Cal Maritime and its Auxiliaries follow the CSU Executive Order No. 1014 Business Continuity Program for implementing and maintaining an ongoing program that ensures the continuity of essential functions or operations following a catastrophic event. Cal Maritime will develop, document, test and maintain a Business Continuity Plan. The plan will ensure the continuance of critical campus functions, systems, and services when a disruption to campus operations occurs after a disaster or emergency situation. Cal Maritime's Plan workbook aids with the consistent development of the departmental support plans and is used to document key information within a department in order to ensure the campus' ability to recover from a disruption.
Business Continuity is the ability of an organization to continue operations and services in the face of a disruptive event. It's about understanding, anticipating, and planning for events that threaten our mission, so that Cal Poly Pomona remains viable. Business Continuity is more than just the ability to recover from a disaster; it's the ability to continue operating before, during, and after.
Business continuity planning identifies where we are vulnerable (are our processes too heavily dependent on a specific resource?) and puts alternate plans in place before a disaster. We can cross-train backups now, document our processes now, create backups of critical information now, order extra equipment now, and even create MOUs with other locations to use their facilities in the event we need to relocate. What steps can we take now to better position ourselves to continue.
Cal Maritime's Business Continuity Program is dedicated to preparing the campus to continue its services in the face of disruptive events. To accomplish this effectively, we are committed to assisting the campus in understanding, anticipating, and planning for events that threaten the campus' mission, so that Cal Maritime remains viable.
The Business Continuity Program's Strategic Plan includes:
Emergency Management plans for the protection and survival of individuals, focusing on health and safety. Business Continuity plans for the protection and survival of the university as an organization. Business Continuity is the "now what" that follows a disaster, and is concerned with ensuring that the university is positioned to return to full, normal operations as quickly as possible following an incident.
Think back to the July 29th, 2008 earthquake. Thankfully, emergency planning efforts ensured workplace safety and open communication. But, what if you were told that you could never re-enter your building again? You cannot retrieve any information from your desk or your computer, and you are expected to resume working conditions tomorrow. Where will you physically work if you no longer have workspace? How will you continue working if all of your data is inaccessible? How will you call your staff if all of their home numbers were located on your computer, which you cannot access? Where will your staff report tomorrow morning? The efforts that led you to safety are part of emergency planning. Ensuring your department will be able to resume operations is business continuity planning.
Failure to have an adequate continuity plan could lead to financial disaster, interruptions of academic classes, failure of research projects, delays in completing other mission critical activities, and a reduction in the quality of our university. Getting back to "business as usual" is imperative to protect the students, faculty, and staff that make the business of Cal Maritime so successful.
Business Continuity Planning includes all threats to an organization whether long-term, short-term, isolated, or campus wide. Attempting to identify and plan for each instance is nearly impossible so we have categorized four general scenarios to plan for:
Completing a business continuity plan using Department Business Continuity Plan is an excellent first step in the planning process. Because our core activities of teaching, research, and services are performed at the department level, arrangements and procedures enabling each department (or unit) to quickly respond to an event and return to performing its Critical Functions Guidelines must be documented.
To begin identifying your department's functions, consider the following questions:
What is a Critical Function?
In the context of business continuity planning, a critical function may be defined as a collection of activities normally performed by your unit that must resume during the first 30 days, or sooner, following a disruption in service.
A critical function:
A Critical Function is Not a Process
Processes are the steps needed to accomplish a function. For example, the function "provide meals for residents of university housing" is accomplished through the processes of "food buying, food storage, cooking, serving, and cleanup." We focus on major functions because processes are too specific and detailed for our level of planning. Identify the function, not the process.
A Critical Function is Not the Name of an Entire Department
A department is the organization of resources needed to accomplish a function. For example, the function "provide hazardous materials clean up and disposal" is performed by the Environmental Health & Safety Department. This is only one function of the department, and this function has been identified as critical. Because the focus is on continuing a specific function of the department, "Environmental Health and Safety" cannot be listed as the critical function.
A Critical Function is Not an Object
Functions are the activities performed by a department or unit. For example, "protective equipment" is not an activity; it is an object. When listing critical functions, identify the action (verb) associated with the object. In this example, the action is "provide" and the critical function is "providing protective equipment".
Levels of Criticality
Critical 1: Must be continued at normal or increased service load. Cannot pause. Necessary to life, health, security. (Examples: hazardous materials cleanup, police services)
Critical 2: Must be continued if at all possible, perhaps at reduced capacity. Pausing completely will have grave consequences. (Examples: purchasing, functioning of data networks, at-risk research)
Critical 3: May pause if forced to do so, but must resume in 30 days or sooner. (Examples: classroom instruction, research, payroll, student advising)
Deferrable: May pause; resume when conditions permit. (Examples: solicit new grant opportunities, routine building maintenance, training, marketing)
Your plan will need to review details on:
Kuali Ready is an on line Business Continuity Planning tool that many Campuses in the CSU-Systemwide utilizes. Cal Maritime does not currently carry a subscription to this software program, but the core process of capturing information to prepare for business interruption is the same.
Sample IT Continuity Plans by Kuali Ready
Instructions to fill-out : Information Technology Section in Kuali Ready
IT Criticality Levels
Instructions to fill-out: Information Technology Section - How to Restart / Recovery Strategies
Question 1: Where will you quickly purchase new workstations, servers, or other hardware?
Response: If your workstations, servers or other hardware are funded or supported by the Division of Information Technology (Central IT), you will contact the Emergency Operations Center / Division of Information Technology in the event of a disaster regarding your hardware needs.
Question 2: When your support technicians rebuild your workstations or servers in the new location (on the new hardware), where will they find the systems software, applications software, and related documentation that they will need?
Response: If your workstations, servers or other hardware are funded or supported by the Division of Information Technology (Central IT), the Division of Information Technology maintains system software, application software and related documentation & licenses. Additionally, the Division of Information Technology is in the process of evaluating/purchasing a cloud-based product, which will store and capture images of desktop computers to assist in the recovery of computers.
Question 3 Does your IT equipment have any environmental requirements (air conditioning, high power consumption, unusual physical security, etc.?)
Response: If your workstations, servers or other hardware are funded or supported by the Division of Information Technology (Central IT), the Division of Information Technology will be responsible for identifying and planning for any specialized environment requirements as part of DR planning with facilities management and Emergency Operations Center.
Question 4: Will your technical support staff be adequate in numbers & skills to rebuild your systems quickly? Will they be available? Do they have other clients to serve?
Response: If your workstations, servers or other hardware are funded or supported by the Division of Information Technology (Central IT), the criticality ratings will be used to prioritize recovery and staff deployment. The campus Emergency Operations Center overall prioritizes the campus needs and resources in the event of a disaster.
Question 5: Are there any other obstacles that could hinder the quick re-establishment of your critical IT services?
Response: The Division of Information Technology documents a Disaster Recovery Plan and tests on a periodic basis. The Division of Information Technology will work closely with Institutional Risk Management and the Emergency Operations Center to prioritize and restore critical IT services.
Question 6: Visualize now a flu pandemic. If all staff were requested to work from home (where possible) for a couple of months to minimize contagion, what would you have to do to enable & support their IT? (Presume the users all have adequate computers at home, plus broadband connections.) Be specific, and estimate how long it would take to get them set up & running.
Response: The Division of Information Technology will provide capacity planning for remote connectivity to campus, including VPN and multifactor authentication for critical/sensitive system.
Question 7: When IT systems become unavailable for an extended time, people use workarounds – paper forms to gather data, snail-mail, chalkboard instead of PowerPoint. In the collection of IT applications & systems that you support, are there any that could not somehow be "worked around" for a few weeks or months? Explain.
Response: ‘Rephrasing this question for better understanding'
Instructions to be added to Kuali Ready: When IT systems become unavailable for an extended time (weeks or months), whether supported by the Division of Information Technology or your department,