Scope_of_Services_Final_Draft.docx

Scope of Services: Consultant shall have experience, expertise, work product, and ability to identify potential disruptions, conduct a business impact analysis, develop recovery strategies, create communication plans, assign roles and responsibilities, test and exercise the plan, and provide ongoing maintenance and updates to ensure the Aviation Authority can maintain critical operations even during significant disruptions like natural disasters, cyber-attacks, or system failures; and who has capability to comprehend all aspects of the Aviation Authority including people, processes, system and operational technology, interdependencies, and regulations.

Majority of services shall require Consultant to be in person/on-site to maintain, exercise, and support the BCP program.

BCP Consultant shall be responsible for providing one or a combination of services, as assigned by Aviation Authority’s Risk Management department staff. This may include, but not limited to the following:

A. Subject matter expert to the officers of the Aviation Authority (Vice Presidents and Executives)

a. Provide guidance and recommendations to officers, in coordination with Vice President of Risk Management, to ensure preparedness and resiliency;

b. Recommend strategies, methodologies, and updates to policy, program, &/or procedures;

c. Monitor and advise on trends and impacts from disruptions that may affect airports or similar organizations addressing how the program is prepared/resilient or can be enhanced.

B. Maintenance of Existing Business Continuity Plan

a. Support department plan coordinator with its review, concepts, methodologies, and updates into its department plan to facilitate best practices in preparedness and resiliency

b. Perform annual audit of each department plan, ensuring each department plan coordinator has reviewed its plan and incorporated necessary updates into their plan;

c. Review and update training guides annually

d. Review and update Governance Plans bi-annually

e. Conduct quarterly Core Team working group meetings

C. Training of Aviation Authority staff or contractors

a. Training on various BCP topics applicable to existing program and procedures, specific to a plan, groups, recovery documentation processes, etc. which may require multiple sessions or modules.

b. Develop/Implement/Train on enhancements to existing program and procedures, including but not limited to documentation of an event that meets F-ROC/FEMA standards, Incident Management Roles & Responsibilities that align with NIMS standards, Department Recovery Coordinator Procedures, and Notification, Escalation and Plan Activation Procedures D. Exercise Business Continuity Plan with interdisciplinary goals (minimum of two, annually) E. Complete & update Risk Impact Analysis (3-year rotation) F. Coordination with Aviation Authority’s:

a. Emergency Management department, its working groups, their maintenance of the Aviation Authority’s Comprehensive Emergency Management Plan, NIMS, EMAP certifications, and other objectives and initiatives as it relates to emergency, safety, preparedness, or emergency response guidelines, regulations, agencies, etc.

b. Information Technology department, supporting the IT Disaster Recovery and ITG processes.

c. Other departments or initiatives that may have emergency, safety, preparedness, or recovery components, such as Florida Recovery Obligation Calculation (F-ROC), Federal Emergency Management Agency (FEMA), and Safety Management System (SMS) G. Coordination and Consulting with the Aviation Authority’s planning and implementation of its Enterprise Risk Management framework, which will require coordination with but not limited to SMS, asset management, Operational Readiness, Internal Audit, and other consultants of the Authority.