware of an elevated threat and
beings the communication process
 Phase 2: High – team prepares
for a higher probability that a
disaster will occur
 Phase 3: Severe – evacuations
and facility closures may be
occurring

14
CORA Tool – Forms
Defining Recovery Procedures – Process
Continuity
Defining Recovery Procedures is a
process of establishing how
departments or teams will recover their
critical business functions after an
event.
Process Continuity describes how a
department/functional group will
continue its defined critical process by
identifying:
 An Alternate location
 Relocation and Mobilization
Procedures
 Required roles needed
 And, establishing alternative groups
who perform the process and how /
when it would be transferred

15
CORA Tool – Forms
Recovery Procedures: Process Restoration
The Process Restoration section
defines the step-by-step procedures
to restore the business activity:
 Activation and Notification–
Identify how you will activate your
team plan, including notification
process; be sure to document
notification to appropriate contacts
and key stakeholders.
 Process Recovery – Define the
step-by-step procedure to restore
the process in lieu of normal
operating conditions.
 Resume Business - Procedures
for resuming to normal; document
your deactivation process.
1. Assess situation and define process to determine cause of
interruption,
2. Activate appropriate personnel to assist in restoration.
3. Notify Management (BCMT).
4. Notify Stakeholders
Step-by-step process to restore the process in lieu of normal
operating conditions. Consider as though you are providing
guidance to a new or replacement team member.
Example:
1. Verify availability of staff (refer to critical staff report)
2. Verify availability of critical resources / inputs
3. Conduct Job Safety Analysis (JSA)
4. Ensure Permit to Work
Step-by-step process to resume to normal business. Describe how
you will stand down your teams and resume to normal.

16
CORA Tool – Forms
Recovery Procedures: IT Restoration
If the technology (IT and Systems)
becomes unavailable), describe the
step-by-step procedures to restore
the business activity:
 Manual Work-Around
Procedures – define your step-
by-step process to perform the
activity without the IT (systems
and/or applications) normally
needed. Consider – can you do
this activity manually?
 Restoring to Normal –
procedures for restoring to
normal. Define how you will
evaluate when to stand down your
team and how you will do so.
Describe step-by-step process to perform the activity
without the IT (systems/applications) normally used.
Include items such as manual forms, offline
documentation, printed manuals, offline printers, DOA /
signature authorities, etc.
Describe step-by-step process to resume to normal.
• When will you stand down.
• How will you communicate to your staff.
• How will you communicate to key stakeholders.

17
CORA Tool – Forms
Recovery Procedures – Assumptions and
Comments
The Assumptions/Comments
section allows users to highlight
any assumptions being made on
the established procedures and
to make any additional
comments needed.
The assumptions being made
should be considered gaps that,
where possible, they work to
implement measures that will
close them.

18
CORA Tool – Forms
Recovery Teams Contact List
The Recovery Team
Contact List form allows
users to develop teams
based on departments and
priority levels.
In this form, contact
information, team member
roles, priority mailbox
requirements and recovery
actions can be defined.

19
Team Recovery Worksheet
• Show worksheet – link above

20
Consolidating Information
Building your plan
Once data collection/migration is complete, CORA will help you build your plans
using built in reports.
–Organization level plan – the roll up of all information that describes
how your organizations as a whole will respond to a BCP activation
–Team level plans – the roll up of each team’s activation and response
activities
CORA REPORT – How to Use

21
Requirement 4
BC Plans
• The business continuity plan (BCP or BC plan) describes how an organization is
to continue or resume critical business functions during and after a disruptive
event. These documents are dynamic and should be reviewed, tested and
updated on an annual basis, as well as, after an event that results in plan
activation. The level of detail in the plan should match the level of risk. BCPs
should be integrated with relevant emergency response and crisis management
plans. BCPs must consider critical interdependencies with relevant public and
private emergency services agencies.
• Each OpCo shall maintain an emergency communications plan to account for
and communicate with all members of the workforce after an incident that
interrupts business operations. Workers shall be made aware of their
responsibilities under such a plan. Workforce awareness programs are to
include steps that employees should take to:
• Ensure their personal safety

22
Requirement 4
BC Plans
• Maintain communication with Chevron
• Understand the personal actions they should take related to their role in the BC
plan
• OpCos may use the Critical Operations Recovery Assistant (CORA) process to
develop and maintain their business continuity and/or disaster recovery plans
(BCP/DRP)

23
Team Recovery Procedure
• Review Procedure

24

25
BCP Key Contacts
Corporate HES / Center for Emergency Preparedness & Response (Ed Clayton)
 Questions on the BCP OE Standard Process
 For general support on BCP implementation (e.g., how to get started)
 Information on training and exercise development
 When you don't know where else to go
ITC / IT Services Support (Brodrick Hill)
 For IT-related support services
 Recovery options for ITC products and services
CBRES / Emergency Preparedness Team (Brandon Gregory)
 For facility-related emergency preparedness and business continuity information or
support
 Lathrop Business Recovery Center
 Questions about alternate work sites

26
Key Links
• Corporate Standard OE Process - Business Continuity Planning
• Corporate OE Business Continuity Sharepoint
• Critical Operations Recovery Assistant – CORA BCP Site Collection
• BCP Word & Excel Templates

BCP – How to develop BCP strategies and Plans 2016.pptx

Recommandé

Recommandé

Contenu connexe

Similaire à BCP – How to develop BCP strategies and Plans 2016.pptx

Similaire à BCP – How to develop BCP strategies and Plans 2016.pptx (20)

Plus de FerriFatra1

Plus de FerriFatra1 (13)

Dernier

Dernier (20)

BCP – How to develop BCP strategies and Plans 2016.pptx