Contingency Planning Methodology
II. Preparations
A. Have contingency planning team members participate in a contingency planning workshop.
The workshop is designed to familiarize contingency planning team(s) with the strategy, approach and tools involved with the Contingency Planning effort. Contact the Contingency Planning Task Force for more information on setting up a workshop.
Deliverables: Completion of a workshop on contingency planning.
B. Review the materials you received in the workshop to understand what is required to perform a contingency planning effort.
The materials due to you at the end of a workshop are:
- Completed Contingency Planning Forms
- Contingency planning database
The Contingency Planning Forms are made up of six (6) individual worksheet forms. Each form provides a place to record information about important entities involved in contingency planning. The information can be imported into the Contingency Planning Database and changed, replaced or deleted. The forms are provided as a working set of documentation that can be added later to the database and to provide you with a step by step process to conduct a business risk assessment.
The Contingency Planning Database is a tool for managing contingency plans as they relate to your business processes, systems, 3rd parties and more. The database allows you to record information about business processes and the systems, 3rdparties, interfaces and contingency plans so you get a more complete view of what could be affected . Keep in mind that is only a tool for managing contingency plans not one that develops or records complete contingency plans themselves.
Deliverables: Commitment to use and training in use of the Contingency Planning Database.
C. Meet with the business leader of the business unit to set expectations for the contingency planning project.
Business unit leaders are ultimately responsible for the business unit and its' proper preparation. This means that they will be responsible for approving the tasks laid out in the contingency planning project and will approve the implementation of the plans as required. Therefore, planning teams need to discuss what those leaders expect in terms of the following items.
- What business functions are to be included (and excluded)
- What resources you will be able to use to carry out your project plan(s)
- Required deadlines and project milestones
- Management procedures including status reporting
- A host of other issues unique to the environment of that business unit.
This step should also include a discussion of the role the business leader wishes to play in the project and any contingency plans developed by the team.
Deliverables: As with any business meeting, documented minutes, agreed upon expectations, action items and differences should be delivered at the end of the session.
D. Review project status to determine how the contingency planning project relates to the projects already in progress.
It is likely that much work has been done that can be garnished for the contingency planning project(s).
The key elements to review are who was involved in the compliance project(s), how is the project organized and what they are doing to make their respective units compliant. Many of the tasks, such as discovering all of the systems that a business unit depends upon, are common between the contingency planning project and the compliance (remediation and testing) project.
This documentation is also required to assess mitigating action as required by each individual contingency plan for each business function, system, interface and 3rd party requiring a plan.
Best Source: Contact the Program Office and project coordinators within each business unit.
Deliverables: Documentation of project work for each system, data interface and third party with a given business unit.
E. Meet with leader for organization to obtain valuable information.
A is a person designated to coordinate the compliance effort within one or more business units. Such a person will be able to provide the means to gather much of the information required for the contingency planning project.
Best Source: Contact the head of each business unit involved to identify leaders or coordinators for business units within your contingency planning business unit.
Other Possible Sources: The Program Office and individual project coordinators with each technical and business unit.
This task simply streamlines the information collection process required when building a contingency plan for a business unit. Having the information documented within the database makes documenting and managing contingency plans easier and faster. The Deliverables section below outlines how to document this information within the database and on the forms
The following is a list of the kind of information required during this process along with sources for that information.
1. An inventory of systems, electronic interfaces, embedded technologies, facilities and 3rd parties.
a. Systems and Electronic Interfaces
- IT System
Possible Sources: Operations Job Scheduling system, IT Security System, IT architectural schematics, IT organizational charts, etc.
- User Systems (Systems on key individual's PC or hand held devices)
Possible Sources: Directory listing on key individuals PC's, Office Secretaries purchase log, Fixed Asset listings, Network Management reports.
- Communications Systems
Possible Sources: Telecommunications Organization, Budget (depreciating items) Fixed Asset System, Facility Management Schematics,
- Embedded Systems and Process Controls
Possible Sources: Instrumentation/Electrical specialists, Shop floor inspections, Fixed Asset Systems, Budget (depreciating items), observe actual facilities for electronic equipment.
- Environmental and Facility Systems
Possible Sources: Facility Organization, Organizational Location listings, Security Systems, mailroom, etc.
b. 3rd Parties (e.g. suppliers, key customers, business partners, any outside party that your business unit is dependent upon):
- Suppliers
Possible Sources: Accounts Payable Systems, CFO's office, Purchasing Office, Contract Negotiations Office, etc.
- Key Customers
Possible Sources: Marketing organization, Accounts Receivables, CFO's office, Purchasing Office, Contract Negotiations Office, etc.
- Telecommunication Services
Possible Sources: Same as above plus IT systems organizations
- Outsourced Systems (IT, User, etc)
Possible Sources: Same as above
- Regulators (Local, State, Federal, International)
Possible Sources: Legal and Audit organizations, Industrial publications for industry, Internet and local library resources
- Facilities and Travel (Local, National & Abroad)
Possible Sources: Facility Organization, Organizational Location listings, Security Systems, Mail Room, local, state and national agencies, Contract Negotiations Organization (contracted with travel agents)
2. Identification of the key individuals and organizations involved with the project. It is likely that the same people and support organizations involved with your projects will be included in contingency planning.
3. Identification of constraints such as deadlines, resource conflicts and availability and finances that could affect your contingency planning project and any contingency plans you choose to develop.
4. Identify any report, database or person that can cross-reference how the items in step 1 (above) relate to one another.
Deliverables: The contingency planning forms and database allow you to record information about systems, interfaces and 3rd parties to consolidate this information.
Document findings as follows:
Systems & Embedded Technologies
Forms: Open the System Inventory Data Collection Form word document and record system information.
Database: Open the Access database named Contplan.mdb, click on the 'Systems Form' and record your system information. At this time you do not need to fill out the relationship tables on this form.
Data Interfaces
Forms: Open the Interface Data Collection Form and record your interface information.
Database: Open the Access database named Contplan.mdb, click on the 'Interfaces Form' and record your interface information. At this time you do not need to fill out the relationship tables on this form
3rd Parties (suppliers, customers, business partners, etc.)
Form: Open the 3rd Party Data Collection Form and record 3rd party information.
Database: Open the Access database named Contplan.mdb, click on the '3rd Party Form' and record your 3rd party information. At this time you do not need to fill out the relationship tables on this form.
F. Identify business functions that each business unit depends on, including immediate upstream and downstream functions.
Business functions are those activities or circumstances necessary to conduct the business (e.g. delivering raw materials, paying bills, receiving cash, discharging waste). See the previous Section I for a more complete definition of business units and functions.
Document the business functions that each business unit uses to accomplish its purpose. Some more complex business functions may require breaking these into smaller units of work (also called a business process), while smaller functions are self contained enough to merit no further breakdown.
The workbook and tools involved with this approach only allow you to define two levels of business classes (units and functions). This design prevents most people from spending too much time defining their business unit's responsibilities. Should you need to define your business processes at a deeper level, document them within your contingency planning forms and database as needed.
Having every business unit document all of the business functions that they depend upon allows the Contingency Task Force to isolate common contingency planning plans for shared functions. These include infrastructure functions, such as transportation, energy and telecommunications, corporate functions, such as employee benefits, and other enterprise-wide business dependencies. Planning teams should identify these functions so that their business unit is kept informed of any shared contingency plans developed centrally.
Define how you want to divide business functions in terms of business processes and record the following information:
- A unique identification number assigned to each business function. Note that the database tool does not allow duplicates, so each business function requires a unique number.
- A name for each business function. If common names already exist, use them.
- The name, contact phone number, address and email address of the person in charge of the business function.
- The criticality of the business function will be determined in a later step. Ignore this field for now.
How to record:
- Forms:
Open the Business Function Data Collection and record your business function information. - Database:
Open the Access database named Contplan.mdb, Click on the 'Business Function Form' and record your business function information.
Best Source: Sources include Program Office, the business unit leader and management team, office assistants, organization charts, annual reports and process control systems.
Other Possible Sources: Also check existing business function inventories, organizational charts, annual reports, company phone books, historical documents involving large projects, etc. See Appendix D for further ideas.
Deliverables: A list of business processes recorded on the planning forms and database.
G. Determine which business functions already have identified risks and contingency plans for potential problems.
Many business units have existing contingency plans due to other potential hazards such as a loss of power, environmental threats, etc. Determine if your business unit has such contingency plans.
Best Source: The business unit's leader and management team for that business unit.
Deliverables: Source of these plans. If a business unit does have existing contingency plans, analysts will want to know how to obtain them for review in a later task.
H. Determine the business functions that have already organized Crisis Management Teams and have established procedures for potential problems.
Many business units have existing Emergency Response Teams due to other potential hazards such as a loss of power, environmental threats, etc. Determine if your business unit has such Emergency Response Teams.
Best Source: The business unit's management team for that unit.
Deliverables: Source of these plans. If a business unit does have existing Emergency Response Teams analysts will want to know how to obtain any information describing the roles, responsibilities and team members for review in a later task.
I. Review the availability of the resources (i.e. cash, capital, staff, etc.) required to complete the contingency planning project.
By now you have collected quite a bit of information from which you can better estimate what is required (staff, time, etc.) to complete a contingency planning project(s) for a business unit. Discuss these needs with the business unit management.
Best Source: The business unit's management team for that business unit.
Deliverables: List of project support requirements including staff and funding.
J. Review and monitor how other contingency planning projects are succeeding by obtaining available publications and media services.
As time permits, discover what others internally and externally are doing in regards to their contingency planning.
Best Source: Program Office.
Other Possible Sources: The Internet, books, user groups such as the API, government agencies, publications, seminars, etc.
Deliverables: List of external sources of data.
K. Resolve Critical Deficiencies, Issues or Concerns.
Now is the time to address any of the critical deficiencies, issues and concerns found while preparing for the contingency planning project(s).
Best Source: Approaching management with a list of requirements and resolving them accordingly.
Deliverables: Resolutions for all critical deficiencies, issues and concerns.