Case Study

Continuity of Operations Plan Analysis and Documentation

Higher Education

We helped a university client optimize their business resiliency and security by conducting a Business Impact Analysis and documenting a Continuity of Operations Plan.

CLIENT’S CHALLENGE

Founded in 1935, Norfolk State University (NSU) has grown over the years into an independent HBCU with university status, serving more than 5,000 students. In conducting security assessments of several sensitive NSU IT systems, Impact Makers discovered that NSU’s Business Impact Analysis (BIA) and Continuity of Operations (COOP) Plan were not optimized to ensure effective recovery from interruption during a contingent event. ​ After Impact Makers identified this risk, NSU extended Impact Makers’ engagement to include modifying the BIA to identify essential functions and their supporting resources more clearly. NSU also requested that Impact Makers assist it in developing a COOP plan aligned with the BIA and conduct a tabletop exercise of the COOP Plan. Our university client had already engaged Impact Makers to conduct security assessments of several of their sensitive IT systems. During this assessment, it was discovered that their Business Impact Analysis (BIA) and Continuity of Operations Plan (COOP) were not optimized to ensure effective recovery from interruption during a contingent event. Trusting the work of the Impact Makers team, our client asked us to help them improve their BIA and COOP.

OUR APPROACH

The Impact Makers Risk team:
  • Worked iteratively with the client to establish the most effective course of action, while soliciting feedback and adjusting as needed
  • Developed a BIA focusing on both the essential and support functions needed to meet business unit recovery requirements. The plan was developed with a balance of making minimal changes to current processes and improving security
  • Documented a COOP to meet the recovery requirements identified in the BIA
  • Developed scenarios and conducted a tabletop exercise to the COOP and documented an after-action report

SKILLS AND TECHNOLOGIES LEVERAGED

Essential function and supporting resource identification​  -  COOP Plan development​ - Tabletop exercise development and execution - Information Security and Risk Management 

The Results

By engaging Impact Makers in these additional efforts, the client was able to develop business resilience planning documentation that:​
  • Their current recovery site was not practical during a contingent event, leaving the primary data center and important business operations vulnerable
  • Provided a roadmap of security and disaster recovery items to address to further optimize their COOP
  • Communicated services available during an event meeting first responder needs, ensuring the safety of students and staff