Welcome to the

September 11, 2011September 11, 20111:30pm 1:30pm –– 4:30pm4:30pm

presented by  

EDWARD S. DEVLIN & ASSOC.

Purpose

Mock Disaster Exercise

• To expose you to a simulated business disaster event, and the critical areas that are often an after thought in most continuity and recovery plans

Process• Work together with your teammates and other company departments (teams) to answer questions and respond todepartments (teams) to answer questions and respond to events based on your continuity knowledge

Payoff• Learn something you didn’t know before

• Have  fun!

Timeline

Mock Disaster Exercise

1:30 – 1:45 Welcome

Introduction 

Overview

1:45 – 3:15 Working the Scenarios

3 15 3 30 P S3:15 – 3:30 Prepare Summary

3:30 – 4:15 Team Summary

4:15 – 4:30 Conclusion

Ground Rules

Mock Disaster Exercise

• Designate your Team Leader

• Designate your Assistant Team Leader                           (must remain at your team table AT ALL TIMES)

• Work as a Team

Instructions

Mock Disaster Exercise

Instructions

ACTIONS (must GO meet with another team)

MEET (another team will come to you)

QUESTIONS (answer these as a team) 

YELLOW SHEETS (deliver to another team, vendor)

We’re here to help!

Mock Disaster Exercise

We re here to help!

See

“Dr. Disaster”

if you need him!

Welcome to  

Best Health Insurance Company

Albany, NY

General Information

Best Health Insurance Company

• Headquartered in 10‐Story Building

• Vital operations on all above ground floors

• Print and Mail Production Area, Storage, Loading Dock area located in basement 

• IT Department and the mainframe are located on the second floor

• Publicly held corporation

Best Health Insurance Company

• Publicly held corporation

• Offering:    Medical, Pharmaceutical, Dental, Behavioral Health, Group Life, Long‐term Care, Disability Plans and Medical Management Capabilities

• Three downsizings in the past twelve months

• Most recently reduced workforce by 2,500 employees

• Business Continuity Program

Best Health Insurance Company

• Business Continuity Program

• Prevention, Emergency Response and Business Resumption

• List of key executives & managers to be notified in the event of a business disruption

• Disaster Prevention

• Fire detectors, alarms, sprinkler system, security systems

• Emergency Response & Evacuation Plan

• Trained floor wardens, plan tested 2 x year

Business Resumption Plans

Best Health Insurance Company

Critical Applications – have been identified• Mock Exercise will deal with only 3 of those selected

Alternate Operating SitesIT – hotsite in Philadelphia PAIT  hotsite in Philadelphia, PAPrint/Mail – hotsite in Warminster, PABusiness Units – workspace recovery contract

Mock Disaster Exercise Objectives

Best Health Insurance Company

Mock Disaster Exercise Objectives

• Deal with departmental issues related to disaster 

• Process Critical Applications

• Print/Insert/Mail – Critical Applications

• Report status to Command Center and/or C‐Suite

Disaster Scenario

4:44 pm on Monday October 31st

Disaster Scenario

Explosion rocks the lobby of Best Health

•Portions of Second & First floors collapsed into

Disaster Scenario

Portions of Second & First floors collapsed into 

floors below

•Walls in basement and 1st floor – seriously damaged

• Explosion ruptured pipes, carrying water throughout the building and poured into basementg g p

• Security Dept. Command Center destroyed

• Electricity, phones, public address system and closed circuit TV monitors knocked out

Disaster Scenario

l h l f•Many employees have left building, a number are still in building

• Emergency response plan  unable to be activated

•No official accounting of•No official accounting of people in building

• Fourteen people injured and taken to the hospital

• Four killed

Disaster Scenario

Business Continuity Management Team arrive at the sceneBusiness Continuity Management Team arrive at the scene to learn: 

•Cause of the explosion unknown

• Second, First floors and basement suffered severe damage

• Smoke damage to upper floors• Smoke damage to upper floors

• Large amount of water in basement

•Building to be cordoned off for further investigation and safety reasons

Disaster ScenarioBasement Damage

Production Office Area

Insert Area

Print Area

Disaster Scenario

Business Continuity Management and Executives decide:Business Continuity Management  and Executives decide:• Employees will not be allowed back in building to work for at least a week, ‐ if the building can be safely shored up.

• Departments will temporarily transfer to alternate sitessites

• IT Recovery Plan will be activated 

•Print/Mail Recovery plan will be activated

What Are Your Next Steps?

Disaster Scenariop

1)  Designate your Team Leaders

2)  Read the following:

• The Disaster Scenario

• Your Team’s Workshop

3) As a team:3)  As a team:  

• Answer Questions

• Follow through on Actions

• Meet with fellow teams

Special Assignment

Disaster Scenario

Special Assignment

Volunteers Needed!

Disaster Scenario

See

“Dr. Disaster”

if you need help!

Disaster Scenario

Have Fun!

SUMMARY

TEAM SUMMARIES

Think About…

1) What did you learn that you didn’t know before?

2) Did anything surprise you?

Public Relations:  Determine Letter FormatD ft L tt

DATA SECURITY BREACH

Draft LetterPrepare Company Response for Media

Facilities & Security: Investigate the BreachNotify Law Enforcement , Agencies

Legal: Notify State and Regulatory Agencies of BreachLegal:   Notify State and Regulatory Agencies of BreachReview Breach Notification Requirements

HR & Accounting:   Prepare for Additional Call Center Personnel

IT: Investigate the incident

Prepare Data File of Affected Customers

DATA SECURITY BREACH

Prepare Data File of Affected Customers

Purchasing:   Acquire Forms, Envelopes

Print:   Print Letter

Mail:   Insert, Mail Letter

C‐Suite:   Confirm, Sign letter

Personal Letter - Notification to all Customers(Most effective way to reach your customers)

(State Breach Requirements ‐ #1 Suggested Method )

DATA SECURITY BREACH

Companies that use generic e mail blasts or form lettersCompanies that use generic e‐mail blasts or form letters 

for crisis notification   are more than 3 x times more 

likely to experience customer turnover than companies, 

using PERSONALIZED LETTER, telephone or a 

combination of both. 

(idtheftcenter.org)

THANK YOU!!