BCP – How to develop BCP strategies and Plans 2016.pptx

3. 3 © 2016 Chevron Corporation Target Audience  Emergency Management or Business Continuity Planning Process Sponsors and Advisors  Business Continuity Planning Coordinators  Others interested in Business Continuity Planning

5. 5 © 2016 Chevron Corporation Defining Recovery Strategies and Resources Once the risk assessment and BIA are complete, the organization should define and implement the appropriate recovery strategies for its critical business processes. At a minimum, the organization should identify the key resources needed to ensure continuation or recovery, including (but not limited to):  Critically needed personnel  Office space  Desktop and laptop computers  Communication tools  Data  Generators  Emergency housing  Raw materials

6. 6 © 2016 Chevron Corporation Process Strategies Business Continuity strategies provide an acceptable level of performance They must be operationally feasible to carry out during a disaster Strategy Options Do Nothing Defer Action (Commence recovery and resumption plans after a disaster strikes) Manual Procedures – processes completed without automation Degrade level of service Outsource (externally) Transfer (internally) Relocate DRII BCLE2000

7. 7 © 2016 Chevron Corporation Location Strategies • Alternate Facility - Locations, other than the primary facility, used to carry out essential functions, particularly in a continuity event. “Alternate facilities” refers to not only other locations, but also non-traditional options such as working at home (“teleworking”), telecommuting, and mobile-office concepts. • Cold site or shell - An alternate facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware, telecommunications equipment, communication lines, etc. These must be provisioned at time of disaster. • Warm Site - An alternate processing site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of providing backup after additional provisioning, software or customization is performed. • Hot site - An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems.* * DRII Glossary

8. 8 © 2016 Chevron Corporation Strategies Process People Location Technology Do Nothing Do Nothing Do Nothing Do nothing Transfer Designate Work from Home Replicate Manual work around Contractor Work from another company location Mirror Reduce level of service Assign at time of event Work from a vendor location Use standard process Recovery location (C,W,H)

9. 9 © 2016 Chevron Corporation Define recovery strategies and resources requirements needed Establish service level agreements and / or contracts for critical services. Complete a Risk Assessment to identify threats or risks to your business (by office/facility location). Conduct a Business Impact Analysis (BIA) to identify critical processes and recovery time objectives. Write the Plan, including employee communications Conduct training and exercises to train personnel and test viability. Refresh the BIA when significant changes occur in your organization. 1 2 3 5 7 4 6 Participate in multi-tenant, multi-site planning. Seven Requirements of the Corp. BCP Process

10. 10 © 2016 Chevron Corporation Business Continuity Plan Graphical Course of Development and Planning Staffing Requirements IT Requirements File System Requirements Telecommunication Requirements Resources Dependencies Disaster Recovery Plans should be aligned with the requirements established in the Business Continuity Plan BC Procedure Recovery Resource Report BC Procedure Recovery Resource Report BC Procedure Recovery Resource Report “Organization-level Plan” “Team-level Plans” Business Continuity Plan (BCP) Input Input Business Continuity Procedure Path Business Impact Analysis (BIA) Path Risk Assessment Path

11. 11 © 2016 Chevron Corporation Importance of Good Data Collection Food for Thought… Understanding the key elements of data collection and in gathering the right information is critical. This process sets the foundation for your business continuity program! • A good business impact analysis, while subjective, will help you determine the most critical activities of your business. • Using the outlined process in today’s workshop will enable you to establish a good foundation to help you build recovery procedures that make sense for your business; however, you must continue to build on learnings from activations and annual exercises to continually improve on them and ensure they will be successful. • Once your BIA is complete, management review and approval is critical to ensure you have the support and resources needed to build and implement realistic recovery solutions that are tactical and realistic. • Training and exercises are critical to a successful BC program – Training ensures staff is familiar with the plan and their role – Exercises help uncover gaps to improve your plan

12. 12 © 2016 Chevron Corporation CORA Tool – Forms Recovery Procedures In the Develop Recovery Procedures section, define:  Team-level Response Plans  Recovery Procedures for identified Business Critical processes  Recovery Teams This section essentially defines how functional teams will recover their business critical functions.

13. 13 © 2016 Chevron Corporation CORA Tool – Forms Team-level Response Plans (Phases 1 – 3) The Team-level Response Plans section allow for teams to define Emergency Preparedness and Recovery Tasks. A phased approach list of common tasks are supplied in editable windows that teams can build upon:  Phase 1: Elevated – team is aware of an elevated threat and beings the communication process  Phase 2: High – team prepares for a higher probability that a disaster will occur  Phase 3: Severe – evacuations and facility closures may be occurring

14. 14 © 2016 Chevron Corporation CORA Tool – Forms Defining Recovery Procedures – Process Continuity Defining Recovery Procedures is a process of establishing how departments or teams will recover their critical business functions after an event. Process Continuity describes how a department/functional group will continue its defined critical process by identifying:  An Alternate location  Relocation and Mobilization Procedures  Required roles needed  And, establishing alternative groups who perform the process and how / when it would be transferred

15. 15 © 2016 Chevron Corporation CORA Tool – Forms Recovery Procedures: Process Restoration The Process Restoration section defines the step-by-step procedures to restore the business activity:  Activation and Notification– Identify how you will activate your team plan, including notification process; be sure to document notification to appropriate contacts and key stakeholders.  Process Recovery – Define the step-by-step procedure to restore the process in lieu of normal operating conditions.  Resume Business - Procedures for resuming to normal; document your deactivation process. 1. Assess situation and define process to determine cause of interruption, 2. Activate appropriate personnel to assist in restoration. 3. Notify Management (BCMT). 4. Notify Stakeholders Step-by-step process to restore the process in lieu of normal operating conditions. Consider as though you are providing guidance to a new or replacement team member. Example: 1. Verify availability of staff (refer to critical staff report) 2. Verify availability of critical resources / inputs 3. Conduct Job Safety Analysis (JSA) 4. Ensure Permit to Work Step-by-step process to resume to normal business. Describe how you will stand down your teams and resume to normal.

16. 16 © 2016 Chevron Corporation CORA Tool – Forms Recovery Procedures: IT Restoration If the technology (IT and Systems) becomes unavailable), describe the step-by-step procedures to restore the business activity:  Manual Work-Around Procedures – define your step- by-step process to perform the activity without the IT (systems and/or applications) normally needed. Consider – can you do this activity manually?  Restoring to Normal – procedures for restoring to normal. Define how you will evaluate when to stand down your team and how you will do so. Describe step-by-step process to perform the activity without the IT (systems/applications) normally used. Include items such as manual forms, offline documentation, printed manuals, offline printers, DOA / signature authorities, etc. Describe step-by-step process to resume to normal. • When will you stand down. • How will you communicate to your staff. • How will you communicate to key stakeholders.

17. 17 © 2016 Chevron Corporation CORA Tool – Forms Recovery Procedures – Assumptions and Comments The Assumptions/Comments section allows users to highlight any assumptions being made on the established procedures and to make any additional comments needed. The assumptions being made should be considered gaps that, where possible, they work to implement measures that will close them.

18. 18 © 2016 Chevron Corporation CORA Tool – Forms Recovery Teams Contact List The Recovery Team Contact List form allows users to develop teams based on departments and priority levels. In this form, contact information, team member roles, priority mailbox requirements and recovery actions can be defined.

20. 20 © 2016 Chevron Corporation Consolidating Information Building your plan Once data collection/migration is complete, CORA will help you build your plans using built in reports. –Organization level plan – the roll up of all information that describes how your organizations as a whole will respond to a BCP activation –Team level plans – the roll up of each team’s activation and response activities CORA REPORT – How to Use

21. 21 © 2016 Chevron Corporation Requirement 4 BC Plans • The business continuity plan (BCP or BC plan) describes how an organization is to continue or resume critical business functions during and after a disruptive event. These documents are dynamic and should be reviewed, tested and updated on an annual basis, as well as, after an event that results in plan activation. The level of detail in the plan should match the level of risk. BCPs should be integrated with relevant emergency response and crisis management plans. BCPs must consider critical interdependencies with relevant public and private emergency services agencies. • Each OpCo shall maintain an emergency communications plan to account for and communicate with all members of the workforce after an incident that interrupts business operations. Workers shall be made aware of their responsibilities under such a plan. Workforce awareness programs are to include steps that employees should take to: • Ensure their personal safety

22. 22 © 2016 Chevron Corporation Requirement 4 BC Plans • Maintain communication with Chevron • Understand the personal actions they should take related to their role in the BC plan • OpCos may use the Critical Operations Recovery Assistant (CORA) process to develop and maintain their business continuity and/or disaster recovery plans (BCP/DRP)

25. 25 © 2016 Chevron Corporation BCP Key Contacts Corporate HES / Center for Emergency Preparedness & Response (Ed Clayton)  Questions on the BCP OE Standard Process  For general support on BCP implementation (e.g., how to get started)  Information on training and exercise development  When you don't know where else to go ITC / IT Services Support (Brodrick Hill)  For IT-related support services  Recovery options for ITC products and services CBRES / Emergency Preparedness Team (Brandon Gregory)  For facility-related emergency preparedness and business continuity information or support  Lathrop Business Recovery Center  Questions about alternate work sites

26. 26 © 2016 Chevron Corporation Key Links • Corporate Standard OE Process - Business Continuity Planning • Corporate OE Business Continuity Sharepoint • Critical Operations Recovery Assistant – CORA BCP Site Collection • BCP Word & Excel Templates

BCP – How to develop BCP strategies and Plans 2016.pptx

You are reading a preview.

Check these out next

BCP – How to develop BCP strategies and Plans 2016.pptx

More Related Content

Similar to BCP – How to develop BCP strategies and Plans 2016.pptx (20)

Recently uploaded (20)