BUSINESS CONTINUITY AND RECOVERY PLAN

REVISION 3: 02/12/2021

1. INTRODUCTION
1.1     PURPOSE
1.2     OBJECTIVES
1.3     KEY SAFEPASS ACTIVITIES
1.4     TEAM ROLES AND RESPONSIBILITIES
1.5     BCP COORDINATION TEAM
1.6     BCP RESPONSE TEAM
2. PLAN ACTIVATION PROCEDURES
2.1     WITH WARNING
2.2     WITHOUT WARNING
2.3     IDENTIFICATION OF POTENTIAL DISASTER STATUS
2.4     DIRECTION AND CONTROL
2.5     COMMUNICATIONS PLAN
2.5.1     Staff Communications
2.5.2     Customer Contact
2.5.3     Management and Staff Contact
2.5.4     Suppliers Contact
2.5.5     Media Contact
2.5.6     Other Third Parties
3. CRITICAL BUSINESS FUNCTIONS
3.1     DESCRIPTION OF BUSINESS FUNCTION
3.2     RECOVERY TIME OBJECTIVE (RTO)
3.3     RECOVERY PROCEDURE
3.4     DEPENDENCIES
3.5     OTHER CONSIDERATIONS
4. RECOVERY STEPS
APPENDIX A: DISASTER IMPACT ASSESSMENT

 

1. INTRODUCTION

1.1      PURPOSE

Business continuity plans are designed to help organizations recover from a disruption in service.  Specifically, this plan provides policy and guidance to ensure SafePass can respond effectively to a disruption and restore essential services to the business as quickly as possible.

1.2      OBJECTIVES

• Identify advanced arrangements and procedures that will enable SafePass to respond quickly to an emergency event and ensure continuous performance of critical business functions.
• Reduce employee/contractor injury or loss of life and minimize damage and losses.
• Protect essential facilities, equipment, vital records, and other assets.
• Reduce and mitigate disruptions to business operations.
• Identify managers and other staff who might need to be relocated depending upon the emergency.
• Identify teams which would need to respond to a crisis and describe specific responsibilities.
• Facilitate effective decision-making to ensure that SafePass operations are restored in a timely manner.
• Provide support to employees and employee families during an event so that employees know that the safety of their families has been addressed, and that employees will therefore be available to work and help restore SafePass function.
• Identify alternative courses of action to minimize and/or mitigate the effects of the crisis and shorten SafePass response time.
• Quantify the impact of any kind of emergency in terms of dollars, time, services, and work force.
• Recover quickly from an emergency and resume full service to Customers in a timely manner.

1.3      KEY SAFEPASS ACTIVITIES

• Provide hardware and software security products
• Host software systems and infrastructure
• Technical support for customers

1.4      TEAM ROLES AND RESPONSIBILITIES

BCP Sponsor: SafePass President

Role/Responsibilities:

Assist Coordinator to draft project work plan and draft BIA questionnaire.  Complete BIA questionnaire.  Assign other staff as necessary to complete project.  Send out periodic emails to all staff providing project updates.

BCP Coordinator: SafePass Technical Manager

Role/Responsibilities:

Draft work plan necessary to develop the BCP.  Draft BIA questions for staff to answer.  Conduct interviews with all staff members.  Compile information and draft BCP.

For emergency contact information for members of all teams, see separate calling tree lists.  These separate lists include cell phone numbers, home phone numbers, home email addresses, as applicable.

1.5      BCP COORDINATION TEAM

This team is responsible for drafting and finalizing SafePass’ business continuity and recovery plan.  This includes developing a project work plan outlining the steps necessary to draft the plan and ensuring that each step is completed.  This team will finalize the questions to be asked as part of the Business Impact Analysis (BIA) process.  Each team member will fill out a BIA questionnaire and will also assign staff within his/her own division to answer BIA questions, as necessary.  This team will meet periodically to review project progress, will revise work plan as necessary, and will edit and approve the final plan.

1.6      BCP RESPONSE TEAM

This team is responsible for responding in the event of a disaster.  This includes assessing potential damage to SafePass assets.  This also includes taking lead responsibility for ensuring that SafePass can function effectively during a crisis and can resume business operations as quickly as possible.

2. PLAN ACTIVATION PROCEDURES

2.1        WITH WARNING

It is expected that in some cases, SafePass will receive a warning at least a few hours prior to an event.  This will normally enable the plan to be enacted with an orderly notification and evacuation of staff.

2.2      WITHOUT WARNING

The ability to execute this plan following an event with little or no warning will depend on the severity of the emergency and the number of SafePass personnel who have been affected by the event.

• Non-Duty Hours:  Although SafePass assets may be rendered inoperable, it is likely that the majority of SafePass staff could be alerted and deployed as needed.
• Duty Hours:  If possible, this plan will be activated, and the pre-designated available staff will be deployed.

2.3      IDENTIFICATION OF POTENTIAL DISASTER STATUS

Criteria for determining whether a particular emergency situation requires that emergency actions be taken or the BCP be enacted include:

• Is there an actual or potential threat to human safety?
• Is there likely to be a need to involve emergency services?
• Is there an actual or potential serious threat to buildings or equipment?
• Is there an actual or potential loss of IT/network?
• Is there an actual or potential loss of workforce?

2.4      DIRECTION AND CONTROL

• Lines of succession will be maintained by all managers reporting to ensure continuity of essential functions.  If possible, successions should be provided to a depth of at least three staff where policy and directional functions are involved.
• SafePass President or designated back-up (successor) may order activation of SafePass business continuity plan.

2.5      COMMUNICATIONS PLAN

During a crisis situation, communication with all affected parties – from staff to customers to media – is vital.  The information provided to all audiences must be accurate and timely to:

• Help prevent loss of life and property
• Warn and inform people in danger about the threat, and tell them what they can do to reduce their risk
• Improve appropriate Customer response to future emergencies and disasters through education.

In particular, any estimate of the timing to return to normal working operations should be announced with care.  It is also very important that only authorized personnel deal with media inquiries.

2.5.1           Staff Communications

If a staff member learns of a potential crisis situation, the staff person should immediately contact SafePass President or communications director.

If the building structure is in question, staff should not enter the building.

2.5.2           Customer Contact

The communication director or designee will develop an official statement for customers.  Depending upon the type and severity of the event, the statement may be issued in the following ways:

• Through local media
• Scheduled customers may be called or e-mailed
• Notice may be posted at the affected facility or facilities

SafePass President will record a message on SafePass’ main phone line briefly explaining the crisis and directing callers to the SafePass web site (if available) for additional information and updates.

2.5.3           Management and Staff Contact

SafePass President or designee will develop an official statement for managers and staff.

If the event happens during work hours, and depending upon the severity of the event:

• Staff may be sent home
• Staff may be asked to assist in implementing work-around procedures

If the event happens after work hours, or becomes a multi-day event, staff will be contacted through:

• Employee call trees
• A call-in number for information about which types of employee positions are to report to work
• Information posted to SafePass web site

In general, the employee call tree involves the following; SafePass President calls all members of the Management Team and shall leave a voice mail message at cell and home phone numbers instructing employees on the status of SafePass offices and where to report.  Staff should be instructed to refer all media inquiries to the communications director. 

2.5.4           Suppliers Contact

The contracts and procurement manager will be the sole contact with suppliers during the business recovery phase.  The facilities manager will use emergency procurement procedures and receive authorization for emergency purchases from SafePass President or designee.

2.5.5           Media Contact

Once an event occurs, the communications director will develop official “Customer statements” to respond to questions frequently asked by the media and Customers.  The communications director will provide these statements to SafePass President or designee for review and approval before providing the statements to any external parties.

The communications director will develop statements to respond to the following questions:

• What happened?
• When did it happen?
• How is state government affected by this incident?
• How much damage was done to the building?
• How many people work in the building (including other agencies, if applicable)?
• Did you have to evacuate the building?  What time?  Was it a total or partial evacuation?
• What corrective measures are being taken to ensure that this doesn’t happen again?
• When can employees come back to work?
• How will this event affect SafePass’ service to Customers?

Depending on the nature of the crisis, determine if a technical expert or a Customer official with specific jurisdiction is required to provide clarity to the situation and/or disseminate information to the media.

If anyone other than the communications director will communicate with the media (e.g., technical expert, field office manager), the communications director will provide those people with the following:

• Spokesperson guidelines
• List of potential questions
• Appropriate statements and responses
• Communications director’s cell phone and home phone numbers

If necessary, the communications director shall also:

• Select and acquire a “media briefing center.”  Ensure that the briefing center is large enough for one-on-one interviews.
• Acquire updates regarding the event occurrence and status of injured employees.
• Arrange interviews and press conferences, as required.
• Coordinate with other agencies to disseminate information to external parties, if appropriate.

The communications director shall also develop “media kits”/press releases containing the following information for distribution to various newspapers, television stations, and radio stations:

• Location of event
• General description of event (stated as positively as possible)
• Corrective measures being taken
• Description of impacts (non-monetary and stated positively)
• Media contact made

Finally, the communications director shall ensure that media and internal response information is recorded/documented for the duration of the recovery effort.

2.5.6           Other Third Parties

The communications director shall be primarily responsible for all contact with other third parties.  If appropriate, after consulting with SafePass director, the communications director will provide information to other staff to assist in responding to these requests for information.

3. CRITICAL BUSINESS FUNCTIONS

3.1      DESCRIPTION OF BUSINESS FUNCTION

Ensure that Customer funds are properly accounted for, spent in accordance with legal requirements, and used to the best advantage.  The President conducts audits by completing the following processes:

• Management of databases info/network security
• Business office functions
• Computer support/helpdesk
• Financial audits
• Management of library and reference materials

3.2      RECOVERY TIME OBJECTIVE (RTO)

72 hours – this plan is based on the assumption that any potential disruption occurs in critical timeframes during peak volume.  Working with this assumption, 40% of business processes must be recovered within 72 hours, 65% within 1 week, and 85% of business processes must be recovered within 1 month.

The timing of this disruption, more than anything else, will determine the RTO for specific processes.  A disruption during non-peak timeframes will allow RTOs to be more lenient.

3.3      RECOVERY PROCEDURE

The recovery procedure will depend largely upon how quickly access to computers can be restored.  If remote computer access is functional, pre-identified staff will be asked to work remotely until an alternate site is available.  Communication will be conducted by phone until computer systems are installed, or restored, to allow email communication.  If computer systems will not be available at the alternate site for more than 1 week, we will implement use laptops and electronic forms, if available, to perform this critical business function.

When computer systems are available, work will continue at the alternate location until the headquarters office is again available.

The recovery procedure also depends upon the length of time the power is anticipated to be out.  If we anticipate power will return in two days or less, we will use the call tree to let employees know not to report to work until further notice, unless they will be reporting to a remote worksite that is unaffected by the outage.

If we anticipate the power will be out longer than two days, the recovery procedure consists of implementing manual procedures at a third-party location to coordinate the conduct of audits.  Communication will be conducted by phone until computer systems are installed, or restored, to allow e-mail communication.  If computer systems will not be available at the alternate site for more than 1 week, we will implement a paper process.  When computer systems are available, business functions will be completed at the alternate location until the headquarters office is again available.

The recovery procedure consists of working with IT to restore normal systems.  After an emergency declaration we may purchase outside of contract if necessary to expedite recovery.  We may need temporary IT assistance to reconfigure and restore the system in a timely fashion.

The recovery procedure depends upon the length of time the computer system is anticipated to be out.  If we anticipate restoration in two days or less, we will complete those processes that do not require the affected computer systems.

If we anticipate the network or computer failure will exceed two days, our plan consists of implementing manual procedures at our main office until computer systems become available.

When computer systems are available, all business processes will continue as normal, and all manual/paper work will need to be recorded in the computer systems retroactively.

3.4      DEPENDENCIES

This plan is dependent upon having the designated alternate worksite available during the time that our facility is inaccessible.  If a wide-scale disaster is the cause of the loss, our alternate site may not be available.

This plan is dependent upon having the designated alternate worksite available, and with power, during the time that the facility is without power.  This plan is dependent on power being restored no later than 30 days after a disaster has been declared.

This plan is dependent on the functionality of remote access to allow staff to work from remote sites.  This plan is dependent on the availability of new equipment and the timeliness of delivery.

3.5      OTHER CONSIDERATIONS

If a wide scale disaster and/or power outage is the cause of the loss, we will revert to paper-based methods whenever possible.  In addition, we will contact our customers to let them know of potential services delays.

Depending upon the amount of downtime, we may need to use temporary staff to assist us in both the manual process and the process of entering all manual work into the computer system once access is restored.

4. RECOVERY STEPS

q        Step 1 – Contact BCP Response Team and arrange for a meeting.

q        Step 2 – BCP Response Team meets and reviews plan steps.

q        Step 3 – Assess damage to SafePass facility and systems.

q        Step 4 – Alert alternate site location to begin setting up for incoming staff.

q        Step 5 – Contact Phones to redirect phone lines.

q        Step 6 – Contact utility services.

q        Step 7 – Meet with Alternate Site management to review operating procedure.

q        Step 8 – Contact Alternate site staff and IT staff with directions for deployment.

q        Step 9 – Contact IT and determine when computer services will be available.

q        Step 10 – Contact customers, vendors, etc. and inform them of possible delays.

q        Step 11 – Announce relocation to media outlets.

q        Step 12 – Establish communication with customers at Alternate Site.

q        Step 13 – Complete priority business processes at Alternate Site.

q        Step 14 – Relocate remaining staff as needed, as space and capability become available, to complete the function at the Alternate Site.

q        Step 15 – Notify and update users as systems become available.

q        Step 16 – Resume normal operations.

 

APPENDICES

 

APPENDIX A:  DISASTER IMPACT ASSESSMENT

DESCRIPTION OF DISASTER/DISRUPTION:
DATE:				DATE Response TEAM MOBILIZED:
BUSINESS FUNCTION NUMBER	BUSINESS FUNCTION	STATUS LEVEL (SEE TABLE BELOW)						ASSESSMENT CARRIED OUT BY	COMMENTS
		1	2		3	4	5

THE FOLLOWING STATUS LEVELS SHOULD BE APPLIED:

LEVEL	DESCRIPTION
1	Is likely to seriously affect normal business operations for over four weeks
2	Is likely to seriously affect normal business operations between one and four weeks
3	Is likely to seriously affect normal business operations for over a week
4	Is likely to seriously affect normal business operations for less than one week
5	Is likely to seriously affect normal business operations for less than two days