business continuity policy bd 37-20 · continuity planning committee (as defined below) or a...

1

Business Continuity Policy Approved per BD 37-20 | March 17, 2020

Purpose: The purpose of this policy is to maintain ongoing operations that ensures the continuity of essential

functions or operations during or following a catastrophic event. This policy provides guidance for the development and implementation of a business continuity plan using models such as the Continuity of Operations (COOP) plans and guidelines promulgated by the California Office of Emergency Services (OES). ASI shall update their continuity plans consistent with the guidelines under California State University Executive Order 1014.

Scope: This policy applies to all ASI personnel who are categorized as non-student employees and student

employees as well as office holders. Section 1: Definitions

a) Business Continuity – The ability of an organization to provide service and support for its customers and to maintain its viability during or following a catastrophic event.

b) Business Continuity Coordinator – A role within the business continuity program that coordinates planning and implementation for overall recovery of an organization or unit(s).

c) Business Continuity Plan (BCP) – Process of developing and documenting arrangements and procedures that enable an organization to respond to an event that interferes with the operation of ASI that lasts for an unacceptable period of time and returning to performance of its essential functions or operations after an interruption.

d) Health Emergency Plan – An effort within departments to ensure continued performance of, at a minimum,

essential functions during a public health emergency as declared by state or local government officials and the California State University system. This is accomplished through the development of plans, comprehensive procedures, and provisions for alternative facilities, personnel, resources, interoperable communications, and vital records/databases

e) Continuity of Operations Plan (COOP) – An effort within departments to ensure continued performance of, at a minimum, essential functions during a wide range of potential emergencies. This is accomplished through the development of plans, comprehensive procedures, and provisions for alternative facilities, personnel, resources, interoperable communications, and vital records/databases.

f) Essential Function – A function that enables an organization to provide vital services, exercise civil authority,

maintain the safety and well-being of the general public, or sustain the industrial or economic base during an emergency.

g) Risk Assessment - Process of identifying the risks to an organization, assessing the essential functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.

h) Training Record - Documentation of training for employees, including employee name or other identifier, training dates, type(s) of training, training providers, and attendee sign-in sheets.

2

Section 2: Roles and Responsibilities

A. Business Continuity Coordinator

1. Under this policy, the role of Business Continuity Coordinator shall be assigned to the Executive Director of ASI who serves as the risk and business manager for the corporation.

2. The Business Continuity Coordinator is delegated the responsibility for the implementation and

maintenance of an effective business continuity program at both the San Bernardino and Palm Desert campus ASI offices.

3. To facilitate oversight of the business continuity program and to ensure measures are taken in a timely

manner, the ASI President may designate the ASI Executive Committee to serve as the Business Continuity Planning Committee (as defined below) or a secondary person (non-student employee) with responsibility for business continuity planning activities.

4. The Business Continuity Coordinator is responsible for the full outcomes of the business continuity

program as follows:

a. Develop and maintain a business continuity framework for functions that include procedures.

b. Establish goals and objectives that reflect the needs of the offices and its operations.

c. Participate in the identification of functions and assets that are essential to operational continuity and needed to support the corporation and campus' mission.

d. Identify a contact for business units and ensure that Business Continuity Plans, inclusive of a

business impact analyses, and Risk Assessments are tested, reviewed, updated, and retained within established time periods.

e. Recommend recovery strategies to the ASI Board of Directors.

f. Develop staff training, awareness and communications programs for business continuity

planning.

g. Provide independent reviews and validation of business unit continuity plans.

h. Support and work with campus emergency planners to ensure a smooth transition between emergency responders and business continuity operations personnel.

B. Business Continuity Planning Committee

1. If designated, a Business Continuity Planning Committee (BCPC) should include the members of the ASI Executive Committee and if necessary ASI Presidential appointments of administrative leaders who have a working knowledge of business continuity processes and are from business units identified as key to essential operations.

2. The BCPC will adhere to the responsibilities as afforded to the Business Continuity Coordinator.

3. Meeting minutes shall be kept for a minimum of two years.

3

Section 3: Training & Maintenance

a) ASI shall test some part of their Business Continuity Plan once a year, with all parts tested every seven years. An actual event necessitating activation of the Business Continuity Plan will meet this requirement.

b) At the completion of each test or review, full documentation of test results and lessons learned shall be completed in the form of a corrective action plan or after-action report. Such reports shall be approved/signed-off by the ASI Board of Directors, the Business Continuity Coordinator or the Business Continuity Planning Committee, and retained for a minimum of 2 years.

c) Upon request, such reports shall also be made available to the Office of Risk Management.

d) ASI shall review their Business Continuity Plan and update whenever changes occur in their operating

procedures, processes, or key personnel.

e) Plans must be updated to maintain accurate lists of key personnel, telephone numbers, and plan elements that may be affected by changes in unit structure or functions.

f) The updated Business Continuity Plans shall be approved/signed-off by the ASI BoD, the Business Continuity

Coordinator or the Business Continuity Planning Committee and retained for a minimum of 2 years. Section 4: Business Continuity Plan Activation

a) A Business Continuity Plan includes 2 separate components: 1. Health Emergency Plan 2. Continuity of Operations Plan (COOP)

b) If it is determined that any Business Continuity Plan must be executed, the Business Continuity Coordinator,

Business Continuity Planning Committee, or designee shall be responsible for all communications of its activation to ASI personnel.

c) If it is determined that any Business Continuity Plan must be executed, the Business Continuity Coordinator, Committee or designee must inform the ASI BoD of its activation immediately.

d) If it is determined that an ASI BoD meeting is essential to discuss the activation of any Business Continuity Plan,

a special meeting may be called by the chair to discuss the matter.

e) Under a Continuity of Operations Plan (COOP), the ASI BoD may continue to conduct their business outside of their normal meeting location (including off-campus) in accordance California Education Code Sections 89305 – 89307.4)

Section 6: Funding Access

a) Should it be determined by the Business Continuity Coordinator that the current operating funds are insufficient to carry out essential duties of employees, the following procedures shall be adhered to in accordance with the ASI Reserves Policy:

1. Accessing reserve accounts will require a 2/3 majority of the filled voting member positions in attendance at a meeting of the ASI BoD.

2. In the event that the ASI BoD is unable to convene, then access to the reserve accounts will be decided by the ASI Executive Committee as defined in Article VI, Section 2A, subparagraph 2 of the ASI Bylaws.

b) Accessible Reserves Under the Reserves Policy 1. Emergency Reserve Account: The Emergency Reserve Account is established to meet unanticipated

needs which arise during a fiscal year involving unanticipated emergency corporate obligations.

4

2. Operations Reserves: The Operations Reserves Account provides for three (3) months operating funds for current operations during any critical operating budget circumstance. It is not anticipated that this account would be accessed without a major area or statewide emergency.

Section 7: Dissolution

Should the Associated Students, Inc. be faced with a catastrophe so extreme it us unable to resume operations, the following dissolution procedure shall take place in accordance with Article X of the Associated Students, Inc. Articles of Incorporation as follows: The property, assets, profits, and net income of this Corporation are irrevocably dedicated to the charitable purposes set forth in Article III, and no part of the profits or net income or assets of this Corporation shall ever inure to the benefit of any private shareholder or individual. Upon the dissolution of this Corporation, net assets, other than trust funds, shall be distributed to one or more nonprofit corporations organized and operated for the benefit of the California State University, San Bernardino; such corporation or corporations to be selected by the President of the University and approved by the President of the university and the Chancellor of the California State University. Such nonprofit corporation or corporations must be qualified for Federal income tax exemption under Section 501(a) and 501(c)(3) of the Unite States Internal Revenue Code of 1954 and be organized and operated exclusively for educational purposes.

California State University, San Bernardino(CSUSB)Plan Managers:Laura CarrizalesPlan Created: 01/10/14Last Edit: 05/23/19

Associated Students,Inc.

2333335568888888999

10101010111111121313131314141414

141515

Table of ContentsTable of ContentsContinuity PlanSA - Associated Students, Inc.Coyote Ready, CSUSB Continuity Planning App

Introduction1. General Information2. Critical Functions

2.1. Critical Function: Maintain safety of ASI students and staff2.2. Critical Function: Sustain Services to Students

3. Information Technology3.1. Centrally-Owned Applications that are Critical for this Unit3.2. Department Applications that are Critical for this Unit3.3. Department Servers3.4. Workstations

3.4.1. Workstation Backup3.4.2. Workstation Support

3.5. Recovery Strategies for IT3.6. Action Items for IT

4. Instruction5. Faculty Preparedness6. Key Resources

6.1. Staff Basics6.2. Key People in Your Unit6.3. Teams6.4. Skills6.5. Staffing Requirements6.6. Staff of Other Units6.7. Stakeholders6.8. Documents6.9. Equipment and Supplies

6.9.1 Office Equipment6.9.2 Other Equipment6.9.3 Supplies

6.10. Facilities and Transportation7. Action Items

7.1. Inform students and staff of communications to expect during a disruption of campus operations. Cross train staffon emergency communication plan.7.2. None

8. Documents

Associated Students, Inc.California State University, San Bernardino (CSUSB) 2 of 17

Created Jan 10, 2014Last modified March, 17, 2020

Continuity Plan

SA - Associated Students, Inc.

Coyote Ready, CSUSB Continuity Planning AppThis document was created with the Coyote Ready, CSUSB Continuity Planning App online Continuity Planningapplication. It is maintained within the application and can be edited by users with appropriate permissions.

IntroductionContinuity planning is a process that helps us become prepared to continue or rapidly resume operations whenfaced with adverse events, or disasters.

Your departmental continuity plan:

Identifies your department's Critical Functions.Documents the business impact of loss of these functions over periods of time.Describes how you might continue these functions under conditions of diminished resources.Contains key information that might be needed during and after a disaster-event.Includes Action Items designed to help your department become more prepared before an event occurs.

1. General InformationDepartment SA - Associated Students, Inc.

Departmentdescription

The recognized voice of CSUSB students.

Major division Student Affairs

Type of unit Student Services

Personnel 0 Faculty and other academic appointees


count 0 Residents/Fellows

4 Staff (full-time)

0 Staff (part-time, excluding students)

30 Student Staff

16 Volunteers

0 Guests

0 Other

Head of unit Jesse FelixExecutive Director [email protected]

Cost center

Buildings Building Ownership Notes

Student Union owned

Evacuationplans for allbuildings?

Yes

Comments

CriticalFunctions

1 Maintain safety of ASI students and staff Critical 1

2 Sustain Services to Students Critical 2

Definitions Critical 1 Critical - must be continued at normal or increased service load. Cannotpause. Necessary to life, health, security. (Examples: inpatient care, policeservices)

Critical 2 -Essential

Essential - must be continued if at all possible, perhaps in reduced mode.Pausing completely will have grave consequences. (Examples: provision ofcare to at-risk outpatients, functioning of data networks, at-risk research)

Critical 3 -Important

Important - may pause if forced to do so, but must resume in 30 days orsooner. (Examples: classroom instruction, research, payroll, studentadvising)

Deferrable may pause; resume when conditions permit. (Examples: elective surgery,routine building maintenance, training, marketing)


2. Critical Functions

2.1. Critical Function: Maintain safety of ASI students and staff

Description Ensure safety of students and staff during emergency

Who performs this? Executive Director or designee

Responsible person(s)

Peak periods January, February, March, April, May, September, November

Comment

Documents See Business Continuity Policy

Upstream dependency comment

Upstream dependencies Santos Manuel Student Union, Vice President of Student Affairs Office,Auxillary Accounting, Alliant Insurance

Downstream dependencycomment

Downstream dependencies

Possible consequences if thisfunction is not continued orrecovered quickly enough

Consequence Explanation

Departure of staff

Departure of students

Well-being of students

Payment deadlines unmet

Loss of revenue

Impact to other units

Impact on importantbusiness partners

Recovery Time Objective

How to cope if usual space is notavailable

Office, students,and staff would be relocated.


2.2. Critical Function: Sustain Services to Students

How to cope if 50% absenteeismof staff and faculty

Temporary staff would need to be hired.

What to do if certainskills/knowledge are held by onlyone staff member (unique skills)?

Reference training modules.

Can this function be performedfully or partly from home?

Yes, we could work from home or other location. Basic computing and networking equipment, as well as essential office equipment would be needed.

How to cope if data network is notavailable

Utilize cell phones and hard copies of information

Any show stoppers? Basic phone technology

Do any of these coping strategiesexpose the University to risk?

No

Policy exceptions that may beneeded

None. No.

Additional vulnerabilities no

Alternate methods when youroffice phone system is unavailable

If temporary closure is declared, isit possible to stop doing thisfunction?

No

Comments Student representation is a necessity

Action items for this function See Action Item list

Description Providing services to students through our service centers including, but not limited to, student communication, corporate operations, legislative affairs, productions and special events.

Who performs this?

Responsible person(s) ASI Staff

Peak periods May, June, October, November


Comment

Documents See Documents list

Upstream dependency comment

Upstream dependencies

Downstream dependencycomment

CSUSB students and ASI Vendors

Downstream dependencies

Possible consequences if thisfunction is not continued orrecovered quickly enough

Consequence Explanation

Payment deadlines unmet

Lose understanding of students needs and ability to advocate on their behalf.

Recovery Time Objective

How to cope if usual space is notavailable

ASI full time staff could operate remotely to ensure essential functions are met.

How to cope if 50% absenteeismof staff and faculty

What to do if certainskills/knowledge are held by onlyone staff member (unique skills)?

Can this function be performedfully or partly from home?

How to cope if data network is notavailable

Our staff will communicate via landlines until network connectivity is restored.

Any show stoppers? Computers, electricity, phones and internet access.

Do any of these coping strategiesexpose the University to risk?

No

Policy exceptions that may beneeded

We will need a place to post agendas for meetings, can be online in orderto conduct any official business as a 501: 3(c) under the Romero OpenMeeting Act


ASI would reduce or limit services offered to students to meet minimum obligation.

Reference training modules.

Yes

3. Information Technology

3.1. Centrally-Owned Applications that are Critical for this Unit

Centrally-Owned applications are those whose technical owner is Central IT. The functional owner can be anydepartment.

No centrally-owned applications are entered for this plan.

3.2. Department Applications that are Critical for this Unit

Department applications are those whose technical owner is our department or another department (but notCentral IT)

No department applications are entered for this plan.

3.3. Department Servers

The department utilized the campus server.

3.4. Workstations

3.4.1. Workstation BackupAll ASI workstations are backed up to the campus server.

3.4.2. Workstation Support

Additional vulnerabilities no

Alternate methods when youroffice phone system is unavailable

If temporary closure is declared, isit possible to stop doing thisfunction?

Yes

Comments

Action items for this function See Action Item list


Workstation support is facilitated through campus IT.

3.5. Recovery Strategies for IT

3.6. Action Items for IT

See Action Item List

4. InstructionThis unit does not provide instruction.

5. Faculty Preparedness

Where will you quickly purchase new workstations, servers, or otherhardware?

When your support technicians rebuild your workstations or servers inthe new location (on the new hardware), where will they find the systemssoftware, applications software, and related documentation that they willneed?

Does your IT equipment have any environmental requirements (airconditioning, high power consumption, unusual physical security, etc.?)

Will your technical support staff be adequate in numbers & skills torebuild your systems quickly? Will they be available? Do they have otherclients to serve?

Are there any other obstacles that could hinder the quick re-establishment of your critical IT services?

Visualize now a flu pandemic. If all staff were requested to work fromhome (where possible) for a couple of months to minimize contagion,what would you have to do to enable & support their IT? (Presume theusers all have adequate computers at home, plus broadbandconnections.) Be specific, and estimate how long it would take to getthem set up & running.

When IT systems become unavailable for an extended time, people useworkarounds – paper forms to gather data, snail-mail, chalkboardinstead of PowerPoint. In the collection of IT applications & systems thatyou support, are there any that could not somehow be “worked around”for a few weeks or months? Explain.


We currently have additional systems that can serve as backups.

All ASI software, applications and documents are currently hosted on the campus cloud.

No

We rely on the campus and will work in accordance with their availability.

Campus priorities.

Nothing, all of our IT functions are available on our mobile devices. The Executive Director will ensure that the staff has adequate equipment to telecommute.

Cutting payroll as we do not have the ability to cut paper checks.

5. Faculty PreparednessThis section is disabled in favor of detailed critical function instruction section.

6. Key Resources

6.1. Staff Basics

6.2. Key People in Your Unit

Does your unit have a (printed)emergency contact list for faculty& staff?

Yes

Who holds copies of theemergency contact list? (Bespecific)

All staff members

Who updates the emergencycontact list?

Executive Director or designee

Who knows how to checkmessages on your department'smain phone line?

Executive Assistant

Who knows how to record agreeting on your department'smain phone line?

Executive Assistant

Who can post messages on yourdepartment's web site (i.e., do theactual mechanics)?

Policy and Legislative Analyst

Do your staff use any sharedpasswords that should be keptavailable?

no

Comment

Name Dacia Woods

Title of function Executive Assistant


Alfredo Barcenas

Policy and Legislative Analyst

Herbert Gonzales

Sr. Program Associate

6.3. Teams

Corporate Operations, Legislative Affairs, Programs and Marketing.

6.4. Skills

No skills are entered for this plan.

6.5. Sta ng Requirements

This list displays bothnumbers of staff who may be REQUIRED during crisis, andnumbers of staff who may be AVAILABLE FOR REASSIGNMENT during crisis

DefinitionsCritical 1: Critical - cannot pauseCritical 2: Essential - could be scaled down brieflyCritical 3: Important - must be returned to normal as soon as possibleDeferrable: resume when conditions permit

Special skill Payment and Document Processing

Special role

Additional comment

Name Jesse Felix

Title of function Executive Director

Special skill Leadership, CFO and Risk Manager

Special role

Additional comment

Function Criticality Level Category of Staff Shift FTE required

under normal

conditions

FTE required

during crisis

FTE who may be

available for

reassignment


Strategic Communication and Policy Implementation

Marketing and Events Management

6.6. Staff of Other Units

These are staff of other units whom you may need to contact.

Maintain safetyof ASI studentsand staff

1 MPP (Manager) Primary (8 amto 5 pm)

4 2.0

0.00

Totals 4 2.00

0.00

Name Paz Oliverez

Department/Org Student Affairs

Work phone 909 537-5185

Mobile phone

Email [email protected]

Address 5500 University Pkwy

Fax

Additional comment

Name Siska Purnawan

Department/Org Aux Accounting

Work phone 909-537-3938

Mobile phone

Email [email protected]

Address 5500 University PKWY

Fax

Additional comment


310-923-0803

6.7. Stakeholders

These are stakeholders whom you may need to contact.

6.8. Documents

See Document List

6.9. Equipment and Supplies

Minimum equipment needed to carry out all critical functions.

6.9.1 O ce Equipment

Name

Stakeholder Type Vendor

Department/Org

Work phone

Mobile phone

Email

Address

Fax

Products/Supplied

Alternate Vendors

Additional comment See uploaded Vendor List

Minimum Number Additional comment

Workstation (includes desktop computer, networkconnection, table, chair)

2

Laptop Computer (car charger advised) 2

Telephone (hard-wired) 2

Printer 2


6.9.2 Other Equipment

6.9.3 Supplies

6.10. Facilities and Transportation

7. Action Items

7.1. Inform students and staff of communications to expect during a disruption ofcampus operations. Cross train staff on emergency communication plan.

Fax 1

Copier 1

Scanner 1

Server 1

Major Items Only

Necessary Consumables

Inventory or StockpilingConsiderations

Facilities (special needs beyondoffice-classroom-lab needs)

Utilities (very important to thefunctioning of the department)

Utility Additional comment

Heating & AirConditioning

Electricity

Wireless Network

Transportation (specialtransportation needs)

Other Resources


7.2. None

8. DocumentsThese documents have been identi ed as important for continuing our critical functions.

Assigned To Executive Director or designee

Due Date

Supports this Critical Function Maintain safety of ASI students and staff

Estimated Cost $100 - $1000

Cost Frequency Both one-time and annual

Within Whose Scope

Details

Status

Date Entered

Assigned To

Due Date

Supports this Critical Function Sustain Services to Students

Estimated Cost less than $100

Cost Frequency One-time

Within Whose Scope Not sure

Details

Status

Date Entered 2014-12-03

Name Emergency Contact Information

Description list of current staff and emergency contact phone numbers


Medium Electronic (computer)

Location Where Stored (Physical) On Executive Director computer

Location Where Stored (URL)

Owner (department) ASI

Contact person(s) Jesse Felix

Backup measures Info is stored on cell phones and a paper copy exists in SMSU 108

Comment

Uploaded in this tool? No

Name List of Vendors

Description Contact information of companies or individuals that we have regularbusiness contact with.

Medium Other (explain in comments)

Location Where Stored (Physical) ASI files, ASI Cloud Storage



Contact person(s) Dacia Woods

Backup measures Multiple hard copies and on campus server

Comment


Name Vendor List

Description contact list of regular vendors

Medium Electronic (computer)


Location Where Stored (Physical) Campus Server



Contact person(s) Dacia Woods

Backup measures Hard Copies are off site with Dacia Woods, Alfredo Barcenas and Jesse Felix

Comment

