Strategy Development 1 Objectives n Examine strategy development

Strategy Development 1

Objectives n Examine strategy development n Examine factors used to select strategies n Identify specific strategies n Review strategy implementation. 2

Developing Strategies n A strategy is an approach used by an organization in order to treat risk to accomplish resiliency objectives. 3

Developing Strategies n Continuity strategies enhance the organization’s capability to respond to events in order to continue operations. n Recovery strategies enhance the organization’s capability to return to stable operations following an event. 4

Developing Strategies n Identify and select cost justified strategies n Crisis scenarios are useful n While developing strategies, focus on what needs to be accomplished n Divide activities into – business as usual for unaffected areas – recovery activities for affected areas n A mixture of strategies is selected. 5

Developing Strategies n For each critical function, the available strategies need to be evaluated. n The selection of a set of strategies depends on costs and benefits. 6

Developing Strategies n Must provide backup against all major events n Some strategies cover multiple events, and cover several operations 7

Developing Strategies n Management selects strategies by reviewing and rating various combinations of strategies n Evaluation criteria include: cost, service level provided, time to switch over, reliability and manageability 8

Developing Strategies n Assess the suitability of the strategies against the BIA n A detailed cost-benefit analysis may be useful 9

Developing Strategies n A strategy usually entails both one-time costs and recurring costs. n One time costs are determined for each component of a strategy and are annualized n One time costs include: the cost of facilities, site construction, equipment, computer hardware, furniture, air conditioners and staff and consulting required implementing the strategy. 10

Developing Strategies n Recurring costs include the costs of: renting/leasing, maintenance, contracted services, personnel, supplies and utilities. n The total annual cost is the sum of the annualized one time costs and the annualized recurring costs. 11

Developing Strategies n Quantifying the benefits of a strategy requires reviewing all the events for which the alternative provides some protection and estimating how it reduces the expected loss of each of these events. 12

Developing Strategies n For each alternative strategy, the losses resulting from the various events are estimated. n The service level provided under each strategy may impact these losses. 13

Developing Strategies n n Direct losses include asset losses such as computers, furniture and buildings, and financial losses such as fees, interest and compensation. Indirect losses include the loss of future and consequential damages or third party losses that would have to be paid. 14

Developing Strategies n n n The benefit of a strategy is the reduction of potential losses compared to the base case. The expected loss from an event is the product of the losses from that event and its probability. The net benefit of an alternative is obtained by subtracting the total annual cost of the alternative from its benefit. 15

Cost-Benefit Analysis n Event Impact – Extent – Duration n Fixed and variable cost of control – Set-up cost – Maintenance cost n Change in Expected Annual Loss – Reduce probability – Mitigate impact n Difficulties – Determining probabilities – Determining costs and losses 16

Developing Strategies n n n n Review business continuity objectives Identify potential strategies Assess strategies against the BIA Consolidate strategies across organization Determine advantages and disadvantages Conduct cost-benefit analysis Present findings to senior management 17

Developing Strategies n Establish parameters for BCM program n Review infrastructure required for operations n Assess level of business resources available n BC strategies are initially explored in the BIA n Document strategies in BCP with management approval 18

Planning Parameters n Facility requirements n Facility content requirements n Community infrastructure support services n Reliance on IT 19

Crisis Impact For the most important crisis events determined in the Risk Assessment and Business Impact Analysis consider: § § § Warning period Crisis area Life-safety hazard Environmental impact Asset damage Disruption 20

Resources Available n Alternate sites n Business continuity budget n Allocation to prevention and mitigation n Allocation to response 21

Selecting Strategies n Before selecting specific strategies, decide upon the strategic plan. n Planning Parameters n Crisis Impact n Resources Available 22

Business Continuity Strategies n Pre-crisis avoidance n Pre-crisis damage mitigation n Post-crisis business continuity n Post-crisis recovery strategies 23

Business Continuity Strategies n n n n Alternate Sites Backup Equipment Buffer Stock Bunker Approach Distributive Manufacturing Distributive Warehousing Insurance Manual Overrides 24

Business Continuity Strategies n n n n Maximize Work Hours Multiple Suppliers Reciprocal Agreements Outsourcing Personal Protection Equipment Portable Equipment Pre-Positioning Quick Re-Supply 25

Business Continuity Strategies n n n n Redundant Operations Remote-Site Storage Social Distancing Policies Subcontractors Temporary Structures Work from Client Location Work from Home 26

Vital materials should be backed up and retrievable. n n n n n Business continuity plans Software and data Procedures Agreements, contracts, leases Insurance policies Supplies, forms Plans, drawings, blueprints Keys, passwords Check books, credit cards, cash 27

Request for Proposal n n n Clarify assumptions Specify requirements Issue request for proposal Review submitted proposals Interview vendors Check references Tour sites Negotiate services and fees Get all agreements in writing Select vendors Award contracts 28

Contract Negotiation n n n Services and fees Technology Testing Exclusivity Declaration determination Liabilities Early termination 29

Conclusion n Selected strategies are driven by results of Business Impact Analysis Senior management approves Business Continuity strategies Forward-looking organizations are creating infrastructures resilient enough to reduce the impact of disasters 30