ACRP Report 93:
Operational and Business
Continuity Planning for Prolonged Airport
Disruptions
FTI Consulting
FTI Consulting
FTI Consulting
FTI Consulting
Airport Operational Resilience
Agenda Agenda Agenda Agenda
How Safety/Security/Emergency Management Complement Business Continuity
ACRP 03-18 Project Background ■ Premise ■ Research Team ■ Research Methodology Findings Deliverables ■ Recovery Framework ■ Guidebook ■ Software Tool
Implications for Airports
Solutions Across the “Crisis Timeline”
Emergency Management
Business Continuity
Crisis Management
C
ris
is
M
a
n
a
g
e
m
e
n
t
Emergency Management Overview
■ Prevent, mitigate, respond to and recover from risks to life, life, life, life, property, physical assets and
property, physical assets and property, physical assets and
property, physical assets and infrastructure.infrastructure.infrastructure.infrastructure.
‒ Causes
‒ Incidents
‒ Responses
■ FocusFocusFocusFocus: incident-specific to “all-hazards”, catastrophes, and disruptions:
‒ Natural, climatological, meteorological
‒ Intentional man-made; unintentional man-made ‒ Business
‒ Technological
■ Objectives: Objectives: Objectives: Objectives:
‒ Build sustainable internal capacity for safety & emergency preparedness for clients ‒ Support property & casualty insurance placement
■ Deliverables: Deliverables: Deliverables: Deliverables:
– Emergency Management Plan
– Crisis Communication and Media Management Plan
Business Continuity and Disaster Recovery Planning
■ Manage, restore and recover essential functions, processes and essential functions, processes and essential functions, processes and essential functions, processes and data
data data
data during and after disruptions to operations.
‒ People
‒ Processes
‒ Plant and equipment
‒ Technology
■ FocusFocusFocusFocus: incident-agnostic functional recovery
■ ObjectivesObjectivesObjectivesObjectives:
‒ Establish a predictable recovery priority that maintains a “going concern”
‒ Addressing contingent supply chain continuity risks
‒ Support business interruption and contingent business interruption insurance
placement
■ DeliverablesDeliverablesDeliverablesDeliverables:
Project Premise Project Premise Project Premise
Project Premise ---- TRBTRBTRBTRB
Prolonged airport disruptions negatively impact the economy and the US transportation system.
While many airports have strong emergency management plans, they lack
operational and business continuity plans, which should complement their short term Emergency plans.
Risk Solutions International LLC (Now FTI Consulting Risk Solutions International LLC (Now FTI Consulting Risk Solutions International LLC (Now FTI Consulting Risk Solutions International LLC (Now FTI Consulting)
Independent operational risk consulting/advisory firm:
■ Business Continuity, IT Disaster Recovery ■ Emergency and Crisis Management
Market Expertise: ■ Consumer Products ■ Retail and Distribution ■ Education
■ Financial Services and Insurance ■ Local, State Government
■ Construction
■ Pharmaceutical, Life Sciences, Biotech ■ Manufacturing
Professional Certifications Professional Certifications Professional Certifications Professional Certifications
10 ■ MBCPMBCPMBCPMBCP – Master Business Continuity Professional
■ CBCPCBCPCBCPCBCP – Certified Business Continuity Professional
■ SBCI SBCI SBCI SBCI – Specialist – Business Continuity Institute
■ MBCI MBCI MBCI MBCI – Member – Business Continuity Institute
■ CHEPCHEPCHEPCHEP – Certified Healthcare Emergency Professional
■ CHSPCHSPCHSPCHSP – Certified Healthcare Safety Professional
■ CEMCEMCEMCEM – Certified Emergency Manager
■ MEPMEPMEPMEP – Master Exercise Practitioner
Research Team Research Team Research Team Research Team
Scott Corzine – Project Director and Principal Investigator.
Three senior, experienced certified BCP practitioners.
Seven experienced airport operations executives.
Project Scope Project Scope Project Scope Project Scope
Airport business and operating functions ■ Not aviation operations
■ Not IROPS ■ Not DOGS
■ Not downstream businesses
Airport-responsible functions and those provided by FBO’s, contractors, government agency or tenants.
Non-aviation operations that contribute materially to airports’ financial viability. Cause-agnostic recovery focus.
Biased:
■ Toward smaller airports and FBO’s
■ Toward non-professional, non-certified users Deliverables:
■ Guidebook
–Critical path framework ■ Software tool
Research Methodology Research Methodology Research Methodology Research Methodology
Literature Review
■ Open literature search: news, websites, journals, white papers, standards and regulations, TRB content, etc.
■ Relevant standards and guidance ■ Available airport BCP plans
■ Academic resources: refereed papers, aviation curricula ■ Records of relevant legislative committees/subcommittees
Issue: All “Preparedness Mandates” Addressed mainly Emergency Management ■ Homeland Security Act (and derivative Directives 5, 7, 8)
■ NIMS
■ National Response Framework ■ NFPA 1600
■ FAA AC 150-5200-31C
■ FEMA Comprehensive Preparedness Guide ■ ISO Standards
■ Et al.
Research Methodology Research Methodology Research Methodology Research Methodology
Continuity guidance
■ FEMA Federal Continuity Guide 1 ■ Continuity guidance Circular 1 ■ ISO standards
Data collection
■ Industry conferences: auditing key issues, creating participant database of airports ■ Industry interviews: industry stakeholder groups, trade associations, relevant
government agencies, aviation schools, NASAO, relevant labor groups
■ BCAP surveys: 41 surveys to self-selected matrix of airport types, sizes and
geography/dominant weather, shared infrastructure, FBO’s, and airlines (85% response = 35)
■ 6 Detailed Business Impact Analyses (BIA): Las Vegas, Salt Lake City, DIA, Louisville, Block Island, Fort Lauderdale Executive
BCAP Survey Matrix BCAP Survey Matrix BCAP Survey Matrix BCAP Survey Matrix
Large Hubs: DFW, JKF, SLC, DCA, DEN
Medium Hubs: Cincinnati, New Orleans, San Antonio, Reno Small Hubs: Savannah, Moline, Wilmington, NC
Non-Hubs: Juneau, Fort Wayne, Evansville, Grand Forks Commercial Service: Santa Fe, Block Island
General Aviation: Ohio State University, Van Nuys, Chandler, Ft. Lauderdale Executive, Tulsa, Boeing Field
Relievers: Teterboro, Worcester, St. Louis Regional Cargo: Louisville, Memphis, Miami, Sky Harbor
FBOs: Signature Flight Support, Jet Aviation, Central Parking System, Meridian Air Group, Landmark Aviation, Shelt Air, Clay Lacey Aviation
Airlines: UPS, Delta/Northwest, Jet Blue
Key Findings Key Findings Key Findings Key Findings
Lack of awareness. Not a strategic priority.
Confusion with emergency management.
Misconception that BCP is an incident-specific recovery recipe. BCP is uniquely challenging at airports.
No existing federal mandate specifically for BCP at U.S. airports.
■ Closest is DOT Advisory Circular 150/5200-31C focused on all-hazards emergency planning.
Few states appear to mandate BCP for their airports. ACRP 03-18 deliverables are likely to have an impact. ■ But adoption will require time and funding.
General Restoration Priority Framework General Restoration Priority Framework General Restoration Priority Framework General Restoration Priority Framework
Recovery Priority Scale Recovery Priority Scale Recovery Priority Scale Recovery Priority Scale
20
Score Value Definition Factors
Resolution Priority
3 Critical Loss of these functions causes immediate closure of airport.
FAA certification revocation, loss of core aviation capacity/infrastructure, terminal penalties. Must resolve immediately. 2 Important
Loss of these functions causes significant negative impact
and threatens long term airport viability.
Significant revenue loss, penalties, unsustainably higher cost structure, serious reputation damage, violation
of legal covenants and service level agreements.
Must resolve within one week.
1 Convenient
Loss of these functions causes modest or tolerable level of
negative impact.
Moderate but recoverable negative impact.
Should resolve when feasible.
0 Non-Existent or Non-Essential
These functions are not present at airport, or not at all
essential.
Business Continuity Planning Guidebook Business Continuity Planning Guidebook Business Continuity Planning Guidebook Business Continuity Planning Guidebook
Help airports and FBOs:
Understand business continuity planning.
Create a management structure to sponsor and support the process. Identify a team to develop a plan.
Develop recovery priorities, and the resulting plan.
Institute a process to create business continuity awareness and a “preparedness culture” throughout their organizations.
Business Continuity Planning Guidebook Business Continuity Planning Guidebook Business Continuity Planning Guidebook Business Continuity Planning Guidebook
Stand-alone “how to” guide.
Written to non-professional users. Primer on BCP.
Guide to using the software tool.
34 areas of business and operations:
Business Continuity Planning Software Tool Business Continuity Planning Software Tool Business Continuity Planning Software Tool Business Continuity Planning Software Tool
Survey Architecture Survey Architecture Survey Architecture Survey Architecture
Core BCP Methodology Built Into the Tool Core BCP Methodology Built Into the Tool Core BCP Methodology Built Into the Tool Core BCP Methodology Built Into the Tool
A data entry vehicle that documents important information about how every mission essential function works.
Overlays a relative recovery ranking based on airport-specific circumstances.
Captures the mix of resources necessary to operate each function and process at the “threshold” level:
■ People ■ Technology
■ Plan, equipment, supplies ■ Interdependent processes
Describes how to operate the function in the absence or degradation of key resources – “manual work-arounds”.
Documents with whom airports must communicate when disruptions occur. Documents who takes over when functional specialists are unavailable.
A description of how core functions and processes work, so intelligent people can craft an incident-specific response plan when disruptions occur.
Question Types Question Types Question Types Question Types
Question Types Question Types Question Types Question Types
“Home” Screen “Home” Screen “Home” Screen “Home” Screen
Survey Index Survey Index Survey Index Survey Index
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Survey Screen Shots Survey Screen Shots Survey Screen Shots Survey Screen Shots
Document Rendering Document Rendering Document Rendering Document Rendering
Document Rendering Document Rendering Document Rendering Document Rendering
Rendered Business Continuity Plan Rendered Business Continuity Plan Rendered Business Continuity Plan Rendered Business Continuity Plan
Business Continuity Plan Components Business Continuity Plan Components Business Continuity Plan Components Business Continuity Plan Components
Introduction ■ Organization
■ Distribution and Access ■ Mission Statement ■ Scope
■ Objectives ■ Assumptions
Concept of Operations
■ Roles and Responsibilities
■ Individual Plan for Functional Recovery ■ Functional Recovery Prioritization
■ Plan Activation and Deactivation
Functional Recovery Plans ■ Functional Description
■ Mission Essential Functions and Recovery Priorities
■ Business Recovery Teams ■ Critical Resources
■ Vital Records and Data ■ Alternate Facilities
■ Delegations of Authority ■ Succession Planning
■ Alert Notification Procedures and Call Lists Devolution
Reconstitution
Airport Business Continuity Planning is Critical Airport Business Continuity Planning is Critical Airport Business Continuity Planning is Critical Airport Business Continuity Planning is Critical
Disruptions create a cascading “multiplier” effect and impact on the financial “ecosystem” of airports: ■ Business ■ Tourism ■ Hotels ■ Car Rentals ■ Restaurants ■ Recreation
BCP is an important element of: ■ Business resilience planning ■ Risk management strategy ■ Meeting contractual obligations
■ Complying with standards and guidance ■ Liability management
Having no regulatory mandate for BCP in a critical infrastructure sector is remarkable. ■ Davos 2014 Risk Management Report specifically called on organizations to have BCP.
■ Cited natural catastrophes, meteorological risks and Cyber-risks among Top 5 CEO/Board issues. ■ DOT Advisory Circular 150/5200-31C barely skirts the topic.
Presented To:
