# Presentation: 040716

## Seven Deadly Sins of Contingency Planning 

***Seven Deadly Sins of Contingency Planning****** ***
- Bob Post, Principal
- Booz | Allen | Hamilton

## For the next hour, I’ll discuss...

**Contingency planning and its role in a comprehensive Infrastructure Assurance Program**
**The “Seven Deadly Sins of Contingency Planning”**
**Summary**
**Questions**

**Notes:**
Contingency planning, continuity of operations, continuity of government planning, and disaster recover planning, all high priorities in the aftermath of 9/11, but for the Information Assurance community they have always been a key component of an overall, sound, Infrastructure Assurance program.

The imperatives of Contingency Planning were demonstrated across both Government and Industry following the terrorist attacks as we watched Wall Street close down, the airline industry grind to a crawl and the US Postal System implement X-ray scanning and rerouting of mail bound for Federal office buildings and the White House. 

As contingency planning becomes a major focus area within Government and Industry it is important to develop, implement, maintain and test these plans in a manner consistent with proven best practices that will guarantee the continued operations of critical business processes in the event of an attack, natural or environmental disaster or other type service interruption.

Today, I will briefly cover the importance of contingency planning as an integral part of the overall Infrastructure Assurance Program, lightheartedly highlight what we consider the Seven Deadly Sins of Contingency Planning, and then, if time allows, gladly take any questions you may have.

## Contingency Planning must be part of an Infrastructure Assurance Program...

**Increased reliance on Information Technology supporting critical business processes demands contingency planning**
**Evolving threat environment inevitably will crack perimeter and boundary protection**
**Need for a respond, recover and resumption capability**
**Mandated by regulatory requirements**

**Notes:**
A comprehensive Infrastructure Assurance program must include contingency planning.  In addition to identify and implementing protection, detection and correction solutions, an organization must have a respond, recover and resumption capability when a crisis or disaster occurs, or when there is a disruption of service due to a failure of perimeter or boundary protection solutions.

Information Technology continues to change the way business is conducted in today’s digital economy.  As dependencies on IT increase, organization’s must plan for failures or disruptions in service, whether the source is a malicious intruder or a natural disaster.

Technology driven perimeter and boundary protection solutions are only as current as the known risk environment, requiring updating and reconfiguration when a new threat or vulnerability is uncovered.  These solutions will be circumvented, or will erode, requiring a mitigation solution to ensure continued operations of core business functions.

Organization’s who incorporate a respond, recover and resumption capability into their Infrastructure Assurance Program actually strengthen the other capabilities of protection, detection and correction associated with a life cycle approach to security.  High availability, redundancy, and no single-point-of-failure are some of the benefits to this approach.  
But, probably the easiest reason to understand the need for contingency planning is that for the Federal Government, it’s the law.  Current legislation and regulatory requirements levy stiff fines and penalties on organization’s who fail to develop comprehensive contingency plans.  Policy oversight groups continuously evaluate compliance and report their findings to the appropriate enforcement organization. 
	- PDD-63
	- GISRA

## Seven Deadly Sins of Contingency Planning...

**Not an all inclusive list**
**Provides hurdles or roadblocks to avoid **
**Not rocket science, but surprisingly overlooked by many organizations**

**Notes:**
To highlight the importance of contingency planning, we’ve come up with a list we affectionately call the “Seven Deadly Sins of Contingency Planning.”   

In the essence of time, I’ve listed what we consider some of the adverse effects associated with not having contingency plans.  We could spend an entire semester on this subject, and many accredited universities do, but our intention is to provide some ideas to consider and some pitfalls to avoid in addressing the contingency planning process.  

To many in government and industry, and those of us in the Information Assurance field, these sins may seem obvious.  Surprisingly, though, many organization’s fail to recognize the need for contingency plans, or believe they are important, but not enough to receiving funding.

## Seven Deadly Sins of Contingency Planning...

**Sin # 1 – Not having a plan(s)**
**Huge risk to the core business functions of the organization**
**Potential loss immeasurable**
**Legal liabilities**

## Seven Deadly Sins of Contingency Planning...

**Notes:**
Occupant Emergency Plan - Provides coordinated procedures for minimizing loss of life or property damage in response to a threat

Critical Infrastructure Protection Plan (CIP) - Identifies and protects physical and cyber-based resources vital to organization’s critical missions and national security

Continuity of Operations Plan (COOP) - Ensures continuity of essential agency-level functions at an alternate site during an emergency

Business Continuity Plan (BCP) - Assures continuity of all phases of a business process or program during an emergency

Physical Security Plan - Identifies vulnerabilities to facilities, personnel, operations, and resources and recommends mitigation actions 

Continuity of Government (COG) - Enables critical department and agency level services to be sustained during strategic national security crises

Disaster Recovery Plan (DRP) - Establishes specific procedures for recovering a process or IT system following a disruption

## Seven Deadly Sins of Contingency Planning...

**Sin # 2 – Not maintaining plans**
**Having a plan(s) is only the beginning**
**Require routine maintenance/updating**
**Must be dynamic and evolve as threats change**

## Seven Deadly Sins of Contingency Planning...

**Sin # 3 – Not exercising or testing plans**
**Contingencies are not part of normal operating procedures**
**Increased urgency and responsibilities require staff familiarity and training**
**Exercises must cover several types of contingencies**

## Seven Deadly Sins of Contingency Planning...

**Sin # 4 – Not raising awareness of plans**
**Contingencies affect everyone in the organization**
**Changes or updates to plans require acquainting staff with new procedures**
**Limits confusion and enables time sensitive decision making **

## Seven Deadly Sins of Contingency Planning...

**Sin # 5 – Not identifying essential functions**
**Not everything is mission essential**
**Need to identify and prioritize critical assets **
**Functions include infrastructure, people and processes**

## Seven Deadly Sins of Contingency Planning...

**Sin # 6 – Not identifying key roles and responsibilities**
**Chain of Command/Span of Control are essential**
**Must reflect current staff and their contact information**
**May extend outside the organization **

## Seven Deadly Sins of Contingency Planning...

**Sin # 7 – Not coordinating plans with partners**
**Many interdependencies exist in a crisis/disaster**
**Establishes boundaries, roles and responsibilities**
**Provides external functional expertise and specialists**

## Summary

**Contingency planning must be part of the Infrastructure Assurance Program**
**Eliminates false sense of security with technology driven perimeter and boundary protection solutions**
**Developing a plan is just the start**
**Don’t commit any of the Deadly Sins**

**Notes:**
An organization’s Infrastructure Assurance Program must include the respond, recovery and resumption capabilities provided by comprehensive contingency plans.  

This approach strengthens the protection, detection and correction capabilities supporting the perimeter and boundaries of the infrastructure and assures continued critical business operations in the event of a failure or service disruption due to a disaster or malicious intruder.  

Contingency planning is cyclic, threats evolve, organizational changes occur, critical IT assets are modified, all affecting contingency plan currency and accuracy.  Plans must be continual reviewed, updated, tested and exercised to be truly effective.

## Booz | Allen’s Continuity Planning Services...

**We provide clients with the right solutions to meet their unique continuity planning needs.**
**For more more information on Booz | Allen’s Continuity Planning Services, contact –**

- Zara Pyatt
- (703) 289-5150
- pyatt_zara@bah.com

- Bob Post
- (703) 289-5096
- post_bob@bah.com

## Seven Deadly Sins of Contingency Planning...

- ?