NYS Forum Business Continuity Committee Meeting
(http://www.nysforum.org/committees/businesscontinuity/)

Date: Held 5/12/2008 @ 2:00 PM Keane Office
From: Tom Luther and Chris Lloyd

Discussion Topic

Introductions

Agencies and organizations represented and note on their current activities:
Tax & Finance - Janine Messina, Joanne Lonzak (working on BCP for district offices)
OFT - Benita Sokolowski, Alan Kowlowitz
Dept. of State - Steve Conant
OSC - Tom Luther, Chad Erickson
Keane - Chris Lloyd
Dormitory Authority - Kelly Chrzanowski (working on BC initiative)
DCJS - Larry Tompkins (working on a High Availability/DR project)
Office for the Aging - Neils Hansen
State Ed Dept - Marie Culver, John Krumdieck (involved in initiative to protect state archives items)
Dept of Labor - Steve Koslowski (working on initiative to develop plans for 18 Divisions)
Nortel - Mike Lashway (indicated some of his clients are asking them to assist with BC/DR.)
CGI - Mark Spreitzer (via phone)

Awareness and training for emergency management program / plan presentation

See Handout for NYS Forum May 12 meeting - One of the 10 principles of an effective BC Program: Education, Training and Awareness following the minutes
Also: See useful material on http://www.ready.gov/america/beinformed/index.html (External Link) which is also a link of NYS OHS web site http://www.security.state.ny.us/ (External Link)
 
Tom Luther and Chris Lloyd presented and discussed the different parts of an awareness program and provided handout with various activities that an organization can consider.
 
Attendees provided some lessons learned:
  • Alan from OFT said their B.C. / COOP / DR training is being integrated into the agency's mandatory security awareness training. Why? It's a great way of exposing all employees to BC concepts. The training is a computer based system (CBT). There are multiple-choice questions at the end and participants must correctly answer 80 percent of the questions.
  • Mark Spreitzer said it's possible to tie E.R. and B.C. programs together through awareness initiatives. For example, at his building in Manhattan, there are sheets near the elevators which can be detached by visitors or employees. The sheets show exit routes from the building. This is a very visible reminder of an ER/BC program. Perhaps, on the back of the sheets, information could be provided about the company's other ER/BC/DR efforts and planning.
  • Benita and Alan from OFT said they use shorter and more frequent training and exercise periods. Instead of asking executives for a half-day commitment (an extremely difficult proposition), they use 90-minute sessions. Alan said they've become better facilitators because of more frequent tests/exercises/classes.

NYS Forum Health Check

General feedback was solicited to learn which attendees had used or looked at the NYS Forum's online Business Continuity Health Check.
Feedback: It appeared that few agencies had completed the Health Check as a group (including all those involved with some level of emergency preparedness).

Roundtable discussion: BC issues at various agencies, authorities and organizations

  • Steve from the Dept. of Labor said he is working with a consultant on 18 B.C. plans - one for each DOL division. They're still in the discussion stages with the consultant about developing a statement of work.
  • Joanne and Janine from DTF said their plan is too broad; it has not been fully developed; only the district offices' plans have been done. Joanne said she believes executives are not being engaged in the process, and instead will be shown a final plan - not one they helped develop.
  • Neils from Aging said they are struggling with getting answers to items that require executive attention or executive decisions. He said it's been an ongoing problem with BC-related issues.
  • Marie from the State Education Department (State Archives) said Hurricane Katrina in '05 and the Southern Tier floods of '06 helped push emergency preparedness to the forefront of the agency. It's now one of their four priority initiatives. They are now benchmarking - looking at what other states are doing or have done in this area. They are looking at a time span of 2007 - 2011 for their own program.
  • John from the State Education Department (State Archives) said they must continue to elevate the importance of protecting records (including those of yesterday; museum pieces and other history) so this remains a priority initiative. "Keeping priorities priorities is critical."
  • Kelly from the Dormitory Authority said she's new to the job and is still learning about BC/DR. She said her supervisor is BC manager, but it's not her full-time job. Kelly said that BIAs had been done at the Authority, and they're now considering how to develop and maintain their BC plans. They are thinking of whether an online solution would work.

    -- Mark said templates are usually not a good tool for BC plans. Chris added that commercial tools/BC software packages tend to limit the types of questions which can be asked.

  • Alan from OFT said he was astonished by how little coordination or standards exist for BC at the New York State level. He said there was too much federal material (NIMS, etc.) for a state agency to make an attempt to go it alone. He feels OGS needs to get more involved to work with agencies on relocation options and SEMO needs to provide more support as well.
  • Larry from DCJS said, at his agency, there was a tendency to focus on the technical side of the DR component, with hopes that the BC component would naturally follow. He said there was a desire for "four nines" availability, but executives may not understand the budget impact for achieving this.
  • Steve from the Dept. of State said he was frustrated that no state agency had taken the lead on dealing with suitable relocation or alternate sites for agencies; he said SEMO only offers agencies two racks of IT space - which is not nearly enough.

Action Items

Action Item
Notify Co-Chairs of suggested agenda items.
Owner
Committee Members
Due Date
ASAP
 

Next Meeting: Wed June 18, 2008 2:00 to 4:00 at Keane Office, Corporate Woods

Additional Documents of Reference

None.

Handout for NYS Forum May 12 meeting

One of the 10 principles of an effective BC Program: Education, Training and Awareness

Elements of Awareness and Training Programs

  1. Components of a BC Plan
  2. Why a BC Plan is important.
  3. Identify who has responsibility and/or who is involved in the planning process.
  4. Indicate where BC information can be found.
  5. Indicate when the plan is exercised.
  6. Indicate how the plan is exercised.

Audience for Awareness Program:

  1. Executives and Managers
  2. Contingency or recovery Team members
  3. New Employee Orientation

Awareness Mechanisms:

  1. Newsletters
  2. Senior staff meetings
  3. Videos/films
  4. Posters
  5. Memo for Commissioner, CIO, Director etc.
  6. Brown Bag lunch session

Some ways of raising Business Continuity awareness within an organization:

  • Create a program and a Charter and distribute it to Executives

  • Report on the progress on the program's development in executive staff meetings, in monthly reports and elsewhere.

  • Create a web site and post news events, accomplishments etc.

  • Establish a link between business continuity and agency strategic goals, mission and values.

  • Strive to get a statement supporting BC and its many benefits (document these and issue them often) from the highest ranking executive and distribute it widely in your organization.

  • Inviting different groups and stakeholders to participate in B.C. exercises, not just the "regular players"

  • Regular and updated Intranet announcements; these could contain information about the types, scope, magnitude and potential impact of the various parts of a B.C. plan. These should be part of a work program and yearly schedule to track when new announcements are due.

  • Issue periodic information bulletins via intranet or to bulletin boards that remind staff of particular aspects of emergency response/management etc: like emergency procedures or phone information etc.

  • Tests / Exercises / Drills that are strategically planned and involve the right people and that include a debrief session to document improvement opportunities.

  • Adding B.C. to the agendas of executive/bureau/staff meetings, so the process doesn't slip out of sight, out of mind

  • A poster or placard campaign within the organization, which would focus on different aspects of B.C.

  • Share news accounts of incidents that occur in other organizations - helps to keep the risk real.

  • Distribute lessons learned from exercises or unplanned incidents.

  • Educational sessions conducted by the unit responsible for B.C. planning. These could take the form of "lunch and learn" seminars

  • Vendor sessions; B.C. experts could be invited to speak to the general employee population about B.C.

  • When conducting exercises, invite a "neutral" third party such as a member of your internal control group to observe and offer feedback.

TRAINING:

Resources that support a program need training.