The University is one of the largest universities in New Zealand and ranks number 82 in the QS world rankings and 172nd in the Times Higher Education World University Rankings. There are around 42,000 students, 5000 staff, including non-academic staff, making a total population of about 47,000 people who are spread over 8 faculties.
A contaminated water supply had been blamed for a mass outbreak of gastroenteritis that had closed all the schools in the New Zealand town of Havelock, senior management was concerned how this infection could impact the University if the infection spread to Auckland. Particularly, they wanted to know how resilient departments were if key people developed the sickness.
Justin Richardson is the Services Transition Manager at the university with responsibility for Disaster Recovery and Business Continuity planning exercises within IT Services. As part of their continuous improvement programme, IT Services are required to conduct an annual exercise of their BCP and full exercise of their DR plans and IT infrastructure. The University also conducts separate exercises to test the enterprise Crisis Management Procedures and incident teams. In addition to the annual BCP and DR exercises, IT Services also runs more frequent DR tests of critical applications and services.
According to Mr. Richardson, the annual BCP exercise IT Services focused on the following core objectives:
- To test the effectiveness of succession planning arising from a major event resulting in the loss of available IT operations support staff;
- To ensure a repeatable BCP exercise could be developed with minimal investment in time and effort without the requirement for specialist facilitators.
The Exercise Scenario
The exercise was based on a number of events that were designed to take place over a period of 3 days starting on Monday morning. On that first morning the exercise was initiated when key members of IT staff failed to turn up for work and this situation continued to deteriorate over the next few days. With important deadlines to meet, the organisation was faced with the loss of critical staff that if not addressed, would result in a failure to deploy critical projects, causing embarrassment to the University, and an impact on the organization’s reputation.
Each participant is responsible for their own Business Impact Assessment and workaround plans based on the University templates.
Faced with running an exercise for the first time, Mr. Richardson turned to Google to find a comprehensive application for BCP (Business Continuity Planning). Senareo Cloud EM provided a complete end to end service based on ISO 22398 and 223001 standards, from initial exercise planning, scoping and scripting, through rehearsals and running of the live exercise.
The application also allows for live observations to be recorded during the exercise and gathering of participant feedback using online surveys via participants mobile devices.
Senareo Cloud EM also has a built in system that allows the exercise manager to save a current exercise as a template that can then be reused in future exercise.
As part of their implementation approach, Uplanit, the authors of Senareo Cloud EM , also set up Auckland University with their standard multi-instance rather than a multi-tenanted solution. This feature provides both separation of data and application from other customers reducing the potential impact from component failure and data breaches.
The exercise was run as a desktop simulation exercise using the “Media Presenter” function in Senareo Cloud EM to deliver images and scripts on an overhead projector. The exercise Facilitator controlled script delivery centrally with Senareo Cloud EM and supported by a media presenter, external actor and 3 observers as well as the 12 participants included in the test. The exercise took 2 ½ hours to complete and was followed up with the collection of survey and feedback data.
The positives that came out of the exercise for the organisation regarding the exercise itself were:
- Increase maturity of IT Services BCP/DR
- Expanded understanding of BCP procedures within IT Services
- Exercise clarified roles for Incident and Crisis management
According to Mr. Richardson, “Although it was difficult to measure in terms of time saved and given we were new to Senareo Cloud and it was our first BCP exercise for IT services, the support and Business Continuity expertise provided by senior consultant Steve Power, ensured we were able to deliver a successful exercise. Also, an important part of the Senareo Cloud EM solution to IT Services is the ability to create a reusable template from an existing exercise, allowing the exercise to be repeatable and therefore deliver time efficiencies going forward”.
Mr. Richardson stated that, ”As this was our first exercise we kept the use of tools to a basic projector, with minimal actors. As our knowledge and confidence with the Senareo Cloud develop we would expect this to change in the future”.
Mr. Richardson also said that, “The product was easy to use and intuitive enough to be able to complete this first exercise with minimal reference to the production documentation/videos”.
Although there is plenty of online documentation Mr. Richardson also confirmed that, “the time Steve made available was highly valuable and appreciated”.
Contact us for more details about Senareo Cloud EM here for more information.