Keep on Keepin On Arkansas Continuity of Operations Program

Transcription

1 Buiness Continuity Keep on Keepin On Arkansas Continuity of Operations Program Planning to continue critical operations in the event of a disaster should be as commonplace as securing insurance on buildings and equipment. Unfortunately, many state agencies fail to prepare for disasters. As the Gulf Coast hurricanes of 2005 demonstrated, the impact of unavailable critical government services can be devastating. In 2004, Arkansas Governor Mike Huckabee initiated a program to improve the readiness of state agencies to deal with debilitating disasters such as ice storms, tornados, earthquakes, and terrorist attacks. The program involved the development of disaster recovery plans and continuity of operations (COOP) plans for state agencies. This state level project was initiated by the Arkansas Office of Information Technology through a Homeland Security grant that supplied the software and hardware. The Arkansas Department of Information Systems and the Arkansas Department of Emergency Management donated staff and resources to support the project. The Arkansas Continuity of Operations Program (ACOOP) provides state agencies and constitutional offices a discipline and methodology to develop, test, and improve organizational disaster recovery and continuity of operations plans. State agencies use software to create a plan to enable them to continue their critical processes in the event of any disruptive incident. Plans also include evacuation plans, call lists and succession plans should agency leadership be unavailable during a disaster. The software not only stores the plans, but provides the ability to prepare hardcopy plans to be kept on hand by recovery team members 24/7. In the event of a disaster, the ACOOP database provides the Governor and other emergency management officials the opportunity to analyze all agency continuity of operations plans geographically in order to deploy state resources to aid those affected by the disaster. The database also contains information about agency processes and their interdependencies which allows the state to do other types of analysis to increase governmental efficiency. Governor Huckabee called for the creation of a committee to prioritize agency processes in state government for recovery purposes. This prioritization will direct agencies whose mission is to support other agencies to recover processes or

2 systems in a specific order. The committee intends to group the prioritized processes and recommend minimum recovery times. Since the Arkansas Continuity of Operations Project began, it has grown to involve over 650 users from 93 agencies, including constitutional offices outside the executive branch. County governments also are encouraged to participate in the ACOOP program. The software has the ability to combine county and state government plans in a specific geographic area. Few state governments have current, consistent, and coordinated continuity of operations plans. Fewer have the ability to combine plans within geographic areas allowing for more meaningful analysis in the event of a disaster. Through ACOOP, Arkansas has begun to recognize the value of developing and maintaining viable continuity of operations plans and has taken initial steps to ensure that Arkansas will be open for business when it is needed most. Concise description of the business problem and solution, including length of time in operation The impact of unavailable critical government services can be devastating: o Over 10,000 law enforcement officers protect our citizens by relying on up to the minute information provided by the Arkansas Crime Information Center o Almost 100,000 unemployment checks are issued monthly o On an annual basis, Arkansas Food Stamp Program processes 154,000 cases supporting approximately 600,000 citizens o 600,000 Arkansas citizens are recipients of Medicaid benefits yearly These are just a few of the many critical state services and benefits that, if interrupted, could make the difference between life and death. These services protect some of our most vulnerable citizens those who rely heavily on state services to survive! Although many of Arkansas agencies planned for the Y2K conversion, those plans were untested and outdated. By 2003, it was rare to find a state agency with a current organizational plan for continuity of operations. In June 2004, Governor Huckabee

3 addressed the critical need for continuity planning by asking all state agencies, boards and commissions to participate in the Arkansas Continuity of Operations Project. This state level project was initiated by the Office of Information Technology (OIT) through a Homeland Security grant that supplied the software and hardware. The webbased proprietary software is hosted on a web server and the plan information is stored in a SQL database on a data server. The software allows agencies to access and update their plans online without having the planning software on their machines and also has the ability to combine agency plans in a specific geographic area, such as a building or complex area. Disasters typically occur in a specific geographic area. The continuity planning application is maintained by the OIT and supported with software, hardware, and personnel donated by the Department of Information Systems and the Department of Emergency Management (ADEM). In addition to the software, OIT provides training for continuity plan development and methods of plan testing. Continuity of operations planning prepares agencies to respond to a wide range of incidents, from a minor water leak that temporarily limits access to work areas to major disasters that destroy facilities, equipment and even personnel. Today, government processes are increasingly dependent on information technology. A technology related disaster can have the same, if not greater, impact as a physical disaster. For example, a significant cyber infection or attack on the state s network could render large numbers of government computers unusable thus preventing state processes from continuing. In the first phase of establishing agency plans, OIT and ADEM guided agencies in conducting business impact assessments, which identify critical agency processes and determine the impact of the absence of those processes over time. Process dependencies were also identified, listing inputs required from other agencies and recognizing their own processes essential to other state and federal agencies. Agencies then moved to the disaster recovery planning phase which establishes plans for the recovery of agency processes with well-prepared recovery teams. Disaster recovery plans include: o agency personnel contact information o the location of backup equipment and records o contact information for vendors o lists of required equipment, supplies and software, and o the required order of tasks to recover processes.

4 The current phase of the project requires agencies to create continuity of operations plans which ensure the delivery of critical agency processes while the agency is recovering from a disaster. Disaster recovery plans are a subset of a COOP plan. Continuity of operations plans include: o alternate ways to deliver critical agency services o evacuation plans should an incident occur during business hours o alternate locations for recovery in the event the office is left inaccessible, and o succession plans for agency leadership positions if regular personnel are not able to participate in agency recovery. A successful element of the project is the partnership with the Emergency Administration and Management Degree program teaching staff at Arkansas Technical University (ATU) in Russellville, Arkansas, one of three universities in the nation offering a Bachelor of Science degree in this discipline. OIT employed interns from this degree area who, in turn, assisted OIT in instructing agencies in the discipline of planning by utilizing the ACOOP software. ATU is now using this identical software to teach COOP planning to their students. As students graduate with EAM degrees, they will have the benefit of knowing the state s software and will be attractive to state agencies as potential employees. Students from the ATU program are also available to state agencies as interns. As agencies formulated COOP plans, interagency communication was both crucial and beneficial. Through regular informational meetings, agencies shared and learned the best practices specific to state government. This essential knowledge encourages consistent behavior that will result in a more timely recovery. The open communication between agencies also highlighted the interdependency of state agencies. Significance to the improvement of the operation of government. There are many forces, including mandates, driving Arkansas state agencies to be prepared in the event of a disaster. The Department of Health and Human Services and other state agencies are required to have disaster recovery plans to be compliant with the Health Insurance Portability and Accountability Act (HIPAA). The Arkansas Division of Legislative Audit audits public organizations for the presence of disaster recovery plans that are kept current and tested periodically. The Arkansas Department of Emergency Management is seeking the Emergency Management Accreditation Program (EMAP) accreditation, which requires disaster recovery plans for agencies with first responder responsibilities. The Risk Management Division of the Arkansas Insurance Department emphasizes the importance of a plan of action to minimize risk of damage to

5 people and property. The presence of an agency s established, tested disaster recovery plan ensures a plan of action that, in turn, reduces insurance premiums for the State of Arkansas. In addition, the fact that all the agency plans are contained in one searchable database allows decision makers to identify government resources for deployment during a disaster. Geographic information system coordinates are being collected for each state government location to enable the ACOOP database elements to be viewed in relation with other data layers from the state s geographic information system database called Geostor. For example, state agency locations can be viewed in relation to area hospitals and schools. Agencies define the business processes that occur in their agencies as a part of their continuity of operations plan and this business process information has been utilized in other areas of state government for information technology planning. It is conceivable that the agency process information could be used in the development of a business architecture for the state. Benefits realized by service recipients, taxpayers, agency or state. In September 2005, Governor Huckabee called for the creation of a committee to prioritize agency processes in state government. When finalized, this prioritized list of agency processes will direct agencies whose mission is to support other agencies to recover processes or systems in a specific order. The committee has chosen to prioritize and recommend recovery time objectives for agency processes that support critical government services related to public safely, public health, the issuance of sustenance payments, revenue systems, and education. The committee will determine if agencies have the ability to recover these critical government processes within their recommended recovery time objectives and seek ways to find common recovery solutions for these processes to take advantage of economies of scale. Realized return on investment, short-term/long-term payback (include summary calculations). Funding from the Department of Homeland Security paid for the web server and software for the ACOOP project. The web server was $5,000 and the software was $195,000. If each agency developed plans individually, the cost for plan development would have been much higher and the plans would not have the capability to be combined in a manner that allowed for analysis. Typically, an organization with 500

6 people will pay a consultant around $50,000 to facilitate the creation of a disaster recovery/business continuity plan. The project relies solely on existing state personnel for plan creation and maintenance. The fact that state personnel maintain the plans makes the employees more aware of the plans and costs to hire contractors for plan maintenance are avoided. Agencies with continuity of operations plans are able to recover from a disaster faster than an unprepared agency. There is great value in government having the ability to provide critical services to its customers during a disaster. Through ACOOP, Arkansas will eventually have the ability to be open for business when it is needed most.