MHA Consulting ACP Houston Mock Dissster Exrecise (Jan 10 2017)

26 Pages·2017·12.87 MB·English

Mock Disaster Exercises
Mock Disaster Exercises
Sponsored by MHA Consulting Inc.
ACP Houston January 10,2017
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 1
MHA CONSULTING, INC.
KEY FACTS • A 17-year proven track record of
applying industry standards and
best practices across a diverse
pedigree of clients.
• A simple mission: Ensure the
17 15 CAPABLE GLOBAL SAAS
continuous operations of our
Years in Average years Comprehensive Diverse, global Compliance
operation. industry and risk tools. client’s critical processes.
suite of services.
client base.
experience.
• Services include Business
Continuity, Crisis Management,
SENIOR LEADER
Disaster Recovery, IT Best
Michael A. Herrera, CBCP
Practices and Physical Security.
Chief Executive Officer
Phoenix, Arizona
www.mha-it.com • SaaS tools include BCM
Compliance and Residual Risk.
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 2
DIVERSE, GLOBAL CLIENT BASE
SERVICES HEALTHCARE EDUCATION FINANCIAL INSTITUTIONS
CONSUMER PRODUCTS INSURANCE TRAVEL & ENTERTAINMENT GOVERNMENT/UTILITY
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 3
COMPREHENSIVE SOLUTIONS PRACTICES
ASSESS THE RECOVERY
RESPONSE & MAINTAIN &
CURRENT STRATEGIES/ EXERCISES
RECOVERY PLANS IMPROVE
ENVIRONMENT SOLUTIONS
§ Current State § Business Recovery § Crisis Management § Training & § Update Recovery
Assessment
Strategies Awareness Plans
§ Business Recovery
§ Business Impact
Analysis § Data Center § Mock Disaster § Update Current
§ IT Disaster Recovery
Recovery Strategies Exercises State Assessment
§ Threat & Risk
Assessment § Plan Functional § Update Business
§ BCMMETRICSTM Walkthroughs Impact Analysis &
Compliance Threat Assessment
Confidence (C2) § Alternate Worksite
Exercises
§ BCMMETRICSTM
Residual Risk (R2)
§ BCMMETRICSTM BIA
On-Demand (BIAOD)
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 4
TRACEY WILDER, CBCP & CBCV
BIO
• Business continuity and crisis leader with over 20 years of
industry experience.
• Holds a Bachelor of Honors degree as well as two certifications
in business continuity: CBCV & CBCP.
• Over the years Ms. Wilder has supported customers through
911, 2005 Hurricane Season, Hurricane Sandy, as well various
other events over the years.
• She led the implementation of work place violence training at
GE Capital as well as conducted BIAs and wrote plans for
organizations to meet FFIEC requirements.
• In past 3 years Ms. Wilder has been instrumental in establishing
policy and procedure related to evaluating external and
internal suppliers and their ability to support their customers
in the event of an incident.
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 5
DEFINITION
WHAT IS A
MOCK DISASTER EXERCISE?
… a simulation of an unplanned disruption that requires
participants to identify the actions and steps they would take to
successfully respond, assess impacts, activate resources and
recover in a timely manner..
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 6
THE SESSION
THE MOCK PROVIDE A
DISASTER EXERCISE CLEAR PICTURE
APPROACH & METHODOLOGY OF THE TYPES OF MOCK EXERCISES YOU CAN USE
• The ”Right” people • Tabletop Exercise/Structured Walk-Through Test
• The “Right” Planning • Walkthrough Drill/Simulation Test
• Increasingly complex exercises • Functional Drill/Parallel Test
• Trained participants • Full Interruption/Full Scale Test
• Maturity appropriate exercises
• Documenting the results
• Updating the process
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 7
TRENDS AND THE FUTURE
TRENDS THE
IMPACTING NEXT EVOLUTION
MOCK DISASTER EXERCISE PLANNING OF MOCK DISASTER EXERCISES
• Few organizations have best of class capabilities • Scenario agnostic –its about the impacts
• Little to no emphasis on training/exercises • Test real time capabilities in unplanned exercises
• Belief events will never happen to them • Fully integrate external agencies and partners
• Attention spans/availability / accountability /participation • Certify team members on a regular basis
• Refuse to exercise at the highest levels • Combination of mini and full exercises
• Don’t incorporate external agencies and partners • Use “Checklist Manifesto” approach
• Leaders can’t lead the team
• No standardized Incident Management process
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 8
PLANNING THE EXERCISE
PLANNING DOCUMENT
YOUR EXERCISE MUST NOT BE TKEN AN EXERCISE PLAN EVEN IT’S A SMALL
LIGHTLY. EXERCISE
Considerations Planning Document
• Exercise Planning Team • Purpose
• Maturity of the Team • Scope
• Time Constraints • Objectives
• Areas of Weakness • Assumptions
• Resources Required (People, Process, Technology) • Risks
• Exercise Type • Resources (People, Places, Things)
• Budget • Action Item Lists
Resources
• DHS Exercise Planning Guidelines
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 9
EXERCISE TYPE
SELECT AN
EXERCISE TYPE
APPROPRIATE TO YOUR TEAM, TIME & RISK THRESHOLD
• Tabletop Exercise/Structured Walk-Through Test –Novice/Days/Risk Low
• Walkthrough Drill/Simulation Test –Novice to Moderate/Days to Weeks/Risk Low
• Functional Drill/Parallel Test –Moderate to Advanced/Months/Risk Moderate to High
• Full Interruption/Full Scale Test –Advanced/Months/Risk High
© 2016 MHA CONSULTING. ALL RIGHTS RESERVED. 10