Consequence-Based Planning: When Nature Strikes

1. Consequence-Based Planning: When Nature Strikes Travis County Local Emergency Planning Committee Austin, Texas September 15, 2005

2. What this session is . . . • An approach to Business Continuity Planning • A set of tools to use in Business Continuity Planning • A place to start and a process to continue planning efforts • A work in progress

3. What this session is not . . . • A complete course in business continuity planning • A guarantee of successful planning • The only way to create a plan

4. Ruth Hooks Association of Contingency Planners Capital of Texas Chapter - Treasurer Texas Treasury Safekeeping Trust Company Director, Information Technology Ed Schaefer Association of Contingency Planners Capital of Texas Chapter – Past President Lower Colorado River Authority Emergency Management Coordinator

5. What do we plan for? What we know Weather Fire Power failure Hackers Sabotage Equipment failure Loss of key personnel Ricin Anthrax Poisons Sarin gas “Dirty” bombs Cyber-terrorism Suicide bombers What we don’t know

6. Consequence-based planning The Domino Theory

7. A Nation’s Nightmare The Domino Theory Businesses fail Buildings collapse Fire exits blocked Intense fire erupts Key personnel killed Numerous casualties Vital records destroyed Fire sprinklers disabled Fire retardant damaged Planes crash into buildings

8. An Invisible Threat The Domino Theory Business fails Loss of revenue Anthrax released Loss of investors Loss of customers Building evacuated Building quarantined Personnel hospitalized Critical functions halted Vital records unavailable

9. The “Worst Case” scenario The Domino Theory City floods Business fails Levee damaged Persons trapped Hurricane strikes Civil unrest erupts Businesses looted Conditions deteriorate No insurance coverage Electric power disrupted

10. Profits Public Products Building a Business– the Essentials What do we produce? What is our function? Who are our customers? Who uses our products? What gives our organization a reason to exist? Payroll Marketing Maintenance Management Other Purchasing Production

11. Consequence-based Planning– Phases • Phase 1– Plan to recover the pieces • Phase 2– Plan to recover the functions • Phase 3– Plan to respond

12. Consequence-based Planning– Phases • Phase 1– Plan to recover the pieces • Identify the components/elements of your organization • Focus planning on individual components/elements (limited linkage) • Start with what you have • Plan to go from total loss to complete recovery • Phase 2– Plan to recover the functions • Phase 3– Plan to respond

13. Profits Public Products Building a Business– the Essentials Who does the work in our organization? • Includes: • Key personnel involved in executing critical business processes • Supervisory/management personnel with direct responsibility for critical business functions • Issues: • Personnel safety is the top planning priority. This includes: • Ensuring physical safety • Providing emergency medical care and crisis counseling • Protecting employees’ families • Cross-training and succession planning mitigate sudden loss of key employees • People inside and outside of the organization need information • Personnel associated with critical functions are the best source of information in plan development. People

14. Profits Public Products Building a Business– the Essentials • Includes: • Raw materials • Business supplies and equipment • Data • Utilities (electricity, natural gas, water) • Fuel for vehicles • Dedicated emergency supplies • Issues: • Reliability of suppliers • Alternative suppliers • Alternative delivery routes and locations • Data backup and restoration • Temporary source of key supplies • Emergency generators for backup electrical power • On-site potable water storage • Gasoline/diesel storage Provisions People What do we need in order to do the work? Raw materials, supplies, etc.?

15. Profits Public Products Building a Business– the Essentials • Includes: • Buildings and facilities • Some organizations may have multiple locations • Some organizations may rely heavily on telecommuting • Issues: • The current space allocation is the starting point for calculating space needs • If 100% restoration isn’t possible, consider implementing a phased approach • Non-critical functions are not allocated workspace during initial recovery efforts • Each business unit involved in a critical business function initially is allocated a percentage of its current space • Adjustments to this allocation can be made as planning continues Provisions People Places Where is the work done? What facilities do we have?

16. Pipes Profits Public Products Building a Business– the Essentials What is our information infrastructure? • Includes: • Telecommunications infrastructure • Telephones • Radio communications • Information technology (IT) infrastructure • Local Area Networks (LANs) • Wide Area Networks (WANs) • Internet connectivity • Issues: • Must identify critical communications paths • Single-points-of-failure must be identified • Redundancy should be provided • Personnel must be trained on use of alternate communications paths • Documentation, equipment and supplies must be readily available to implement backup plans • Emergency communications must be planned Provisions People Places

17. Processes Pipes Profits Public Products Building a Business– the Essentials How do we do our work? What procedures do we use? • Includes: • Official policies • Organization charts • Written procedures • Institutional knowledge • Unwritten procedures • “The way we’ve always done it” • Issues: • Are policies/procedures comprehensive? • Are policies/procedures up-to-date? • Is actual practice consistent with our written policies and procedures? • Are critical process manuals, policy documents backed up off-site? • Do key employees know how to find them? Provisions People Places

18. Protection Processes Pipes Profits Public Products Building a Business– the Essentials • Includes: • Physical security • Locks • Security personnel • Surveillance cameras • Personnel awareness • Cyber security • Firewalls • Intrusion detection processes • User-initiated workstation security procedures • Issues: • Access control • Automatic door locks-- fail open or closed? • Availability of additional security personnel • Off-site monitoring of surveillance equipment • Awareness training for all personnel– security is everyone’s job Provisions People Places How do we ensure that our organization is safe?

19. Profits Public Products Building a Business– the Essentials

20. Protection Processes Public Profits Scenario-based Planning Lightning Plan Provisions Places People Products

21. Protection Processes Public Profits Scenario-based Planning Lightning Plan Tornado Plan Provisions Places People Products

22. Protection Processes Provisions Places People Public Profits Scenario-based Planning Lightning Plan Tornado Plan Earthquake Plan Products

23. Protection Processes Public Profits Scenario-based Planning Lightning Plan Tornado Plan Earthquake Plan Biohazard Plan Provisions Places People Products

24. Protection Processes Public Profits Scenario-based Planning Hurricane Plan Lightning Plan Tornado Plan Earthquake Plan Biohazard Plan Provisions Places People Products

25. Consequence Recovery Provisions Places People Response Public Profits Products Scenario-based Planning Event

26. Lightning Plan Tornado Plan Earthquake Plan Biohazard Plan Hurricane Plan Scenario-based Planning Plan development is multi-disciplinary and requires coordination of all functional groups. This may be the optimum approach but it can prove to be time-consuming. Content may be repeated in multiple documents, making it difficult to keep all plans current. Business Continuity Plans

27. Consequence Recovery Provisions Places People Response Public Profits Products Consequence-based Planning

28. Pipes Processes Provisions Places People Protection Consequence-based Planning Plan development is usually confined to one or two functional groups. Concurrent planning can be conducted by the functional groups. Repetitive content is minimized, facilitating plan maintenance. Business Continuity Plan

30. Group exercise • You are the management staff of a large restaurant chain • Austin is the headquarters of the chain • Restaurant locations include: • 3 in Austin • 1 in Marble Falls • 1 in San Marcos • 2 in San Antonio • The company also operates a packaged dinner business that is distributed to grocery chains in five southwestern states • The manufacturing operation is based in La Grange • Each table has been assigned one of the phases of the company’s operation • For this phase, outline the key elements of a plan to ensure that the business can survive any reasonable disaster

31. The name of the restaurant chain . . . The Perfect Storm La Tormenta Perfecta

33. Consequence-based Planning– Phases • Phase 1– Plan to recover the pieces • Phase 2– Plan to recover the functions (This phase was covered in detail in last year’s workshop. Copies of the presentation are available by e-mail or at: http://www.acp-centraltexas.com/pastmeet_2004.htm) • Phase 3– Plan to respond

35. Consequence-based Planning– Phases • Phase 1– Plan to recover the pieces • Phase 2– Plan to recover the functions • Phase 3– Plan to respond • Organize for flexible response • Begin with an assessment of which elements have been lost or damaged • Prioritize response actions • Respond effectively

36. Organizing for a flexible response– concepts • Use all available resources • Continuity of responsibilities • Phased response • An emergency will be met at the lowest and most suitable level. • If resources available to a facility or business unit are inadequate to meet the need, additional resources will be provided. • Requests for additional resources will generally be made within the business units most directly affected, but assistance from other business units may be requested as needed. • Events which have the potential to generate widespread publicity or which require a major commitment of resources will be coordinated through the Emergency Operations Center (EOC).

37. Organizing for a flexible response– functions Core functions • Command = making the decisions • Planning = figuring out what we need to do • Operations = taking action • Logistics = getting the “stuff” we need • Finance/Administration = tracking costs and paying bills Ancillary functions • Communication = public information and employee communication • Safety = making sure no one gets hurt • Liaison = coordinating activities with other organizations

38. Incident Command System (ICS) Incident Commander Command Information Command Staff Liaison Safety General Staff Finance/ Administration Operations Planning Logistics

39. Consequence-based Planning– Assess • Begin with an assessment of which elements have been lost or damaged • Evaluate the impact of this loss or damage on ongoing operations • Identify “quick fix” options

40. Consequence-based Planning– Prioritize • Prioritize response actions • Safety is ALWAYS the first priority • Consider “low-hanging fruit” • Allocate more resources to “mission critical” functions

41. Essential response elements Command Control Communication Command • Who’s in charge? • Who decides our mission? • Who establishes priorities? • Who assigns roles? • Who allocates resources? • Who sets policy? • Who decides that we’re done?

42. Essential response elements Command Control Communication Control • How do we stay on track? • Who plans our efforts? • Who assigns tasks? • Who monitors progress? • Who evaluates performance? • Who coordinates activities? • Who documents our efforts?

43. Essential response elements Command Control Communication Communication • How do we keep in touch? • How do we tell folks what to do? • How do we know if they did it? • How will they know if things change? • How do we know when they need help? • How do they know when we need help? • How do we report our activities?

44. People / organizations Impact / visibility Problems / complexity Determining factors • How many people or organizations are involved? • Can we handle this by ourselves? • How complex and variable are the problems? • Is this routine? • Can we handle this easily? • How large is the impact? • Is this life threatening? • Is it a major media / political event?

45. People / organizations Impact / visibility Problems / complexity Management Supervisory Normal Normal conditions Command Control Communication

46. Policy makers People / organizations Impact / visibility Problems / complexity Management oversight Management Supervisory Normal Expanded Internal Emergencies Command Control Communication

47. Regulatory Incident Command System Policy makers People / organizations Impact / visibility Problems / complexity Management oversight Management Supervisory Normal Expanded Joint information center (JIC) External Emergencies Command Control Communication

48. Continuity of government Emergency powers Modified roles & responsibilities Multi-jurisdiction Unified Command Regulatory Incident Command System Policy makers People / organizations Impact / visibility Problems / complexity Management oversight Management Supervisory Normal Expanded Redundant emergency communications Joint information center (JIC) JIC /Critical Incident Stress Management Catastrophic Events Command Control Communication

50. Group exercise • Hurricane Rita is expected to make landfall at Matagorda Bay within 6 hours. • The weather service has made the following predictions for landfall. • Hurricane force winds are expected to affect the Colorado River basin from Matagorda to Lake Travis. Continuous wind speeds of 100 mph are expected at La Grange with sustained winds near 80 mph possible in Austin. • Multiple tornadoes may affect the region. • Widespread heavy rains, approaching 4 to 8 inches are expected to cause severe flooding on the Colorado River and its tributaries. • Street flooding may make travel difficult in many areas. • Widespread electric power and telephone outages are expected.