BUSINESS CONTINUITY PLANNING IN THE PUBLIC SECTOR

1
BUSINESS CONTINUITY PLANNING IN THE PUBLIC SECTOR

• Lessons Learned from the Events of September 11,
  2001 and Assessment of Progress
• NEW YORK STATE INSURANCE DEPARTMENT
• George E. Pataki, Governor
• Gregory V. Serio, Superintendent

2
BCP/COOP for Government

• Government as Provider of Essential Services
• Government as Managers of Public Emergencies
• Government as Regulator of Essential Industries
• Government as Business

3
BCP/COOP for Government

• Government as Victim of Emergencies

4
BCP/COOP for Government

• Government as Primary Source of Public
  Security in Times of Emergencies

5
BCP/COOP for Government

• Review of Events of September 11th
• Major emergency in highly-populated, highly
  valuable hub of commerce and industry
• Major emergency in densely-populated seats of
  local, state and federal government services
• Major emergency in unique/challenging geographic
  area (island, limited mobility in any direction,
  etc)
• Major emergency in concentrated network of
  critical utilities

6
BCP/COOP for Government

• Review of Events of September 11th
• Life Hazards and Economic Implications Primary
  Concerns
• Hundreds of Thousands Working or Residing in
  Affected Area
• Stock/Commodity Markets, Major Property and
  Health Insurers, Major Banks, International
  Financial Concerns, Depositories for Physical
  Assets All Impacted
• Financial Services Utilities Located Here

7
BCP/COOP for Government

• Review of Events of September 11th
• -Government Services Impacted
• NYC City Hall, Mayors Office, Police
  Department, OEM, Virtually Every Agency
• NYC FDNY HQ Protected in Brooklyn, But Agency
  Faces Largest Single Impact
• NYS Insurance, Banking, MTA, PA, OCA
• Feds Fed Reserve, FBI/Secret Service/Customs,
  Major (and Primary) Federal Presence for NY and
  Region

8
BCP/COOP for Government

• Review of Events of September 11th
• Geographic/Environmental Factors Exacerbate
  Impacts
• Surrounded by Water on Three Sides
• 17th Century Street System
• Limited Access Below Grade
• Narrow E/W/S Mobility Options

9
BCP/COOP for Government

• Review of Events of September 11th
• Major Hub of Utilities
• Electric, Gas and Water
• Telephone, Data, Video
• Transportation (Infrastructure, Assets,
  Management)
• Hospitals and Health Care

10
BCP/COOP for Government

• Review of Mindset on September 10th
• Inconceivability-of emergency of this type
• Invulnerability-to emergency of this type
• Independence-of agencies to one another in normal
  course of business
• Invariability-of government operations whether in
  routine or emergencies

11
BCP/COOP for Government

• Review of Mindset on September 10th
• Government Not Victim of Emergencies or Disasters
• Government Works to Assure Readiness of Public
  Assets and Private Organizations to Emergencies
• Government Responds (As Expected) to Publics
  Needs Regardless of Conditions or Locations of
  Emergencies
• Government Security

12
BCP/COOP for Government

• Lessons of September 11th
• Mindsets of September 10th No Longer Acceptable
• Government Prepares Itself for BCP/COOP in
  addition to Emergency Management
• Government Prepares Its Regulated and Critical
  Industries for BCP as well as Emergency
  Management
• Government Prepares Its Public for Expectations
  from Public and Private Parties
• GovernmentSecurity More Than Ever

13
BCP/COOP for Government

• September 10th Mindsets No Longer Valid
• Everything is Conceivable
• No One is Invulnerable
• Agencies Cannot Operate Independent of One
  Another and Must Share Responsibility for
  Exchanging Vital Information along Secure,
  Critical Pathways
• Government Must Maintain Orderly Flow of Business
  as It Responds to Internal or Localized
  Emergencies--No Closed for Repairs Sign

14
BCP/COOP for Government

• Government Prepares Itself for BCP/COOP
• Full Review of Disaster Planning Protocols
• Dual Role Responding to Disaster as Emergency
  Responder vs. Responding As Organization to
  Restore/Continue Normal Operations
• QuestionIs Agency Prepared to Continue
  Operations Necessary, eg Routine Matters, HRM,
  And Does It View Itself as Potential Victim?
• Critical Internal Infrastructure Assessment and
  Determination of Critical and Essential Functions
  Based on Established Maximum Time Frames for
  Restoration of Functions and Systems that Support
  the Functions

15
BCP/COOP for Government

• Preparing Critical and Regulated Businesses for
  BCP as well as Emergency Response
• Concept Organization Can Only Be Prepared to
  Respond to Emergencies for the Public If It Can
  Respond to Emergencies for Itself
• Government Responsible for Making Certain that
  Critical Industries Are Prepared to Stabilize and
  Respond
• Disaster Readiness and BCP Now Key Examination
  Issues

16
BCP/COOP for Government

• Government Must Prepare Its Public
• Expectation Management
• Public Education of Disaster Scenarios and
  Alternative Modes of Operations
• Leveraging Technology and Facilitating Publics
  Comfort With, Access to and Use of Technologies
• Partners and Stakeholders in Efforts to Prepare
  and Manage Public Expectations and Behaviors
• GovernmentSecurity the Bottom Line for Public

17
BCP/COOP for Government

• BCP/COOP Activities Now Established
  Component of Government SOPs
• Vulnerability Assessments of Major Pathways and
  Critical Systems in Govt Facilities, Regulated
  Parties and Critical Partners
• Critical Infrastructure Protection Protocols
  Established
• Critical Evaluations of Government Partnerships
  for System/Relationship-wide Security
• Public-Private Partnerships Identified,
  Established and Exercised

18
BCP/COOP for Government

• USFA What is CIP and Why Is It Important--
• Critical Infrastructure Protection pertains to
  the proactive activities for protecting critical
  infrastructures the people, physical entities,
  and cyber systems that are indispensably
  necessary.

19
BCP/COOP for Government

• USFAs Analytical Model for CIP
• Identifying Critical Infrastructures
• Determining the Threat
• Analyzing the Vulnerabilities
• Assessing Risk
• Applying Countermeasures

20
BCP/COOP for Government

• Technology Tools for BCP Progress
• Data Backup and Disaster Sites for Critical Data
• Data Multiple Access Points to Database
• Data Interface with Regulated Industry and Other
  Private-sector Partners
• Data Wireless and Portable Systems with Capacity
  for Continuity of Operations
• Data Substantial Increase in E-mail and
  Web-based Data and Message Transfer, thru Secured
  Lines and Password Protected Sites

21
BCP/COOP for Government

• Technology Tools for BCP Progress
• Telecommunications Hardline, wireless, satcom
• Telecommunications GETS Lines, Govt Priority
  Access and Restoration (Govt and Critical
  Industries)
• Telecommunications Low-tech Two-way Radio
  Systems and Two-way Paging Backups

22
BCP/COOP for Government

• New York Insurance Department
  A Case Study
• Profile
• Business Operations and Customer Bases
• Disaster Preparedness and Response
• Events of September 11th
• Post-September 11th Activities
• Highlights of BCP/COOP Activities
• Highlights of Changes to Disaster Planning Models

23
BCP/COOP for Government

• Department Employs Classic Model
  Functions--Busines
  s Risk Assessment-- Business Continuity Risk
  Assessment-- Business Continuity Plan w/ Asset
  Identification and Deployment

24
BCP/COOP for Government

• Empire Blue Cross--A Model for Public and Private
  Business Continuity Planning
• Smooth Transition After Complete HQ Destruction
• Personnel, Data/TeleCom Pathways Rerouted
• Senior Management Relocated
• Minimal Disruption of Processes, Minimal
  Disruption of Key Decision-making Activity,
  Minimal Loss of Data or Financial Assets

25
BCP/COOP for Government

• Action Steps
• Taken--Comprehensive Disaster/Business
  Continuity Plan Drafted
  
  --Re-evaluation, backup and Disaster Access
  to Critical Data
  --Electronic Mailbox for Information
  Delivery/Exchange with Regulated
  Industry --Satcom Assets Acquired
  --New, Larger IEOC
  Constructed --Fed
  Critical Infrastructure Protection Board
  and FBIIC Established

26
BCP/COOP for Government

• To Be Taken Fed/State/Local Vulnerability
  Assessment to be Completed Security
  Clearances for Smooth, Multi-layered
  Communications Secured
  Securing of Vital Data, Voice and Video
  Transmission Lines

27
BCP/COOP for Government

• Rule to Live By
  
  
  Prepare, Plan and Practice
  
  
  Richard Sheirer

28
BCP/COOP for Government

• Thank You.