neca7.doc

77
Business Continuity Plan 2005

Upload: terry34

Post on 20-May-2015

370 views

Category:

Business


0 download

TRANSCRIPT

Page 1: neca7.doc

BusinessContinuity

Plan2005

Page 2: neca7.doc

Attachment 7Page 1 of 53

NECA Services Business Continuity Plan

1. Overview

This document describes how each department plans to operate during a disaster period. It identifies the critical business functions that will need to be performed, the staff required to perform these functions, and the operating procedures that will be followed. It includes a communication plan for each department and restores validation procedures.

This document will contain a plan for the following departments: Schools and Libraries, Billing & Collection and State Funds. Each department will have its own plan because of the different needs of each department. Billing & Collections and State funds are located entirely in the same building while the Schools & Libraries Department is located in two different buildings. The different locations for the Schools and Libraries Department warrants a different plan then the one used by Billing & Collections and State Funds. The two locations are 80 South Jefferson Rd and 100 South Jefferson Rd, Whippany, NJ. There are different action plans for each address.

Each Department plan is similar in nature and is broken up into the following five parts: Plan Overview & Maintenance, Major Functions, Communication Plan, Restore Validation procedures and Operating Procedures. In the event of business interruption during non working hours the notice will be sent out by way of an Alertcast system. See the attachment at the end of this section on how the Alertcast system works.

2. Objectives of the Plan

Promote awareness of our BCP initiative across all levels of the company to ensure continuation of service to our customers.

Educate company management on our Business Continuity principles of awareness, prevention, preparedness and recovery.

Inform company management on the procedures to follow in the event of a disruption.

Minimize delay in re-establishing business operations in the event of a disruption.

Provide management and critical staff a recovery blueprint in the event of a disruption.

3. Scope of the Plan

In addition to identifying strategies to promote awareness and prevention, this plan is intended to present the techniques and strategies for addressing a high level of preparedness as well as recovery efforts. Detailed plans for the recovery effort related to data/ network are part of the IT plan. Some areas of recovery (voice/data) are outlined in this document but are not intended to replace the detailed plans residing within the appropriate departments. Each department has developed plans that identify their critical resources and functions. Together these plans comprise the actual recovery strategy in the event of a disruption.

4. BCP Assumptions

The company has a backup data center.

Page 3: neca7.doc

Attachment 7Page 2 of 53

NECA Services Business Continuity Plan

Processes and technologies exist that keep the backup data center current.

Critical employees for each department have been identified and, initially, will be required to telecommute.

Those employees who are not equipped to telecommute can be teamed with partners who have access and equipment. Some alternative accommodations can be made in DR Site if needed.

All department plans are documented on the secure web site and with each department Business Continuity Coordinator

5. Program Pillars

The program pillars for the department as well as the company’s Business Continuity Planning are: awareness, prevention, preparedness and response planning. Each of these is fundamental to the success of our Business Continuity Planning.

Awareness

Company management has developed an Awareness Program that uses education, training and testing to reach employees and management staff. Communication is a key component of our awareness program and we will utilize various tools to inform general and critical staff of the roles and responsibilities of each team in the event of a business disruption.

An emergency response brochure for staff and management has been distributed to all company staff. New employees will receive a brochure during their orientation process as well as an incident matrix. They will also receive a copy of the evacuation process. All of these documents are also located on our web site.

Our intranet site includes all of the above mentioned documents. In addition there is a secured area on the site that includes the Corporate Plan (this document) as well as each of the department plans. These documents are only available to Business Continuity Coordinators Executive Staff and the Business Continuity IT team.

At a minimum, quarterly meetings will be held with the Business Continuity Coordinators to discuss any changes to their plans and to ensure names and numbers are updated to reflect the most current information.

An annual Business Continuity Awareness day will be held in October and updated brochures will be distributed to all company staff.

Upon announcement of a new program or business process, the BCP team will contact the appropriate company employees to educate them on the need to provide a continuity plan in the event of a disruption and offer assistance and templates. 

A monthly reminder will be sent to all staff deemed critical to instruct them to check their login capabilities. This reminder will be sent by the Business Continuity team.

Prevention

Page 4: neca7.doc

Attachment 7Page 3 of 53

NECA Services Business Continuity Plan

Physical security improvements, new security policies and the implementation of several security based computer tools have enabled us to provide a secure environment with a focus on prevention. Our ability to protect our desktops and network is fundamental to protecting our customers and our intellectual property. As part of our Prevention Plan we will continue to protect our facilities at 80 and 100 by:

Issuing Card Key access that controls access to secure areas such as Computer Room. Deactivating contractor and temporary badges within 24 hours of not being returned. Reviewing weekend and after hour access on a weekly basis. Automating the sign in process using PassagePoint to pre-register visitors. Providing Security Guard Service between the hours of 4 PM and 12 AM. Providing surveillance equipment. Automating building security and fire notification through Supreme Security. Performing Annual Risk Analysis for updating plan.

There will be continual updates and improvements to the security of our data and network by utilizing new technologies, procedures and policies some of which include:

An Incident Management Team to react to security breaches and virus incidents. Multiple layers of security to protect data and network. Working with outside security organizations (Infraguard/ASIS) that report on trends in the

security arena.

Preparedness

Preparedness in the event of a disruption will enable us to accelerate our recovery efforts and ensure our ability to continue to deliver services to our customers. To ensure we are prepared for a business disruption, the BCP team will focus on:

Conducting annual table top exercises to identify areas for improvement. Participating with outside organizations that provide information and guidance on BCP including

MCCC and ASIS, an organization for security professionals Working with departments to establish individual plans that highlight areas of responsibility,

critical processes and resources. Conducting periodic and annual testing exercises (Department testing is conducted quarterly and is

set up in the NECA IT Training Room so that immediate assistance can be given to those experiencing log in or data access problems. All problems encountered are logged into a database so that we can follow up on the problem before the next testing scenario.)

Recovery

Detailed data recovery steps are the responsibility of the IT organization and a comprehensive plan is included on our secure web site. Each department also has a plan that highlights their critical functions and personnel. The plans will be activated in the event we have a business disruption. Business disruptions can be categorized in one of three ways:

Level 1 – building intact but access limited. Level 2 – building inaccessible due to fire or other conditions. Level 3 – the event has a regional impact, affecting our ability to recover locally

In the event of a Level 1 event, NECA IT will most likely continue to operate the HQ data center and employees will access data via telecommuting.

Level 2 and Level 3 will most likely result in our switching over to the backup center facility in DR Site and dispatching some NECA IT personnel to aid in the transition of the operation.

Page 5: neca7.doc

Attachment 7Page 4 of 53

NECA Services Business Continuity Plan

The following will aid us in our recovery efforts: Back up generator designed to support computer room and PBX at 80. Agreements with vendors to reroute lines. Agreements with multiple ISP vendors. Redundant configurations for servers

6. Communications during the Interruption - Activating the Plan:

In a disaster situation, Department Management will be contacted as specified in the NECA Business Continuity Plan. The President will implement the Alert Cast System (See Attachment on how to use the Alert Cast System) in order to inform employees of the disaster situation. If the President is unavailable his designee will assume the role of the President. At this point contact will also be made to the Temporary Agencies in order for them to notify their temp employees of the situation. Verbal contact will be made by the President to the department management team who then will contact their direct reports, and they in turn will contact their direct reports. This will continue until all department staff has been contacted. Staff will be kept informed of developments by their managers and notified what responsibilities they will be assigned during the disaster. If one or more critical staff members are unavailable, department management will assign those responsibilities to another staff member. If the department requires the assistance of staff members from another department, department management will contact that person’s department management.

After initial contact, critical department staff will begin performing their assigned duties. Non-critical department staff will await instructions on specific assignments.

If the department employs temporary staff or consultants, department management will continue to update the firm providing the temporary staff or consultants.

Department management will ensure that critical vendors (see Attachment E in all sections) and customers will be contacted. Department management will contact other internal NECA/NSI groups with whom there is a critical interface that must be maintained during the disaster period (see Attachment C in all sections).

Voicemail and the Internet will be the primary modes of communication. Voicemail communication will be dependent on the availability of the NSI voicemail system. Internet communications will be the primary source of communication once the recovery effort in DR Site is complete. Restoration of e-mail is a top priority.

If there is a catastrophic event during business hours, evacuation procedures (as documented on the website) are to be followed. Within 12 hours of the building evacuation, all employees are to call the Human Resources Emergency Number (800-871-3242) to report on their condition. HR will monitor and report on employee status. If the event results in an extended outage, the number can be used for other HR needs such as benefit information. However, the immediate use of the number is to report on the status of employees in the event of a major building outage.

If the event happens after hours, your first notification will most likely be through the Alertcast Emergency Notification Services. This third party service will enable the Communications Coordinator or Department President to reach out for their staff using a broadcast message feature. Instructions are included under section 3.5 Staff Communications and in an attachment at the end of this document. Below is a description of the roles of the various coordinators in case we experience an interruption of Business.

Communications Coordinator’s Role

Page 6: neca7.doc

Attachment 7Page 5 of 53

NECA Services Business Continuity Plan

In the event a major disaster is declared, NSI’s Executive Management will identify a Communications Coordinator (Director Corporate Communications) who will review and approve all general communications to employees, vendors, customers and other stakeholders  This individual or his designee, will be responsible for the timely and accurate distribution of information and procedures related to reporting to alternate work sites or other pertinent information as well as any interfacing with media. This individual or designee will maintain a list of the entire Senior Management Staff (Director and above) and their home and alternate numbers. The individual will also maintain the Disaster Communication plan away from the headquarters location. It is important that an updated list of staff numbers is kept updated with the Alertcast server provider. An updated list will be provided on a monthly basis. A Communications Center will be established immediately. Building Services will immediately contract for space or a local hotel location to set up the Communication Center.

Business Continuity Coordinators

The BCP Coordinators are responsible for maintaining and updating their departmental plan. All Senior Management Staff and the Department Coordinator should keep these plans at home. Each coordinator will have a list of phone numbers of other company coordinators so they can assist in interdepartmental communications. These numbers are also on the secure website.

Senior Management Communications

In the event of a major building disaster, during business hours, the NECA VP of Operations will contact the President of NSI who will then contact Executive Management team of NSI. In the event the VP of Operations, President and other Executive Management are out of town or not available, the Executive Director of Information Technologies will assume responsibility to declare a disaster and contact the President, Executive Management and Executive team.

The President and Executive Management will determine the appropriate time for an emergency conference call that would include Executive Director levels and above to activate the Disaster Recovery plan.

At a pre-determined time, the Executive Management team will set up a reservationless conference call using our provider BT. The numbers are:

Staff Communications

A service has been established with Alertcast Emergency Notification Services that will enable the Communications Coordinator and/or individual management teams to reach out for their staff using a broadcast message feature.

Website Communications

After the website is re-established, staffers will be directed to utilize the site to obtain updated information.External CommunicationsIn the event of an extended business disruption, the Communications Coordinator will prepare statements to be communicated to our external customers, members and trade press. The following outlines who has responsibility for contacting these entities.

NCS Communications

Page 7: neca7.doc

Attachment 7Page 6 of 53

NECA Services Business Continuity Plan

If required, it is the responsibility of NSI to notify NCS.

Trade Press

It is the responsibility of NECA Corporate Communications to update the trade press if required.

Alternate Site Requirements

Activating the Business Continuity Plan will require the activation of the telecommuting plan. Each department has identified the critical resources needed to support the recovery of their business unit. There will be an immediate need for a central point to organize the recovery efforts. The Director of Customer Support Services will acquire a meeting place that will be set up as a Command Center. The Center will be staffed with support resources and will provide space for additional staff as required. Event dependent, the Command Center will be staffed for 10 hours per day. In the event more coverage is needed, multiple shifts will be defined.7. Telecommuting Plan

HeadquartersAll department heads must have a telecommuting plan included in their Departmental Business Continuity procedures. Each Executive Director has identified critical resources in their departmental recovery plan. The criteria for being designated a critical resource should be based not only on the business expertise they provide but each individual should also have a home PC and access in order for them to telecommute. Each of these individuals will be provided with Metaframe access, passwords, documentation and training. They are required to dial in to Metaframe on a monthly basis in order to update their access (this is done automatically when they log in). These individuals will be the first wave of telecommuters to access the system to begin business recovery. Once a disaster is declared, Help Desk personnel and additional IT personnel will relocate to a local hotel to provide support to those telecommuters requiring assistance. Building Services will also arrange to acquire additional hotel/meeting space so that the departments can convene a meeting for all telecommuters so that instructions on business recovery activities can be given. You can refer to the NECA 2005 BCP plan on voice and data recovery.

8. 80 South Jefferson Action Plan

Stage One: (If disaster occurs during business hours)1. Evacuate the building per evacuation procedures. 2. Handle fire/medical emergencies by calling 911 3. Shut down the power (emergency mode)

a. If orderly computer room shutdown is feasible, a member of the Building Services staff will wait to cut off power from electrical room.

b. If orderly shutdown is not feasible, a member of the Building Services staff will cut off power immediately by throwing major breaker in electrical room.

Stage Two:1. President, Executive Director of NSI or designee declares Disaster Recovery mode by contacting

the Chief Information Officer of NSI who will in turn contact NECA’s Director Customer Support Services – this will most likely occur during business hours. During non-business hours, Security will contact the Building Services group, who will in turn contact the Executive Director of IT, who will contact the Executive Director of SLD/RHC or designee. Fire and Police are automatically contacted through automated alarm system.

Page 8: neca7.doc

Attachment 7Page 7 of 53

NECA Services Business Continuity Plan

2. The NECA Director of Customer Support Services will assemble Building Services team at a predetermined location.

3. NECA/NSI Building Services Manager will contact Verizon and redirect 800 lines to Regional backup. Verizon will be contacted to redirect main list number to DR Site and DID numbers to a recording. We also have the flexibility to direct the 800 lines to any other identified number depending on requirements (Detail in Building Services Plan).  Lines are typically rerouted within 15 minutes.

4. NECA/NSI receptionist and additional Building Services staff members will be dispatched to Command Center to answer 800 and main list if they can not be handled by the DR Site office. DID’s will route to a recording or continue to be answered by voicemail if building and power are still intact.

5. NECA Communications Coordinator will provide the Building Services Manager with a prepared statement for callers.

6. Establish communications network (Details in Building Services Plan).

Stage Three:1. Finance (with Building Services and Insurance provider) assesses status of primary site.

2. Building Services’ priority is to find alternate space for critical business.

3. Enact long term Telecommuting Plan if necessary. 4. Document building / equipment damage.

a. Conduct detailed assessment of the site’s condition, support services, equipment & available supplies.

b. Assemble Building Services staff and contact appropriate vendors c. Identify all equipment that has been damaged. d. Identify all physical damage to the site environment. e. Identify all usable equipment, files and supplies. f. Create list of property that must be replaced. g. Determine minimum and maximum estimated times to recover data center. h. Building Services to provide information to Finance and wait for approval.

Stage Four:1. Establish a work schedule for rebuilding or replacing primary facility or determine location for

new space. a. Analyze the damage assessment of the data center.     b. Identify required vendors to assist in the restoration process. c. Review reconstruction plan with senior management.

2. Contact contractors regarding need to rebuild/replace the primary facility. a. Obtain bids and estimatesb. Analyze costsc. Wait on approval for reconstruction prices

3. Estimate time to rebuilda. Board approves bidb. Finance negotiates penalties for schedule delays and possible incentives for earlyc

completionc. Adjust completion date estimates to allow for unexpected delays

Page 9: neca7.doc

Attachment 7Page 8 of 53

NECA Services Business Continuity Plan

d. Select recommended vendorse. Distribute a rebuilding schedule

4. Rebuild primary facilitya. Choose contractorsb. Monitor reconstruction effortc. Complete the structural aread. Restore utility and security servicese. Restore environmental systems

5. Order equipmenta. Order equipment based on approved inventory lists and salvage reportsb. Order required cablingc. Confirm all delivery dates with vendors (negotiate penalties for delays)d. Install operating environmente. Schedule return to primary facilities

Building 100 Action Plan

Building 100 is dependent upon 80 for communications and data support. In the event that building 80 suffers a major disaster, the staff at 100 must be included in the recovery plan. However, there may be circumstances where building 100 experiences a major catastrophic event that does not involve 80. In the event it is only the fiber link between 80 and 100 that is lost, we have the ability to provide a wireless connection for data.  We are working on voice.

Page 10: neca7.doc

Attachment 7Page 9 of 53

NECA Services Business Continuity Plan

Attachment (A ) – How to use Alertcast

One-Call Notification through Alertcast Emergency Broadcast SystemIn an emergency, the Communications Coordinator will have an approved communication to be delivered to staff. The Communications Coordinator or Executive Director will make a single toll-free call to Alertcast from any touch-tone phone and record a message up to 90 seconds long. Once you hang up, your message is sent to all the numbers on your list – phone, cell or pager. This ensures quick, efficient and accurate notification.Lists have been set up for each department that include primary and secondary numbers (where appropriate) to call for each contact.

Notification OptionsStandard Notification – when a call is answered, a message you recorded is not delivered until the people on your list respond by keying in their 10 digit telephone number (described by the AlertCast call as your emergency notification number) using a touch tone phone. After keying their telephone number, they may then indicate whether they are responding, not responding or acknowledging that they received the message. NOTE: With this method, messages are not received unless the employee answers the phone and keys in their 10-digit “emergency notification number”. Absent their doing this, no message is left on answering machine or voicemail.

Express Notification – is ideal for the uninitiated responder and has been set up as our default. When a call is answered, the message is repeated up to three times to make sure that an answering machine or voicemail gets the full message. An answered phone is considered a delivered message.NOTE: This is the preferred method unless you must require confirmation or receipt.

ReportingAlertcast can fax you status reports that show who on your list has responded, how they responded and when. These reports can be faxed to you periodically during an emergency – as often as every five minutes- or after it’s over. The mailroom fax (973-884-8469) has been set up as the default but can be changed prior to sending your message by following the menu prompts.

To Send an Alertcast MessageDial from a touch-tone phone You will be prompted to enter the company’s account code followed by # and the security code followed by #You will be given the following menu options: 1 to start an event and record your message2 to change the default printer3 to have a copy of your list sent to the default fax4 to create an empty list5 to edit an existing list6 to delete a list9 to end the sessionAfter pressing 1 you will be prompted for the following information:Enter your list number (this is published in the Appendix of the DR Plan)Enter the number for retry intervals in minutes (up to 60) – this is the interval between retriesEnter the number of retries – this will control how many tries are made to a given number. If this is a test message you may want to enter 1 to cap the number of tries that will be madeEnter (1) for Standard Delivery or (2) for Express Delivery. Selecting 2 requires no action on the part of

Page 11: neca7.doc

Attachment 7Page 10 of 53

NECA Services Business Continuity Plan

the person receiving the callEnter (3) to request a Confirmation reportYou will be prompted to enter a Fax number for the report or to request it be sent to the default fax (in the mailroom) by pressing # You will then be prompted to record your messageAfter recording, press 1 to activate event or 2 – 3 to review and rerecord AlY receive the message along with everyone else.)

Page 12: neca7.doc

Attachment 7Page 11 of 53

NECA Services Business Continuity Plan

Schools and Libraries Division (SLD)Department/Group: Schools and Libraries Division (SLD)

Location: HQ – 100 South Jefferson Rd., Whippany, NJDR/BCP Coordinator: Tom Gill

Date: May 15, 2005

Table of Contents

1. Plan Overview & Maintenance

2. Major Functions

3. Communication Plan

4. Restore Validation Procedures

5. Operating Procedures

Attachment A – Staff Contact List

Attachment B – Processing Schedule/Critical Dates

Attachment C – Critical Interfaces

Attachment D – Critical Data Back-Up List

Attachment E – Vendor List

Attachment F – Organizational Equipment Requirement

Attachment G – Primary Site Equipment List

Attachment H – Workstations Required

Page 13: neca7.doc

Attachment 7Page 12 of 53

NECA Services Business Continuity Plan

1. Plan Overview & Maintenance

This document describes how the department plans to operate during a disaster period. It identifies the critical business functions that will need to be performed, the staff required to perform these functions, and the operating procedures that will be followed. It includes a communication plan for the department, and restores validation procedures.

The NECA disaster recovery site is located in Disaster recovery Site. During a disaster critical staff will telecommute, accessing the Disaster recovery Site using metaframe software. Any exceptions to this are noted in the operating procedures section of this document. Critical staff will use their metaframe software on a monthly basis to ensure it is working correctly.

This plan and attached documents are maintained on a continuous basis to reflect updated systems, operational and personnel changes. The plan will be reviewed by department management periodically to confirm any changes to the business environment. The Plan will be reissued on an annual basis.

The staff contact list (Attachment A), identifying critical staff and containing phone numbers and home email addresses for all department staff, is maintained by the Administration & Support Associate Manager and distributed to SLD Management, Human Resources and NECA IT Disaster Recovery Team. The document is updated and redistributed whenever someone leaves the department, or there is an addition to the department. On an approximately monthly basis, the document is reviewed for other changes.

NECA will conduct periodic tests of disaster recovery and business continuity procedures. During such a test the department will execute this business continuity plan and staff members will perform the duties assigned to them under the plan.

2. Major Functions

The following table lists the major functions performed by this department. The first column lists the function. The second column classifies each function in the event of a disaster as follows: Class 1 (most critical, essential to business survival, to be restored as soon as possible), Class 2 (critical, to be restored after Class 1 functions have been restored), or Class 3 (non-critical, will not be restored during the disaster period). The third column lists any computer resources (systems/applications/software) that the function requires.

Function Class Computer Resources

Executive 1

STARS, SIEBEL, GROUPWISE MetaFrame, DESKTOP FAX

Internal and External Websites

Invoicing1

STARS, SIEBEL, ISTARS, GROUPWISE MetaFrame, DESKTOP FAX

Internal and External Websites

Page 14: neca7.doc

Attachment 7Page 13 of 53

NECA Services Business Continuity Plan

Function Class Computer Resources

Technical Analysis1

STARS, SIEBEL, LASERFISCHE, ASTARS, ISTARS, GROUPWISE

MetaFrame, DESKTOP FAX

Internal and External Websites

Project Planning1

STARS, SIEBEL, LASERFISCHE, ASTARS, ISTARS , GROUPWISE

MetaFrame, DESKTOP FAX

Internal and External Websites

Client Operations2

STARS, SIEBEL, ASTARS, ISTARS, GROUPWISE MetaFrame, DESKTOP

FAX

Internal and External Websites

Program Compliance1

STARS, SIEBEL, ASTARS, ISTARS, GROUPWISE MetaFrame, DESKTOP

FAX

Internal and External Websites

PIA1

STARS, SIEBEL, GROUPWISE MetaFrame, DESKTOP FAX

Internal and External Websites

RHC1

STARS, SIEBEL, GROUPWISE MetaFrame, DESKTOP FAX

Internal and External Websites

Services2

STARS, SIEBEL, GROUPWISE MetaFrame, DESKTOP FAX

Internal and External Websites

Special Investigations 2

STARS, SIEBEL, ASTARS, ISTARS, GROUPWISE MetaFrame, DESKTOP

FAX

Internal and External Websites

Page 15: neca7.doc

Attachment 7Page 14 of 53

NECA Services Business Continuity Plan

3. Communication Plan

In a disaster situation, Department Management will be contacted as specified in the NECA Corporate Disaster Recovery plan. The Executive Director will authorize HR to implement the Alert Cast System in order to inform employees of the disaster situation. At this point contact will also be made to the Temporary Agencies in order for them to notify their temp employees of the situation. Verbal contact will be made by the Executive Director to the department management team who then will contact their direct reports, and they in turn will contact their direct reports. This will continue until all department staff has been contacted. Staff will be kept informed of developments by their managers and notified what responsibilities they will be assigned during the disaster. If one or more critical staff members are unavailable, department management will assign those responsibilities to another staff member. If the department requires the assistance of staff members from another department, department management will contact that person’s department management.

After initial contact, critical department staff will begin performing their assigned duties. Non-critical department staff will await instructions on specific assignments.

If the department employs temporary staff or consultants, department management will continue to update the firm providing the temporary staff or consultants.

Department management will ensure that critical vendors (see Attachment E) and customers will be contacted. Department management will contact other internal NECA groups with whom there is a critical interface that must be maintained during the disaster period (see Attachment C).

4. Restore Validation Procedures

The Director of SLD Systems will direct the restore procedures. Upon notification that Information Systems has completed the process of restoring data, systems, and software, department staff will verify that any critical data is correct, and that the required systems and software are available and functioning correctly. If validation of data requires the retrieval of information from offsite storage (identified in Attachment D), department management will contact the Purchasing group to request that the appropriate information be retrieved.

Verification and validation procedures are as follows:

The Director of Program Planning and Systems will be responsible for verifying the validity of the Schools and Library/Rural Heath Care Data.

The Technical Analysis group will confirm the following:

Alternative ISP ConnectivityFirewall ImplementationMetaFrame FunctionalitySLD Public WebsiteSLD Internal WebsiteSTARS AvailabilityISTARS AvailabilityASTARS AvailabilityAppeals DatabaseSLCPIA Tracking

Page 16: neca7.doc

Attachment 7Page 15 of 53

NECA Services Business Continuity Plan

Eligible Services MatrixRHC SIDSRHC PATSRHC Contact Log

Upon notice that the system has been restored by Information Systems and the above areas confirmed by PIA’s Technical Analysis group the following steps will be taken:

The Senior Technical Analyst will run the PIA Report for the daily counts. This will be reviewed by the PIA Director for any discrepancies. The PIA Director will notify the individual PIA Team Managers that daily processing can resume.

The Technical Analyst will verify Image volume with NCS. System updates will be made if necessary.

The Invoicing manager, QA Manager, RHC manager will run reports to confirm valid production data prior to resuming daily processing. Since the management team has Remote Access Capability, these reports can be run from a temporary worksite if one has been established, or from their homes.

5. Operating Procedures

Operating procedures describe how the department will perform critical business functions and meet processing schedules/critical dates (see Attachment B) during the disaster period.

Attachment (H) outlines month by month the number of workstations that will be needed at an alternative work site for both a moderate and long term outage. The number of employees that have the ability to telecommute can reduce these numbers.

Operating procedures can be found on H:\PICOMMON drive for the following departments:

Program Integrity Assurance (PIA)Client Operations/ServicesInvoicingProject Planning, Measurements & ReportingProgram ComplianceRural Health Care

Page 17: neca7.doc

Attachment 7Page 16 of 53

NECA Services Business Continuity Plan

Attachment A – Staff Contact List

Page 18: neca7.doc

Attachment 7Page 17 of 53

NECA Services Business Continuity Plan

Attachment B – Processing Schedule/Critical Dates

The following is the processing schedule and critical dates associated with the critical functions that must be performed by the department during a disaster period. The first column lists the critical process or task and the second column lists the date the process or task must occur.

Critical Process/Task Date

See SLD Contract with USAC

Page 19: neca7.doc

Attachment 7Page 18 of 53

NECA Services Business Continuity Plan

Attachment C – Critical Interfaces

The following is a list of critical interfaces for the department during a disaster period. The first column lists the critical process or task and the second column lists the organization interfaced with.

Critical Process/TaskOrganization Interfaced

With

Daily Production Support NECA IS

Siebel Support NCS

Letter Support NCS

Processing Support NSC

Website Support NSC

Telecom Download PWC

Invoicing PWC

Page 20: neca7.doc

Attachment 7Page 19 of 53

NECA Services Business Continuity Plan

Attachment D - Critical Data Back-Up List

The following is a list of critical information stored off premises which must be retrieved in the event of a disaster. The list must include a description of the critical data back-up, where the data is stored and some type of reference to easily identify the data.

Description of Back-Up Data Stored AtLocation Reference

(If Applicable)

SIEBEL NCS Kansas/Iowa

All other data backed up by NECA IS.

Page 21: neca7.doc

Attachment 7Page 20 of 53

NECA Services Business Continuity Plan

Attachment E – Vendor List

The following is a list of vendors unique to your organization who must be notified in the event of a disaster.

Vendor Name Product Phone Number

NCSVarious Les Bice

785-838-2201

USACGeorge McDonald

202-263-1629

Page 22: neca7.doc

Attachment 7Page 21 of 53

NECA Services Business Continuity Plan

Page 23: neca7.doc

Attachment 7Page 22 of 53

NECA Services Business Continuity Plan

Attachment F - Organizational Equipment Requirements

Please indicate any equipment requirements for the department that are in addition to the home PCs and equipment used for telecommuting during the disaster period.

Quantity Equipment/Furniture Description

See Spreadsheet titled “Attachment F”

Page 24: neca7.doc

Attachment 7Page 23 of 53

NECA Services Business Continuity Plan

Attachment G - Primary Site Equipment List

Facilities maintain a list of standard office equipment and furniture in use by the department. Please use this form to list any specialized equipment beyond the list of standard office equipment and furniture that is necessary to restore the primary site to the condition it was in prior to the disaster.

Quantity Equipment/Furniture Description3 High speed Scanners6 Fax Machines

Page 25: neca7.doc

Attachment 7Page 24 of 53

NECA Services Business Continuity Plan

Attachment (H) - Business Continuity Planning Workstations RequiredJan Feb Mar Apr May Jun Jul Aug Sept Oct Nov De

cModerate Outage

PIA 25 25 25 25 25 25 5 5 5 5 5 25Services 3 3 3 3 3 3 3 3 3 3 3 3RHC 4 4 4 4 4 4 4 4 4 4 4 4Invoicing 5 5 10 10 10 5 5 5 5 5 5 5Program Compliance 5 5 5 5 5 5 5 5 5 5 5 5Client Operations 9 9 9 9 9 9 9 9 9 9 9 9Project Planning 2 2 2 2 2 2 1 1 1 1 1 2Technical Analysis 6 6 6 6 6 6 6 6 6 6 6 6Executive 2 2 2 2 2 2 2 2 2 2 2 2 TOTAL 61 61 66 66 66 61 40 40 40 40 40 61

Jan Feb Mar Apr May Jun Jul Aug Sept Oct Nov Dec

Long Term OutagePIA 100 100 100 100 100 100 25 25 25 25 25 50Services 3 3 3 3 3 3 3 3 3 3 3 3RHC 8 8 8 8 8 8 8 8 8 8 8 8Invoicing 5 5 10 10 5 5 5 5 5 5 5 5Program Compliance 10 6 6 6 6 6 10 10 10 10 10 10Client Operations 9 9 9 9 9 9 9 9 9 9 9 9Project Planning 4 4 4 4 4 4 4 2 2 2 2 4Technical Analysis 6 6 6 6 6 6 6 6 6 6 6 6Executive 2 2 2 2 2 2 2 2 2 2 2 2 TOTAL 147 143 148 148 143 143 72 70 70 70 70 97

Page 26: neca7.doc

Attachment 7Page 25 of 53

NECA Services Business Continuity Plan

USPS – State Program OperationsLocation: HQ - 80 South Jefferson Rd., Whippany, NJ

DR/BCP Coordinator: Donna CaseyDate: August 31, 2004

Table of Contents

1. Plan Overview & Maintenance

2. Major Functions

3. Communication Plan

4. Restore Validation Procedures

5. Operating Procedures

Attachment A – Staff Contact List

Attachment B – Processing Schedule/Critical Dates

Attachment C – Critical Interfaces

Attachment D – Critical Data Back-Up List

Attachment E – Vendor List

Attachment F – Organizational Equipment Requirement

Attachment G – Primary Site Equipment List

Page 27: neca7.doc

Attachment 7Page 26 of 53

NECA Services Business Continuity Plan

1. Plan Overview & Maintenance

This document describes how the department plans to operate during a disaster period. It identifies the critical business functions that need to be performed, the staff required to perform these functions, and the operating procedures to be followed. It also includes a communication plan for the department and restores validation procedures.

The NECA disaster recovery site is located in Alpharetta, GA. During a disaster, critical staff will telecommute, accessing the Alpharetta site using metaframe software. Any exceptions to this procedure are noted in the operating procedures section of this document. Critical staff will use their metaframe software on a monthly basis to ensure it is working correctly.

It is essential that this plan be maintained. The documentation must be reviewed periodically by department management updated to reflect any changes to the business environment.

The Staff Contact List (Attachment A), which identifies critical staff and contains phone numbers and home email addresses for the department, must be distributed to each staff member.  This document must be updated whenever there is a change in personnel or contact information.  On a monthly basis, the document must be reviewed by department management to ensure that it is current in all respects.

NECA will conduct periodic tests of disaster recovery and business continuity procedures. During such tests, the department will execute this business continuity plan and staff members will perform their Business Continuity assigned duties.

2. Major Functions

The following table lists the major functions performed by this department. The first column lists the function. The second column classifies each function in the event of a disaster as follows:  Class 1 (most critical, essential to business survival, to be restored as soon as possible), Class 2 (critical, to be restored after Class 1 functions have been restored), or Class 3 (non-critical, will not be restored during the disaster period). The third column lists any computer resources (systems/applications/software) that the function requires.

Function Class Computer Resources

Administrator / Fiscal Agent of “12” statewide Universal Funds.  The following funds are administered by the State USF Department:

Arizona USFConnecticut TRSHawaii TRSKansas USFNevada USFOklahoma USFPennsylvania USFPuerto Rico USFTexas USF

1 All systems/applications /software used by the State Program Operations department reside on either the Access databases located on fileserver NECAFS7 or for Texas on fileserver NECAWEB1, NECAWEB2 with the data residing in PRODSQL1 SQL Server and PRODSQL2 SQL Server  and Excel and Word files on the H:\StateUSF directory located on fileserver NECAFS1.

Page 28: neca7.doc

Attachment 7Page 27 of 53

NECA Services Business Continuity Plan

Vermont USFWashington DC USTF

Administrator / Fiscal Agent of “1” Energy Fund:

Vermont Energy Efficiency Utility Fund

1 All systems/applications /software used by the State Program Operation department reside on Access databases located on fileserver NECAFS7 and Excel and Word files on the H:\StateUSF directory located on fileserver NECAFS1.

Administrator of “1” Low Income Discount Program

Texas LIDA

1 All systems/applications/software used by the State Program Operations department reside on database located on fileserver NSISQL1 for TXLIDA DATA & FTP Site, the Dataflux software resides on Dataflux servers TXLIDA1 & TXLIDA2, and the Web Application resides on NECAPROD1W2K (primary) & NECAPROD2W2K (backup)

3. Communication Plan

In a disaster situation, State USF management will be contacted as specified in the NECA Corporate Disaster Recovery plan. Department management will then contact their direct reports, and they in turn will contact their direct reports. This will continue until all department staff has been contacted. Management will inform staff of any significant developments and notify staff of their responsibilities during the disaster. If one or more critical staff members are unavailable, management will assign those responsibilities to another staff member. If the department requires the assistance of staff members from another department, management will contact the appropriate personnel on the chain of command.

After initial contact, critical department staff will perform their assigned duties. Non-critical department staff will await instructions on specific assignments.

If the department employs temporary staff or consultants, management will contact the firm providing the temporary staff or consultants with the necessary information.

Department management will ensure that critical vendors (see Attachment E) and customers will be contacted. Management will also contact internal NECA groups with whom there is a critical interface that must be maintained during the disaster period (Attachment C).

4. Restore Validation Procedures

Upon notification that Information Systems has completed the process of restoring data, systems, and software, department staff will verify that any critical data is correct, and that the required systems and software are available and functioning correctly. If validation of data requires the retrieval of information from offsite storage (identified in Attachment D), department management will contact the Purchasing group to request that the appropriate information be retrieved.

Verification and validation procedures are as follows:  Responsibility – Lori Tasca

Page 29: neca7.doc

Attachment 7Page 28 of 53

NECA Services Business Continuity Plan

State USF & Energy Access Programs Systems Check List

System Validation:1. Contact the Associate Managers to obtain a date of last worksheet input, upload date and

approximate number of customers for each fund.2. Review Worksheets Table “Last Maintained Date” field after restore, to ensure that all

necessary information is restored, complete and accurate.3. Review Company Table for the number of records and “Creation Date” for each

company.4. Communicate with IS Department if any fund does not have complete and accurate

information.

System Functionality:1. Review the database to ensure all necessary fields are present, including the

“Company/Contact” tab, “Filing” tab and “Notes” tab.2. Review the necessary fields to ensure that information can be entered in the Company,

Contact and Worksheet fields.3. Review financial reports to ensure that they are formatted correctly for each state.4. Review the Peoplesoft Report Database to ensure that a Hand-off Report can be

generated.

Communication:1. Work with IS Department to ensure all systems are properly functioning before release

State USF for use.2. Communicate with Associate Managers before release of State USF System to provide a

status on the restore date and data validation.

State USF Data Collection System Check ListTexas USF On-Line

System Validation:1. Contact the Associate Managers to obtain a date of last manual worksheet input, upload

date and approximate number of customers for the Texas USF.2. Review Worksheets Table “Last Maintained Date” field after restore, to ensure that all

necessary information is restored, complete and accurate.3. Review Company Table for the number of records and “Creation Date” for each

company.4. Communicate with IS Department if any fund does not have complete and accurate

information.

System Functionality:1. Review the database to ensure all necessary fields are present, including the

“Company/Contact” tab, “Active Status” tab and “Notes” tab.2. Review the necessary fields to ensure that information can be entered in the Company,

Contact and Worksheet fields.3. Review financial reports to ensure that they are formatted correctly for each state.4. Review the Create Report Menu to ensure that a Hand-off Report can be generated.

Page 30: neca7.doc

Attachment 7Page 29 of 53

NECA Services Business Continuity Plan

Communication:1. Work with IS Department to ensure all systems are properly functioning before release to

Call Center and Back Office personnel.2. Communicate with Call Center and Back Office personnel before release of system to

provide a status on the restored data and validation issues.

State Program Operations System Check ListTexas LIDA On-Line

System Validation1. Review Daily Tables “Last Maintained Date” field to ensure that data from the prior

business day has been restored.2. Review Monthly Tables (Customer History Tables, Enrollment Master, etc.) and confirm

that tables are available for prior processing month.

System Functionality:1. Confirm that Call Center Personnel are able to fulfill LIDA application requests.  2. Confirm that Call Center & back office Personnel are able to retrieve applicant history.3. Confirm that FTP site is capable of receiving and sending REP/TSP, Business Ink and

TDHS files.4. Confirm that back office personnel are able to generate fulfillment center feeds.5. Confirm that load processes are available to load REP/TSP and TDHS files.6. Confirm that Data Flux software is in place to run monthly matching process.7. Review reports to ensure that historical data is captured.

Communication:1. Work with IS Department to ensure all systems are properly functioning before release to

Call Center and Back Office personnel.2. Communicate with Call Center and Back Office personnel before release of system to

provide a status on the restored data and validation issues.

5. Operating Procedures

Operating procedures describe how the department will perform critical business functions and meet processing schedules/critical dates (see Attachment B) during the disaster period. The operating procedures for the department are as follows:

State Program Disaster Recovery Operating Procedures

Departmental Contact:1. The Director State Program Operations will contact each State Program Operations

Manager (direct reports) to notify them of the disaster and any instructions.2. Each Manager State Programs Operations will contact their reports to notify them of the

disaster and any instructions. 3. Each Manager State Programs Operations will report back to the Director to confirm that

staff has been notified and to provide a list of all staff that could not be contacted.

Initial Disaster Recovery Coordination:

Page 31: neca7.doc

Attachment 7Page 30 of 53

NECA Services Business Continuity Plan

1. The Director State Program Operations will contact the State Program Operations Disaster Recovery Coordinator with updated information from Executive management such as:

a. Duration of Disaster (i.e. 1day, 1 week, 6 weeks or longer)b. Plans for Recovery as a Corporationc. Initiation of State Program Operations Plan or any part of Plan

2. The State Program Operations Disaster Recovery Coordinator will contact the critical personnel to begin initiation of the State Program Operations Disaster Recovery Plan.

a. Associate Manager assigned to System Recoveryb. (3) Associate Managers assigned to notification of state commissions and

program participants and applicants3. Other State Program Operations personnel will be assigned to critical staff members to

assist with Disaster Recovery State Program Operations process of notification.4. Critical Staff members will remain in contact with the State Program Operations Disaster

Recovery Coordinator for status reports.5. The State Program Operations Disaster Recovery Coordinator will regularly update the

Director State Program Operations on the recovery status.6. The State Program Operations Disaster Recovery Coordinator will contact the Facilities

group to request a dedicated phone line and fax number.

State Program Operations Disaster Recovery Steps:1. Notification of Disaster to all state commissions (Within 3 days of disaster)

a. Phone calls will be placed to all state commissions (numbers maintained in Attachment E) regarding the following:i. Status of Disaster

ii. Expected duration of Disasteriii. Operation recovery time iv. Plans to notify program participants

b. Written notification to all state commissions will include:i. Phone call confirmation/summary

ii. Any additional information not provided2. Notification of Disaster to all State Program Operations program participants and

applications (Within 5 days of disaster)a. Written notification to all State Program Operations participants and applicants

will include some or all of the following:i. Status of disaster

ii. Expected duration of disasteriii. Operation recovery timeiv. Request for re-submission of information sent to State Program Operations

within last 30 daysv. State Program Operations fax number

vi. State Program Operations phone number 3. System restore and verification of system (Pending IS notification of availability).

a. Associate Manager will follow steps outlined in the Restore Validation Procedures

b. Notification of (3) critical staff members and State Program Operations Disaster Recovery Coordinator that the system is ready for use and further verification

4. State Program Operations Processing Cyclea. State Program Operations Disaster Recovery Coordinator will review with

Director State Program Operations whether a facility will be available or whether staff will need to work in teams from their homes (mail becomes a problem)

Page 32: neca7.doc

Attachment 7Page 31 of 53

NECA Services Business Continuity Plan

b. (3) Associate Manager (critical staff members) will prioritize State Program Operations Report Matrix to evaluate status of each state programi. Review time frames compared to disaster date

ii. Action plan to meet required due datesiii. Assign tasks to staff members to accomplish

5. State Program Operations Disaster Coordinator will contact Finance Disaster Recovery Coordinator regarding:

a. Lockbox worksheet deliveryb. Availability of finance systems to receive A/R uploadsc. Availability of finance systems to receive A/P uploads, process checks and send

wire/electronic paymentsd. Status of Treasury department regarding balances and disbursement ability

6. Implement Processing Action Plana. State Program Operations Disaster Recovery Coordinator will coordinate with

Facilities group for mail and fax deliveryb. (3) Associate Managers (critical staff members) will supervise processing

workflow of other staff membersc. (3) Associate Managers (critical staff members) will verify processed paperwork

for accuracyd. State Program Operations Disaster Recovery Coordinator will obtain approval

from Director or above for all disbursementse. (3) Associate Managers (critical staff members) will coordinate A/R and A/P

uploads with Finance and data transfers to FTP sites for Texas LIDAf. (3) Associate Managers (critical staff members) will coordinate with Finance

personnel for statement review and approval prior to mailingg. Associate Manager (critical staff member) will process all commission fund

performance packages to that be reviewed by the Director State Program Operations prior to sending to commissions

h. Director State Program Operations will coordinate with Director of General Accounting to verify that all unaudited financial statements are delivered on schedule

i. State Program Operations Disaster Recovery Coordinator will coordinate with staff members to ensure that all other reports due to the commissions are delivered on schedule

In the event of a disaster, the State Program Operations Department should be able to meet contractual requirements with the use of home computers accessing the metaframe and the picking up of mail, lockbox and fax information at a location that NECA Services designates during a short period of time. However, if the disaster lasts longer than one week, the State Program Operations group would need to secure a location to work together.

Page 33: neca7.doc

Attachment 7Page 32 of 53

NECA Services Business Continuity Plan

Attachment –A Staff contact List

Page 34: neca7.doc

Attachment 7Page 33 of 53

NECA Services Business Continuity Plan

Attachment B – Processing Schedule/Critical Dates

The following is the processing schedule and critical dates associated with the critical functions that must be performed by the department during a disaster period. The first column lists the critical process or task and the second column lists the date the process or task must occur.

Critical Process/Task Date

Processing of Toll Return Data3rd and 4th weeks of

each month

Processing of AT&T Data Sheets3rd and 4th weeks of

each month

Development of prior month’s holdbacks for Service Providers1st week of each

month

Processing of prior month’s Service Provider Statements1st week of each

month

Review/Approval of prior month’s Service Provider Statements and payments

1st week of each month

Processing of prior month’s Exchange Carrier and Service Provider Statements (including receipt and upload of UDP data via FTP)

2nd week of each month (between the

7th and the 9th)

Mail prior month’s Exchange Carrier and Service Provider Statements2nd week of each

month (between the 9th and the 10th)

Copy Toll Return data and mail to Service Providers2nd week of each

month (between the 11th and the 13th)

Page 35: neca7.doc

Attachment 7Page 34 of 53

NECA Services Business Continuity Plan

Attachment C – Critical Interfaces

The following is a list of critical interfaces for the department during a disaster period. The first column lists the critical process or task and the second column lists the organization interfaced with.

Critical Process/Task Organization Interfaced With

Invoice Generation Finance & Admin

Statement Mailing Finance & Admin (Mailroom)

WECARE processing IT

Payment Notifications & Aged Receivables Reports Finance & Admin

Page 36: neca7.doc

Attachment 7Page 35 of 53

NECA Services Business Continuity Plan

Attachment D - Critical Data Back-Up List

The following is a list of critical information stored off premises, which must be retrieved in the event of a disaster.  The list must include a description of the critical data back up, where the data is stored and some type of reference to easily identify the data.

Description of Back-Up Data Stored At Location Reference

(If Applicable)

                                 N/A

Page 37: neca7.doc

Attachment 7Page 36 of 53

NECA Services Business Continuity Plan

Attachment E – Vendor List

The following is a list of vendors/customers unique to your organization that must be notified in the event of a disaster.

Vendor Name Product Phone Number

UDPB&C Service Bureau for Messages

Processing

Phone 210-576-2132

Fax  210-826-7459

Billing Concepts (including ACI Services)

B&C Service ProviderPhone 210-949-7005

Fax   210-949-7154

ILD B&C Service ProviderPhone 954-717-6808

Fax 954-777-2795

CBS B&C Service ProviderPhone 972-728-6639

Fax 972-241-1537

Integretel/eBillit/Payment One

B&C Service ProviderPhone 408-362-4166

Fax  408-362-2795

Excel B&C Service ProviderPhone 214-424-1175

Fax  214-424-1177

Sprint B&C Service ProviderPhone 913-315-8443

Fax 913-315-0620

MCI B&C Service ProviderPhone 303-390-6027

Fax 303-390-6015

AT&T B&C Service ProviderPhone 732-457-5875 Fax  732-369-7070

I4Mation B&C Service ProviderPhone 215-629-0928

Fax 215-627-3145

Faxxent

Broadcast Fax Distributor

([email protected])

Phone303-268-0000

Fax 303-794-0399

Exchange Carriers B&C CustomersSee Attachment H (Excel Spreadsheet

under separate cover)

Page 38: neca7.doc

Attachment 7Page 37 of 53

NECA Services Business Continuity Plan

Attachment F - Organizational Equipment Requirements

Please indicate any equipment requirements for the department that are in addition to the home PCs and equipment used for telecommuting during the disaster period.

Quantity Equipment/Furniture Description

2 Fax machines for Manager – Operations and Manager – B&C Settlements

1 High Speed Printer – for Settlement Statement printing

Page 39: neca7.doc

Attachment 7Page 38 of 53

NECA Services Business Continuity Plan

Attachment G - Primary Site Equipment List

Facilities maintains a list of standard office equipment and furniture in use by the department. Please use this form to list any specialized equipment beyond the list of standard office equipment and furniture that is necessary to restore the primary site to the condition it was in prior to the disaster.

Note: List is in addition to desks, chairs, PCs, Modems, Calculators, Laser Printers, Phones, Fax Machines, and File Cabinets, which are assumed to be “standard office equipment”

Quantity Equipment/Furniture Description

1 High Speed Printer (for Settlement Statements)

Page 40: neca7.doc

Attachment 7Page 39 of 53

NECA Services Business Continuity Plan

Department/Group: Billing and CollectionLocation: HQ - 80 South Jefferson Rd., Whippany, NJ

DR/BCP Coordinator: Tom CarrollDate: April 21, 2005

Table of Contents

1. Plan Overview & Maintenance

2. Major Functions

3. Communication Plan

4. Restore Validation Procedures

5. Operating Procedures

Attachment A – Staff Contact List

Attachment B – Processing Schedule/Critical Dates

Attachment C – Critical Interfaces

Attachment D – Critical Data Back-Up List

Attachment E – Vendor List

Attachment F – Organizational Equipment Requirement

Attachment G – Primary Site Equipment List

Attachment H – Exchange Carrier Contact List

NOTE: PASSWORD TO BCP PLANS (ON NSI INTRANET) IS Di$@ster

Page 41: neca7.doc

Attachment 7Page 40 of 53

NECA Services Business Continuity Plan

1. Plan Overview & Maintenance (B&C Division)

This document describes how the department plans to operate during a disaster period. It identifies the critical business functions that will need to be performed, the staff required to perform these functions, and the operating procedures that will be followed. It includes a communication plan for the department, and restore validation procedures.

The NECA disaster recovery site is located in Disaster recovery Site. During a disaster B&C critical staff will be located in an alternative site, accessing the Disaster recovery Site using metaframe software. The WECARE front-end may be accessed via the Internet, but all other reports and tools are accessed via metaframe. Any exceptions to this are noted in the operating procedures section of this document.

It is essential that this plan and attached documents be maintained. It must be reviewed by department management periodically and updated to reflect any changes to the business environment.

The staff contact list (Attachment A), identifying critical staff and containing phone numbers and home email addresses for all department staff, must be distributed to each member of the department. This document must be updated and redistributed whenever someone leaves the department, or there is an addition to the department. On an approximately monthly basis, the document must be reviewed for other changes.

NECA and NECA Services will conduct periodic tests of disaster recovery and business continuity procedures. During such a test the department will execute this business continuity plan and staff members will perform the duties assigned to them under the plan.

All critical personnel are required to validate their Metaframe access once a month, coinciding with when they change their regular Novell password. Accessing Metaframe with the new password will validate access for the period that the new password is effective. Procedures for validating Metaframe access are contained in a separate document that has been distributed to B&C staff.

2. Major Functions (B&C Division)

The following table lists the major functions performed by this department. The first column lists the function. The second column classifies each function in the event of a disaster as follows: Class 1 (most critical, essential to business survival, to be restored as soon as possible), Class 2 (critical, to be restored after Class 1 functions have been restored), or Class 3 (non-critical, will not be restored during the disaster period). The third column lists any computer resources (systems/applications/software) that the function requires.

Function Class Computer ResourcesDevelopment of monthly Billing and Collection Settlement Statements. This includes:

Toll Return and Tax data entries.

AT&T Data sheet entries.

1 This function requires individual PCs and access to the WECARE system and Report Writer tools InfoMaker and Impromptu.

Page 42: neca7.doc

Attachment 7Page 41 of 53

NECA Services Business Continuity Plan

Function Class Computer Resources Input file processing from

UDP (Billing and Collection Service Bureau).

TDS file upload Proofing of all manually

input data (toll returns, taxes, miscellaneous adjustments)

Processing of monthly Settlement Statements (Exchange Carriers & Service Providers)

Starting Balance InterfaceProofing ReportsNET2Holdback reportFinalizeInvoicingFulfillmentCustomer/Vendor Invoice InterfacesE-mail Invoices (some customers)Century & Toll Return Reports

Sorting, Collating, and Mailing Settlement Statements.

Standard windows applications such as Word and Excel are also required.

3. Communication Plan (B&C Division)

In a disaster situation, department management will be contacted as specified in the NECA and NECA Services Corporate Disaster Recovery plans. At this point department management will contact their direct reports, and they in turn will contact their direct reports. This will continue until all department staff have been contacted. Staff will be kept informed of developments by their managers and notified what responsibilities they will be assigned during the disaster. If one or more critical staff members are unavailable, department management will assign those responsibilities to another staff member. If the department requires the assistance of staff members from another department, department management will contact that person’s department management.

After initial contact, critical department staff will begin performing their assigned duties. Non-critical department staff will await instructions on specific assignments.

If the department employs temporary staff or consultants, department management will contact the firm providing the temporary staff or consultants.

Department management will ensure that critical vendors (see Attachment E) and customers will be contacted (Attachments E and H). Department management will contact other internal NECA

Page 43: neca7.doc

Attachment 7Page 42 of 53

NECA Services Business Continuity Plan

and NECA Services groups with whom there is a critical interface that must be maintained during the disaster period (see Attachment C).

Billing and Collection Communications Plan:

The Director, Billing and Collection, will notify the Manager – Operations, the Manager – Finance & Accounting, and the Manager - Customer Relationship Management.

Note: In the event that the Director, Billing and Collection is not available, the Manager – Operations will assume his/her duties. In the event that both the Director and the Manager – Operations are not available, the Manager – Finance & Accounting will assume the Director’s duties and the Manager – B&C Settlements will assume the Manager – Operations duties.

The Director will also prepare a broadcast fax notification to all Exchange Carriers in B&C plans. The fax will be distributed by Faxxent (phone = 303-268-0000, Fax = 303-794-0399, e-mail = [email protected]. The fax distribution list is shown on Attachment H.

The Manager – Operations will notify:

B&C Administrative Assistant Manager - B&C Settlements Senior Data Management Analyst UDP (B&C Service Bureau) Billing and Collection Service Providers

Corporate Communications:

Voice Communications

In the event a major disaster is declared, the NECA Communications Coordinator (currently the Director of Corporate Communications) will have an approved communication to be delivered to NECA and NECA Services staff by Alertcast. Alertcast will begin broadcasting the message immediately. Based on predetermined groupings, each team could receive a different message. Alertcast will deliver the message in one of two ways, depending on the Coordinator’s option:

Standard – the NECA or NECA Services person receiving the call would need to put in a pin number to verify who they are (pin number is recipient’s 10 digit home phone number).

Express – will deliver the message to whoever or whatever (answering machine, voice mail, etc.) answers the call.

Web Communications

After NECA and NECA Services websites are established, staffers will be directed to utilize the site to obtain updated information.

B&C Staff Phone/Contact Numbers:

See Attachment A

Page 44: neca7.doc

Attachment 7Page 43 of 53

NECA Services Business Continuity Plan

Vendor/Service Provider List:

See Attachment E

Broadcast Fax Universal List:

See Attachment H

4. Restore Validation Procedures (B&C Division)

Upon notification that Information Systems has completed the process of restoring data, systems, and software, department staff will verify that any critical data is correct, and that the required systems and software are available and functioning correctly. If validation of data requires the retrieval of information from offsite storage (identified in Attachment D), department management will contact the Purchasing group to request that the appropriate information be retrieved.

Verification and validation procedures are as follows (Note – assumes a facilities-based scenario rather than a telecommuting scenario):

System Validation (WECARE) – B&C Operations personnel (Manager-Operations, Manager-B&C Settlements, and Senior Data Analyst) will log onto WECARE system and navigate through the various screens/modules (toll returns, report generation, tax data entries, etc.) to insure WECARE has been restored successfully. Operational reports will also be run. NECA IT will be notified of any problems/issues.

The Manager – Customer Relationship Management, will log onto Access to verify the software has been restored.

Data Validation – depending on the day of the month the disaster occurs, data validation can be minimal or extensive. If a disaster occurs shortly after the Settlement Statements have been run (say between the 11th and 15th of the month), a minimal amount of manually-entered data (toll returns, taxes, miscellaneous adjustments, will have been entered into WECARE for the current month. In any case, data will be reviewed to insure that it is current up until the day preceding the disaster. If necessary, sources for that data (Exchange Carriers and Service Providers) will be contacted and asked to re-submit the data for either validation or re-entry in the current month (time permitting – if not possible, data will be held for entry in the following month).

Note: NECA IT Applications will assist in preparing detailed test plans for both System and Data Validation. The scripts will present job runs that can be performed to validate the restorals.

High Speed Printer – In the event of a disaster requiring activation of Disaster recovery Site and procurement of alternate facilities for the B&C Group, NECA IT will procure a high-speed printer. The printer will be located in Disaster recovery Site. While WECARE reports (pre-Netting, post Netting 2, etc.) can be printed locally at the alternate facility, the monthly invoices will be printed in Disaster recovery Site and shipped to the alternate facility for proofing and distribution to Exchange Carriers and Service Providers.(In the event that the disaster is limited to 80 South Jefferson and 100 South Jefferson is available as the alternate site, it will be possible to locate the printer there and utilize the network connections with Disaster recovery Site that are already in place. In the event that the alternate facilities are in a different location, another option for a long term disaster is to establish a network connection between Disaster recovery Site and the alternate facility. This option may be costly and will be reviewed with Senior Management during the disaster).

Page 45: neca7.doc

Attachment 7Page 44 of 53

NECA Services Business Continuity Plan

If a disaster occurs relatively late in the month or early in the following month (before the latest Settlement Statements have been processed) and the paper source documents for the data has been destroyed, manually entered data will be initially validated using prior months’ data levels as a “reasonableness” barometer. Sources for that data (Exchange Carriers and Service Providers) will be contacted and asked to re-submit the data for manual validation in both the current month and subsequent months (as time permits – adjustments may be submitted in subsequent processing cycles).

All personnel at facility will go into Word and Excel and verify that both software’s have been restored and that all documents previously stored on their directories on the LAN have been restored.

The Manager-Customer Relationship Management will review the Access Customer Database to determine if all Sub-CIC data has been restored.

Note: The Director – Billing and Collection will also validate that all critical WECARE system migrations were included in the WECARE system that has been restored.

Page 46: neca7.doc

Attachment 7Page 45 of 53

NECA Services Business Continuity Plan

5. Operating Procedures

Operating procedures describe how the department will perform critical business functions and meet processing schedules/critical dates (see Attachment B) during the disaster period. The operating procedures for the department are as follows:

Note: the following Operating Procedures assume a facilities-based business continuity scenario with limited space (See additional note at end of Section). Critical B&C personnel to be located at the site are as follows:Director –Billing & CollectionManager – OperationsManager – B&C SettlementsManager – Customer Relationship ManagementManager – Finance & AccountingSenior Data Analyst

The Manager – B&C Settlements will assume all responsibilities for the processing of toll returns, AT&T Data sheets, and miscellaneous adjustments. This is in addition to normal duties as primary interface with Exchange Carriers for settlement statement activities.

The Senior Data Analyst will assist in the validation and ongoing processing of toll returns and AT&T Data sheets.

The Manager – Operations will assume all responsibilities for the validation and entry of all tax transfers. This is in addition to normal responsibilities as primary interface with UDP.

The Manager – Customer Relationship Management will be available to assist Operations and Settlements as required. The Manager will also be responsible for all broadcast fax and mass mailing notifications sent to Service Providers and/or Exchange Carriers during the disaster period. These are in addition to normal responsibilities for customer relations.

The Manager – Finance and Accounting will perform all normal responsibilities for financial activities, budgetary tracking, and processing of data under the MCI & Sprint contracts with TDS.

The Director – Billing & Collection will assist in any/all activities/responsibilities listed above as required. He/she will also serve as the interface with the President/CEO of NECA Services, as well as senior management at NECA and NECA Services. These are in addition to normal supervisory responsibilities and activities.

Page 47: neca7.doc

Attachment 7Page 46 of 53

NECA Services Business Continuity Plan

Additional Operational Items:

The monthly TDS file that is currently e-mailed to B&C will be forwarded to Disaster recovery Site for uploading into WECARE.The UDP files that are currently FTP’d to WECARE at 80 South Jefferson, will be pulled into the Disaster recovery Site site.

Additional Note: In the event that NECA and NECA Services Executive Management does not deem the “disaster” as sufficient in either severity or duration to warrant the procurement of alternative space, the Director – Billing & Collection will evaluate the immediate Billing and Collection priorities and assign responsibilities to B&C staff as required for the duration of the disaster.

Page 48: neca7.doc

Attachment 7Page 47 of 53

NECA Services Business Continuity Plan

Attachment –A Staff contact List

Page 49: neca7.doc

Attachment 7Page 48 of 53

NECA Services Business Continuity Plan

Attachment B – Processing Schedule/Critical Dates

The following is the processing schedule and critical dates associated with the critical functions that must be performed by the department during a disaster period. The first column lists the critical process or task and the second column lists the date the process or task must occur.

Critical Process/Task Date

Processing of Toll Return Data3rd and 4th weeks of

each month

Processing of AT&T Data Sheets3rd and 4th weeks of

each monthDevelopment of prior month’s holdbacks for Service Providers 1st week of each month

Processing of prior month’s Service Provider Statements 1st week of each month

Review/Approval of prior month’s Service Provider Statements and payments

1st week of each month

Processing of prior month’s Exchange Carrier and Service Provider Statements (including receipt and upload of UDP data via FTP)

2nd week of each month (between the 7th and the

9th)Mail prior month’s Exchange Carrier and Service Provider Statements 2nd week of each month

(between the 9th and the 10th)

Copy Toll Return data and mail to Service Providers2nd week of each month (between the 11th and

the 13th)

Customer Relationship Management Ongoing

Page 50: neca7.doc

Attachment 7Page 49 of 53

NECA Services Business Continuity Plan

Attachment C – Critical Interfaces

The following is a list of critical interfaces for the department during a disaster period. The first column lists the critical process or task and the second column lists the organization interfaced with.

Critical Process/TaskOrganization Interfaced

With

Invoice Generation Finance & Admin

Statement Mailing Finance & Admin (Mailroom)

WECARE processing IT

Payment Notifications & Aged Receivables ReportsFinance & Admin

Page 51: neca7.doc

Attachment 7Page 50 of 53

NECA Services Business Continuity Plan

Attachment D - Critical Data Back-Up List

The following is a list of critical information stored off premises, which must be retrieved in the event of a disaster. The list must include a description of the critical data back up, where the data is stored and some type of reference to easily identify the data.

Description of Back-Up Data Stored AtLocation Reference

(If Applicable)

N/A

Page 52: neca7.doc

Attachment 7Page 51 of 53

NECA Services Business Continuity Plan

Attachment E – Vendor List

The following is a list of vendors/customers unique to your organization that must be notified in the event of a disaster.

Vendor Name Product Phone Number

UDPB&C Service Bureau for Messages

ProcessingPhone 210-576-2132Fax 210-826-7459

Billing Concepts (including ACI Services)

B&C Service ProviderPhone 210-949-7005Fax 210-949-7154

ILDB&C Service Provider

Phone 954-717-6808Fax 954-777-2795

CBSB&C Service Provider

Phone 972-728-6639Fax 972-241-1537

Integretel/eBillit/Payment One

B&C Service ProviderPhone 408-362-4166Fax 408-362-2795

ExcelB&C Service Provider

Phone 214-424-1175Fax 214-424-1177

SprintB&C Service Provider

Phone 913-315-8443Fax 913-315-0620

MCIB&C Service Provider

Phone 303-390-6027Fax 303-390-6015

AT&TB&C Service Provider

Phone 732-457-5875 Fax 732-369-7070

I4Mation B&C Service ProviderPhone 215-629-0928Fax 215-627-3145

FaxxentBroadcast Fax Distributor([email protected])

Phone303-268-0000Fax 303-794-0399

Exchange CarriersB&C Customers

See Attachment H (Excel Spreadsheet

under separate cover)

Page 53: neca7.doc

Attachment 7Page 52 of 53

NECA Services Business Continuity Plan

Attachment F - Organizational Equipment Requirements

Please indicate any equipment requirements for the department that are in addition to the home PCs and equipment used for telecommuting during the disaster period.

Quantity Equipment/Furniture Description2 Fax machines for Manager – Operations and Manager – B&C Settlements

1High Speed Printer – for Settlement Statement printing

Page 54: neca7.doc

Attachment 7Page 53 of 53

NECA Services Business Continuity Plan

Attachment G - Primary Site Equipment List

Facilities maintains a list of standard office equipment and furniture in use by the department. Please use this form to list any specialized equipment beyond the list of standard office equipment and furniture that is necessary to restore the primary site to the condition it was in prior to the disaster.Note: List is in addition to desks, chairs, PCs, Modems, Calculators, Laser Printers, Phones, Fax Machines, and File Cabinets, which are assumed to be “standard office equipment”

Quantity Equipment/Furniture Description

1High Speed Printer (for Settlement Statements)