Adams and Reese LLP
BUSINESS RECOVERY PLAN
Washington, D.C. Office
May 4, 2004
Adams and Reese LLP
BUSINESS RECOVERY PLAN
Table of Contents
PART A PLAN OPERATION
Section Section Name Page No.
1. INTRODUCTION 4
1.1 Statement of Policy 4
1.2 Purpose 4
1.3 Scope 4
1.4 Objectives 5
1.5 Assumptions 5
1.6 Business Recovery Management Team 5
2. DISASTER DEFINITIONS 6
2.1 Disaster Classification 6
2.1.1 Level I Disaster 6
2.1.2 Level II Disaster 6
2.1.3 Level III Disaster 6
2.2 Activation Procedure 6
2.2.1 Damage Limitation 7
2.2.2 Damage Assessment 7
2.2.3 Damage Declaration 7
2.2.4 Damage Notification 7
2.2.5 Interim Operations 8
2.2.6 Site Restoration 8
2.2.7 Resumption of Normal Operations 8
3. BUILDING EVACUATION PROCEDURES 8
4. ALTERNATE FACILITIES 9
4.1 Command Center 9
4.2 Staging Area 9
4.3 Alternate Operations Site 9
5. PLAN DISTRIBUTION 9
6. TRAINING GUIDELINES 10
7. PLAN TESTING 10
7.1 Overview 10
7.2 Test Management 11
7.3 Test Results Reporting 11
7.4 Testing Outline 11
7.4.1 Testing Procedure 12
8. PLAN MAINTENANCE 12
8.1 Maintenance Guidelines 13
9. BUSINESS RECOVERY MANAGEMENT TEAM PLAN 13
9.1 Business Recovery Management Team 13
10. HOT BOX ITEMS 16
PART B WASHINGTON, D.C. OFFICE PLAN 17
PART C SUMMARY CHART 32
1. Introduction
1.1 Statement of Policy
It is the policy of the Firm to have in place a Business Recovery Plan (“Plan”) for the Firm’s operations. The Plan shall provide for contingencies that could potentially affect physical property, data, personnel and client confidence. The Plan will provide for the re-establishment of critical business functions and the continued functioning of necessary operations or services on a priority basis. Development, implementation, testing and, when necessary, adjustment and revision of the Plan shall be the responsibility of the Business Recovery Committee. It is recognized that the degree and complexity of potential emergencies require flexible contingency plans.
1.2 Purpose
This Plan is designed to enable or re-establish continued functioning of the business operations within the Firm in the event of a disaster. Any disaster is a unique event and the provisions of this Plan can be used as the basis for controlling any recovery in conjunction with management’s discretion. Execution of this Plan will facilitate the timely recovery of business functions.
This Plan is based on a “team concept” recovery methodology. This means that all required recovery actions will be the responsibility of designated teams with specific instructions for each team for each section of the Plan. Employees in each department will have operations duties within their own areas of responsibility after the contingency working environments have been established. It is not the purpose of this Plan to detail standard operational procedures that already exist and are used daily.
This Plan depends upon the experience and knowledge of the Firm personnel to serve as the foundation of any recovery efforts regardless of the level of business interruption or disaster.
NOTE: This Plan is not intended as the definitive course of action. The disaster recovery team may need to modify the Plan and identify other action steps or responses, in order to respond to and recover from any specific situation.
1.3 Scope
The scope of this Plan is limited to the business and services carried out by the Firm and have been developed to:
· Identify levels of disaster and responses to each;
· Identify systems, tasks, and processes that are critical to the operation of each department or function, and define alternate procedures for business recovery;
· Identify personnel responsible for business recovery activities;
· Identify operations and processing locations, and;
· Identify the resources required to continue to function effectively (i.e. vital records, office furniture and equipment, data processing hardware and software, supplies and vendors, etc.).
1.4 Objectives
· To protect personnel, assets and informational resources from further injury or damage.
· Minimize economic losses resulting from interruptions to business
functions
· Provide a plan of action to facilitate an orderly recovery of business operations.
1.5 Assumptions
The following assumptions were made:
· One or more of the Firm’s current facilities are either partially or totally damaged or inaccessible.
· Key personnel, or their designated back-ups identified in the Plan, are available following a disaster.
· Alternate facilities are available for use and will be able to handle the specified additional volume.
· Procedures for back-up and off-site storage of computer media and manual files have been followed and the data is available.
· Critical resources listed in the Plan are available from identified suppliers or off-site storage.
1.6 Business Recovery Management Team
The Business Recovery Management Team includes the Managing Partner, the Chairman of the Executive Committee, CAO, CFO, CMO, CIO, HR Director and Office Manager (the Office Service Manager (OSM), if the disaster is in New Orleans, and PiC from the affected office. They will provide coordination and directions to all other affected personnel.
2. DISASTER DEFINITATIONS
2.1 Disasters are classified in three levels as described below:
2.1.1 Level I Disaster
A Level I disaster is one resulting in facility inaccessibility or loss of power or other life sustaining services for an expected period of up to 48 hours.
Damage from a Level I disaster is not large scale. It may consist of minor damage to the building, lack of access due to weather or city infrastructure conditions, or hardware or significant software damage.
2.1.2 A Level II Disaster
A Level II Disaster is one in which the outage is expected to last from two to five days.
Damage from a Level II disaster is of more serious nature than Level I and may mean heavier loss of equipment and documents (files, reports, contracts, etc.) due to a prolonged event (fire, flooding, etc.)
2.1.3 A Level III Disaster
A Level III disaster is one in which the outage is anticipated to last in excess of five days.
A Level III disaster is severe and could extend to total destruction of the building or service within the building, requiring replacement and/or significant renovation of the facilities.
2.2 Activation Procedures
The activation phases include:
§ Damage Limitations
§ Damage Assessment
§ Disaster Declaration
§ Disaster Notification
§ Interim Operations
§ Site Restoration
§ Resumption of Normal Operations
2.2.1 Damage Limitation
There are two types of disasters, those with warning that we can plan for, such as a hurricane, and those for which there is no forewarning. This paragraph addresses disasters for which there is time before the occurrence to make some preparations. In the event of advance warning of flooding or wind damage, the Chief Administrative Officer will contact the Managing Partner and Partner-in-Charge of the affected offices to trigger the damage limitations plan. It will include taking any feasible steps to ensure that Firm equipment or records will not be damaged or destroyed by the potential disaster, such as removing vital records, files and equipment from window offices, and securing items in a safe place. All files should be locked to avoid damage in the event of excessive winds or water intrusion.
2.2.2 Damage Assessment
Upon being notified of a disaster situation, the Business Recovery Management Team will begin the process of analyzing and assessing the damage. The purpose of damage assessment is to determine whether operations can continue at the Firm’s facility in a reduced capacity, or if relocation to an alternative facility is required. The assessment process will also identify which items (i.e. equipment, documents, etc.) are salvageable and which have been destroyed. An estimated “down” or “outage” time can be made, and the necessary actions be instituted.
2.2.3 Disaster Declaration
Utilizing the information from the initial damage assessment, the Business Recovery Management Team must determine if a disaster situation exists. Based upon the initial damage assessment, any disaster will be categorized into one of the previously mentioned levels.
2.2.4 Disaster Notification
If a disaster is declared, recovery team notification procedures will commence and the team will report to a pre-determined command center. Employees nonessential to the recovery process will be asked to remain at home pending the determination of the length and extent of the disaster. If necessary, all alternate recovery facilities will be notified.
A website, http://emergency.arlaw.com is available to check the status and updates in the event of an emergency. The CAO and CIO will coordinate initial input and updates.
A toll free number – 1-866-828-5161 has been set up for emergency calls.
2.2.5 Interim Operations
During the recovery phase, each recovery team will be responsible for performing a series of tasks and procedures to facilitate the resumption of their offices’ business processing. These tasks and responsibilities will be broken down by various time frames and may be general or specific to a particular office.
Once an alternate facility has been established, business functions can commence. These functions may be operating in a reduced capacity.
During this phase, the role of the Business Recovery Management Team will be to coordinate all the necessary tasks to ensure an effective recovery.
2.2.6 Site Restoration
This process entails all activities and procedures that are required to restore the Firm to normal operations.
2.2.7 Resumption of Normal Operations
Upon completion of the restoration of the Firm’s offices, these procedures provide a smooth transition from the alternative operating facility to the primary facility. The return will be a phased approach to reduce the potential for any additional disruptions or delays.
3. BUILDING EVACUATION PLAN
All employees should be familiar with the facility evacuation methods, guidelines, and associated floor plans for emergency exits. Each office has added its office specific evacuation plan.
The evacuation plan for each office is included in Section 3 of this Plan.
4. ALTERNATE FACILITIES
When a disaster occurs and the Firm’s current facilities are unavailable, three
alternate facilities may be utilized. This information is outlined in Section 2.
4.1 Command Center
In the event of a major disaster, a centralized command center will be established from which all communications and activities can be directed. The command center will be used to coordinate the management of recovery procedures and will be in continuous contact with all recovery teams and locations. The command center will contain a number of phones and fax machines, and will be large enough to accommodate the Business Recovery Management Team. In the event that a major disaster causes one or more of our offices to be inoperable for some period of time, another office will serve as the command center.
4.2 Staging Areas
One or more staging areas will be established for individuals to meet prior to relocating. The staging area performs two functions: (1) it provides safety by keeping personnel away from the disaster site; and, (2) it provides a common meeting area from which a headcount can be taken, and employees can be informed to proceed to an alternate facility or return home and await further instructions.
4.3 Alternate Operations Site
To maintain business recovery for the Firm, it is necessary to have one or more alternate locations where work may be resumed. These locations must be able to provide the proper environment for both systems and business support for the individual functions performed at the Firm.
Each office has identified Real Estate Brokers to assist in identifying these locations. This information is contained in Section 3.
5. PLAN DISTRIBUTION
A distribution listing for the Plan is outlined below. This section should be referenced whenever changes are made to the Plan as a result of plan maintenance, testing, or organizational changes. Proper distribution will ensure that appropriate personnel have a current copy of the Firm’s Business Recovery Plan.
It is the responsibility of each department to submit updates of their recovery plan to the CAO as necessary. All changes and/or updates will be submitted as they occur, but no later than one week from the date of the update and/or change. All changes and/or updates are to be sent directly to the CAO. He in turn will send to the distribution list amended/affected pages to substitute in each Business Recovery Management Team member’s copy of the Plan.
All Business Recovery Management Team members will have a copy of the Plan. A copy of the Plan in each city should be located off-site, (e.g., at home), to guarantee its availability for use during an emergency.
A complete copy of the Plan is stored on the emergency website.
Distribution
Business Recovery Management Team ( Full Plan)
Practice Group Leaders (Full Plan)
Partners-in-Charge and PiC Alternate (Office Specific Plan)
Facilities Manager/Office Managers and Alternates (Office Specific Plan)
6. TRAINING GUIDELINES
There are three levels of Plan training:
1. Team Training: provides a detailed review of the specific responsibilities procedures to be followed in the event of an emergency. It also explains the
make-up of a recovery team and how the team will facilitate the transition from disaster site to recovery site.
2. Orientation for General Staff: an introduction to business recovery planning providing employees with the opportunity to
become familiar with the terminology and procedures of business recovery planning, allowing them to be more comfortable
with a recovery plan.
3. Cross Training: allows individuals to understand all aspects of the recovery plan for their individual teams as well as other
teams, thus facilitating the implementation of a successful recovery plan.
7. PLAN TESTING
7.1 Overview
Testing the Plan allows the Plan to be periodically evaluated and verified in order to confirm its accuracy, and the preparedness of the individuals needed to execute the Plan.
Testing is an essential element of the Firm’s business recovery effort and must be performed to ensure that critical functions can, in fact, be accomplished according to the Plan and that all components of the Plan (i.e., personnel, hardware, software, etc.) function as expected.
Testing must demonstrate:
· System/technical compatibility
· Applications compatibility
· Adequacy of computer back-ups