Policy of Oakland University

The Business Continuity plan is for Oakland University. This plan is aimed at maximizing the safety of humans and animals, which are within the campus, identification and minimization of danger, preserving and protecting property and restoration of normal services once a disaster has occurred. It also gives a plan for ensuring that there is an availability of critical business processes in case a man-made or natural disaster occurs (Kruis, 2014).

It is the policy of the Oakland University to:

Come up with a strategy for reacting to and recovering from difficult situations that are in line with acceptable risk levels

Initiate a programme of activity that will ensure the university has the ability to react to and recover from difficult situations in line with the  disaster recovery objective

Maintain an appropriate response plan that has a clear escalation procedure

Exercising of response and recovery plans annually

Have a level of resilience to operational failure that is in line with risk faced, level of negative effect that can emanate from failure and acceptable risk levels

Ensure that the employees are aware of the University’s expectations of them when an emergency or a situation that threatens business continuity arises. (Sneadker, 2013)

Take into account the changing needs of the university and ensure that business continuity plan is revised when necessary

The university will align itself with best practice in business continuity management

The Oakland University offers different courses and there are several faculty offices on campus. There are a number of lecture halls, library and canteen area. Additionally there are laboratories and a rescue centre for sick or injured animals. The University has 100 full time staff members and 500 students, both part-time and full-time. The business continuity plan will cover disaster management for the entire campus incase disaster strikes or operations are disabled.

The management of Oakland University will continuously ensure that the business continuity plan is monitored and performance outcomes are driven. They will approve the necessary budgets, ensure adequate staffing, participate in testing of plans and regularly review the business continuity plan.

Oakland University management will be responsible for risk assessment and escalation. Assessment will involve identification of threats and barriers, which may be present in the operating environment. Assessment of risk will involve measuring probability of risk and if it can become reality (Kliem & Richie, 2015). The key questions that will be asked during assessment are:

Description of Campus

What risk is facing Oakland University – how will the university recognize if it becomes a reality?

• What is the probability of the risk occurring – Is it high, medium or low?
• How serious is the threat to Oakland University – high, medium or low?
• What signals should Oakland University look out for?

 Any risk, which is assessed as highly likely to happen by Oakland University will need closer attention than those, termed as low or medium.  As the risks are being assessed, the university will consider the following strategies for dealing with risk:

• Risk avoidance– Some risks can be avoided all together
• Risk reduction– Regular reviews by the university can lead to the reduction of some risks
• Risk protection– Oakland University can take insurance to protect itself against some risks
• Risk management– Ensuring that the university has risk management plans
• Risk transfer– Difficult tasks that lead to higher risks can be passed to those organizations which can deal with them

Oakland University will come up with a risk log, which will include all the risks that have been identified together with an assessment of their probability and impact (Council, 2015). They will have plans to deal with these risks.

In critically doing risk assessment, Oakland University will take the following steps:

• Step 1: Identification of  hazards that can cause potential risk to the university
• Step 2: List who might be harmed by the hazard and how
• Step 3: Evaluation of the risks and making a decision on control measures
• Step 4: Recording of Findings
• Step 5: Reviewing the assessment and continuously updating

Oakland University will use the following table in assessing the likelihood and consequences of risks identified.

The business impact analysis provides a background upon which the business plan is developed. The key consideration for the business impact analysis will include:

• The damage to Oakland University, which can result from an adverse occurrence
• Determining if the deliverables are required by law
• The different levels of disaster that may affect Oakland University
• Identification of the importance or criticality of the functions
• Confirming if they affect the long term success of the University
• Understanding and defining recovery time objective for each function and prioritizing recovery

The management of Oakland University will define the recovery requirements for identified functions and the infrastructure and resources, which will be required to enable Oakland University function at a minimum acceptable level. The recovery requirements will be:

• The timeframe in which operations must resume and items must be replaced
• The business requirements for recovery
• Technical requirements for the recovery
• The manual process that will mitigate losses
• Identification of internal and external dependencies

An effective business management plan for Oakland University will have the following objectives:

• Employee and Rescued Animals Safety- The business plan must ensure health, emotional well-being and safety. All lives must be safe and there should be assistance programs in place to make sure that employees are able to get over any adversity that has occurred.
• Recovery of essential activities-Oakland University must make a documentation of processes and procedures which are needed to continue with the critical business functions during a disaster and after.
• Oakland University Assets protection-The university will have to document how they will protect and preserve the organization’s physical, financial, reputational and intellectual assets.
• Effective Communication-Oakland University has to make sure that it communicates to employees, students, clients and vendors before, during and after an adversity. Detailed instructions on how to distribute information should be put in place.

• Scope identification
• Key business areas identification
• Identify critical functions
• Identification of discrepancies between different business areas and functions
• Determining the acceptable downtime for different functions
• Creation of a plan to maintain operations

 In business continuity planning, Oakland University will have to adhere to regulatory compliance. The regulations by the state concerning health and safety and fire evacuation procedures must be met. The university must be aware of the local state rules and in the case where certification has to be obtained, they must comply with this.

In the business continuity plan, recovery and mitigation measures have to be considered. Mitigation is the effort by Oakland University to lessen the impact of disaster so that loss of life and property is reduced. Effective mitigation will only occur if Oakland University ensures that there is an understanding of local risks and investing in the well-being of its people. There must be therefore analysing of risk, reduction of risk and the university must insure against risk.

The disaster recovery plan will capture all information describing Oakland University’s ability to withstand any adversity as well as processes that will be followed in achieving disaster recovery. A disaster can occur from man or nature and will result in Oakland University’s IT department not being able to function and carry out regular roles and responsibilities for a while. Oakland University defines a disaster as:

• A number of vital systems being non-functional
• Buildings not being available for a certain period but systems within may be functioning
• The building may be available but systems inside are not functioning
• The buildings and systems are all on-functional

• Fire
• Flooding
• Power Outage
• War
• Terrorist Attacks
• Pandemic
• Theft

The aim of the disaster recovery plan will be to capture all information relevant to Oakland University to withstand disaster and documentation of steps, which will be followed in the event of a disaster. In the event of any disaster, Oakland University aims to prevent loss of lives. Before any secondary measures are initiated, the university will ensure that all staff, students, individuals and rescued animals that are in the premises are secure and safe. Once all life is brought to safety, Oakland University will be able to implement secondary measures so that normalcy can be restored as quickly as possible and this will include:

• Prevention of loss of University resources like hardware, data and physical IT assets
• Minimizing downtime arising from IT issues
• Keep business running in case of an adversity
• Restoring telecommunication
• Ensuring access to buildings is restored

• IT Networks
• Servers Restoration
• Telecommunications
• Data storage and backup
• Output of data devices
• Computers
• Oakland University software
• Oakland University Databases
• Physical access to buildings
• Physical Assets e.g. furniture and desks

• Business Continuity Leaders
• Disaster Management Group
• Facilities Department
• Servers and Network Team
• Operations Staff
• Management
• Telecommunications Team
• Finance Team

Risk Assessment and Escalation

Technology plays a vital role in management of disasters. Information technology can help to prevent and recover when an adversity strikes. Internet, GIS, remote sensing and satellite communication should be used by Oakland University in reducing hazards.GIS improves the quality and power of assessments of natural hazards and assists those planning in lessening measures (Agsary,2016). Remote sensing will help Oakland University to detect hazardous areas and in monitoring earth for any changes hence giving warning on impending disasters. Communication Satellites will enable the university to enable emergency communication to relevant authorities and provide timely measures. Appropriate resources must be invested by Oakland University in relevant technologies.

The media has a role to play during any disaster. There are activities in hazard mitigation which are dependent on mass media. Such activities will ensure that there is public awareness about risk and responses, which should be taken. Oakland University should collaborate with the local media houses as they change the society’s mindset so that they are more reactive rather than proactive. The media will initiate continous awareness trainings and can collaborate with university in carrying out drills. The media are also key when a disaster strikes as they help get news to the relevant bodies, which will assist.

The crisis management plan will provide a management structure, responsibilities assigned, emergency assignments and processes that will be followed during and after an adversity. Oakland University has come up with this plan to take care of the immediate requirements for a major adversity where normal operations are interrupted and special measures need to be taken to resume to normal operations (Smith, 2015). Oakland University has different classifications for crisis that may be faced.

A limited crisis is an adversity, which will occur but will not seriously affect overall functioning of the university but will require a certain degree of action to be taken. If it happens within a department, it can be small enough to be contained within. In some cases however, University Police or the emergency team may be needed. Such occurrences can be chemical spills, water leaks or plumbing failures.

An issue driven crisis will negatively affect the Oakland University. Such an incident can be severe and cause damage, which will lead to interruption of operations. The university may be the only affected entity within its locality. This can happen from occurrences such as protests, hate crimes or unauthorized occupancy in the campus areas.

Risk Mitigation Strategies

A major crisis will pose a great risk to the University staff, students, visitors, rescued animals and resources. It can lead to fatalities and major damage to the University facilities and infrastructure. It leads to a state of emergency and may affect the locality within which the university is located. Oakland University in this case will require help from the local authorities and the city’s emergency operations center (Kunthe, 2012). It may emanate from level one or 2 incidences. It may include but is not limited to occurrences such as an active shooter, explosion, floods, aircraft emergency or earthquake.

The plan is activated by Oakland University when emergency conditions exist and normal operations cannot happen hence action will be taken to:

• Save lives
• Ensure that there is coordinated communication
• Prevention of damage to facilities, systems and the surrounding environment
• Provision of essential services
• Temporary assignments of staff to perform emergency work
• Initiating emergency authorization to purchase and allocate resources

During most crisis, there are erratic reactions from employees and this can lead to poor decision making. When stress levels cross a certain threshold, people are unable to reason rationally. Oakland University has to carry out training so that during a crisis people behave as expected. The crisis management leaders must be trained and will be the point of reference during any crisis. They will monitor people’s stress levels and work with different teams to define desired expectations and outcomes.

The cyber security planning and event management will outline a risk mitigation process. It will also give recommended security controls and specify how the risk should be accepted or mitigated, actions to be taken, responsible parties and implementation timeline. The scope of the plan will be to put in place cyber security controls for Oakland University and mitigate risks brought about by various technologies (Bailey, 2015). The target audience will be the Oakland University security team, IT organization and leadership team.

• Security of People and Policies
• Security of Operations
• Insecure software development life cycle (SDLC)
• Physical security
• Relationships of Third-parties
• Security of Networks
• Security of Platforms

• Defining the Oakland University System
• Identification and classification critical cyber assets
• Provision of active executive sponsorship
• Identification and analyzing the electronic security perimeter(s) (ESPs)
• Performing a vulnerability assessment
• Assessing risks to system information and assets
• Selection of security controls
• Monitoring and assessing the effectiveness of controls
• Assigning the responsibility for security risk management to a senior manager

Emergencies can happen at any time and the first priority will be to ensure safety of lives in Oakland University (Reilly, 2015). Standard emergency procedures will be followed to ensure safety. The guidelines must be followed by the faculties, departments and units of Oakland University and will cover the following:

• Definitions
• Principles of emergency management
• Structures for emergency management
• Documentation  for emergency management
• Responsibility structure
• Testing and maintenance of emergency management processes

Oakland University will ensure the following perfomance standards are met with regards to emergency evacuation:

• Establishment of an emergency control organisation in all university buildings and areas occupied by staff, students and rescued animals
• The emergency control organisation will meet once every quarter
• Emergency procedures for buildings will be established and reviewed quarterly so that changes in staff or building alterations can be adequately captured
• Testing will be done every six months in each of Oakland University’s buildings

Oakland University will have an emergency evacuation plan for use in the different university buildings. The plan will exit paths and emergency exit doors (Parsons & Brouggy, 2015).

Oakland University will test all its plans to ensure that all disaster recovery requirements have been considered (Public Service Canada, 2015). The plans will be tested twice a year. The disaster recovery testing programme for different systems will determine which types of tests are to be performed and the scope. The process will be as follows:

• Setting of a test date
• Developing and circulating disaster recovery test scope to relevant departments
• Assembling a test team, confirming the disaster recovery test scope and identifying preparation tasks
• Reviewing of  the disaster recovery test report from the previous disaster recovery test
• Progressing the disaster test through change management
• Completion of  preparation tasks for the test
• Performing disaster recovery tests
• Completing post disaster recovery test activities

Oakland University will have a test team, which will prepare for and perform the disaster recovery tests (Orhan, 2014). This team will comprise of:

• Disaster Recovery Coordinator
• Representatives of different faculties and departments
• Students

12.0 Conclusion

A successful business continuity/ disaster management plan will have the desired results when Prince University does realistic tests for the business and technology processes. The plans have to be because of cooperative thinking and must be based on realistic analysis of business impact analysis. The plan must contribute the university’s overall success and should not just be an overhead exercise (Phelps, 2014). All staff and students of Oakland University must be aware of the business continuity processes. Management should involve all departments in plan formulation so that all areas are covered and the plans are effective.

13.0 References

Agsary, A. (2016, June 10). Business Continuity and Disaster Risk Management in Business Education: Case of York University. Retrieved from https://publicaciones.eafit.edu.co/index.php/administer/article/view/3562/2992 

Bailey, D. (2015). Business continuity management into operational risk management: Assimilation is imminent… resistance is futile!. Journal of business continuity & emergency planning, 8(4), 290-294.

Council, F. F. I. E. (2015). Business Continuity Planning, 2004. As of September, 23.

Kliem, R. L., & Richie, G. D. (2015). Business continuity planning: A project management approach. NY,CRC Press.

Kruis, A. (2014). Disconnected? Business Continuity Management put to the test a drama in three acts: A drama in three acts.

Kunthe, C. (2012, October 12). Difference Between BCP and DR. Retrieved from https://owl.english.purdue.edu/owl/resource/560/10/ 

Orhan, E. (2014). The role of lifeline losses in business continuity in the case of Adapazari, Turkey. Environmental Hazards, 13(4), 298-312.

Parsons, D., & Brouggy, P. (2016). Business Continuity Management. Disaster Health Management: A Primer for Students and Practitioners, 81.

Phelps, R. (2014). Rethinking business continuity: Emerging trends in the profession and the manager’s role. Journal of business continuity & emergency planning, 8(1), 49-58.

Public Safety Canada (2015, December 3). A Guide to Business Continuity Planning. Retrieved from https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/bsnss-cntnt-plnnng/index-en.aspx 

Reilly, D. (2015). Business continuity, emergency planning and special needs: How to protect the vulnerable. Journal of business continuity & emergency planning, 9(1), 41-51.

Smith, J. (2014). Business Continuity Planning (BCP) & Disaster Recovery Planning (DRP). Obtido em, 8.

Snedaker, S. (2013). Business continuity and disaster recovery planning for IT professionals. Newnes.