Business Continuity Planning
The purpose of business continuity planning is to provide for the continuation of critical business functions in the event of disruptions. The preparation for handling disaster contingencies is generally called business continuity planning or contingency management. A secondary purpose of business continuity planning is to minimize the effect of disruptions. Many potential contingencies and disasters can be averted, or the damage they cause reduced, if appropriate steps are taken early to control the event.
In accord with Commonwealth of Virginia standards, University management ensures the necessary allocation of resources for the development and maintenance of a business continuity plan for critical information technology systems for the support of critical business functions. As part of this planning, the University establishes plans to ensure that sensitive information is not compromised as a result of such disruptions.
The University develops, documents, maintains and periodically tests business continuity plans that provide reasonable assurance that critical data processing support can be continued, or resumed within an acceptable time frame, if normal operations of a business information system are interrupted. These plans include:
- Emergency response procedures appropriate to any incident or activity
that may endanger lives, property, or the capability to perform
essential functions.
- Arrangements, procedures, and responsibilities, including data
backup, offsite storage and contingency safeguards, that ensure
critical operations can be continued and that sensitive information
can be protected if normal processing or data communications are
interrupted for any reason for an unacceptable period of time.
- Recovery procedures and responsibilities to facilitate the rapid
restoration of normal operations at the primary site, or if necessary,
at a new facility, following the destruction, major damage or other
interruptions at the primary site.
- Minimally acceptable prioritized level of degraded operation of
critical systems or functions to guide implementation at the backup
operational site. The business continuity plan must accommodate
the established priorities.
- Interim manual processes to enable the continuance of critical operations in the absence of data processing support.
The business continuity plan for large systems supporting critical University functions is fully documented. Small systems, such as those located in the office environments, may develop more abbreviated and less formal plans. All plans are operationally tested at a frequency commensurate with the risk and magnitude of loss or harm that could result from the disruption of information processing support.
[Adapted from materials provided by the Virginia
Alliance for Secure Computing
and Networking (VA SCAN -- see http://www.vascan.org)]
UMW Response, Recovery and Continuity plans
Emergency Response Plan
- University Emergency Operations Plan (http://www.umw.edu/safety/emergency_operations)
Inventory of centrally-managed IT systems with criticality ranking and related support tiers
- This inventory is reflected in the Response Priority and Restoration Order matrix.
IT Systems Disaster Recovery Plans (these documents are restricted in access)
- University Business Systems Disaster Recovery Plan (under revision for Banner-related changes)
- Infrastructure Systems Disaster Recovery Plan (in progress)
- E-mail systems
- Major network components (including network diagram maintained by the Director of Infrastructure Services)
- File servers
Continuity Plans for Major UMW Business Functions (These documents are restricted in access)
[The following list includes possible topics for continuity plans, and some have not yet been developed or are in progress.]
- Access to Buildings when Card Access System is Down
- Food Service Activities when Envision System is Down
- Communication when E-mail System is Down
- Communication when Verizon Telephone Service is Down
- Phone message-taking when Voice Mail is Down (Fredericksburg Campus Only)
- Financial Accounting and Management when Banner System is Down
- Purchasing when Banner System or eVA is Down
- Credit Card Transactions when the Credit Card Gateway is Down
- Financial Aid Activities when Banner System is Down
- Human Resources Activities when Banner System is Down
- Student Information Activities when Banner System is Down
- Web-based Communication when Institutional Web Environment is Down