Homeland Security Forum Response 303

31 Jul Homeland Security Forum Response 303

Discussion Question:  One of the essential keys to understanding and managing risk rests with the ability of our businesses and government agencies to establish and execute continuity plans.  Sound continuity planning in the private and public sectors can significantly reduce the consequences of many hazards faced by our communities, and significantly reduce the vulnerabilities our nation has in relation to these risks.

Continuity planning in the public sector is typically referred to as Continuity of Operations Planning (COOP); and in the private sector as business continuity (BC).  In this discussion, explain what continuity planning is, what it incorporates, and how it is carried out in both the public and private sectors. Also, what relationship does it have upon the underlying themes of this course regarding risk, threats, and consequences?

Instructions: Fully utilize the materials that have been provided to you in order to support your response. Your initial post should be at least 350 words.

Lesson

Week 7 – Continuity Planning

Throughout this study, attention has not only been directed the overarching topic of risk and the individual components that make it up, but how to address them in a practical and organized manner. Obviously, one of the overarching goals related to these issues is the ability to function in an effective and resilient manner when dealing with a particular threat or hazard. This objective would apply whether speaking of a community as a whole, or a subcomponent of it, such as a government agency or privately owned business. This is the essence of continuity planning; the individual steps needed that will collectively allow essential services to be provided in an uninterrupted manner in the midst of a critical incident. This is not a new concept by any means, but began a slow ascent to greater prominence in both the public and private sectors following the events of 9/11. As a practice related to crisis management, business continuity management (BCM) has progressed since being embraced in the 1970s. This approach was primarily conducted in response to various technical and operational risks that threatened an organization’s ability to recover from certain hazards and disruptions (Herbane, 2010). As it relates to government, the first federal guidance regarding continuity planning was issued in 2007 in the form of the National Security Presidential Directive (NSPD) 51/Homeland Security Presidential Directive (HSPD) 20. The policy statement found within this Directive is as follows:

 

It is the policy of the United States to maintain a comprehensive and effective continuity capability composed of Continuity of Operations and Continuity of Government programs in order to ensure the preservation of our form of government under the Constitution and the continuing performance of National Essential Functions under all conditions. (2007, under “Policy”).

It was rapidly followed in August of that same year with the publication of National Continuity Policy Implementation Plan, which sought to offer direction to executive departments and agencies concerning the appropriate manner in which to both identify and carry out their Primary Mission Essential Functions (HSC, 2007). Since that time there have been a number of federal level documents intended to provide guidance, assistance and some measure of standards for continuity planning to government agencies at the federal, state, and local levels. Because such plans are mandated to be formulated and adhered to, as well as other incentives related to grant funding and other such programs, these have had a significant impact upon the public sector at all levels of government. Unfortunately, continuity planning has had much less of an impact upon the private sector, where businesses either follow well-accepted standards and practices, or simply elect not to engage in the practice at all. Whether it is because such planning is not mandated in the private sector (with the exception of certain regulated operations related to critical infrastructure, etc.), or whether the owners and operators of such organizations simply do not see the value in such practices, there is a great deal of room for improvement.

In the public sector, this initiative is covered by the phrase “continuity of operations planning,” or better known as COOP. This is a common term at all levels of government, even extending to the military.  We need to be careful to distinguish between COOP and the older, far more limited concept of continuity of government (COG), which is defined as “A coordinated effort within the Federal Government’s executive branch to ensure that National Essential Functions continue to be performed during a Catastrophic Emergency” (HSC, 2007, p. 60). Beginning with the days of the Cold War, the United States has had a plan in place to continue the operation of the government following a catastrophic attack on the nation’s capital. Obviously, this still remains as a vital mission of our country, but now finds itself within our nation’s overall continuity efforts. Concerning the private sector, while there are well established and commonly recognized standards for continuity planning, a common, overall term for these efforts has been more elusive. Different industries, such as information technology, financial, and logistics have all gravitated towards different terms; though the concepts translated for industry needs remain the same. Yet, it would appear that the phrase “business continuity management” (BCM) has been the terminology embraced within this sector on a widespread basis.

As previously noted, a number of documents have been produced for both federal and non-federal governmental organizations (as well as the private sector) in an effort to offer direction related to continuity planning efforts, and to create a sense of uniformity related to plan components and expectations. Space will not allow an exhaustive listing and review of these, but focus will be directed towards a few that have been produced by DHS and FEMA. First, as it relates to the Federal Executive Branch, which is made up of a variety of organizations at the federal level, the following have been developed:

· Federal Continuity Directive 1 : Federal Executive Branch National Continuity Program and Requirements

· Federal Continuity Directive 2 : Federal Executive Branch Mission Essential Functions and Candidate Primary Mission Essential Functions Identification and Submission Process

Likewise, guiding documents have been provided for those government entities that are not located at the federal level, which include:

· Continuity Guidance Circular 1 (CGC 1): Continuity Guidance for Non-Federal Governments. (States, Territories, Tribes, and Local Government Jurisdictions)

· Continuity Guidance Circular 2 (CGC 2): Continuity Guidance for Non-Federal Governments: Mission Essential Functions Identification Process

In addition, a variety of programs and accompany resources have been developed that are focused specifically on upon the private sector, those that include:

· The Voluntary Private Sector Preparedness Program (PS-Prep)

· DHS/FEMA’s National Protection and Programs Directorate Business Continuity Planning Suite

· NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs

Although there may be some minor differences between individual components that make up a continuity plan based upon whether the organization is affiliated with government (devolution and reconstitution) or the private sector (business impact analysis), there are those elements that are fundamental and common to all. These include, but not limited to:

· Determining essential functions

· Resource needs assessment

· Identifying key personnel and addressing related issues

· Orders of succession

· Delegations of authority

· Identification and preparation of alternate facilities

· Determining important records and needed protective measures

· Internal and external communications

· Appropriate test, training, and exercise activities

· Program maintenance and improvement

It must be noted that there must be sufficient commitment and support from both leadership and affected employees/personnel for continuity planning to achieve desired results; coupled with the necessary resources to carry associated efforts out. This is not always the case, which is not only unfortunate to the organization itself, but those in which they serve. Therefore, an identified need for these planning activities and dedication to address and carry them out in a professional and responsible manner are integral to overall success.

As noted earlier, continuity planning is essentially the practice of organizations keeping their essential functions up and running either during a disaster event, or re-establishing their most important functions as soon as possible following such a critical incident. In theory at least, each of these agencies, from the federal level down to those organizations found in counties and cities, will have COOP plans in place, and are prepared to continue providing the most important of their services to their communities within 12 hours of their plan activations. Most state and local government agencies will make similar claims to COOP planning. Similarly, private sector organizations should develop performance objectives related to BCM that contain three essential components; performance, conditions, and criteria. It is also suggested that performance objectives be SMART, in that they are Specific, Measurable, Action oriented, Realistic, and Time sensitive (NFPA, 2013). Again, Homeland Security Presidential Directive 20 directed all federal executive branch agencies to engage in continuity of operations planning.  Plan activations will take place either upon the onset of the disaster event, or before the event occurs, if the event is one that provides some warning such as hurricanes typically do.

Continuity planning fits well within the overall “whole community” concept that was highlighted in previous lessons, and that of community resiliency encouraged by the National Preparedness System. It could easily be said that continuity planning is the basis of community resiliency. Continuity planning deals with how quickly government services are restored to their communities; how quickly essential utility services such as electricity, water, sewer and gas are restored, even if not to their fullest pre-disaster capacity. In regards to the private sector, the manner in which organizations recover and reopen and provide the public with needed goods, services and continued employment has a tremendous impact upon economic viability and survival, as well as the physical, social, and psychological well-being of the community as well.

It must be understood however that continuity planning is not to be equated with long term recovery. Restoration of services under the auspices of continuity planning are done on an emergency basis and are intended to maintain the basics of life until recovery operations can return communities and their included agencies and businesses to full operating capacity. Continuity planning is not emergency management, but it deals with a great many of the same issues, such as hazard analysis, risk assessments, mass warning notification, emergency communications, and a host of other similarities. So continuity planning is focused more on organizations and services and less on human life and property than is emergency management. The end goal of COOP would certainly speak to the greater preservation of life and property, but its immediate focus is more specifically directed internally to the continuation of expected operations and delivery of services.

Continuity planning is focused on organizational functions and not on matters of geography. For example, when a disaster strikes a community, the focus of the community is bound by the geographic and political boundaries of that community; saving lives within the community, protecting property within that community, recovery efforts that take place within that community. Very often, COOP will have the same geographic focus, but it is not a necessity. Sometimes, necessity will even dictate an entirely different focus. In most cases, government agencies will want to resume government services to the stricken community by either returning to the same physical building the services had been offered from before the disaster, or to some other facility within the community.  But, economic necessity could dictate that those services now be offered from a facility in a neighboring county or city. For example, a state office of motor vehicles that has been destroyed by a tornado may be relocated in an entirely different city; yet provide those same services to those same citizens.  Likewise, a county public health department office may re-open in a neighboring city.  The stricken community keeps or regains its services, its people continue to receive the government services, but the physical facility from which the government administers those services to that community could move.

This idea of not being geographically bound is especially true when looking at private sector business continuity. As seen in the previous paragraph, in most cases, government will want to (and will generally) resume its operations in the community that has been stricken by the disaster. Yet, as it relates to the private sector, restoration of the facility, and other issues that impact profit and loss will certainly factor into future decisions regarding if, when, and where operations will be resumed, if at all. It is certainly a viable and acceptable alternative for a company to recover disaster generated loss via insurance, and still not re-open the business. Likewise, it could completely transfer those business functions to another part of the country, or to another country altogether (ASIS/BSI, 2010). This is a major difference between public sector and private sector business continuity efforts. COOP must restore pre-disaster services to the stricken community, even if physical facilities may move. Private businesses are not bound to pre-disaster services or locations, though in most cases, they will choose to recover within the same community. As would be expected, large corporations have far greater resources at their disposal that produce additional options, than do smaller local or regional businesses. It is also worthy to note that the private sector’s notion of risk in regards to its continuity planning will normally be broader than the notion of risk used in public sector. The private sector will focus continuity planning on any disruption of the services it provides or the manufacturing of any of the goods it produces. Disaster, in this regard, could come from a break in the supply chain half a world away, or a few hours long disruption of internet services or electrical supply. Such incidents would not qualify as a catastrophe to the community itself, but certainly serves as a disaster to the organization that has been impacted.

In this lesson, we have looked at the purposes of continuity planning from the different perspectives of the public and private sectors.  As part of the resiliency concept in our nation’s homeland security system, continuity planning ranks as a strong mitigating initiative to counter the effects of disaster events. Remember that mitigation is the lessening of the consequences of a critical incident upon a community or an organization. Continuity planning assumes the disaster event has occurred; it carries no value related to prevention planning. It does however carry tremendous value elsewhere as an overall mitigation, response, and recovery strategy. If the agencies of a county or city government have strong, sound, continuity planning in place, then the occurrence of a disaster event will only briefly disrupt the most important of its mission functions, thus significantly lessening the consequences to a community of losing a specific facility due to a natural disaster, terrorist attack, or other notable threat.

References

ASIS/BSI. (2010). Business continuity management systems: American national standard. Alexandria, VA: ASIS International.

Bush, G.W. (2007) National security presidential directive/nspd-51, Homeland security presidential directive/hspd-20: Subject:  National continuity policy. Retrieved from http://www.fema.gov/txt/about/org/ncp/nspd_51.txt

Herbane, B. (2010, October 20). The evolution of business continuity management: A historical review of practices and drivers. Taylor & Francis Online. Retrieved from http://www.tandfonline.com/doi/abs/10.1080/00076791.2010.511185

Homeland Security Council. (2007). National continuity policy implementation plan. Washington, D.C.: Government Printing Office.

National Fire Protection Association. (2013). NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. Quincy, MA: NFPA.