launching a sustainable business continuity program in a higher ed culture (without getting eaten...

8/11/2019 Launching a Sustainable Business Continuity Program in a Higher Ed Culture (without Getting Eaten Alive) (242319062)

http://slidepdf.com/reader/full/launching-a-sustainable-business-continuity-program-in-a-higher-ed-culture 1/35

“ Launching a Sustainable Business Continuity Program in a

Higher Ed Culture (without getting eaten alive)”Melanie J. Lucht, Sr. Mgr, DR/BC Services – Carnegie Mellon University

Pittsburgh, PA

This presentation leaves copyright of the content to the presenter. Unless otherwise noted in the

materials, uploaded content carries the Creative Commons Attribution-NonCommercial-ShareAlike

license, which grants usage to the general public with the stipulated criteria.

https://creativecommons.org/licenses/by-nc-sa/3.0/






Overview and Introduction



CMU Quick Facts



Disaster Recovery/Business Continuity

Services

Mission:

“Provide the guidance, tools, and governance commensurate with

the strategic mission and risk tolerance of the University and its

divisional units so that they may continue to provide critical services

in the event of a disaster or significant business disruption.”



Discussion Topics

• How It All Begins (Catalysts and Challenges)

• Leadership Support and Buy-In

• Pilot Business Continuity Program

• Multi Year Strategy

• Where We Are Today



How It All Begins



Catalysts for Business Continuity

Lessons LearnedFollowing Events

Advisory Board

Recommendations

Audit Findings

Organizational Changes

ComplianceRequirements



Challenges

• Resource Constraints

• Complexity Perceptions

• Ownership

• Strategy & Prioritization

• Time Commitment

• Changing Environment

• Funding



Leadership Support and Buy-In



Selling Business Continuity

• Goal of Business Continuity = “To ensure… (insert

institutional mission and/or strategy here)”

• Expectations of preparedness

• Vested interest in the success of organizational continuity

and resiliency

• Proactive Value vs. Reactive Cost

• Establishes prioritization of recovery (builds the spider web)

• Identifies potential risks to achieving recovery

• Bridges the knowledge gap



What is Business Continuity?

Capability of an organization to continue delivery of critical services at an

acceptable level following a disaster or significant business disruption

(addresses actions taken in the event of a loss to people, facility,

technology, and supplier).

All Hazard Approach



Business Continuity vs. Disaster Recovery

Subset of Business Continuity that focuses on the collection of resourcesand activities to re-establish information technology services at an alternate

site following a disruption of IT services in the event of a significant

business disruption or disaster.

All Hazard Approach



Risk Management Continuum



How Not To Get Eaten Alive

Industry Best Practices

Set Expectations

Flexible

Transparent

Communicate Frequently

Build Relationships



Three Objectives

PAINLESS

PAINLESS

MORE PAINLESS



Getting The Business On Board



Pilot Business Continuity Program



Business Continuity Lifecycle



Business Impact Analysis



Understand the potential risk

What is the potential impact of the risk?

What is the cost to remediate the risk?

Does the benefit outweigh the cost?

Does it balance with the culture

and mission of the institution?

Communicate Decision

Risk Assessment/Gap Analysis



Business Continuity Planning

Documents the activit ies that a department/funct ion wil lperform in the event of a loss of people, facility, technology,

and supplier in order to continue operations at an acceptable

level within the defined recovery objective.

Loss Of:

Communications, Decision Points, Contact Lists, Call Trees



Plan Exercising & Continuous Improvement



Results of Pilot Init iative

80% response rate



Multi-Year Strategy



DR/BC Strategic Structure

Strategic Oversight

Disciplinary

Expertise and

Direction



Strategy and Prioritization



Administration Priorities



Where We Are Today



Administration Priorities

Life/Health Safety

• Environmental Health & Safety

• Facilities Management

• Health Services

• University Police

• Student Affairs

• Human Resources

• University Advancement (includes Media Relations)



Program Management

• Configuration, Implementation, andTraining of Business Continuity Tool

• Building Application/IT Service Records for

DR Planning

• Ongoing Conversations with Organization

Leaders for support and buy-in



Final Thought

“One thing that makes it possible to be an optimist, is if you

have a contingency plan for when all hell breaks loose. There

are a lot of things I don't worry about, because I have a plan in

place if they do.”

―Randy Pausch, The Last Lecture

http://www.goodreads.com/author/show/287960.Randy_Pausch

http://www.goodreads.com/work/quotes/3364076

http://www.goodreads.com/work/quotes/3364076

http://www.goodreads.com/author/show/287960.Randy_Pausch



• Websitehttp://www.cmu.edu/computing/partners/drbc/

• Contact InformationMelanie Lucht, Senior Manager, DR/BC Services

412-268-5939 (office)

[email protected]

Q&A

http://www.cmu.edu/computing/partners/drbc/

mailto:[email protected]

mailto:[email protected]

http://www.cmu.edu/computing/partners/drbc/



Help Us Improve and Grow

Thank you for participating

in today’s session.

We’re very interested in your feedback. Please take

a minute to fill out the session evaluation found within

the conference mobile app, or the online agenda.