Aiming to be a More Resilient Campus
Business continuity planning is a university-wide initiative to ensure that ÐÇ¿Õ´«Ã½ will be prepared to resume operations with efficiency in the event of a crisis. Business continuity, a critical component in establishing a resilient university, is the capacity to resume business functions, academic instruction and research activities shortly following a disruptive event. These disruptions could come in the form of natural or manmade catastrophes, large or small.
In the event of a crisis situation, ÐÇ¿Õ´«Ã½â€™s Emergency Management program will direct response efforts, prioritizing the safety and welfare of the campus community. While order is being restored to operational levels across campus, IT will activate their Disaster Recovery plan. Disaster Recovery planning hones in on IT procedures to ensure that vital IT function is unimpeded and essential telecommunications, applications and systems continue to be accessible for the campus community.
Meanwhile, the intention of the Business Continuity Plan is to focus on carrying on operations to support the mission of the university– scholarship, research and service – despite crises of varying magnitude.
Engaging the Entire Campus
Business continuity planning will require the participation and support of all ÐÇ¿Õ´«Ã½ administrative, academic and research-oriented business units. These business units and academic colleges will be engaged in the plan development process by mapping out critical processes and prioritizing resumption and recovery activities in the aftermath of a crisis event.
In collaboration with the university’s Business Continuity manager, departments will identify resources needed to carry on operations essential to the university’s mission.
Business units or departments will nominate a continuity coordinator who will engage both with the department and the business continuity manager. The coordinator will be a liaison to educate colleagues and provide updates on the university business continuity program. Additionally, the coordinator's chief function will be to manage the process of compiling the plan components as they are determined by the business unit.
Vision
Promote organizational resilience at ÐÇ¿Õ´«Ã½ with comprehensive planning, preparedness and collaboration.
Mission
Through the systematic development of a Business Continuity Plan, ÐÇ¿Õ´«Ã½â€™s plan will safeguard the continuity of research and scholarship for our university community’s critical operations within a reasonable period of time.
Values
- Restore essential university operations while keeping safety and security paramount.
- Foster a collaborative and consultative relationship with departments and business units in the plan creation process to ensure a realistic and functional plan.
- Maintain integrity and transparency when drafting the plan to meet the diverse needs of the university community.
- Learn from and share best practices of any one department, business unit or college with others, in order to build a more thorough, congruent Business Continuity Plan.
- Treat the plan as a living document – it will grow and evolve over time with testing and process refinement
Business Impact Analysis
Completing a Business Impact Analysis (BIA) is a fundamental planning exercise for all departments as they begin to think about business continuity. The intention of the BIA is to identify all processes that pass through your area, prioritize those processes that are critical to supporting the university’s mission, and determine all resources needed to ensure process completion. That includes employees, vendors, supplies, equipment, systems, applications.
When completing a BIA, assume the worst case scenario of a university outage for an extended period of time at peak time of year. This outage could entail loss of personnel and could impact a single or multiple campus facilities. The circumstances and university response may differ depending on when the crisis occurs during the academic year.
Training
For an introduction on the purpose of the BIA, and training on how to complete it, please contact the Business Continuity Manager at publicsafety@case.edu. You will schedule a time to address your business unit and help with identifying critical processes, resources, impacts and any potential gaps.
Once your BIA has been completed, the Business Continuity Manager will continue to be the contact for your department’s business continuity representative(s) and will provide ongoing support and oversight of the plan development process.
Planning Considerations
Developing a Business Continuity Plan is an interdisciplinary exercise. Collaboration across and within departments will be critical to building a sustainable, meaningful and robust plan. Rather than simply engaging in your own business area, reach out to other dependent and partner organizations. Here are some questions to consider in this process:
- What critical services does your department provide?
- What work can be done in the event of a loss of a building? How about with the loss of personnel? How about in the event of loss of network connectivity?
- Are any employees cross-trained to manage multiple functions, if needed?
- Does your department have any manual or back-up processes in the event of a technical failure?
- Have all employees been trained in these backup processes?
- Does your department have an updated contact list? Is it available offline?
- What special equipment, access or system requirements does your department need to function? This includes laptops, desktops, work space, network access, laboratory equipment, machinery.
- Identify upstream and downstream dependencies.
Understanding Dependencies
Upstream: The failure of another process, system, unit or equipment that would have a negative impact on your department’s function.
Downstream: The failure of your department’s process, system, unit, or equipment that would have a negative impact on another department’s function.
| Key Terms | Definition |
|---|---|
| Asset | Anything that has value to the university. This could include physical assets, such as plant and equipment, as well as intellectual property, human resources, goodwill and even reputation. |
| Backlog | An accumulation of work tasks that remains incomplete as the result of a system or application being unavailable for a period of time. Account for the backlog of work when assessing resources (i.e. time, staff and materials) necessary in resuming business operations. |
| Backup | A process by which both electronic and paper data is duplicated in some form so as to be available and usable if the original data is lost, destroyed or corrupted. |
| Business Continuity (BC) | The strategic capability of our university to plan for and respond to unplanned outages and business disruptions, in order to continue delivering our university mission at acceptable levels. |
| Business Continuity Manager | University employee responsible for ÐÇ¿Õ´«Ã½ Business Continuity program, who works with departments to create plans to keep ÐÇ¿Õ´«Ã½ functioning after a disruptive event. |
| Business Continuity Plan (BCP) | A dynamic collection of documented procedures and operational guidelines developed by individual business units. These plans are maintained in the event of a business disruption. The intent of the plan is to enable the university to respond in such a manner that critical business functions would resume with minimal constraints. |
| Business function | Work or processes performed to achieve specific requirements of the university. Examples would be purchasing supplies, processing invoices, managing cash, interviewing prospective employees, conducting research, providing training, etc. |
| Business Impact Analysis (BIA) | The process of identifying business functions and the impact a business disruption could have on both the function itself and the university at large. |
| Business unit | A department or unit within the university. |
| Campus Incident Management Team (CIMT) | At ÐÇ¿Õ´«Ã½, the CIMT’s role is to provide strategic guidance to support on-scene incident management activities, coordinate decision making and resource allocation among cooperating departments and external partners, establish the priorities among incidents, and harmonize university policies. |
| Compliance | Upholding the highest ethical and professional standards of conduct, intending to operate in full accordance with all applicable laws and policies. Reference the university Compliance Program for specific details. |
| Contact list | List of all critical contacts, such as campus contacts, employees, critical vendors. |
| Continuity of Operations Plan (COOP) | While very similar to a Business Continuity Plan, a COOP is used mainly in the context of government or military agencies. |
| Crisis | An aberration or event that threatens the university operations, its students, staff, and visitors. |
| Critical | A term to describe the importance of an operational process or resource that must be made available at the earliest possible opportunity after an incident or business disruption. |
| Critical activities | Activities which must be performed in order to deliver key services and products to enable the university to meet its most important and time-sensitive objectives. |
| Critical business function | A business function that is vital to the university; without it the university will either dysfunction or lose the capability to effectively achieve its critical objectives. |
| Dependency | The reliance, directly or indirectly, of one activity or process upon another. Dependencies could be with either internal or external parties. |
| Disaster | A serious or sudden event, such as an accident or natural catastrophe that causes great damage, injury or loss and disrupts the university’s ability to carry on its critical business functions. |
| Disaster Recovery (DR) | The ability of the university to provide critical Information Technology (IT) and telecommunications capabilities and services, after a disruption caused by emergency, incident or disaster. |
| Disruption | An event that interrupts any normal business functions, operations or processes. Disruptions may be anticipated (i.e. hurricane, political unrest, planned outage) or unanticipated (such as terror attack, technology failure, earthquake) |
| Document | Any medium containing information – paper or electronic. |
| Downtime | A period of time when something is not in operation, or has been shut down, either planned or unexpectedly. |
| Emergency | An emergency is a serious, unexpected, and often dangerous situation requiring immediate action and response. |
| Emergency Management (EM) | Efforts by ÐÇ¿Õ´«Ã½ and the Office of Emergency Management team to prepare for, protect against, mitigate the effects of and recover from natural or man-made disasters or acts of terrorism. The Office of EM works in collaboration with police, campus security, environmental health and safety, university communications and other campus management centers. |
| Emergency Operations Center (EOC) | The central command and control facility responsible for carrying out the principles of emergency management. The staff at the EOC, the Operations, and Policy Groups, is responsible for making operational decisions, gathering, analyzing data, making decisions protecting life and property, disseminating decisions and information to all concerned agencies and individuals. |
| Emergency Operations Group | This group is comprised of key leadership from department or business units that have a direct role in emergency response activity on campus. Their responsibilities include liaise with on-scene incident command; mobilize, coordinate and direct campus emergency response resources; support emergency procurement of supplies and equipment etc. Reference the ÐÇ¿Õ´«Ã½ Emergency Response Framework for more information. |
| Emergency Response Framework (ERF) | At ÐÇ¿Õ´«Ã½, a reference document detailing how the university’s core decision makers will respond to a crisis of any magnitude. The framework identifies principals, personnel, roles, resources, structure and partners that provide for an integrated, flexible, efficient university response. |
| Essential services | Infrastructure services without which a building or area would be considered disabled and unable to provide normal operating services; includes utilities (electricity, water, gas, steam, telecommunications), and may also include standby power systems or environmental control systems. |
| Event | Occurrence or change of a particular set of circumstances. See “Incident†|
| Exercise | Rehearsal of the roles of team members and staff, testing the recovery or continuity of an organization’s systems (i.e. technology, telephony, administration) to demonstrate business continuity competence and capability. |
| Facility | Any infrastructure or plant and related systems that have a specific function or service on campus. |
| Financial impact | Expenses undertaken following a business interruption or disaster which cannot be offset by income, and directly affects the university’s financial position. |
| First responder | A member of an emergency service who is first on the scene at a disruptive incident. |
| Hazard | A danger or risk leading to an unwanted incident, which may result in harm to individuals, assets, systems or organization, the environment or community. |
| Hot site | A facility equipped with fully synchronized technical requirements including IT, telecom and infrastructure, which can be used to provide rapid recovery and resumption of operations. |
| Incident | An event that has the capacity to lead to a loss of business or disruption to an organization’s normal operations, services or functions, and if mishandled, could escalate to an emergency, crisis or disaster. |
| Incident Command System (ICS) | A standardized, on-scene, all-hazards incident management approach, operating within a common organizational structure. It is designed to aid in the management of resources during incidents. |
| Organization | A group of people and facilities with an arrangement of responsibilities, authorities and relationships (i.e. company, university, firm, enterprise, institution, etc.) An organization can be public, private or non-profit. |
| Phone tree | A pre-determined, tiered telecommunication chain that enables a list of persons to be notified of an incident. Phone trees (or call trees) can only be successful if employee contact information is up-to-date and multiple contact options are provided. |
| Policy Group | The ÐÇ¿Õ´«Ã½ Policy Group is made of senior leadership personnel with authority to make broad-based policy decisions for the entire university during a crisis. Responsibilities of the Policy Group mirror those of the Office of the President and senior leadership including: setting broad, strategic goals for the entire campus incident management team; making decisions about closures and associated timelines; continuing of academic operations and decisions regarding instruction; liaising with and addressing concerns of the Board of Trustees. Reference the ÐÇ¿Õ´«Ã½ Emergency Response Framework for more information. |
| Process | A series of interrelated actions taken to reach an identified goal. |
| Record | A collection of documented information, regardless of characteristics, media, physical form, or the manner it is recorded or stored. Generally speaking, records provide evidence of activities (whereas documents provide evidence of intentions). |
| Recovery point objective (RPO) | The ability of your systems to recover data in the event of failure and the maximum tolerable period of time in which data might be lost. Determining the RPO allows administrators to determine the minimum frequency for which data back-ups would be required. |
| Recovery strategies | The methodology employed by the university to restore critical operations and systems to their normal status following a disaster. Recovery strategies could include:
|
| Recovery time objective (RTO) | The maximum time allowed between an outage and resumption of normal operations. |
| Sub-process | One or more tasks that accomplish a significant portion of a process. |
Frequently Asked Questions
In the event of any disruption on campus or in Cleveland, ÐÇ¿Õ´«Ã½â€™s administrative, academic and research operations will be momentarily paused until the emergency situation has been addressed. The Emergency Response Framework has been designed to focus on the mitigation of immediate safety hazards.
Any prolonged disruption could have a dual impact on the University. Primarily, student instruction might be impeded and research initiatives may stall while order and safety is assured on the campus. The secondary impact, however, is a more subtle, long-term concern; the University might experience student attrition and the loss of faculty to other institutions. ÐÇ¿Õ´«Ã½â€™s response to and recovery from a disruptive event could also color its reputation and public image. Therefore, an organized, efficient course of action to restore operations will be of utmost importance.
While restoration efforts to bring ÐÇ¿Õ´«Ã½ to a normal state may occur in stages, based upon the type of incident, the University will prioritize the resumption of core academics and major research projects.
Emergency management at ÐÇ¿Õ´«Ã½ is focused on planning for and coordinating the response to mitigate and recover from a natural or man-made disaster situation. The safety and welfare of the campus community -- students, faculty, staff and visitors – are paramount, and emergency responders are responsible for addressing immediate life safety concerns.
Meanwhile, business continuity is ÐÇ¿Õ´«Ã½â€™s capability of carrying on essential university academic, research and administrative operations. In essence, business continuity bridges emergency response and normal operations.
Disaster Recovery focuses on the continuation of information technology services and systems. This includes critical applications and telecommunications. ÐÇ¿Õ´«Ã½â€™s Information Technology Services (ITS) has developed a stand-alone Disaster Recovery Plan that is not included in ÐÇ¿Õ´«Ã½â€™s business continuity program. The two plans are designed to work in alignment, rather than one supersede another.
A Business Continuity Plan for your academic college, department or business unit will account for details related to the following:
- Basic departmental information:
- Location
- Contact numbers
- Contact list (or location of list), phone tree
- Departmental Chain of Command
- Mission Critical Functions
- Recovery time frames
- Primary responsible staff
- Resource Inventory
- Employees
- Workstation requirements – computers, phones, printers, etc.
- Special equipment
- Special forms required
- Data recovery information
- Critical Vendor Contact Information
Business functions are defined as work or processes performed to achieve specific requirements of the University. Examples would be purchasing supplies, processing invoices, managing cash, interviewing prospective employees, conducting research, providing training, etc.
Critical or essential business functions are defined as a business functions that is vital to the University – without it, the University will either dysfunction or lose the capability to effectively achieve its critical objectives.
The interruption of critical business functions may have a serious impact on your college, department, business unit or the University at large. Some of your critical business functions may be temporarily halted as your department recovers from the disruptive event; if this is the case, identify the time frame in which the function must be back on schedule.
The extended suspension of a critical business function (or shared services) could have a ripple effect on affiliate departments, so consult your business partners when drafting your plan. Consider the impact that deferring any of your critical business functions might have on others.
Critical business functions:
- Support the primary mission statement
- Support other agencies’ mission critical function
- Must be recovered quickly
- Have a high dollar impact on the University
- Have a high business impact
- Have widespread public ramifications or implications
- Have legal or compliance requirements / liabilities
Business continuity planning is a campus-wide initiative and will engage all ÐÇ¿Õ´«Ã½ administrative, academic and research-oriented departments and business units. This encompasses all colleges and schools, departments, and other units that conduct teaching, research or public service. Any other units that provide essential support or infrastructure to these units should also develop business continuity plans. Meanwhile, the University administrative leadership will develop an over-arching strategy to provide general guidance as to how they will deploy the Business Continuity program at time of incident.
A BIA is a tool to help your department understand the effect of an interruption on your regular operations and critical business functions. This is a departmental exercise where employees outline processes and prioritize them based on urgency to fulfilling the department’s mission.
Yes, preferably a staff or faculty member who has access to senior level management. This will be a part-time responsibility for the coordinator, but their role will be part facilitator, part project manager. The BC coordinator in your department or division will administer the plan inputs and any updates, with support from the ÐÇ¿Õ´«Ã½ Business Continuity Manager.
In essence, all levels of the department, school or business unit will be involved in the planning process. The dialogue around business continuity should circulate among upper and middle managers, associate and assistant deans, key functional managers, building coordinators and other support staff. Planning groups should be relatively small in size and interdisciplinary in order to cover process dependencies.
The time frame to complete a plan will depend on the individual department and the essential business processes they perform. However, the process in total need not take more than one quarter of the year. Longer time frames do not necessarily produce better plans. Since departments and business units will be provided with plan templates, completing the Business Impact Analysis will likely be the most time consuming portion of the planning process, while writing the plan itself will be the shortest.
The ÐÇ¿Õ´«Ã½ Business Continuity Program adopts an all-hazards approach; most disruptive events (weather-related catastrophes, human disasters, pandemic, etc.) will impact the University’s ability to function in similar ways. Essentially, they will temporarily impede normal operations and access to resources regularly utilized, including:
- Facilities and space (classrooms, offices, labs)
- Infrastructure (power, sewer, water, network connectivity and VOIP)
- People (staff and faculty)
- Equipment (computers, special machinery/devices)
- Funds (income stream)
Planning strategy should focus on:
- Identifying critical resources
- Safeguarding these resources against loss – backing up data, systems, safe storage of research materials and proprietary data
- Actions that could help mitigate the impact of losses
- Replacing resources quickly (backup supplies, contracts with same or alternate vendors)
- Performing essential business functions without traditional resources (working from home, distance learning technology, cross-trained employees, sharing facilities with unaffected areas)
- Providing information to the impacted community with information and updates, post-disaster
Here are some reasonable assumptions:
- Access to buildings: If campus officials have any reason to suspect that a building is hazardous to enter, the building will not be open or accessible. You may be unable to access your office, lab, classroom or residential building for an extended period of time until all hazards have been removed.
- Locating temporary space: Any advanced arrangements that you can make within your own divisions to share office or lab space would be to your benefit. In the event that your space has been damaged or is inaccessible, ÐÇ¿Õ´«Ã½ leadership will make every effort to secure temporary, alternate locations for your work to continue. If the circumstances result in a campus-wide closure, reassignment and temporary workspace planning will be evaluated accordingly.
- Computing infrastructure: The University Technology [U]Tech Disaster Recovery Plan focuses on the restoration of critical centrally-supported IT applications. Resumption of network connectivity will be of highest priority after any disruption. Within your own units, we strongly encourage that you take steps to back up your data and develop plans on recovering your individual servers and applications.
- Communications protocol: Communications with the campus community -- students, faculty, staff and the public – will be managed by University Marketing and Communications to ensure consistency and clarity of messaging. As functionality is restored to your specific area, internal communications will be handled by your departmental leadership. Develop a communications strategy for your department or division, including updated contact lists and phone trees.
- Employee welfare: Personnel-related issues may arise during a disaster or disruptive event regarding payroll, temporary leave, benefits, temporary reassignments, work-from-home, layoffs, family issues, etc. As Human Resources (HR) cannot develop universal policies to cover any and all extenuating circumstances, HR will be available to provide guidance to assist departments in these complex areas. Should your department have any specific concerns for HR, seek counsel in advance of any disaster.