RE: Business Continuity Plan

[mlist -at- safenet-inc -dot- com]

You'd write a Business Continuity Plan for a small company.
For a larger company, you'd get the various departments and 
business units to prepare their own, under guidance, and 
then you'd compile the results into the "global" plan.

I was part of the effort at Ericsson, in Montreal, in the 
mid-nineties. Each major department or group was broken 
down into sub-groups and, based on business and customer 
requirements, we evaluated what we/they would need in order 
to provide service during/after a disaster. My area to 
plan and document was TAC, the Technical Assistance Center 
that served our customers worldwide. Since we dealt with 
communications systems, notably cellular, that meant 
about half the North American cellular system at the time, 
including aspects of 911 and emergency services communications.

The plan excluded many areas as not being critical, including 
some functions performed by groups that were themselves 
deemed critical. The TAC stuff was uniformly highest priority.
We, the company, decided that we could always delay our 
development and marketing and training and other functions, 
but we could not tolerate the unavailability of customer 
support. So, IT department had equally high priority in 
the short term.

The plan detailed how we should react to a disaster, with 
alternate "command" structures (based on who'd been killed...), 
including a multi-week plan to get back to full function.
We had to specify different scenarios and sub-scenarios 
depending upon localized disasters (fire, explosion, etc.) 
and widespread disasters (floods, earthquakes, war, etc.) 
and personnel disasters (basically epidemics). 

We had to specify what we could and should attempt to 
protect/recover/reclaim on-site versus what functions 
should be offloaded to remote offices. Based on those 
choices, we had to make reciprocal agreements with those 
remote offices and, in several cases, arrange for those 
offices to have additional, surplus capability, so that 
they could realistically handle what they'd be asked to do.

Interestingly, this meant that *we* had to plan for 
how we'd re-allocate our own personnel and resources 
if we had to take on the functions of other offices 
that suffered disasters.

What was critical was to reduce decision-making to as 
simple and straight-forward a process as possible...
we also had to store the checklists (for helping make 
those decisions) offsite, in case the building wasn't 
there for our managers to walk in and pick up the 
clipboards... :-)

We went so far as to go through some "talking" 
exercises and even one major walk-through, based upon 
scenarios. We picked our major physical disaster scenario 
when a couple of us noticed that large propane trucks 
drove past our front window every day and entered the 
expressway just in front of our building. That was an 
expressway that suffered frequent accidents. We calculated 
how much of the building was likely to be destroyed when 
the propane truck exploded against another vehicle and 
concrete. We picked a time of day for the event, and 
worked out, from there, which personnel would likely be 
on-site and thus killed or injured. Whole departments 
were told that they were dead and could not work. Other 
groups had to pick up their functions, if deemed necessary, 
and carry on.

Ericsson already had a lot of information and functions 
on mainframes that were mirrored around the world, so 
that lessened our requirements for "leasing" serverspace 
at our alternate locations.

Even the HR department had important duties. Initially, 
there was the task of identifying the living and the 
dead, having contact info available for personnel, as 
well as next-of-kin info where necessary. In the longer 
term, they were tasked with making grief counselling 
and other psych services available to staff who remained, 
so that they could carry on effectively.

Based on our talk-throughs and the big walk-through, we 
adjusted the draft plan at several levels. The last of 
that finished in mid-late 1997. Some of you may recall 
Ice-Storm '98 (tm) that devastated a big chunk of Quebec, 
Eastern Ontario and parts of northeastern States.

The Biz-Cont Plan was put to the test only a few months 
after it was signed off. It immediately revealed a number 
of flaws, including the fact that we hadn't thought to 
anticipate a slow-motion disaster. The ice storm started 
on a weekend, but we didn't finally declare disaster until 
the following Thursday, by which time it had become 
impossible to ship key personnel out to Toronto, Richardson, 
and other buddy sites. Airports were closed. Trains were 
shut down. Bus lines were not running. Many roads were 
closed.  We actually managed to sneak a few people out 
to the US using 4x4 vehicles, but we should have recognized 
the seriousness of the situation and made the call about 
four days earlier.

At the time, hundreds of our own personnel and their 
families were living at the office because we had a 
generator system, heat, running water (even showers!).
There were cots all over the place, whole families 
and multiple familes living in conference rooms, for many 
many days after the weather cleared (and the temperatures 
plummeted...), because there was no power or phone service 
to their homes (and thus no heat in most cases... electric 
heating is big in Quebec). No heat or power meant no water 
as pipes froze or wells were inaccessible.

After it all cleared up, we adjusted the Biz-Cont Plan 
yet again, to put more emphasis on the criteria for 
actually declaring a disaster. We had to take into 
account the kind of incremental disaster that sorta 
sneaks up on you while you cope with incremental aspects 
that keep you from seeing the forest for the trees.
We also thought that that revised emphasis would be 
important in a health/epidemic scenario, where everybody 
wouldn't sicken and/or die at once (unless, as we remarked, 
we all got e-coli at the company picnic...), but the
numbers of the incapacitated would ramp up over days or 
weeks.

We wrote in some more triggering criteria that would get 
the disaster/Biz-Cont plan launched, and we filled in a 
lot of other holes that we'd discovered.  Still, we were 
very glad to have the overall plan in place. It really 
helped to focus minds and to ease decisions at every 
step, and to get people back on track when they were 
frazzled and exhausted.

Kevin (in Ottawa and away from Montreal and Ericsson more 
        than six years now)

--

The information contained in this electronic mail transmission may be
privileged and confidential, and therefore, protected from disclosure. If
you have received this communication in error, please notify us immediately
by replying to this message, and then  delete it from your computer without
copying or disclosing it.



^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

ROBOHELP X5: Featuring Word 2003 support, Content Management, Multi-Author
support, PDF and XML support and much more!
TRY IT TODAY at http://www.macromedia.com/go/techwrl

WEBWORKS FINALDRAFT: New! Document review system for Word and FrameMaker
authors. Automatic browser-based drafts with unlimited reviewers. Full
online discussions -- no Web server needed! http://www.webworks.com/techwr-l 

---
You are currently subscribed to techwr-l as:
archiver -at- techwr-l -dot- com
To unsubscribe send a blank email to leave-techwr-l-obscured -at- lists -dot- techwr-l -dot- com
Send administrative questions to lisa -at- techwr-l -dot- com -dot-  Visit
http://www.techwr-l.com/techwhirl/ for more resources and info.