When the rubber hits the road will you be ready? PMI Lakeshore Chapter February 21, 2005 CAROL MOFFITT.

When the rubber hits the When the rubber hits the road will you be ready?road will you be ready?

PMI Lakeshore ChapterPMI Lakeshore Chapter

February 21, 2005February 21, 2005

CAROL MOFFITTCAROL MOFFITT

22 February 2005February 2005 True North Continuity GroupTrue North Continuity Group

Where we’ve been….Where we’ve been….

Disaster Recovery…Disaster Recovery…

Business Recovery…Business Recovery…

Business Contingency…Business Contingency…

Business Continuity…Business Continuity…


What is a disaster, incident, event…?What is a disaster, incident, event…?

Natural or weather relatedNatural or weather related

Man-madeMan-madeAccidentalAccidental

DeliberateDeliberate

TSUNAMI

natural

disaste

r

SARS

pandem

ic

BLASTER

Computer viru

s

POWER O

UTAGE

infra

structu

re fai

lure

9-11

terroris

t Acti

vities

SYSTEMS C

RASH

technology fa

ilure

“MAD C

OW”

DISEASE

LABOUR STRIKE

disgruntle

d employee

s

FIRE

natural

or man

-mad

e

PRIVACY

BREACH

HURRICANES

A-Z

CHEMIC

AL SPILL

accid

ental

or deli

berate


Business Continuity ManagementBusiness Continuity Management

Process to minimize potential and / or real risksProcess to minimize potential and / or real risks

Business Continuity PlanningBusiness Continuity Planning An ongoing process to An ongoing process to prepareprepare for interruptions through for interruptions through

the development, implementation and testing of business the development, implementation and testing of business continuity initiativescontinuity initiatives

Event / Crisis ManagementEvent / Crisis Management The activities undertaken to The activities undertaken to respondrespond to interruptions to interruptions

including returning to normal and debriefing the event to including returning to normal and debriefing the event to improve both Planning and Event Management going improve both Planning and Event Management going forwardforward


Business ContinuityBusiness Continuity

Education &

Awareness

BIA & RA

PlanDevelopment

/ Revision

TestingPlan Update

ExecutiveSign-off

LifeCycle

GOVERNANCE

Directive

Policy

Procedures

Standards

Guidelines

Methodologies

Compliance

Reporting

Audit

EVENT / CRISIS MANAGEMENT

People Communications Technology Security Facilities Administration


Event / Crisis ManagementEvent / Crisis Management

External Partners

Divisions / Departments

Operations, Networks

Technology Logical SecurityTelecoms, etc.

Human Resources

AdministrationFinance, Legal

Bldg Mgmt, Security

Facilities Real Estate, Insurance

Employees

CommunicationsClients / Public

Media

Response & Status

Executive / Board of Directors

Senior Management


Roles & ResponsibilitiesRoles & Responsibilities

Regulators &External Governance

Internal Support Teams

CivilAuthorities

BUSINESS

BCM Group

Technical Support

Executive

External Service Providers

Audit &Risk Management


Shifting TrendsShifting Trends

Increase in events Increase in events (type / variety / number)(type / variety / number)

Increase in simultaneous eventsIncrease in simultaneous events

Increase in customer expectationsIncrease in customer expectations

Increase in interdependencies across Increase in interdependencies across business, with I.T., and external service business, with I.T., and external service providers / outsourcersproviders / outsourcers


Shifting TrendsShifting Trends

Technology enhancements and Technology enhancements and diversificationdiversification

Increase in costs Increase in costs (technology and people resources, (technology and people resources, reduced service availability and potential loss of revenue)reduced service availability and potential loss of revenue)

Decreasing windows for testing Decreasing windows for testing (combination (combination of technical complexity and ‘service’ availability)of technical complexity and ‘service’ availability)

Increase in governance and complianceIncrease in governance and compliance


IT ChallengesIT Challenges

Business demands speed & agilityBusiness demands speed & agility

Technology is core to business strategyTechnology is core to business strategy

Integration of technologies & servicesIntegration of technologies & services

Competitive technology marketplaceCompetitive technology marketplace

ResourcesResources

Business vs. Technology SolutionsBusiness vs. Technology Solutions


BCM ChallengesBCM Challenges

Traditional response to the ‘risk of system Traditional response to the ‘risk of system failure’failure’

Backup requirementsBackup requirements Equipment replacementEquipment replacement Focus on disaster recoveryFocus on disaster recovery

‘‘business failure’ often an after thought…business failure’ often an after thought…



New requirementsNew requirements

Managing ‘goldfish bowl’ environmentManaging ‘goldfish bowl’ environmentImpact of the internetImpact of the internet

Impact of the mediaImpact of the media

Impact of the savvy client….Impact of the savvy client…. Cultural readinessCultural readiness

Lip service or reality?Lip service or reality? Continuous operations and protection of assetsContinuous operations and protection of assets

E-business BCM = ongoing operationsE-business BCM = ongoing operations



Planning is critical to minimize damagePlanning is critical to minimize damage

Value not recognized until the unexpected Value not recognized until the unexpected occursoccurs

Often under-resourceOften under-resource

Traditional hedges no longer effectiveTraditional hedges no longer effective

Everyone is an ‘Expert’Everyone is an ‘Expert’


Changing AttitudesChanging Attitudes

Impact of Year 2000, 9-11 terrorist Impact of Year 2000, 9-11 terrorist activities, cyber related, infrastructure activities, cyber related, infrastructure failuresfailures

Cross business / sectorCross business / sector

Cross bordersCross borders

Business / personalBusiness / personal

Role of regulatory bodiesRole of regulatory bodies

Clients expectationsClients expectations

Board / Shareholder obligationsBoard / Shareholder obligations


PartneringPartnering

InternalInternal Risk managementRisk management AuditAudit Technical groupsTechnical groups Project managementProject management Other business groups – interdependenciesOther business groups – interdependencies

ExternalExternal CompetitorsCompetitors RegulatorsRegulators Outsourcing / joint venture relationshipsOutsourcing / joint venture relationships


Adding Value…Adding Value…

Business Continuity is NOT rocket science, conceptually it is pretty Business Continuity is NOT rocket science, conceptually it is pretty simple, however…simple, however…

Implementation & execution can beImplementation & execution can beComplexComplex

Resource intensiveResource intensive

CostlyCostly

Time consumingTime consuming

Project management discipline is an asset Project management discipline is an asset

Educate your clients about business continuity and make suggestions Educate your clients about business continuity and make suggestions where they can improve their processes to make them more resilientwhere they can improve their processes to make them more resilient



Incorporate business continuity into your own Incorporate business continuity into your own project plansproject plans

Educate your clients about business continuity Educate your clients about business continuity and make suggestions where they can improve and make suggestions where they can improve their processes to make them more resilienttheir processes to make them more resilient

Educate your clients on how the project Educate your clients on how the project management discipline can help ease the management discipline can help ease the perceived pain of business continuityperceived pain of business continuity



Keep it simpleKeep it simple Stick to the basics of Business ContinuityStick to the basics of Business Continuity Leverage the foundations of Project Leverage the foundations of Project

ManagementManagement

Goal is to have an approach that is Goal is to have an approach that is FlexibleFlexible ScalableScalable ApplicableApplicable


For considerationFor consideration

If the two guarantees in life are:If the two guarantees in life are:TaxesTaxes

DeathDeath

Then the three guarantees for business Then the three guarantees for business continuity are:continuity are:

There will be more eventsThere will be more events

They will be different They will be different

No one is exempt No one is exempt


Business Continuity Awareness WeekBusiness Continuity Awareness Weekin North Americain North America

September 18 – 24, 2005September 18 – 24, 2005

2005 Events2005 Events DRIE Quarterly MeetingsDRIE Quarterly Meetings

March, June, Sept, Dec - TorontoMarch, June, Sept, Dec - Toronto DRJ ConferencesDRJ Conferences

March - OrlandoMarch - Orlando

September – San DiegoSeptember – San Diego

www.drj.comwww.drj.com CPM ConferencesCPM Conferences

May – Las VegasMay – Las Vegas

November – OrlandoNovember – Orlando

www.contingencyplanning.comwww.contingencyplanning.com WCDM ConferenceWCDM Conference

July – TorontoJuly – Toronto

www.wcdm.orgwww.wcdm.org

Industry LeadersIndustry Leaders Business Continuity Institute Business Continuity Institute

(BCI)(BCI)www.thebci.orgwww.thebci.org

Disaster Recovery Institute Disaster Recovery Institute International (DRII)International (DRII)

www.drii.orgwww.drii.org Disaster Recovery Information Disaster Recovery Information

Exchange (DRIE)Exchange (DRIE)www.drie.orgwww.drie.org

Canadian Centre for Emergency Canadian Centre for Emergency Preparedness (CCEP)Preparedness (CCEP)

www.ccep.orgwww.ccep.org

For additional information….

Stay tuned for …


Carol MoffittCarol MoffittTrue North Continuity GroupTrue North Continuity Group

[email protected]@aol.com 647-444-1844 647-444-1844

Coaching for Executives and Coaching for Executives and Management Teams mandated with Management Teams mandated with establishment and/or management of establishment and/or management of Business Continuity Management Business Continuity Management Programs and/or a portion thereofPrograms and/or a portion thereof

Strategy Development including needs Strategy Development including needs analysis, policy development, analysis, policy development, governance frameworkgovernance framework

Education and Awareness Program Education and Awareness Program development and delivery development and delivery

Business Impact and Risk Assessment Business Impact and Risk Assessment including how to leverage existing including how to leverage existing processes such as Risk and Control processes such as Risk and Control Self Assessment (RCSA) Self Assessment (RCSA) methodologiesmethodologies

Business Continuity Plan development Business Continuity Plan development and/or revision including internal tool and/or revision including internal tool development and/or external software development and/or external software assessments and selectionassessments and selection

Exercise/Testing Programs including Exercise/Testing Programs including methodology, development and methodology, development and facilitation (internal and/or external)facilitation (internal and/or external)

Maintenance Program including Maintenance Program including reporting (regulatory, governance, reporting (regulatory, governance, management), on-going program management), on-going program management methodology, audit management methodology, audit program integrationprogram integration

External annual assessment and review External annual assessment and review of Business Continuity Management of Business Continuity Management ProgramsPrograms

For additional information….

When the rubber hits the road will you be ready? PMI Lakeshore Chapter February 21, 2005 CAROL MOFFITT.

Documents

event management

real risks business

compliance slide

deliberate slide

service availability

carol moffitt slide

diversification increase

costs technology