This higher ed continuity planning guide will walk you through the basics of a continuity plan so you can get started planning for your department or institution. Continuity planning is the process of proactively thinking through how an institution prepares to respond to, and recover from, an adverse event. It also includes mitigating or removing risks before they occur. This higher ed continuity planning guide will walk you through the basics of a continuity plan so you can get started planning for your department or institution.
Continuity planning is the process of proactively thinking through how an institution prepares to respond to, and recover from, an adverse event. It also includes mitigating or removing risks before they occur.
Before documenting a continuity plan it is important to identify the critical functions and develop strategies for continuing to perform the functions during and following the event. Knowing the function criticalities and the recovery strategies is the starting point for creating a continuity plan.
For a continuity plan to be considered viable it should be exercised, and regularly updated as information in the plan changes.
A critical function is an activity a department performs regularly, that must be resumed within a set period of time and at a predetermined level after a disruption.
If a critical function cannot resume to the determined minimal level the institutional community is at risk for negative impacts. Impact examples include loss of life or property, injuries, reputation or financial damage, or lack of control/direction over the institution’s mission of instruction, research, and other essential services.
The criticality of a function (or an application that supports the function) is determined by the impact to the institution if the function cannot be performed. The importance of the application criticality is that if it supports a critical function, but is unavailable due to a network outage, data center issue, or something else, the critical function is at risk.
Conducting a business impact analysis (BIA) will assist in identifying a function and/or application criticality, and focuses on two exposure types, quantitative and qualitative, both of which should be considered. Some examples are listed here
To avoid an extensive and time-consuming BIA project, a simplified analysis can be conducted by objectively assigning a criticality based on one’s knowledge of the function and its assumed impact to the institution. However, this methodology must go through levels of approval beginning at the department level, then to the division level, and finally to an executive committee. The executive committee should approve a function’s criticality by analyzing a collective list of all institutional functions and determining where the functions fit within the institution’s mission and vision. Likewise, the supporting applications should be analyzed and in the same way.
Once the function and application criticalities have been vetted, a recovery hierarchy, or order of recovery can be determined. This hierarchy will also provide valuable information as to where resource requirements of staff, equipment, applications, etc., should be addressed.
A recovery strategy is the methodology for recovering a function if key people, normal work location, critical resources, or supporting applications are not available. These are sometimes called workarounds. Prior to developing the continuity plan consider what you would do if any of these are missing. Some strategies include:
Understanding and testing the recovery strategies during an exercise will ensure they are sustainable when needed during a live event.
A continuity plan is generally written at the department level and includes key contact information, the department’s functions that must be recovered quickly, and key resources needed for the functions to continue. A very important component of a continuity plan are strategies for recovery in the event any people, resources, applications, or normal work locations are not available. Considerations for instruction or research recovery should also be included, when it applies.
By its very nature, a continuity plan is written before an adverse event occurs, but if one doesn’t exist, documenting the critical elements of a plan as a department is working through an event will capture the information so that the department is better prepared for the next event, when it occurs.
At a minimum, the continuity plan should include the following information:
a. Department Contacts - contact information for all department staff. Be sure to capture alternate phone and email information in case the event displaces employees from their normal work location.
b. Institutional Contacts - contacts who are outside of your department but still within your institution, with whom you may need to communicate during the event. Some examples include:
c. External Contacts - external vendors, grantors, partners, etc., with whom you may need to communicate to provide updates, place special orders, redirect deliveries, etc. Be sure to document contact names, and contact information, along with an explanation of the relationship. It is important to consider alternate vendors in the event your primary vendor experiences an incident as well.
The recovery team consists of key staff members that will be responsible for carrying out the recovery effort for a department. A basic department recovery team includes a team leader, an alternate team leader, and team members. It is not unusual to have more than one team documented in a continuity plan if a person in the department is a member of another team, i.e., the incident management team.
Critical functions are those tasks a department completes day-to-day to contribute to the institution’s ‘products and services”, i.e., instruction, research, athletics, residential, food service, etc. Generally, we capture only the functions that are essential and must be resumed within two to three weeks of the initial adverse event. Some information to consider when capturing the critical functions is:
As discussed in section II, the strategies outline what the department will do if any of the following are not available during the recovery effort and normal operations are not an option.
Continuity plans for higher ed institutions must consider the components specific to instruction and research. Plans for these departments must still include the information outlined above, but more information is needed to capture the unique elements of these.
a. Essential Courses
b. Courses that must continue on campus
c. Strategies
Having continuity plans that include the items above, and an accurate understanding of what the critical functions are within an institution, is the starting point of a mature continuity planning program. However, just having the plans in place does not ensure a department is ready to manage through a recovery effort easily. Once completed a continuity plan should be exercised and maintained to ensure the team members have a clear understanding of what to do during an event, and that the plans do not contain any gaps.
Once a continuity plan has been documented it should be exercised. Exercising the plan through (at least) a tabletop exercise will help to educate the department staff on recovery activities, as well as each team member’s role and responsibilities during an adverse event. Live events are, of course, the best exercise and should be considered an excellent learning opportunity.
Whether a live event or an exercise, plans should always be updated with what was discovered, and any gaps can provide a roadmap for improvement.
.jpg)
