Federal Continuity of Operations

Transcription

1 A WHITE PAPER Federal Cntinuity f Operatins Part 7 f 10: Emergency Cmmunicatins Planning Tpic Summary: Prpsed Emergency Cmmunicatins lifecycle and guidance frm federal plicies Management structures t supprt Emergency Cmmunicatins Facilities supprt fr mass ntificatins and mbile ptins Stakehlder supprt, especially emplyees and their families Summary and Recmmendatins fr next steps

2 Table f Cntents 1.0 Intrductin The Emergency Cmmunicatins Cycle Guidance (Plicies and Prcesses) Management Structures Facilities and Mbility Supprt Stakehlder Integratin Training and Exercise Cncluding Remarks Summary Recmmendatins Next Steps... 8 Appendix A: Acrnyms and Abbreviatins... 9 Abut the Authr... Errr! Bkmark nt defined. Reference List Illustratin Index Figure 1: Prpsed Emergency Cmmunicatins Lifecycle... 1 Figure 2: Emergency Management Structures per FEMA Table Index Table 1: Recmmendatins... 7 Fitsi_FederalCp_07.dc Page i

3 1.0 Intrductin Within the federal gvernment and Department f Defense (DOD), sund and effective emergency cmmunicatins capabilities receive tp pririty fr guiding an rganizatin s respnse t a crisis. This paper, the seventh in a series f ten analyzing Cntinuity f Operatins (COOP) and using a small Army Prgram as a use case, examines the rle f emergency cmmunicatins in respnding t and minimizing the impact f a declared emergency situatin. This paper uses guidance frm the cmmercial, federal, and DOD spaces t prpse a cmmn emergency cmmunicatins lifecycle cnsisting f management structures, facilities supprt, mbility supprt, and stakehlder invlvement; all undergirded by frmal plicies and prcedures, and furthermre enabled via training and exercise. Specific recmmendatins adapted t the Army Prgram use case, in cnjunctin with a summarizatin f the paper s findings, prvide a practical implementatin basis fr the COOP practitiner t use thrughut the public, and the Business Cntinuity Management (BCM) practitiner t use thrughut the private, sectrs. 2.0 The Emergency Cmmunicatins Cycle The Federal Emergency Management Agency (FEMA) defines Emergency Cmmunicatins as the functins that a facility might need t perfrm in an emergency and the cmmunicatins systems needed t supprt them (FEMA-141, p 31). These functins include cmmunicatins between Emergency Respnders; Respnders and the Incident Cmmander (IC); the IC and the Emergency Operatins Center (EOC); the IC and emplyees; the EOC and external respnders; and, the EOC and external stakehlders. This paper prvides a simple framewrk t express these relatinships and hw an rganizatin can supprt them: Figure 1: Prpsed Emergency Cmmunicatins Lifecycle 1 1 Drawing by the authr. Fitsi_FederalCp_07.dc Page 1

4 The remainder f this sectin addresses hw Emergency Cmmunicatins is supprted by frmal guidance in the frm f plicies and prcedures backed by management structures and supprt. Facilities and mbility supprt ensure mass cmmunicatin capabilities t affected stakehlders, with the whle being cnnected by a regularly scheduled tests and exercises. 2.1 Guidance (Plicies and Prcesses) The Business Cntinuity Institute (BCI), in its Gd Practice Guidelines fr 2008, uses guidance frm British Standard (BS) :2006 fr ensuring that rganizatins include Emergency Services and a Lcal Authrity Emergency Planning Officer when creating a BCM Respnse in rder t create emergency management prcedures (GPG08-5, p 10). The Internatinal Cnsrtium fr Organizatinal Resilience (ICOR) further identifies the need fr a plicy-based Crisis Management Team (CMT) t run an rganizatin during an emergency event (ICOR-7, p 24). Within the federal gvernment and DOD, BCM is addressed by a COOP Prgram t ensure Cntinuity f Gvernment (COG) and the cntinued success f Natinal Essential Functins (NEFs). This sectin identifies the high-level guidance available t the COOP practitiner regarding Emergency Cmmunicatins in the federal sectr with special relevance t an Army Prgram use case. The Natinal Emergency Cmmunicatins Plan. The Department f Hmeland Security (DHS), as the executive arm f the President s COOP plicy, created this plan t integrate the emergency respnse capabilities f mst federal agencies (t include DOD), the 56 states and U.S. territries, and the 75 largest urban centers thrugh the realizatin f seven key bjectives. These bjectives include: Objective 1: Frmal Gvernance Structures and Clear Leadership Rles. Plicies and teams t be clearly defined. Objective 2: Crdinated Federal Activities. Emergency respnse t be an integrated capability rather than an ad hc functin. Objective 3: Cmmn Planning and Operatinal Prtcls. Standards and cmmn techniques t be applied t the emergency respnse functin. Objective 4: Standards and Emerging Cmmunicatin Technlgies. Cmmunicatins t fllw cmmn prtcls and t leverage new capabilities frm private industry. Objective 5: Emergency Respnder Skills and Capabilities. Respnders t be trained and demnstrably cmpetent in their areas. Objective 6: System Life-Cycle Planning. Emergency respnse t be an integral part f the rganizatin s management planning. Objective 7: Disaster Cmmunicatins Capabilities. Emergency cmmunicatins t be resilient and highly available in all scenaris. FEMA 141 ( Emergency Management Guide fr Business and Industry ). This lder (1993) guide cntains the guidance fr hw an Emergency Management plan shuld be implemented by a business. With sme minr updates (fr example, t include scial netwrking), this guide still prvides sund advice: Create an Emergency Management Grup (EMG), an Incident Cmmand System (ICS), an Emergency Operatins Center (EOC), and include family members in the emergency ntificatin prcess. Fitsi_FederalCp_07.dc Page 2

5 DOD Unified Facilities Criteria (UFC) ( Design and O&M: Mass Ntificatin Systems ). Emergency cmmunicatins must include mass ntificatin f emplyees within a facility. Especially relevant t the Army Prgram use case, individual buildings must have an effective system t warn emplyees f when and hw t respnd t particular emergencies. Hazard (natural) emergencies such as flds and fire may require evacuatin, while ther threats (manmade) such as terrrist attacks might require clear ntificatin t shelter-in-place (SIP). Military Auxiliary Radi System (MARS). The Army, in cnjunctin with DOD, supprts the MARS missin which cnsists f licensed amateur radi peratrs wh are interested in military cmmunicatins n a lcal, natinal, and internatinal basis as an adjunct t nrmal cmmunicatins in supprt f DOD Instructin ( Military Auxiliary Radi System (MARS) ). Of particular interest t the Army Prgram use case is the dcument Intrductin t the Army s MARS 101, which ntes that emergency respnse regained its primary rle after the years devted mstly t handling MARSgrams and phne patches fr America s servicemen abrad (DA-MARS, p 2). The rganizatin must use these plicy dcuments and guidance t cnstruct a frmal Emergency Cmmunicatins Plan aligned with enterprise bjectives and cmpliant with verarching guidance. 2.2 Management Structures Bth DHS and FEMA stress the imprtance f management structures within the Emergency Cmmunicatins. DHS specifically calls fr effective gvernance grups and designated emergency cmmunicatins leadership rles (DHS-NECP, p 18); this crrespnds clsely with FEMA s EMG and the IC. FEMA prvides an example structure as shwn belw: Figure 2: Emergency Management Structures per FEMA Furthermre, Emergency Cmmunicatins management requires full integratin int the existing planning effrt. Frm a COOP Prgram perspective, the practitiner must ensure that COOP Steering Cmmittees include representatives frm the Emergency Cmmunicatins grups s that changes t a COOP Plan d nt negatively impact the rganizatin s ability t ntify all stakehlders during a crisis scenari. Mst imprtantly, the COOP practitiner must ensure that senir management (r, in the case f the Army 2 Surce: FEMA-141, p 28. Fitsi_FederalCp_07.dc Page 3

6 Prgram use case, the Cmmanding Officer) is fully supprtive f the Emergency Cmmunicatins planning effrts. Withut dedicated high-level supprt, these prgrams will nt be capable f surviving and evlving with the business. 2.3 Facilities and Mbility Supprt DOD UFC and FEMA 141 bth emphasize the imprtance f emergency ntificatin frm a facilitybased and a mbility-based view. The DOD dcument in particular describes the requirements f facility-based Mass Ntificatin Systems (MNS) t prvide: real-time infrmatin and instructins t peple in a building, area, site, r DOD installatin using intelligible vice cmmunicatins alng with visible signals, text, and graphics, and pssibly including tactile r ther cmmunicatin methds. MNS are intended t prtect life by indicating the existence f an emergency situatin and instructing peple f the necessary and apprpriate respnse and actin. 3 Numerus vendrs prvide systems t supprt UFC requirements, and the Natinal Systems Cntractrs Assciatin (NSCA) even prvides an entire Web site devted t this field at These systems can be emplyed by federal agencies as well as the Army Prgram use case t satisfy DHS and DOD mass ntificatin requirements. FEMA 141 highlights mid-1990s technlgy fr mass cmmunicatins t a mbile audience (including the use f hand signals), but this paper extends the examples t include mdern capabilities. Scial Netwrking (Facebk, Twitter). The Army Prgram can and shuld create a Facebk presence and a Twitter presence. All emplyees shuld be encuraged t friend the Facebk presence r fllw the Twitter presence, and these media can be used as an effective methd t share infrmatin n emerging incidents and emergency ntificatins. While this kind f resurce (scial netwrking) cannt be relied upn as an authritative distributin pint, it can prve t be a useful adjunct t message delivery. Crprate Web Site. The Army Prgram can use the Army Knwledge Online (AKO) site at t create its wn page t prvide emergency infrmatin. Staff must be aware f this Web site via educatin, and prcedures must be in place t keep it updated in synchrnizatin with scial netwrking updates. Telephne / . The Army Prgram must gather cntact infrmatin fr each emplyee s that call trees can be cnstructed and instructins can be sent. Where an emplyee s phne supprts Shrt Message Service (SMS) texting, this can be used in cnjunctin with the crprate Web site and scial netwrking t send autmated mass ntificatins. Each emplyee shuld have, at a minimum, a primary and secndary address t allw this medium t be used in the same manner. Tw-way Radi / Gvernment-Specific. Of specific interest t the Army Prgram use case, the Army s MARS prgram emplys amateur and prfessinal tw-way radi t allw emergency ntificatins t be made. Additinally, the Federal Cmmunicatins Cmmissin (FCC) prvides a gvernment-wide 3 DOD-UFC-4, p 14. Fitsi_FederalCp_07.dc Page 4

7 prgram called Gvernment Emergency Telecmmunicatins Service (GETS) that can be used in cnjunctin with DHS wn Wireless Pririty Service (WPS) t prvide critical natinal security and emergency preparedness functins, including thse areas related t safety, maintenance f law and rder, and public health, yu need WPS. By using yur GETS card number, yur call receives a calling queue pririty ver regular calls, thereby greatly increasing the prbability (90%) that yur wireline call will get thrugh the netwrk, even with cngestin Stakehlder Integratin Emergency Cmmunicatins requires recipients; fr the rganizatin, these recipients are the stakehlders invlved in the business functins and affected by a specific emergency. Viewed frm this angle, rganizatinal stakehlders include nt just emplyees, suppliers, custmers, and regulatry agencies but als the wider public and emplyees families. In rder fr an emplyee t react effectively during an emergency situatin, that emplyee must be sure that his r her family is safe and secure. Furthermre, the emplyee must be able t cmmunicate with family members fr the entire duratin f the emergency. The DOD s UFC addresses stakehlder cmmunicatin primarily in terms f a facility- r site-wide MNS. Even where such facilities are nt cvered by specific MNS regulatry requirements (such as single-family and duplex military family husing), UFC recmmends the use f a wide-area MNS such as a telephne alerting system (p 68). This can easily be extended t the use f additinal mbility-riented appraches such as text messaging and scial netwrking sites as described abve. FEMA 141 prvides mre explicit guidance fr including family members in the verall Emergency Management prcess (nt just the Emergency Cmmunicatins phase). Specifically, emplyee emergency preparedness training must include scenari use cases t reinfrce the fllwing (p 25): Individual rles and respnsibilities Infrmatin abut threats, hazards and prtective actins Ntificatin, warning and cmmunicatins prcedures Means fr lcating family members in an emergency Emergency respnse prcedures Evacuatin, shelter and accuntability prcedures Lcatin and use f cmmn emergency equipment Emergency shutdwn prcedures FEMA 141 ges further with the issue f family cmmunicatins during an emergency, and prvides these specific suggestins, all f which require a training cmpnent t reinfrce (p 32): Cnsider hw they wuld cmmunicate with their families in case they are separated frm ne anther r injured in an emergency. 4 FCC, Gvernment Emergency Telecmmunicatins Service (GETS), FCC Web site. (accessed: July 4, 2011). Fitsi_FederalCp_07.dc Page 5

8 Arrange fr an ut-f-twn cntact fr all family members t call in an emergency. Designate a place t meet family members in case they cannt get hme in an emergency. DHS NECP addresses ntificatin requirements fr federal gvernment stakehlders such as regulatry agencies r the general public; the Army Prgram use case must, in general, fllw the precepts f the Army Regulatin (AR) ( U.S. Army Cntinuity f Operatins Prgram Plicy and Planning ) and ensure that the specified COOP pint-f-cntact (nrmally, the grup manning the EOC) perfrms [m]nitring and reprting n the situatin (AR-500-3, p 19) t meet regulatry requirements. Finally, federal/dod agencies, private businesses, and individual citizens can all benefit frm the federal gvernment s preparedness site ready.gv ( which prvides a series f user-friendly and apprachable emergency preparedness and cmmunicatins techniques and tls. 2.5 Training and Exercise Training and exercise prgrams are integral t a successful Emergency Cmmunicatins prgram. Specific t the Army Prgram use case, AR requires annual testing, training and/r exercising f COOP capabilities t include peratin f cmmunicatins devices and cmputers required during emergency peratins (p 14). FEMA 141 ges further and specifies fur specific training activities that include exercising the Emergency Cmmunicatins capabilities: 5 Orientatin and Educatin Sessins. Regularly-scheduled discussin sessins t prvide infrmatin, answer questins and identify needs and cncerns. This shuld be run by the Steering Cmmittee as part f the larger BCM / COOP implementatin prgram. Tabletp Exercise. Members f the Steering Cmmittee r the Emergency Management Grup meet in a cnference rm setting t discuss their respnsibilities and hw they wuld react t emergency scenaris. This is a cst-effective and efficient way t identify areas f verlap and cnfusin befre cnducting mre demanding training activities. Walk-thrugh Drill. Team Leaders frm the Crisis Management Team r the Emergency Management Grup, with their allcated respnse teams; actually perfrm their emergency respnse functins. This activity generally invlves mre peple and is mre thrugh than a tabletp exercise. Functinal Drills. These drills test specific functins such as medical respnse, emergency ntificatins, warning and cmmunicatins prcedures and equipment, thugh nt necessarily at the same time. Persnnel are asked t evaluate the systems and identify prblem areas. As a qualitative analysis tl, functinal drills prvide detailed capability cntrls that help t imprve the Emergency Cmmunicatin respnse. Evacuatin Drill. Persnnel walk the evacuatin rute t a designated area where prcedures fr accunting fr all persnnel are tested. Participants are asked t make ntes as they g alng f what might becme a hazard during an emergency, e.g., stairways cluttered with debris, smke in the hallways. Plans are mdified accrdingly. The classic example wuld be the schl fire drill that every child in the cuntry must perfrm; this brings up the imprtant pint that evacuatin drills are subject 5 Adapted frm FEMA-141, p 24. Fitsi_FederalCp_07.dc Page 6

9 t imprvement. Althugh these drills can be disruptive t the rganizatin, they must be perfrmed regularly in rder fr the rganizatin t receive the best benefit frm them. Full-scale Exercise. A true-t-life emergency situatin is simulated as clsely as pssible. This exercise invlves cmpany emergency respnse persnnel, emplyees, and management and cmmunity respnse rganizatins. Fr the Army Prgram use case, such an exercise might include a simulated failure f cmputer infrastructure by the simple expedient f unplugging a key ruter t determine hw persnnel react. Within the cntext f Disaster Recvery, these exercises are als knwn as full interruptin tests. In rder fr these training and exercise functins t be successful, senir management must authrize nging funding fr them. The COOP practitiner therefre needs t include these cst estimates in the verall COOP Plan. 3.0 Cncluding Remarks 3.1 Summary This paper has prvided a practical analysis f emergency cmmunicatins as part f a larger COOP Prgram implementatin plan. Emergency cmmunicatins help t ensure that the rganizatin can react apprpriately t a crisis situatin and that wise decisins can then be made abut hw best t reduce the impact and t restre nrmal peratins as quickly as pssible. The paper prpses that Emergency Cmmunicatins can be expressed as a clsed-lp system that allws cntinuus imprvement via respnse t enterprise-level plicies and prcedures and measurement f training and exercise prgrams. The rganizatin can create specific management structures such as Emergency Directr and Incident Cmmander prir t an emergency in rder t prvide the directin and framewrk fr effective decisin-making during an emergency. Cmmunicatins must be capable f leveraging the latest technlgy innvatins; fr example, Facebk and Twitter prvide new means fr stakehlders t be kept infrmed during an emergency situatin. Hwever, fr these cmmunicatin channels t wrk, they must be fcused n the rganizatinal stakehlders (emplyees, custmers, regulatry agencies, and s n). Finally a regularlyscheduled and funded training / exercise prgram ensures that the Emergency Cmmunicatins plans stay relevant and useful. 3.2 Recmmendatins This paper has applied a tailred emergency cmmunicatins planning strategy t its Army Prgram use case and has prvided a number f recmmendatins as shwn in the table belw: Recmmendatin Align t relevant plicy. Create a separate Ratinale Table 1: Recmmendatins This paper identified five pssible federal and DOD plicy drivers; these plicy drivers prvide the radmap fr what individual agencies must accmplish. Mrever, they almst always lead t specific implementatin plans such as FEMA 141 that prvide guidance n individual plan elements. The EMG prvides the centralized cmmand structure t enable multiple EOGs t Fitsi_FederalCp_07.dc Page 7

10 Recmmendatin Emergency Management Grup (EMG), with a subrdinate Emergency Operatins Grup (EOG). Acquire Senir Management supprt fr the Emergency Cmmunicatins effrt. Implement a Mass Ntificatin System (MNS). Integrate scial netwrking int Emergency Cmmunicatins. Identify Stakehlders and integrate family members int any Emergency Cmmunicatins plan. Regularly training and exercise t ensure cntinuus imprvements. Ratinale be dispatched and integrated within the cntext f a specific emergency. Within the Army Prgram use case, the EMG crrespnds t the Prgram Management Office (PMO) while the EOG crrespnds t the Operatins grup. Defining the reprting structure practively helps t prevent cnfusin during an emergency. Nt just the Emergency Cmmunicatins effrt, but the entire BCM / COOP implementatin requires substantial management cmmitment. In the Army Prgram use case, this translates t annual budget requests made by the Cmmanding Officer t the chain f cmmand (ultimately, t Cngress fr apprval). The Emergency Cmmunicatins plan must be clearly identified as t its intended gals and purpse; primarily, this must be the prtectin f human life as specified in FEMA 141. Each facility must have an MNS that prvides full emergency capabilities (annunciatr, fire alarm, ability t send ntificatin t affected stakehlders, ability t integrate with emergency respnders). This paper prvides the NSCA Web site where DOD-apprved systems can be researched. This paper advcates the rganizatin t create Facebk and Twitter presences t augment existing means f emergency cmmunicatin. Fr the Army Prgram use case, AKO can be used as a highly-available and easily-accessible Internet lcatin where emergency infrmatin can be published. During an emergency, stakehlders include mre than just emplyees, custmers, suppliers, and regulatry agencies. Visitrs, family members, and even the general public must be kept infrmed f varius types f emergencies as required by statute. This paper advcates the extensive recmmendatins made by FEMA 141 t ensure that family member cmmunicatins are included in any plan. Army, DOD, and federal plicy t the highest levels all require COOP plans t be tested ( exercised ) at least annually. This exercise naturally cnsists f training elements, and FEMA 141 prvides a number f practical and cst-effective ptins such as tabletp, functinal, evacuatin (such as classic fire drills), and even fullinterruptin tests. Frm a training view, the federal gvernment prvides ready.gv at where additinal infrmatin targeted t individuals and businesses can be readily lcated. 3.3 Next Steps The next paper in this COOP Prgram implementatin series fcuses n ensuring that the underlying infrastructure can supprt the COOP effrt thrugh an integrated Infrmatin and Cmmunicatin Technlgy (ICT) Cntinuity Management Plan. Fitsi_FederalCp_07.dc Page 8

11 Appendix A: Acrnyms and Abbreviatins AKO Army Knwledge Online AR U.S. Army Regulatin BCI Business Cntinuity Institute BCM Business Cntinuity Management BS British Standard CMT Crisis Management Team COOP Cntinuity f Operatins DA Department f the Army DOD Department f Defense EMG Emergency Management Grup EOC Emergency Operatins Center FCC Federal Cmmunicatins Cmmissin FEMA Federal Emergency Management Agency GETS Gvernment Emergency Telecmmunicatins Service GPG Gd Practice Guidelines IC Incident Cmmander ICOR The Internatinal Cnsrtium fr Organizatinal Resilience ICS Incident Cmmand System IT Infrmatin Technlgy MNS Mass Ntificatin System NSCA Natinal Systems Cntractrs Assciatin O&M Operatins and Maintenance SMS Shrt Message Service SIP Shelter-in-Place U.S. United States UFC Unified Facilities Criteria WPS Wireless Pririty Service Fitsi_FederalCp_07.dc Page 9

12 Abut the Authr Andrew Bruce is a Clud Architect fr D&SCI in the Army Prgrams grup ut f Aberdeen Prving Grund, MD. D&SCI prvides prfessinal services t the Federal Gvernment and the Department f Defense, specializing in custmizing and develping architecture and gvernance mdels that enable tight integratin t the Army s datacenter cnslidatin and clud virtualizatin enterprise prtfli initiatives. Mr. Bruce's jb respnsibilities include: wrking directly with custmers and partners fr new business develpment, supprting prpsal effrts, verseeing Army custmers netwrk infrastructure, wrking with prject managers t ensure prject cmpletin, managing sftware develpment effrts thrughut the entire system life-cycle, and leading new technlgy research and prfs-f-cncept. After a career spanning three decades in shrink-wrap, cmmercial, and crprate sftware develpment, Mr. Bruce is fcusing n Infrmatin Assurance t achieve his gal f building and managing large data centers prviding clud cmputing utility services fr cmmercial and Gvernment custmers. Mr. Bruce hlds the CISSP, PMP, and FITSP-D certificatins as well as a Master s Degree in Infrmatin Assurance frm Nrwich University. Reference List [AR500-3] DA. April 18, Army Regulatin 500-3: U.S. Army Cntinuity f Operatins Prgram Plicy and Planning. < Accessed: June 12, p. [DA-MARS] DA. February 19, Intrductin t the Army s MARS 101. < >. Accessed: July 4, p. [DHS-NECP] DHS. July, Natinal Emergency Cmmunicatins Plan. < Accessed: July 4, p. [DOD-UFC-4] DOD. April 9, UFC : Design and O&M: Mass Ntificatin Systems. < Accessed: July 4, p. [FEMA-141] FEMA. Octber, FEMA 141: Emergency Management Guide fr Business and Industry. < Accessed: July 4, p. [GPG08-5] BCI Gd Practice Guidelines 2008: A Management Guide t Implementing Glbal Gd Practice in Business Cntinuity (Sectin 5). Caversham (UK). 16 p. [ICOR-7] ICOR Essentials f Business Cntinuity Management Series: Develping a BCM Respnse: Incident Respnse & the Crisis Management Plan (Week 7 Reading). Lmbard (IL). 42 p. Fitsi_FederalCp_07.dc Page 10