It's rare these days for anyone in IT to build a program from the ground up. Yet, I recently had the opportunity to establish a Business Continuity and Disaster Recovery (BCP/DR) program for the University Information Technology Services (UITS) group of the University of Connecticut in Storrs, CT (UConn). UITS is UConn's central IT service provider for over 40,000 students, faculty, and professional staff.
When I arrived at UConn, UITS had barely more than a basic BCP/DR Policy written by the Information Security Office that essentially says:
Each University department will maintain a current, written and tested Business Continuity Plan (BCP) that addresses the department’s response to unexpected events that disrupt normal business (for example, fire, vandalism, system failure, and natural disaster).
Apart from the policy, there was nothing else except a rudimentary Microsoft Word business continuity template that didn't even come close to meeting the University's needs. There were no IT contingency plans, no training materials, no instructions, no definitions, no other templates…nothing! How could anyone comply with a policy without the requisite accompanying program?
To complicate matters, UITS had been cited in audits for years for not having a Business Continuity and Disaster Recovery program in place. Around March of 2012, local news outlets picked up on the story about UConn's lack of preparedness and the University's reputation suffered. The audits also called out the need to hire a full time Business Continuity and Disaster Recovery Coordinator. As of this writing, that job has not yet been posted or filled. To date, the University has not provided a budget for Business Continuity and Disaster Recovery.
Business Continuity and Disaster Recovery Coordinator
In my role as Business Continuity and Disaster Recovery Coordinator, I reported into Jason Pufahl, Chief Information Security Officer. Jason shared his vision of what needed to be done and I was off to the races. At some point during the first couple of weeks, Jason commented, "I've never seen anyone hit the ground running so fast. Every time I talk to someone on campus about the need to meet and talk to you, you've already met with them!" For me it was no big deal. I was just doing my job. But what I accomplished for UConn over the next 6 to 7 months provided a foundation for a Business Continuity and Disaster Recovery program that rivals any other campus based resilience program in the United States. My hope is that they continue making progress in this vital area. What I delivered for UConn includes:
- BCP/DR Governance Teams Established
- UITS Emergency Operation Plan
- BCP/DR Toolkit & Document Library
- BCP/DR Integration Into New Project Process
- Critical Infrastructure Protection (CIP) Site in Chemistry
- Negotiated with University of Connecticut Health Center for CIP Remote Site
- IT Capital Investment Funds Requested
- Business Partner Training Program Established
This series of articles discusses the challenges discovered at UConn and describes how those challenges were overcome to build this program. All the documents created for the University of Connecticut are in the public domain and may be downloaded for your own adaptation.
UConn Part 2: BCP/DR Governance Teams →
Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation
Leave a Reply