You have been tasked with creating business continuity plans for Good Egg Auto loans. The business is to work with auto dealers to get loans for those with less than stellar credit. They have 3 business divisions, Account Opening and Funding, Account Servicing, and Collections. IT has two divisions Network support and Helpdesk. Everyone else is considered back office and will not be part of this exercise. Each team has approximately 100 people split between 2 facilities, Philadelphia and Dallas. Both are in similar office parks in the suburbs of their respective cities. For the midterm you must create a Business continuity plan for a small, medium and major incident. 6 plans all together. Make any assumptions you need to fill in any information gaps or ask your instructor for advice.
CT 415 Mid Term Resources for this mid-Term: (located in Week 5 Reading folder) Risk Assessment Survey_PHL Risk Assessment Survey_DFW Critical Business Function Survey Objective: You have been tasked with creating business continuity plans for Good Egg Auto loans. The business is to work with auto dealers to get loans for those with less than stellar credit. They have 3 business divisions, Account Opening and Funding, Account Servicing, and Collections. IT has two divisions Network support and Helpdesk. Everyone else is considered back office and will not be part of this exercise. Each team has approximately 100 people split between 2 facilities, Philadelphia and Dallas. Both are in similar office parks in the suburbs of their respective cities. For the midterm you must create a Business continuity plan for a small, medium and major incident. 6 plans all together. Make any assumptions you need to fill in any information gaps or ask your instructor for advice. Definitions: Small incident: Trashcan fire closes half the building for a day Medium incident: Power outage closes building for 2-3 days Major incident: Flooding closes the building for 4-6 weeks Grading rubric for this mid-term will be as follows: 15% PHL Small incident plan 15% PHL Medium incident plan 15% PHL Major incident plan 15% DFW Small incident plan 15% DWF Medium incident plan 15% DWF Major incident plan 10% Spelling, grammar, APA cites, formatting Critical Business Functions Template Identifying critical business functions is integral in resuming operations following a disaster. This template will walk you through the very important steps of identifying the most critical functions in your business. You may consider your critical functions as those activities that are vital to your organization’s survival and to the resumption of business operations. Typically, your critical functions are the business functions that are (1) most sensitive to downtime, (2) fulfill legal or financial obligations to maintain cash flow, (3) play a key role in maintaining your business’ market share and reputation, and/or (4) safeguard an irreplaceable asset. Keep in mind, the process of identifying your critical business functions will work in close conjunction with your risk assessment analysis. Steps: 1. Identify the critical business functions of your business. Please reference the following considerations when determining the importance of each business function. 2. Classify these critical business functions into the following categories: high (most severe), medium, and low (least severe). Please reference the proceeding graphs for an illustrated example. 3. Complete the Critical Business Functions Chart with each critical business function. 4. Attach the Critical Business Functions Chart in myAgility in the Document Management section. Considerations when Determining Criticality of a Function: 1. The business objective/goal this business function supports. 2. How often this business function occurs. 3. How many business units (departments) perform this business function. 4. Whether or not the successful completion of this function depends on any other business functions. 5. Whether or not other business functions are dependent on this function for their successful completion. 6. If there is a potential for significant revenue loss to the organization if this business function is not performed. 7. If there is a potential for fines, litigation, or other punishment for noncompliance due to a required regulatory requirement. 8. If noncompliance is tied to a specific downtime for this function. 9. Whether or not this function directly impacts your business image or market share of your organization. 10. The priority ranking you would give this function within the entire organization’s functions. Critical Business Function Classification The goal of these graphs is to help you identify when it is absolutely necessary to restore each of your critical business functions. Once you have determined the maximum downtime for each function, you will be able to prioritize your list in order of most to least critical. Consider the horizontal axis as downtime and the vertical axis as an impact scale. Each critical business function is going to rise over time (becoming a greater impact to your business). You can determine the impact category (high, medium, or low) of each business function by identifying which impact category the function is located in when it reaches its peak impact on your business. Critical Business Functions Chart After you have identified the criticality and maximum downtime for each critical business function, you will record each function and the impact it has on other business functions in the chart below. It is your objective to identify all the resources and personnel required to restore or reproduce this function during a recovery. After identifying what will be required to reproduce each critical business function, make sure you include a brief guide on how to restore this function in a recovery environment. Individual Form Function Criticality Maximum Downtime Employee /Team Required Resources Impacted Functions Brief Process to Complete Function Example: Insurance Claims High 2 Days A. Jones – Mgr. Alt 1: K. Smith Alt 2: R Keely 10 employees, phones, claim mgt software, paper forms Claims assessing, filing Take calls, document in system, file Example: Open new savings act. Low 1 Week L. Singleton Crisis Mgmt. Team 1 employee, account mgmt software, N103-B form, printer New accounts Customer completes N103-B form onsite, enter into system Account opening and funding High 4 hours B. Bechard- Dir. Alt 1: A. Stauffer Loan Origination system, Funding system, email, phone system, payment system Account opening, Acceptance acknowledgement, Dealer funding Autobots must process and send loans to account opening for final processing and funding for payment to dealers. Account servicing High 4 hours E. Calloway- VP Alt 1- J. Sylvester Alt 2- Aasif TBD Account Maintenance system, phone management system, email, Operations and Financial reporting including partner reporting (partners have longer recovery point objective); file transfer to servicing platforms and from servicing platforms to domain servers Varies; generally answering questions about loans and updating customer/dealer accounts. Subject to regulatory requirements, CFPB. Collections Med 48 hrs J.Jones Alt1 K.Kramer Collections management (CMS) Collection on overdue accounts Varies; generally answering questions about loans and updating customer/dealer accounts. Subject to regulatory requirements, CFPB. Network (including telecommunications) High Less than one hour T. Smith Mgr Alt 1: S.Carbone Alt 2: Chris Nguyen Routers, firewalls, hubs, switches, cabling, Active Directory Resolve end user issues; identify and resolve server and network issues; configure call routing Varies; from production impact outages to changes in configuration on existing devices Application (Originations) Support High Less than one hour J. Doyle Alt 1: Lisa Sonnenberg Loan Originations and supporting infrastructure; Collections management (CMS) Resolve end user issues; code enhancements Varies; from production impact outages to changes in configuration on existing platform Critical Business Functions Form (For use in developing recovery strategy for each individual function. Consider both isolated and regional interruptions) Business Function: Priority: _X_ High __ Medium __ Low Recovery Time Objective (Maximum Downtime for Function): Refer to above by business area (process) Employee in Charge: Refer to above by business area (process) Alternate(s): Refer to above by business area (process) Required Physical Resources to Perform/Restore this Function: Refer to above by business area (process) Required Personnel to Perform/Restore this Function: Refer to above by business area (process) Required Business Functions to Perform/Restore this Function: Refer to above by business area (process) Impact on other Business Functions when this Function is Down: Varies; complex combinations in IT depending on nature of issue Brief Description of Procedures to Perform/Restore this Function: Varies with problem type; must perform diagnostics to determine recovery strategy Risk Assessment Form To plan for recovery you must understand what risks threaten your organization and employees. This assessment checklist will guide you through identifying and rating these risks. You can then focus mitigation efforts on risks with higher importance, which is calculated by multiplying the probability (increasing 1 to 5) and impact (increasing 1 to 5) numbers. Use the blank rows to write in any other threats particular to your organization. We will consider risks to your supply chain in a separate checklist, so focus here on threats directly to your business and employees. Risk Importance ( Comments EXAMPLE: meteor strike to building Probability 1 5 No reasonable mitigation techniques. Ignore. Impact 5 EXAMPLE: transformer hit by lightning; power out for one week Probability 2 6 Install transfer switch to allow generator power Impact 3 Power outage: consider whether your grid is a priority for utilities to restore quickly Probability 5 25 Generator available Impact 5 Lost access to building: due to pest infestation quarantine, crime scene, etc. Probability 3 6 Low crime area with limited native pests Impact 2 Critical equipment failure: examples are email server, key file server, heat or A/C Probability 5 10 HVAC systems only; hardware off-prem where critical Impact 2 Phone/Internet outage: cut cable, phone company power loss, phone server down Probability 5 25 Business critical system Impact 5 *Fire: wildfires, nearby building fires, and chemical fires are possible sources Probability 1 5 Low likelihood Impact 5 *Tornado: and other high winds. Impact increased if building is not storm-proof Probability 3 15 Dust storms Impact 5 *Flood: may represent regional flooding from coast or rivers, or pipe bursts/leaks Probability 3 15 Increased likelihood of flooding; pipe bursts more likely Impact 5 *Hurricane/seasonal storms: Ice storms represent similar risk for other regions Probability 1 4 Low likelihood Impact 4 *Earthquake: weigh supply chain effects, not just your own building Probability 1 5 Low likelihood Impact 5 Employee absenteeism: those with unique skills or special needs for family Probability 2 8 Documenting Human Single Points of Failure Impact 4 Mass absenteeism: pandemic or transportation strike/outage are causes Probability 1 5 Low likelihood Impact 5 Explosion/Spill: heightened risk if near highway, railroad, airport, chemical plant Probability 2 Not near airport or rail Impact 2 Terrorism: communications and transport likely to cause secondary challenges Probability 1 1 Low likelihood; not a target Impact 1 Probability Impact Probability Impact Probability Impact *More information can be found in the associated threat checklist available on MyAgility Agility recommends that you review a checklist for each “risk” to best prepare your business and your people for all common threats. The map below demonstrates the frequency and variety of