Exhibit_2_-_AR_412_Continuity_of_Operations_Program.pdf

ADMINISTRATIVE REGULATION

A.R. NUMBER

4.12 NEW

FUNCTION

Legal Matters Page 1 of 5 SUBJECT

CONTINUITY OF OPERATIONS PROGRAM

EFFECTIVE DATE

November 1, 2021

REVIEW DATE

I. STATEMENT OF COMMITMENT

The City of Phoenix continues to grow, now home to nearly 1.7 million residents. It is vital to the welfare of its residents that the city provide vital services, performed without interruption, many times during adverse conditions or unexpected disruptions to business as usual. It is during these times that essential functions be continued or resumed as soon as possible. This is particularly important when a crisis, whether a natural disaster, technological emergency or human caused emergency, impacts the ability to provide needed services.

To ensure essential functions continue or are resumed quickly, each department shall develop and maintain a Department Continuity of Operations Plan (COOP) identifying and prioritizing their essential functions, outlining who is responsible for each function, as well as what is needed and where it will be accomplished. Continuity planning is one part of the City’s comprehensive Emergency planning, and collectively, ensures Continuity of Government

(COG).

The Office of Homeland Security and Emergency Management (OHSEM) is responsible for the administration and management of the Continuity of Operations Program, which includes managing usage of the BOLDPlanning system utilized for creating, maintaining and storing continuity plans; developing and conducting training to those identified by each department as Continuity Planners; developing improvement plans; reviewing each continuity plan for completeness; and providing feedback to department planners and department directors.

II. PURPOSE

The purpose of this regulation defines Continuity of Operations planning, as well as the requirements for each department or function in completing and maintaining continuity plans.

This regulation also outlines the roles and requirements of the Office of Homeland Security and Emergency Management in the administration and management of the Continuity of Operations Program.

A.R. 4.12 NEW

III. DEFINITIONS

The following definitions apply to the provisions of this administrative regulation:

“Alternate Facilities” are locations, other than the primary facility, used to carry out essential functions during a continuity event. Continuity Facilities are also referred to as Continuity Facilities and must be identified as part of the planning process.

“BOLDPlanning System” is a Software as a Service (SaaS) application provided through agreement with the Maricopa County Department of Emergency Management to facilitate the development, maintenance and storage of emergency management plans, including Continuity of Operations Plan.

“Continuity of Operations Plan” is the document produced from the planning process conducted by a department outlining their Essential Functions and the actions, personnel and resources needed to ensure essential functions are continued, or resumed as soon as possible, during an emergency or continuity event.

“Continuity Event” is an event impacting a department’s ability to operate under normal conditions (e.g., Power Outage, Cybersecurity event, Evacuation, etc.)

“Continuity of Operations Program Administrator” is the Emergency Management Director

“Continuity of Operations Program Manager” is an Office of Homeland Security and Emergency Management Planner responsible for managing the continuity planning process;

conducting training with department continuity planners in the elements of continuity planning and use of the BOLDPlanning System; providing assistance to departments in completing department continuity plans; reviewing completed continuity plans and providing recommendations for improvement; and assisting departments in conducting training, testing and exercises intended to prepare departments to implement the plan during a continuity event.

“Department Continuity Planner” is the person(s) identified by their respective department to develop the department’s continuity of operations plan.

“Essential Functions” are those functions that enable an organization to 1) provide vital services; 2) exercise civil authority; 3) maintain the safety of the general public; 4) sustain the industrial or economic base during an emergency.

“Exercise” means a discussion or operations-based activity allowing an organization to discuss or practice an emergency or continuity response in a controlled manner to assist personnel in learning how to apply plans to a simulated scenario, and apply lessons learned to improvement of the plan as well as plan implementation. (Exercise types are further described in Attachment #1.)

“Hazard Identification and Risk Assessment” is a process of identifying the hazards threatening the ability of a department from accomplishing an essential function and assessing the risk of the hazard occurring to identify mitigation and response actions to ensure continuity of essential functions or that they are resumed as soon as possible.

“Test” means to activate an operational process to determine whether the operation can be implemented as documented in the plan and to help improve the plan related to the operation. An example is testing a communication plan or system to ensure it serves the intended operation.

“Vital Records and Resources” are the important items the department requires to operate.

Some examples include software/systems, databases, specialized programs, spreadsheets or any other items the department relies on to complete its Essential Functions. Vital Records are not just electronic documents. Examples include official stamps/seals, watermark paper, maps, manuals, specialized equipment or other tangible materials. Steps to protect and ensure the availability of these resources must be identified in the planning process and resulting plan.

IV. GUIDELINES

A. Office of Homeland Security and Emergency Management Responsibilities

The Office of Homeland Security and Emergency Management is responsible for the management and administration of a Continuity of Operations Program for the City of Phoenix. The program will include the following:

1. Conduct group and individual training with departmental continuity planners designated by their departments in the:

a. Purpose of a Continuity of Operations Plan

b. Elements of an effective Continuity of Operations Plan

c. Use of the BOLDPlanning System to complete the planning process

d. How to conduct a basic continuity exercise

e. How to conduct a basic continuity test

2. Review department continuity plans on an annual basis, at a minimum to provide feedback related to gaps in the plan, as well as input intended to improve the plan and the planning process.

3. Assist department continuity planners in developing continuity plans, exercises and tests designed to educate department staff and improve their plans.

4. Develop an annual report to include:

a. Status of each department continuity plan, verifying the plan has been approved by the department director annually.

b. Number of training events, both group and individual planner training, conducted during the calendar year.

5. Maintain the BOLDPlanning System, including serving as the User Manager for assigned COOP plans to ensure access is provided for personnel in each department as needed to support the planning process, and revoked for those users no longer employed by the City of Phoenix, or no longer serving in a planner role.

6. Monitor compliance with this Administrative Regulation.

B. Department/Function Responsibilities

1. Each department and function in the city of Phoenix is required to develop a Continuity of Operations (COOP) Plan to ensure the most important functions of the department are continued during any emergency, or the department can resume those functions as quickly as possible. Exemption from this requirement is at the discretion of the Assistant City Manager or designee

2. Each department and function shall identify a lead planner to facilitate the planning process for their department. Additional planners may be identified based on the needs of the department and at the discretion of the department director or designee.

3. Participate in meetings and training event scheduled by the Office of Homeland Security and Emergency Management in use of the BOLDPlanning System, as well as basic and ongoing training in continuity planning.

4. Identify personnel within the department/function to have access to the BOLDPlanning

System, as well as the level of access needed, including:

a. User – Ability to edit any part of the plan

b. Viewer – Ability to view all parts of the plan, but has no editing capabilities

c. Administrator – System administration is reserved for the Continuity Program

Administrator and Managers

5. Complete a Hazard Risk Assessment to identify hazards and assess impacts that may prevent a department in accomplishing their essential functions to assist in developing measures to ensure they are continued or resumed within the established timeframe.

6. Complete continuity planning within their department, to include information gathering from each division within their department and documenting the information in the BOLDPlanning System.

7. Maintain their department continuity plan, ensuring it is up-to-date and approved by the department director on an annual basis.

8. Conduct staff training and a minimum of one test and one exercise annually within their department for members responsible for executing the continuity plan, ensuring the plan can be implemented effectively and members are aware of their roles during a continuity event. All training, exercises and tests shall be documented in the Training, Testing and Exercises section of the BOLDPlanning System.

V. ATTACHMENT

Attachment: Continuity of Operations Plan Test and Exercise Types

VI. QUESTIONS

Questions about this AR can be addressed to the Office of Homeland Security and Emergency Management at 602-534-0642.

JEFFREY BARTON, City Manager

By: ________________________________________ Toni Maccarone Deputy City Manager

036763 T Maccarone

ATTACHMENT

Continuity of Operations Plan Test and Exercise Types

Introduction

Tests and exercises are an important part of an emergency planning process, including Continuity of Operations and Business Continuity planning. Tests and exercises, based on a plausible situation, help train personnel to know what is expected of them during an emergency or continuity event; and, help identify gaps in a plan not previously considered, all to improve the plan. It is important to identify what works, what doesn’t work, and what was missed when the sky is blue, not when the storm has begun, and the organization has been adversely impacted.

Frequently the terms “Test” and “Exercise” are used interchangeably, but they are actually quite different! A test checks the ability of a function to be accomplished, for example, testing whether an employee can successfully telework from home during a continuity event. Do they have the right equipment? Do they have the right access? Do they have VPN to access the network, and do they know how to use it? Most importantly, do they have everything needed to accomplish their essential functions away from the office? A test might involve sending an employee home or to an alternate facility to work for a day to make sure they can continue to work normally or identify problems in need of a solution.

Exercises can take many forms, depending on how sophisticated, as well as how time-consuming, an organization wants to make it. There are five types of exercises that may be used, although some require considerable time, personnel and resources to accomplish.

1. Orientation

a. Training to introduce personnel to a new plan or process

b. Workshop intended to work on a plan or plan element with an end product in mind

2. Drill: An exercise designed to test a single emergency response function (e.g., Evacuation drill, Call Tree drill, etc.)

3. Tabletop Exercise: A facilitated, no-stress, discussion-based exercise, where a facilitator presents a narrative problem and leads a discussion about what will be done to solve it. Personnel involved in this type of exercise should have already participated in an orientation of the plan and be able to apply the current plan to the situation. Lessons learned during the exercise should be captured and used to improve the plan, conduct further training, and identify resource needs and make the program better. A tabletop exercise is the easiest and most common type of exercise used.

4. Functional Exercise: During a functional exercise personnel perform activities related to the plan being exercised. In a continuity or operations context, a functional exercise could involve a relocation to an alternate facility, simulating an event requiring a move and reconstitution of functions in the new space. The exercise would conclude when functions have been established and lessons identified.

Functional exercises are much more involved exercises requiring considerable planning, communication, safety considerations and evaluation to get the most benefit from the exercise.

5. Full-scale Exercise: The most rigorous and organizationally taxing is a Full-scale exercise. In this type of exercise, the event is made to be a real as possible, implementing the relevant plans and functions as needed to address the emergency.

For continuity plan purposes, Functional and Full-Scale exercises are the least common exercises to perform, particularly the Full-scale exercise. A Full-scale exercise is time and resource extensive with little value beyond what could be realized during one of the lesser complicated exercise types.

By far the most common and beneficial exercise type is a Tabletop Exercise, which can be conducted in as little as one to two hours around a conference room table. These exercises are designed to be low-stress and no-fault facilitated discussions aimed at helping people become comfortable with the plan; identify gaps or issues with the plan;

and get buy-in from those who will be responsible for the plan implementation during a continuity event. While still requiring planning and preparation, the time and effort are more reasonable for most departments.

While the Office of Homeland Security and Emergency Management (OHSEM) does not have the resources to plan and conduct exercises for each department, we are available to consult with and provide limited assistance in creating an exercise for city departments upon request by contacting your assigned OHSEM Planner.