Operational and Business Continuity Planning for Prolonged Airport Disruptions (2013)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

P a r t 1 Business Continuity Planning at Airports

3 The likelihood that incidents will occur threatening to dis- rupt the continuity of business and operations at airports cre- ates significant risk and obliges airports to develop recovery strategies and plans. Whether these disruptive incidents are specific to an airport or the result of broader circumstances, it is the airport’s and fixed base operator’s (FBO’s) responsibility to plan for pos- sible impact on its operations. Planning enables organizations to assure their customers, stakeholders, and regulators that they can maintain some minimal service level during disrup- tions and recover fully afterward. To minimize the impact of potential interruptions on operational continuity, airports can develop and maintain a business continuity plan. Business continuity plans equip air- ports to recover their mission-essential functions as quickly as possible after any kind of material or prolonged disruption. Recovery is particularly important in the airport envi- ronment because airports—as part of the critical national infrastructure—play an outsized role in connecting people, supporting commerce, sustaining communities and econo- mies, and protecting the national interest. This guidebook is a resource that airports and FBOs can use to do the following: • Gain an understanding of business continuity planning • Create a management structure to sponsor and support the process • Name a team to develop a plan • Institute a process to create business continuity awareness and a preparedness culture throughout their organizations This guidebook was written and designed to function seam- lessly with the accompanying CRP-CD-140: Airport Busi- ness Continuity Planning Software Tool, which is bound into this book or which can be burned onto a CD-ROM from an ISO image located at www.trb.org/Main/Blurbs/169246. aspx. The tool is a detailed interactive survey that enables users to create a basic, customized business continuity plan quickly by answering a series of detailed questions about their operations. Definition of Business Continuity Planning Business continuity planning (BCP) is the process of devel- oping a roadmap for continuing operations under adverse con- ditions and during disruptions caused by all types of incidents, emergencies, and crises. BCP is a process or methodology that documents how business is conducted during a disruption and how essential functions, processes, and resources are opti- mally recovered and restored after a disruption. BCP focuses on recovering data, information, operations, and processes in every essential organizational function. It is a holistic process that should be applied across the business and operations foot- print of the entire entity. Airports and FBOs that have achieved a state of business continuity are those that have rigorously embraced the BCP process, developed a “living” business continuity plan, adopted a business continuity mindset and discipline throughout the enterprise, and regularly exercise and update their plans. What Business Continuity Planning Is Not BCP is quite distinct from other emergency-related pro- grams and processes in the airport environment, although other processes may be tangentially related to business conti- nuity. The distinctions among these other processes and their relationships with BCP are described below. Emergency Management Emergency management is the process of preventing con- trollable incidents that threaten life, property, and physical Overview of Business Continuity Planning at Airports

4assets; mitigating the impact of incidents that actually occur; responding to these incidents; and physically recovering from them. Emergency management is incident-specific and deals with all types of risks, hazards, and emergencies, both natu- ral and man-made. It includes incident action plans (IAPs), which are incident-specific strategies for dealing with each unique emergency situation. Business and operational disruptions to airport operations may well be caused by emergency incidents. Unlike emer- gency management, however, BCP is not concerned with the type of incident or emergency that causes disruptions or with the likelihood of its occurrence. The focus of BCP is on the impact of such an emergency incident on the continuity and resilience of the essential functions and processes that are regular, routine airport operations. The kinds of resources used to respond to emergencies are very different than those used to recover business operations. Information Technology Disaster Recovery The information technology (IT) department’s Disaster Recovery (DR) plan addresses how technology infrastruc- ture, applications, and resources will be optimally recov- ered after disruption and in what order these elements will be restored to support the business requirements of the organization. The IT DR plan is a component part of a comprehensive BCP process. Optimally, DR plans are aligned with the busi- ness continuity plan through the business impact analysis (BIA). This analysis assigns relative recovery priority to all business and operational functions, and, in turn, the BIA defines the demand for the recovery of IT support for the most critical functions. The BIA ranks the priority of busi- ness functions for IT resources through two measures—the tolerance each function has for loss of data and the amount of time these functions can be unavailable to the airport before there is material negative impact to their mission and to the airport. Crisis Management Crisis management consists of methods used to respond to both the reality and perception of a crisis, the estab- lishment of metrics to define which scenarios constitute a crisis and should therefore trigger the necessary response mechanisms, and the communications that occur within the response phase of emergency management scenarios and persist afterward. Crisis management is the strategic overlay to how airport organizations think about and deal with critical incidents that can affect elements like operations, regulatory assurances, financial performance, reputation, and legal circumstances. BCP plays a role as a component of the crisis management strategy, specifically supporting both the resilience of essen- tial functions during those crises that cause disruptions and the recovery of these functions after the crisis passes. Irregular Operations Irregular operations (IROPS) are events that disrupt nor- mal flight schedules, causing problems for airports, airlines, and passengers. IROPS are usually caused by extreme weather conditions or mechanical issues and can vary widely among airports. Negative impacts can include tarmac delays, passen- ger surges in terminals, and extended stays in airports. Creat- ing a comprehensive contingency plan helps airports comply with related government regulations and improve overall customer service during IROPS events. BCP addresses how to recover and restore normal airport operations after a material disruption of any kind. “Normal operations” refers to how the airport routinely runs its myr- iad functions and activities when the operating environment is stable. IROPS, on the other hand, encompass airports’ con- tingency plans during abnormal circumstances in the aviation system and with air carriers that impact passengers at the air- port. IROPS are operations during times when the systemic air traffic environment is fundamentally in chaos. ACRP Report 65: Guidebook for Airport Irregular Operations (IROPS) Contingency Planning is available to assist airports in developing, continually evaluating, and updating contin- gency plans and procedures during IROPS periods that may cause significant disruptions to the traveling public. Disaster Operations Groups Disaster operations groups (DOGs) are regional airport- to-airport voluntary mutual aid compacts that offer opera- tional assistance during large-scale disasters. These groups offer effective “airport-centric” response during disasters, including specific relief and operational, technical, and logis- tic support. A typical DOG response could include the coop- erative provision of services such as the following: • Liaison • Needs assessment • Skilled personnel • Relief services • Specialized equipment • Basics (food, water, personal needs, fuel trucks, and jet fuel) • Airfield equipment (regulators, generators, lighting, and signage) • Public safety items such as law-enforcement officers (LEOs) and aircraft rescue and firefighting (ARFF) personnel and equipment

5 • Assessment and advisory teams • Shared emergency operations center (EOC) facilities to coordinate relief efforts DOGs, such as Southeast Airports Disaster Operations Group (SEADOG) and Western Airports Disaster Operations Group (WESTDOG), are essentially emergency management cooperatives that recognize that airports may be the entities best equipped to help other airports respond to large-scale regional crises such as hurricanes. DOGs can play an impor- tant business continuity role because they provide potential alternative resources to support operational continuity for some airport activities until the affected airport can recover its own capacity. Business Continuity Planning— A Strategic Priority for Airports Critical National Infrastructure Airports are a key part of the critical national infrastruc- ture in the United States. Airports efficiently move people and cargo, support commercial activity and economic develop- ment, enable response to emergencies and crises in a timely way, and provide infrastructure that helps protect the coun- try. They provide the vital commercial and general aviation backbone connecting communities and people across the nation’s span of urban, rural, and remote localities. It is in the national interest that members of the critical air transportation sector develop a sustainable internal capacity for operational resilience. Ensuring the continuity of airport operations is important—not just at large and medium hubs and cargo airports, but also at non-hub, reliever, commercial service, and general aviation airports. It is also important to ensure continuity of operations for the companies that are FBOs and specialized aviation service operators (SASOs) at airports. Because each of the thousands of public and private avia- tion entities serves as a vital element in the lives and live- lihoods of Americans everywhere, the extended or prolonged loss or disruption of function and capacity at any facility poses a significant community, regional, or national threat. The U.S. economy and way of life depend on a vital and uninterrupted aviation sector, and airports are critical to that imperative. Good Business Practice Good Strategy That BCP is strategically important as a good business practice and as a risk management imperative, is perhaps the best reason to initiate BCP at airports. As federally cer- tificated transportation and commercial centers serving and supporting local and regional economies for the public good, airports’ strategic business plans should include the capacity and capability to provide continuous operations in the service of their stakeholders. Risk Management Business continuity is a natural adjunct to airport enterprise risk management (ERM) and insurance programs because it documents risk mitigation efforts that the airport has adopted and assures underwriters that tangible contingency planning is in place. BCP can help organizations quantify the economic cost of business interruptions so that they can understand, document, and plan for the impact in terms of lost revenue, contractual or regulatory penalties, or contingent cost impli- cations. Airports are organizations that may be exposed to enhanced operational continuity risk because many of their operating assets are concentrated in a single physical location with severely limited or non-existent aeronautical relocation options. Contractual Obligations BCP may also help airports meet service level agreements (SLAs) with and contractual obligations to their business part- ners and maintain compliance with loan or funding covenants. Airline tenants may require the development of a business con- tinuity plan by the airport as a condition to (or prerequisite for) locating or continuing flight operations at that airport. Because airports depend on complex “supply chains”—symbiotic net- works of vendors, contractors, tenants, and concessions—for their mission-critical services, resources, and capacity, they may encourage airlines to coordinate their own contingency plans with those of the airport. Airports should establish BCP programs to address the operational resilience of each of their partners in order to mitigate single points of failure in their integrated networks and help these partners meet their own continuity objectives. Compliance Regulation and Oversight Airports must comply with numerous federal, state, and local regulations; directives; rules; and oversight. These may directly or indirectly obligate airports to implement BCP. Many states have statutes requiring that departments, agen- cies, and other arms of government comply with continuity of operations planning (COOP) directives for operational resilience and sustainability (e.g., the capacity to recover after disruptions and remain operational). To the extent that

6airports are considered government organizations, govern- ment COOP directives may require BCP at airports in their jurisdictions. Indirectly, compliance with specific FAA certifi- cation requirements (such as maintaining ARFF index levels) may be enhanced with BCP. Industry Standards Whether airports develop business continuity plans for business reasons or to comply with governmental mandates, there is a body of business continuity standards that has been developed and widely adopted to define recommended pro- cess and practice. Government COOP mandates usually refer- ence these standards. A voluntary BCP compliance program of the U.S. Department of Homeland Security aligns with these standards. Many business continuity “leading practices” are consistent with them. These business continuity standards are further detailed in Appendix A. Liability Management BCP may be adopted at airports as a mechanism to sup- port organizations’ efforts to limit their (or the airport operator’s or governmental jurisdiction’s) exposure to liabil- ity for claims, lawsuits, and contractual penalties related to operational losses. Why Business Continuity Planning Has Been Poorly Embraced— Findings from the Research The research that preceded the development of this guide- book and software tool amplified the original premise behind ACRP Project 03-18: that relatively few American airports have adopted BCP and that they need a better understand- ing of BCP as well as a basic roadmap and tool to help them implement it. The research confirmed that although some airports have implemented various levels of BCP, a majority of them have not made BCP a critical priority. The research concluded that airports need a process, along with supporting information, to equip them to address busi- ness continuity with the same rigor and expertise that they address emergency management. The key findings of the research are summarized below. Business Continuity Planning Not a Strategic or Business Priority at Most Airports A minority of airports have included comprehensive BCP in their strategic business plans or supported BCP from the top of the organization by establishing a steering committee to oversee it. Few have formally named a person who is quali- fied to lead a business continuity effort. Those that have made some progress in BCP may have instituted the process at a non-strategic level of their organizations. For some, responsi- bility for BCP may reside in City Hall, the county office build- ing, or with the airport operator. Until someone of rank and authority publicly prioritizes and endorses BCP, it is unlikely to be embraced or to compete effectively for scarce airport resources. Minimal Awareness of Business Continuity and Inconsistent Operational Understanding The U.S. airport industry is largely unaware of BCP, and the discipline is generally misunderstood. There is a pau- city of reliable sources of information in the industry about BCP and no apparent or dedicated provider of training or best practices on the topic. The top aviation schools do not address BCP in their textbooks, curricula, or classrooms, so young airport executives arrive at their first jobs with no grounding in the process. Until the inception of ACRP Project 03-18, BCP had not been a topic, track, or item pre- sented from the podium at industry conferences or work- shops, and BCP is rarely addressed in industry publications or resource lists. BCP is not widely practiced at airports, so most airport employees do not get exposure to the topic on the job. There is very little in the available press or online that addresses business continuity within an airport context. Because BCP is uncommon in the airport sector, even a small step forward will represent significant progress for airports. Emergency Management versus Business Continuity Planning One core reason for the lack of understanding of BCP is wide- spread confusion about the terms “emergency management” and “business continuity.” Airports are very good at emergency management because they are “genetically” focused on emer- gencies, accidents, and safety and are extremely resourceful and competent at preventing, preparing for, mitigating, and recov- ering from emergencies. Airports are also good at emergency response because they have sufficient management, staffing, training, funding, regulatory impetus, emergency supplies and equipment, federal assistance, and memoranda of understand- ing (MOUs) for regional collaboration through local emer- gency services and DOGs. Airports have benefitted from no regulatory basis, funding, and support for business continuity activities.

7 Challenges of Business Continuity Planning in the Complex Airport Operating Environment Airports are host to a unique mix of critical and support- ing activities, roles, and responsibilities spread across multiple entities at fixed locations. Key functions are managed by airport staff, commercial contractors, tenants, FBOs and SASOs, or by airport operator personnel (e.g., city or county employees). Creating a business continuity plan that takes into account a broad assortment of independent or quasi-independent pub- lic, private, or government entities makes the BCP process more challenging than it would be if all airport functions were controlled centrally. Because most airports are operations-centric entities with staffing and resource constraints, their institutional knowl- edge often rests in the hands (and heads) of a single manager, a small group of executives, or highly specialized personnel. Because this knowledge may be undocumented, when there is a “succession situation”—such as dismissal, relocation, death, retirement, or sickness—single points of failure may exist at many airports, increasing the risk of failure during prolonged disruptions. While essential functions at some airports may be supported by recovery strategies that are well understood, documented, and exercised by their staffs, many airports have no formally written and rehearsed plan. Responsibility for business continuity management, like other airport func- tions, may reside with the airport operator, adding another layer of complexity to the challenge. Business Partner Interest in Airport Business Continuity Plans Airports are co-dependent with a number of stakeholders with whom they maintain symbiotic relationships. Airlines, as the single most important operating tenants at airports, main- tain corporate business continuity plans. Yet, as carriers who are dependent upon efficient airport recovery, airlines need to understand what they can expect when the host airport acti- vates its recovery plan. Similarly, all other commercial tenants, FBOs, and con- cessions need to develop and maintain their own business continuity plans and align them with the airport’s recov- ery plan. The general aviation community is enthusiastic about airports having a commitment to operational recov- ery because private and business aviation fundamentally depend on continuity of available airport services, assets, and facilities. Airport BCP and exercises should involve tenants, FBOs, concessionaires, and general aviation interests appropriately. Some of them (corporate flight departments and recreational pilots, for example) have both choice and mobility; they can relocate their activities to alternative airports that have better plans for operational resiliency. No Federal Mandate for Airport Business Continuity One of the reasons why BCP is not a core practice at airports (notwithstanding the standards and federal guidance summa- rized in Appendix A) is that no federal mandate specifically requires airports to develop a business continuity plan. No grant specifically funds airport BCP. Having a business conti- nuity plan is neither an official obligation in consideration of grant assurances nor is it funded by any aviation program at the federal level. While the absence of a mandate should not be a reason for any airport to delay the development of a plan, this absence undermines the industry’s understanding and embrace of BCP. Challenges to Developing Airport Business Continuity Plans Although the unique operating environment at airports and the broad mix of airport types, sizes, and missions makes widespread adoption of BCP somewhat more challenging, it also renders the results more beneficial. The complex inter- play of aeronautical, non-aeronautical, commercial, non- commercial, government, military, and support activities provided by numerous independent entities makes coordi- nating recovery planning important. Because contractors, commercial tenants, federal agencies, and FBOs often perform essential functions instead of airport employees, authority and control are dissipated and divided among these contractually connected organizations. The multi-organizational structure at airports makes BCP more complex because the chain of command is indirect, and plans must rely heavily on the operational continuity planning of each distinct entity. The lines of demarcation that separate operational responsibilities among these various entities can blur, varying greatly from airport to airport. This level of complexity makes the BCP process at airports understandably challenging because so many core functions are out of airports’ control. The tools available to airports to ensure that a disparate group of interdependent stakehold- ers optimally coordinate business and operational recovery may be limited to contractual provisions with commercial partners, MOUs with governmental entities, or simply strong administrative coordination. The complexities that make BCP a challenge for airports are closely related to the roles each constituent plays and its vested interest at the airport, including ownership, commercial tenants, government agen- cies operating at airports, and FBOs and SASOs.

8Ownership The ownership dynamics of U.S. airports contribute to the business continuity challenge because, for publicly owned air- ports, responsibility for numerous business functions may lie with departments at City Hall, the county office building, or the airport operator such as a port authority or even the state. In these cases, airport business departments in areas such as finance and administration (F&A), human resources (HR), or payroll may actually be extensions of the larger city or county departments. If airport employees are formally con- sidered employees of the municipality, for example, then the airport’s payroll, labor relations, or HR function may be actu- ally housed and performed at City Hall, not at the airport. Likewise, grants, funding, government relations, bond issues, and many other essential airport activities may be coordi- nated jurisdictionally, with the airport as the beneficiary, but with operations centrally coordinated or controlled. The implications for BCP include extending the manage- ment commitment process, assessment, planning process, and training and exercises beyond the boundaries of the air- port to each of those core functions that are managed by the airport operator or a governmental department or agency, wherever it may be physically located. This adds a level of complexity and demands inclusion, coordination, and inte- gration for two reasons. First, the city or county COOP needs to be considered during the airport’s BCP process to understand the extent to which it defines and documents what the airport can expect for departmental recovery priorities and resources for those externally managed and located functions. Second, the airport plan must take into account those externalities to which its recovery planning is exposed because many city or county (i.e., non-airport-related) disruptions can partially or fully bring operations in these offsite business departments to a halt. These non-airport disruptions can still impact airport operational continuity because of the airport’s dependence on those department functions that are essen- tially outsourced. Commercial Tenants Just as some essential airport business functions may rest with local government, many airport operating functions are controlled under contract, commercial lease, or land lease by tenants. Commercial flight operations are the responsibility of airlines; general aviation operations are run by the FBO; fueling services may be provided by an FBO or into-plane fueling agent; parking may be the responsibility of a parking contractor; rental car service is the province of the national car rental companies; and public safety may be outsourced to a private security contractor. While airports likely maintain strong and cooperative rela- tionships with private operational contractors and commercial lessees, the airport’s influence on the BCP practices of these companies may be limited practically to contractual leasehold provisions that require that these outside firms adopt and maintain their own business continuity plan. Large, well-funded, national companies such as commer- cial airlines, car rental companies, and hotels probably prac- tice BCP at the corporate level. The question for the airport is whether those plans have recovery systems and processes in place for airport-specific operations (e.g., “what is Acme Parking’s plan for operational recovery at my airport?”). Those essential airport operating functions that are contractu- ally controlled through commercial relationships present the challenge of how to ensure an orderly recovery of functions that the airport itself does not directly control. Contractors that may not have any plan for recovering their operations at the airport present airports with an even more serious problem; the airport business continuity plan may be unable to address critical third-party functions that must be recovered in order for the larger airport to function smoothly. Consequently, airport business continuity planners need to inform the process through inquiries into the local recov- ery capacity and plans of its essential commercial tenants and contractors. The airport BCP team should be in close con- tact with its counterparts at hotels and car rental companies, among others, so that, ideally, the airport’s plan can be inte- grated with the business continuity plans and recovery goals of their partners and expectations are as cohesive as possible. If the airport decides to add a BCP provision or require- ment to its commercial leases and agreements, such a con- tractual requirement should be applied fairly and equally across all similar types of agreements and leases in order to maintain compliance with FAA requirements. Government Agencies Operating at Airports Several mission-critical airport functions are the responsi- bility of independent federal agencies that are not part of the airport organizational or management structure. At many air- ports, the FAA is responsible for some aeronautical operations, air traffic control (ATC) activities, navigation aids (NAVAIDS), and related inspections and certifications in areas like ARFF operations. To minimize flight safety risk, the TSA screens all passengers, baggage, and cargo, coordinating enforcement activities with the airport’s public safety department. The U.S. Customs and Border Protection Agency (CBP) and the Immigration and Customs Enforcement Agency (ICE) clear inbound passengers from international flights, inspect their declarations for prohibited materials, and enforce immigra- tion laws. In some airports, the U.S. Department of Agricul-

9 ture (USDA) screens and isolates potentially harmful organic and agricultural substances to protect the U.S. food chain and public health. The airport does not control the functions these agencies provide. However, without the recovery of FAA, TSA, CBP, ICE, and USDA functions after disruptions, aviation operations are impossible: departing passengers cannot board, arriving inter- national passengers cannot legally enter the United States, and harmful substances and dangerous people may not be detected and their entry interdicted. Downtime or partial or complete loss of any of these essential airport functions can massively impact airports and their tenants. The result could be an esca- lating crisis—thousands of stranded passengers who require food, restroom facilities, and access to medical facilities, sleep- ing quarters, and transportation; massive flight delays and can- cellations with far-reaching impact on airlines’ flight networks; or flight and passenger diversions to alternative international arrival airports. While airports have no direct responsibility for the opera- tional processes of the key federal agencies operating in an airport, each agency relies on airport-provided space, infra- structure, utilities, and access in order to perform its activities there. Hence, the airport’s business continuity plan must pro- vide for the recovery of any supporting services and infrastruc- ture the airport provides federal agencies, and it must take into consideration their airport-specific operational contin- gency plans. Fixed Base Operators and Specialized Aviation Services Operators At most airports, FBOs (and sometimes SASOs) single- handedly manage complex responsibilities such as general aviation operations, aircraft maintenance, or the fueling func- tion. The entirety of operations and management at some smaller airports may be handled by an FBO managed under contract with the municipal or county airport operator; this places extraordinary responsibility for essential airport func- tions in the hands of private-sector companies. FBOs and SASOs should implement and exercise a site- specific, scope-specific recovery planning process for each fixed base operation they provide at airports. Functional business and operational recovery after disruptions may “look different” at each unique airport where FBOs and SASOs operate, with widely varying priorities and considerations based on each air- port’s mission, strategy, resources, and recovery capacity. Overcoming Challenges and Inertia in Business Continuity Planning Airport operators and management have a duty of care to all their constituents to run the airport soundly, as a local or regional resource upon which thousands and sometimes hundreds of thousands of people and organizations depend for their livelihoods, mobility, and recreation. Airports are an important element of the public good—macrocosms of economic, social, and government activity. Their operational continuity is invaluable to their owners, tenants, contractors, and customers. If the airport breaches public trust by failing to implement a BCP process for expedited recovery after disrup- tions, it introduces unacceptable risk to the common good. Hurricanes Katrina and Sandy, the 9/11 attack, rolling regional black-outs, floods and tsunamis in Asia, transit strikes, data center and network crashes, and other catastro- phes have taught an important lesson. Disruptive incidents and emergencies happen to all economic entities with seem- ingly increased regularity, severity, and negative impact. The collective appreciation for enhanced risk management, in turn, obligates airports to take concrete steps to ensure that their constituents can always rely on the operational resil- ience of the airport. To be able to deliver credibly on that implicit promise, airports should embrace accepted practices for operational continuity planning as one of the rational and effective management disciplines available to them. Airports should embrace BCP because it is a wise busi- ness practice. They should adopt BCP to comply with related standards. They should implement BCP as a fundamental risk management practice and rely on it to reduce liability exposure. With so many disruptive incidents in the relatively recent past, choosing not to embrace resilience planning for reasonably predictable business and operational disruptions introduces unnecessary risk and causes unnecessary harm. At the very least, such willful ignorance may amount to operator and managerial incompetence. At its worst, it may rise to the level of negligence and failure. This guidebook and accompanying software tool can be the catalyst that helps introduce U.S. airports to BCP and helps them start the process in earnest.

10 Preliminary Steps in Business Continuity Planning Creating a Risk Profile Scenario Planning Scenario planning is the process of identifying the range of specific threats that an airport faces based on its mis- sion, ownership, geographic location, operating environment, and many other factors that define the airport’s risk profile and the types of disruptive incidents that the airport might encounter. Walking through the most pressing and likely cri- sis scenarios as part of a disciplined organizational process can help airport management better understand how disrup- tive incidents might be triggered or develop and how their impact might negatively affect essential operating and busi- ness functions. It is the impact of disruptions on essential processes and functions that is important to the business continuity process rather than the probability of their occurrence. Assigning prob- ability or likelihood, however imprecise, is addressed during the risk assessment. Scenario planning addresses the impact of incidents regardless of their chance of occurring. Risk Assessment Airports and FBOs can also create a risk profile, which will inform the business continuity plan, by conducting a risk assessment. This assessment can be done internally or be per- formed by outside engineering, IT, or risk management con- sulting firms. It can have a broad scope (e.g., ERM) or a narrow scope (e.g., technology risk, engineering risk, or facilities risk). Most assessment methodologies use some combination of these elements: type of incident, probability of occurrence, risks to the airport, impact on the airport (e.g., life safety, facilities/physical plant/infrastructure, operational, finan- cial), and the acceleration and duration of incidents or their impact. The most helpful or productive business continuity risk assessments focus on the impact of predictable and less- predictable incidents on the core mix of resources that enable each essential airport function. These resources include staff (employees or contractors), plant and equipment (the facili- ties that staff need to perform and the tools, supplies, materi- als and vital records, and files they require), technology that enables or supports staff efforts, and other processes upon which many functions depend. Effective business continuity risk assessments consider the functional impact to these four types of resources if disrup- tive events occur, rather than attempting to predict how likely they may be to occur. For example, rather than consuming time predicting the likelihood of winter storms, or a tran- sit strike, or a power outage, business continuity risk assess- ments should address the impact of those incidents on the ability of people to get to work and do their jobs, on the avail- ability of essential tools and equipment, on the availability of space and facilities, and on the availability of processes upon which other processes depend. Because every important airport function depends upon some mix of these types of resources, it is the impact of inci- dents on the availability of these resources that should be the focus of the business continuity risk assessment. Impact assessment helps direct the business continuity plan toward preparation for the most impactful resource disruptions, which can degrade essential airport functions, activities, and processes or bring them to a halt. BCP then addresses how to mitigate impact risk with alternative ways to keep important functions operational during disruptions and recover full capacity afterwards. Developing the Scope of the Plan A combination of several factors establishes the param- eters and scope of an airport business continuity program. Each organization should consider these factors in defining and funding their BCP efforts: number of locations, num- ber and complexity of operating functions, IT DR, partner

11 network or “supply chain,” departmental depth, and strategic business objective. Number of Locations If the business continuity plan is being driven by an airport operator responsible for more than one airport, it should include an individual plan for each airport. Airport locations might include only the airport operator’s key terminal(s), other on-site and offsite facilities, and back-office operations. Alternatively, the plan might include non-aviation proper- ties and businesses that the airport operator may own and operate (if these are material to its mission). Plans might also be expanded to include resilience preparedness at locations operated by the contractors and third parties that perform essential airport functions as independent entities. Number and Complexity of Operating Functions The set of operating functions to be analyzed also deter- mines the scope of the business continuity plan for the air- port. Small, general aviation, commercial service, or reliever airports may have a relatively modest number of depart- ments or functions. This narrows and simplifies the plan- ning scope. Larger hubs and cargo airports are likely to have a more comprehensive mix of functional groups, implying a more complex and integrated planning process. Identify- ing these functions requires a comprehensive analysis of how the airport is organized; how it conducts its daily activities; and which departments, offices, contractors, processes, and activities compose the entire operation. Information Technology Disaster Recovery If the IT department’s DR plan is included in the scope of the business continuity plan, there will be added complexity in the process necessary to align the business recovery requirements of each department or function with the IT department’s technol- ogy recovery plan. At technology-dependent airports, reliance on supporting technology significantly impacts the recovery expectations of many business and operating functions. The business continuity and DR plans are inherently linked, or should be, as many business and operating functions depend on the technology provided and supported by the IT depart- ment. These plans are also linked by the synchronization that should take place between each department’s recovery point objectives (RPOs) (tolerance for loss of supporting data) and its recovery time objectives (RTOs) (tolerance for functional “downtime”) and the provisions in the DR plan for recov- ering essential hardware and network infrastructure and applications. Partner Network or “Supply Chain” Airports may extend their BCP initiative to key business partners that operate at the airport. Depending on the extent and complexity of those relationships with airlines, lessees, suppliers, FBOs, and contractors, the scope of the planning process may be commensurately broader and more complex. Departmental Depth The BCP program scope is also influenced by how deeply the process goes into departmental organizations. Business continuity plans can delve deeply into each function or depart- ment, covering multiple levels of sub-departments, and add- ing granularity to the scope of the plan. Conversely, they can take a more high-level approach. Strategic Business Objective The “end game” of the BCP process may be narrow— including only a BIA, a gap analysis, or a strategy development document—or it may be a far more comprehensive process, culminating in the documentation of a full-scale business continuity plan or an IT DR plan. The scope of BCP may be influenced by its primary goal, whether this is developing a sound operations management approach to resilience; pro- viding required sustainability documentation to regulators, airlines, or funding sources; or addressing a negative com- ment in the auditor’s report. Identifying the Stakeholders Airports are variously accountable to many types of stake- holders, according to each airport’s ownership, mission, and whether it is publicly or privately held. Other factors affecting an airport’s accountability to stakeholders are its inclusion within a governmental jurisdiction or its employment of unionized personnel. Stakeholders—those groups whose interests are fun- damentally affected when an airport’s routine operations are compromised and disrupted—typically include the following: • Elected officials • Regulators or authorities • Shareholders • Employees • Federal agencies • Workers’ unions • Trade associations • Insurers or insurance brokers • Customers • Business partners (tenants, contractors, suppliers, FBOs, and general aviation users) • The general public

12 BCP at airports should comprehensively identify critical stakeholders, appropriately communicate with them about the process, and include them when relevant. Airports should consider whether stakeholder groups should be part of the process or simply be included in the communications plan to keep them apprised of BCP at the airport. Forming a Business Continuity Planning Leadership Team A critical step in initiating the BCP process at the airport is naming the appropriate participants in the process, the BCP leadership team. Naming the BCP leadership team ideally includes identifying an executive sponsor, a project steering committee, a project manager or coordinator, business pro- cess owners, and plan administrator(s). Executive Sponsor The sponsor is typically the most senior manager who (1) coordinates the scope of the process, (2) often leads or participates as a member of the project steering committee, (3) ensures that the program has an adequate budget or fund- ing, (4) communicates to the other airport stakeholders that BCP is an organizational priority, and (5) motivates others within the organization to participate as necessary, at the executive level. BCP projects can easily fail or become meaningless exercises without strong executive sponsorship by airport management. Ideal executive sponsors might come from the arenas of inter- nal audit, F & A, compliance, risk management, or IT. Some- one in a chief-of-staff or senior operating role could also be a sponsor. Steering Committee The BCP steering committee should comprise a manage- able number of departmental leaders representing the breadth and scope of airport departments and organizations that are within the process scope. The committee oversees the BCP process and ensures the necessary internal cooperation and support and availability of resources at the functional level to meet the project’s objectives. Assigning formal departmental roles for BCP and including participation as a metric in staff performance plans may be required to achieve the best results. Project Manager Reporting to the steering committee, the project manager coordinates the day-to-day work on the BCP program. This person may be an internal manager from the office of the airport director or another department with airport-wide knowledge and perspective, such as those suggested above and in the following section titled “Assembling the Right Expertise.” The project manager might also be a BCP expert hired from the outside on a temporary consulting or advisory basis. BCP is a complex process, so the ideal project manager will excel in cross-functional process management. Business Process Owners Staff members who have responsibility for entire depart- ments or specific functions or processes within departments are known as business process owners. They can be high-ranking staff members (e.g., the Chief Financial Officer) or lower-level staff members, such as the persons responsible for accounts payable, accounts receivable, treasury, or cash management. Plan Administrator(s) Plan administrators are staff members assigned by the steer- ing committee or project manager to coordinate business pro- cess owners in keeping the plan up to date on an established basis (i.e., annually) or as circumstances change and opera- tions evolve. Assembling the Right Expertise Departments such as internal audit, risk management, F & A, operations, or IT often spearhead BCP projects internally because these departments typically have a broad financial, technical, or functional perspective on the airport’s overall operations, which puts them in a good position to facilitate the process. Airports may additionally choose to use the planning, over- sight, guidance, or involvement of professionals who are certi- fied in the discipline of BCP by organizations like the Disaster Recovery Institute International (DRII) in the United States or the Business Continuity Institute (BCI) in Europe. Trained BCP practitioners carry designations such as Certified Busi- ness Continuity Professional (CBCP), Master Business Con- tinuity Professional (MBCP), Member—Business Continuity Institute (MBCI), Specialist—Business Continuity Institute (SBCI), Fellow—Business Continuity Institute (FBCI), or Certified—Business Continuity Institute (CBCI). Airports may hire business continuity professionals as part of their staff or retain them as outside consultants. BCP special- ists can help ensure that the planning process follows industry practices and complies with relevant BCP standards. This guidebook and accompanying software tool were developed by certified BCP professionals. The tool includes a truncated, self-directed process that when completed will generate a customized business continuity plan that aligns with accepted BCP practice.

13 BCP includes a core set and general order of activities and processes, each of which is a building block of the finished plan. After taking the preliminary steps described above, air- ports and FBOs will have prepared the organizational and funding framework necessary to begin the process of devel- oping their actual plans. Conventional BCP follows a generally accepted process from conceptualization through plan development, exercis- ing, and plan maintenance (see Figure 1). Each process phase includes several steps. Project Management The BCP project management phase should start with proj- ect initiation activities and continue until the airport’s plan- ning process has been completed. A project kick-off meeting should formally initiate the process when the steering com- mittee establishes goals, objectives, and timelines; identifies roles and responsibilities; develops and finalizes a project plan; and establishes management and status reporting tools and escalation procedures. At this stage, it is important for the steering committee to define the strategic and business priorities at the airport; these will be used to establish how the airport will qualita- tively and quantitatively measure impact from the disruption and downtime of its essential functions. Without a common measure of disruption impact, the job of prioritizing recov- ery among widely disparate functions that contend for scarce resources can be extremely challenging and politically divi- sive. The steering committee typically examines the effects of disruption on the following: • Loss of revenue • Fines, penalties, and lawsuits • Brand image • Customer satisfaction and attrition • Regularity impact • Competitive advantage • Employee morale • Stakeholder confidence The steering committee should also define a recovery time- frame scale that the airport can tolerate, measured in hours, days, or weeks. For example, RTOs for the most critical func- tions might be measured in minutes or hours, while RTOs for less critical functions might be measured in days or weeks. Recovery of the least critical functions might be measured in months. A consistent scale should be applied across all busi- ness and operating functions. Establishing Planning Objectives and Assumptions Defining the Business Continuity Planning Objectives The objectives of the BCP process should be to document the organization of the recovery, individual and functional roles and responsibilities, and the associated resources required to minimize the effect of a disruption on airport operations. Additionally, the business continuity plan should detail the procedures that will be carried out by the individual functions operating at the airport in the event of a disaster that affects airport facilities. The plan should provide for testing, mainte- nance, and overall planning standards. The end result should be a plan to facilitate the recovery of critical operations, functions, and technology in a timely and organized manner and to ensure the availability of sup- porting resources, so that the organization can continue as a viable airport facility. The plan should identify the primary objectives for the recovery planning process, which may include the following: • Maintaining customer service commitments • Preserving the reputation of the airport The Business Continuity Planning Process

14 • Maintaining financial controls • Maintaining compliance/regulatory status • Improving risk management • Maintaining employee commitments • Meeting contractual covenants Defining Planning Assumptions In order to document the recovery requirements and detailed tasks and responsibilities provided in the airport’s business continuity plan, key planning assumptions should be identi- fied and documented. Identifying planning assumptions will ensure a consistent basis for identifying the requirements for all functions to recover efficiently from a disruption at the airport. Each airport should construct its own assumptions, based on its unique circumstances. Examples of planning assumptions are the following: • The disaster will affect a specific facility only, rather than the region as a whole. • There will no longer be access to the airport facility, and all documents and equipment at the facility will be inacces- sible for some assumed number of weeks. • Recovery or relocation resources will be unaffected by the same disaster. • Qualified personnel will be available to continue operations. • IT recovery plans are in place, and IT can meet the RTOs of all other airport departments. The types of operational assumptions an airport makes will define much of the scope, breadth, duration, and complexity of its plan. Assessing the Organization— The Business Impact Analysis Conducting the assessment, or BIA, is the foundational step that usually drives the development of the business continuity plan. The BIA generally consists of these general steps: • Identify essential business functions and operations at the airport—those core operations, processes, and functions that are critical and routine in running the airport (and FBO functions at the airport) during normal circumstances. • Analyze and document how these essential functions work and what human, technology, physical, and process resources these functions require to do what they are expected to do. • Determine the sensitivity of each essential function to downtime and the loss of supporting data by establishing RTOs and RPOs. • Rank the relative recovery priority of each function based on the strategic and business objectives of the organization established by the steering committee. • Review the results and make management adjustments, if necessary, to most accurately reflect the recovery impera- tives at the airport. Identifying Critical Business Functions An airport’s essential functions are those that are fun- damental to the core mission and operation of the airport or FBO. Some functions may be essential to most airports, such as uninterrupted power and sufficient back-up power, adequate water supplies to support ARFF functions, and pay- roll processing. The criticality of other functions, however, may differ markedly among airports. For example, winter operations will be a critical operating function in airports in Minnesota, while flood control may be essential to those in Florida and the Gulf states, where storms frequently inundate airside operations areas. Maintenance of the aeronautical operations assets of a co-located military unit at the airport may be critical to supporting its defense mission. For airports that make significant revenue from parking operations, the maintenance of parking garages and payment equipment may be deemed critical. Essential functions may exist in every department or office and may also exist within the agencies or departments of the local government or airport operator, to the extent that these functions (such as payroll or human resources) are managed there. By answering the question “How do we do what we do to run the airport?”, the BCP project team can begin to identify what is essential in aeronautical operations, environmental compliance, governmental reporting, human resources, cargo operations, ARFF, purchasing, and every other core function that is critical for the airport to continue as a viable operating entity. Many departments may have multiple essential functions. When identifying critical functions in the BIA process, it is not uncommon for airports to recognize how essential even Project Management— Objectives and Assumptions Business Impact Analysis Gap Analysis and Strategy Plan Development and Integration Testing and Maintenance Figure 1. The business continuity process.

15 obscure, “minor” functions, processes, or operations can be to their viability. Many other, more obvious, airport functions can be predicated on seemingly inconsequential processes. For example, contracting with a back-up provider of diesel fuel to run back-up generators may, during a disruption, be the function that ensures that the secondary generators are able to provide power to runway and taxiway lights. Essential functions can include operating, business, and support and infrastructure functions. Good places to start in identifying essential airport functions include the organization chart; the strategic business plan; risk management assessments; FAA or state aviation authority man- dates; and the historic record of incidents, claims, emergencies, and disruptions that have occurred at the airport. Analyzing and Documenting Functions Every important activity that takes place in every func- tion at the airport involves some mix of resources—human resources, physical plant and equipment, technology, and processes. The first step in documenting how essential func- tions at the airport operate is to create a critical resources inventory. This list describes the people that are required to operate the function or department and complete the task or manage the process. The list also describes the tools, equip- ment, supplies, facilities, space, and vital records needed to accomplish each function and the technology and automa- tion that supports the function. Creating a critical resources inventory involves dissecting every essential function into a set of sub-functions and pro- cesses, each of which is accomplished with a specific mix of resources, and documenting these through a discovery pro- cess as part of the BIA. The following questions should be asked regarding the people involved in each function and documented to help identify and describe their airport role: • How many people do we need to perform this airport function? • Are they airport employees, government employees, or contractors? • Do they require any special training, licensing, or certifica- tions to do their jobs? • Are they union members? Is there any union-specific pro- cess for replacing employees who may become unavailable? • Must they possess any job-specific skills, such as language fluency, or meet strength or height thresholds in order to do their jobs? • How long does it take to find replacements for them if they are absent? • Do the jobs that require special knowledge include suc- cession plans, so the airport’s institutional knowledge is documented in case it loses someone? Each of these kinds of questions informs the BCP process about the appropriate mix of human resources required for every essential function. These requirements help identify the staffing needed to manage each function during disrup- tions and to recover them afterward. The responses establish a framework for thinking through what must be done to plan for and ensure that essential functions and activities can be staffed appropriately during significant operational disruptions. Regarding the processes involved in each function, the fol- lowing questions should be asked: • What do the essential people in each airport function do to complete the core functions for which they are respon- sible? • How do they do them? • What processes have they established, and what processes do they, in turn, depend on in their roles? • Can they initiate or complete a job activity if a predecessor activity or process has failed or if they lose technology or automation? • Has the airport identified those predecessors for each essential function and does it understand who or what organization is responsible for providing them? Answering these questions helps define each essential func- tion and puts it into context relative to other activities at the airport or activities performed by others outside the airport. This helps document exactly what processes have to be recov- ered and sheds light on how the operations of these functions might be temporarily possible during disruptions if they have to be done without the technology upon which they normally depend. It also helps to document how interdependent many processes are and, consequently, how much contention there may be over resources during periods of disruption. Regarding plant and equipment, the following questions should be asked: • What kinds of facilities or physical space does each depart- ment need in order to perform its essential functions at the airport? • How many gates, hard stands, square feet, or acres of space are required? How much ramp space is required? • What support or characteristics must this space have (e.g., access to special critical infrastructure, proximity to another operational area at the airport, or special security considerations)? • What equipment, tools, devices, or vehicles does the depart- ment or function need to do its essential work? • Are there any mission-critical supplies without which depart- ments cannot function appropriately? • Does the airport store enough at normal usage rates to ensure that it can weather a disruption?

16 These questions help define the tangible “physical plant” components that are required by every function to operate sat- isfactorily. Many airport operating functions are equipment- centric (e.g., the maintenance and repair department) and space-centric (e.g., public parking or aeronautical operations) by the very nature of their missions. Essential plant and equip- ment inventories for these will always be very important com- ponents of the airport business continuity plan. Essential supplies are also important to identify. These may not be run-of-the-mill, ubiquitous supplies such as office sup- plies, bathroom supplies, or cleaning supplies. Rather, these are supplies that are fundamental to the capacity of depart- ments to perform essential functions. For example, if public safety officers are armed, their ammunition is a critical supply item. Diesel fuel is mission-critical to the back-up power func- tion, and supplies of jet fuel are crucial to the fueling function; likewise, fire-retardant foam is a key supply item for the ARFF function. Regarding technology, the following questions should be asked: • What are the technology requirements of each of the air- port’s essential business and operating functions? • Does the function require computer or communications hardware, and, if so, how many of which kinds of devices? • From which hardware and software vendors or systems integrators does the airport procure devices and hardware if it needs more? • Which software and applications do the functions require and depend on in order to perform their roles? • Has the airport documented where these applications reside in the organization and how to gain access to them in a disruptive situation? • How long can the airport do without these essential applications? • What kind of network, communication, and storage infra- structure does the airport need to support each function? Many airports are highly automated and make exten- sive use of technology across their operational footprint. Knowing the specific technology requirements of depart- ments is important in BCP because it helps establish how the IT department must plan for support, availability, and redundancy. An awareness of technology needs also helps identify how every core technology-dependent activity might be accomplished for a short period of time if the technology these activities depend on is “down” during disruptions. For airports that have, or plan to move to, a shared infra- structure services model, the requirement for technology resources may be even more acute because entire automated systems may depend on functioning technology—for instance, baggage handling, a common car rental center, or airport- owned gate operations. Defining Recovery Time Objectives The BIA process at the airport should objectively assess how long every essential business and operating function can with- stand partial degradation of capacity or a complete loss of func- tion before it is incapable of doing its job, meeting its goals, or providing functional output to the larger organizational entity. The important question is, how long can a function be down before there is real pain and negative consequences? This tolerance to downtime is referred to as each function’s RTO. Functional RTOs can be measured in minutes, hours, days, or weeks, based on level of criticality, seasonal or cycli- cal imperatives, and other factors. Identifying RTOs provides a comprehensive perspective into which functions are truly mission-critical and how the interdependencies among these functions affect other “upstream” or “downstream” functions. For example, payroll (obviously, an essential function) cannot be run until the time management system reports on the num- ber of hours employees worked during the pay period. That is an internal dependency. An example of an external depen- dency is when airport services such as electrical, water, or sew- age utilities are provided outside the airport; when disruptions in service occur because of events such as a regional black-out or water utility emergency, the airport can be affected. The qualitative and quantitative parameters established during BCP kick-off by the steering committee are important in determining RTOs because they provide a unified definition of how disruption impact is measured at the airport. These parameters may be very different among different airports or types of airports. Negative impact can be measured many ways: reduction in revenue; increase in fines or penalties; fail- ure to meet loan covenants or regulatory requirements; dam- age to the airport’s brand, image, or reputation; and so forth. Defining negative-impact benchmarks uniformly across the airport forces the assignment of RTOs based on a common denominator, which is important in aligning relative recovery priority among widely disparate types of functions. Defining Recovery Point Objectives In the BIA process, the organization should also identify for each essential function a finite measure of its tolerance for loss of data that are essential to the function’s role and mission at the airport. Tolerance for the loss of data needed to sup- port activity in a function is referred to as the function’s RPO. The RPO is an indication of the amount of time the function can continue without supporting data before the productiv- ity of the function is materially impacted. Data dependence can be profound for critical financial and reporting applica-

17 tions; supervisory control and data acquisition (SCADA) sys- tems; and hardware, network, database, or communications infrastructure. A function’s RPO is affected by factors such as how often a process must run or be activated (e.g., running payroll semi- monthly) or how long it can use data processed or produced earlier (e.g., composing reports to the FAA or EPA using the last period’s data if the supporting process is currently down or paying the parking contractor using last period’s data if the current period’s credit card data are unavailable). RPOs can be affected by whether there are viable functional alternatives for temporarily running the process without the usual technology support. These are called “manual work- arounds,” and they are a very important part of departmental recovery plans. A remarkable number of technology-dependent functions may be available temporarily with manual work- arounds. These short-term fixes may seem inelegant, but they might suffice for a few hours, a few days, or a week before the absence of new data is fatal to the ongoing function. For example, the TSA can still accomplish its security mis- sion if power is lost. It can perform hand pat-downs, open and inspect baggage, use battery-powered scanning wands, and deploy canine teams. The process will still work, but pos- sibly at a quickly escalating cost to the airport and airlines in the form of missed flights, crowd management crises, and overtaxed personnel resources. RPOs are also influenced by whether seasonal or cyclical circumstances render functions more or less critical at cer- tain times (e.g., winter operations are only seasonally criti- cal; payroll is critical only twice per month; baggage systems are critical only during aviation operations hours). RPOs can vary widely, from minutes to months, based on these factors. Ranking and Reviewing Recovery Priorities When each essential function has been analyzed and RTOs and RPOs established by those responsible for them, it is important to create a system that prioritizes functions, sub- functions, processes, and activities. This helps airport man- agement understand the recovery priorities among many different kinds of functions that may be completely unrelated or, alternatively, highly interdependent. The recovery ranking process can be difficult because it requires some kind of system that can order the recovery prior- ity among functions as different and seemingly unconnected as payroll, wildlife management, parking systems, ARFF, bag- gage management systems, procurement, and fueling. The difficulty is compounded because many of these critical func- tions are the responsibility of a third-party contractor or a government agency. The airport’s BCP project team and steering committee should establish a relative ranking approach that works for the airport’s unique needs and circumstances. Ideally, rank- ing should be driven directly from a set of qualitative and quantitative factors that reflect the strategic business priori- ties of the airport. A recovery ranking system based on these priorities pro- vides the underlying basis for assigning to any given function a higher or lower priority than another function. Creating a model for ranking relative recovery priority requires analy- sis, negotiation, and patience because process “owners” and function managers may each see their responsibilities as more important than someone else’s. Centrally defining the rank- ing factors helps reduce these disagreements. Because airports have common basic roles, such as sustain- ing commercial and general aviation operations, and may be certificated by the FAA based on their sustained capacity to comply with regulations and meet minimum standards, there is a basis for establishing recovery priorities. The functions, processes, activities, and technology that need to be recovered more quickly than others should be those that enable and sustain aeronautical operations, protect the revenue stream and financial viability of the airport, help the airport meet its contractual obligations, and help it maintain its certification. Beautiful grounds may be an airport objective, but recovering the maintenance department so that it can meet this objective is less important than recovering aircraft fueling operations. Based on these parameters, it seems critical to recover the water supply if it is disrupted for any reason because compro- mising the airport’s ARFF index can lead to de-certification or a shutdown of flight operations. Likewise, recovering the capacity to provide infrastructure and support services to the FBO(s), airlines, contractors, and tenants that operate under contract at the airport is important because penalties and contractual “give-backs” can materially impact the airport’s financial position. Similarly, recovering the power supply after a black-out or providing sufficient back-up power is important because power loss darkens the runway, stops elevators and escalators from moving people, shuts down flight arrival and departure monitors and signage, and makes printing boarding passes and passenger and cargo manifests impossible. Planning for how to keep or replace airport employees or contractors who may be highly specialized or may possess critical operat- ing knowledge that has not been documented is important because loss of these people to retirement, relocation, health issues, or death can remove vital institutional or functional knowledge from the airport. Notwithstanding these obvious recovery priority drivers, every airport and FBO has a different mix of business param- eters that helps their organizations rank priorities across the breadth of their operations. There is no such thing as a stan- dard recovery priority format or model; each organization is unique.

18 Critical Path Framework for Determining Recovery Priority Recovery priority depends on determining those operating and business functions that are essential to the airport’s mis- sion. The greater the negative impact is on the airport when a particular operating or business function is disrupted, the greater priority the recovery of that operating or business func- tion should have. This can differ widely among airports based on what is important to their unique operating and business model. Figure 2 provides a logical framework to use in evaluat- ing and determining criticality of functional recovery. When the impact of disrupted airport functions could lead to a shutdown of airport operations, the affected functions should be considered essential functions and be assigned the shortest RTOs. Examples include the following: • The disruption of the aeronautical operations area that shuts runways • The loss of ARFF index due to loss of essential ARFF resources or supplies • Power outage or loss of back-up power that blacks out runway lighting, NAVAIDS, and airport systems Figure 2. Critical path framework for recovery priority.

19 • The widespread absence of key operations staff due to pandemic, strike, or regional catastrophe • Loss of winter operations equipment during a major snowstorm Loss of these functions may result in a statutory or rule- based airport shutdown or an incident-specific shutdown. Loss or significant degradation of capacity of any function that can result in airport closure should be assigned a very short RTO, one measured in minutes or hours. BCP should take into account seasonality and cyclicality in assigning some RTOs. For example, recovery of the winter operations func- tion is critical during winter storm months, but non-critical during summer months. Loss of payroll on or around pay- day may require immediate recovery, but this function can be recovered less quickly during the days when payroll is not being run. The negative impact of many functional disruptions may not be as immediate, but may nonetheless threaten the viabil- ity of the airport by severely cutting services, by exposing the airport to regulatory fines and penalties or contractual penal- ties and claw-backs, by degrading the airport’s customer ser- vice capacity, or by materially damaging the airport’s image and reputation. While these impacts may be less immediate, they may be severely damaging if disrupted functions are not recovered in an appropriate timeframe. These functions should be assigned reasonably short RTOs, possibly mea- sured in hours or days. Examples include the following: • Loss of the infrastructure maintenance function could impact airport services by causing non-working elevators, escalators, and moving sidewalks. • Loss of recharging stations for electric people movers might cause elderly and immobile passengers to face dif- ficulties moving within the airport. • Loss of power to TSA screening stations could necessitate manual scanning, luggage searches, and pat-downs, creat- ing long lines of angry passengers and problems with air- lines, who expect smooth security screening. Loss or disruption of other functions may not directly or severely impact the airport, but may trigger contingent dis- ruptions that, in turn, cause severe impact. These contingen- cies are examples of internal and external dependencies. The BIA process should identify critical dependencies so RTOs can be appropriately assigned based on the potential con- tingent impact of disruption. Losing the system that reports employee hours worked may not itself be critical, but its sus- tained outage may in turn render the payroll system inop- erable. A strike that includes employees or contractors with highly specialized skills or training on unique equipment might be tolerable until those skills are required in critical path operations in the aeronautical operations area. Degra- dation of general aviation services may result in corporate flight operations moving to an alternative airport. Negative impact from the loss of other airport functions may be less severe or may manifest over a longer term, and thus these functions are less important to recover. The impact of disruption of these functions might be felt over time, but the airport can afford to restore them over several weeks or even months. For example, recovering the grounds main- tenance function can wait as its impact is largely aesthetic. Recovering non-aeronautical businesses or concessions may not require immediate action if they are not crucial to airport operations or consolidated revenue. If the impact of the loss of a function is minimal or manifests very slowly, the BCP might classify it as a non-essential func- tion, per se, and therefore leave its disruption unaddressed. Reviewing, Adjusting, and Finalizing the Results The BCP steering committee and senior airport manage- ment should be prepared to provide oversight and direction to the process of ranking recovery priorities by reviewing the results and making management adjustments, if necessary, to reflect their view of the recovery imperatives at the airport. These adjustments are needed to “break the ties” when two or more functions argue for recovery primacy. Adjustments should be made against a fact-based backdrop that looks to the severity of impact should a given function or process become degraded or completely lost, in these typical areas: • Revenue impact—does the loss materially affect the income statement? • Regulatory or legal impact—will the loss result in fines, penalties, lawsuits, negative court orders, or loss of grants? • Contractual impact—might the loss trigger breach of con- tract, claw-backs, or penalties? • Customer or stakeholder impact—will the loss degrade capacity to serve tenants, lessees, and flying customers? • Reputational impact—is the loss likely to negatively affect the airport’s or the airport operator’s image, brand, or reputation? • Employee morale—will the loss materially impact staff attitude? Gap Analysis and Strategy Development The BIA is an essential precursor to the component of gap analysis and strategy development (which helps the airport identify potential areas of mitigation). The BIA examines the interdependence of the various components of airport

20 operations and prioritizes those functions the airport abso- lutely requires in order to continue its day-to-day activi- ties. For every function at the airport, the BIA catalogs how things are done at the airport. The BIA evaluates which mix of resources is required for every function to sustain a minimal operational level and shows the relative priority of the essential functions that need to be recovered for nor- mal operations to resume after material disruptions. The BIA process also assesses where IT resources should be most quickly directed to support recovery. Gap Analysis In the follow-on gap analysis phase, the airport should analyze its set of required functions, as defined by the BIA, and compare it to both the resources currently available to aid recovery and the current plans or procedures for doing so. The gap (or difference) between recovery needs and capacity and resources available to sustain operations is addressed by the airport’s business continuity strategy and is defined for every essential operational element. Current General Resources Understanding the general resources available at the air- port might include a review of departmental plans and pro- cedures such as the following: • The human resources staffing process • The existence of succession plans in key departments and delegation of authority for critical roles • The facilities plan • The procurement and requisitioning process • The alert notification procedures used to call relevant stakeholders • The location of, and access to, vital records, files, and data • The IT DR plan In its gap analysis, the airport should look at the various elements of current practice and capacity and document dis- parities between what is required by each essential function to recover operations (based on priority) and what resources are currently available to do so. Closing those gaps (or decid- ing to live with the risk of not doing so) is part of a well- thought-out business continuity plan. Current Technology Resources Because many airports and FBOs are technology depen- dent, it is important to align the technology requirements of essential functions to the IT department’s DR plan, which documents how the IT department will provide resources and services and restore them to full operational status after disruptions. The gap analysis should assess the back-up and restoration policies and procedures for key data files and application systems used in the essential functions of the air- port. The analysis should also include a comparison by the IT department of the minimum equipment configuration required in the data center for delivering those technology resources and sustaining current operations as required versus its current data center configuration. Critical Resources Inventory An important step in BCP is to identify and inventory all the critical resources that are necessary to accomplish each essential airport function. These resources are addressed in these categories: • People (for specific duties) – Number of staff – Special certifications, licenses, or training they require – Other job-specific qualifications, such as height require- ments to operate equipment or strength requirements for ARFF staff – Status as employees or contractors and contractual replacement restrictions that may be present with union members • Plant and equipment – Physical space required to perform the function such as office space, operating space, shop space, and storage – Necessary office equipment such as workspaces, desks, copiers, and fax machines – Equipment that is mission essential such as tools, vehi- cles, and heavy equipment • Materials and supplies – Minimum on-hand inventory required such as office supplies, parts, fuel, and so forth – Minimum quantity for reorder • Systems and processes – Assemblages of permanent equipment and assets that work together to support any essential function such as shared services baggage handling system • Information technology – Network infrastructure – Computers and laptops • Mutual aid and assistance – Essential resources that are contractually available from outside organizations such as local first responders, DOGs, and disaster services vendors The gap analysis matches essential functions with the inven- tory of resources that support these functions. The BCP strat- egy that follows should address the gaps between the RTOs of each essential function and the organization’s capacity to

21 execute recovery within the RTO. Airports should close those gaps that they determine to be critical by investing in a mix of essential resources that will enable the organization to predict- ably recover its essential functions within their RTOs. Business Continuity Strategy Development The airport’s business continuity strategy will be its approach to mitigating or minimizing interruptions to its operational continuity and recovering its mission-essential functions as soon as possible after significant disruptions. The strategy should include a detailed and granular recovery plan for each function or department as part of an airport-wide perspective that takes into account the interdependencies among opera- tions and processes. The airport’s plan itself will be the result- ing documentation of recovery resources and procedures that address the organization’s recovery priorities for bringing criti- cal processes to a minimum threshold level of effectiveness dur- ing and after disruptions. Contention for Recovery Resources A major part of the business continuity strategy should be an analysis of the critical resources required by each function, so airport management can plan a cohesive strategy for their combined needs for space and facilities, staff, equipment, sup- plies, and technology during and after disruptions of any kind. When all departmental inventories of resource requirements are considered en masse, contention for resources such as staff, space, and technology may result. For example, several depart- ments may plan to relocate physically to the same space in the case of disruption, unaware that the space may not be able to accommodate them all. Several departments may vie during a disruption for a limited number of airport vehicles; demand for those vehicles might then exceed the supply. More than one department that plans to relocate to alternative space may claim prepositioned office equipment although there is not enough to be used by more than a single entity. Recovery priority helps define the “triage” system for these resources. However, airport management should take into account competing and overlapping needs as it develops its business continuity plan and provisions recovery resources. This process of defining priorities for resource contention is sometimes known as de-confliction, because it forces a com- prehensive solution to resource conflict across airport func- tions and departments. Manual Work-Arounds Another key step of the airport’s business continuity strat- egy is documenting manual processes for performing a func- tion that is normally performed using technology. During times of disruption, this documentation can guide each airport department in manually performing some essential functions when it has lost access to technology or automation or to some other process that is necessary to those functions. Because contention for technology may escalate during disruptions and because IT budgets may be constrained, defining viable manual work-arounds for as many essential processes as pos- sible can make the difference between operational continuity and functional failure. Alternatives to the Status Quo— Processes and Technology Many essential functions at airports depend to some degree on the support of technology, IT infrastructure, and technology- driven processes. If a disruption debilitates or degrades criti- cal supporting technology processes, the business continuity plan should document ways that dependent functions can be provided or maintained when technology is partially or completely absent. Some functions may be completely depen- dent on technology and thereby impossible to recover in its absence. However, many essential functions can be provided at some basic level or for a minimal amount of time without this infrastructure. For example, running payroll may normally be an auto- mated process managed by a payroll application. Nonetheless, the airport may be able to document an alternative payroll process that it can manage for one or two pay periods when the payroll software is down, whereby it calculates compensa- tion and deductions manually, based on the last period’s data, and writes payroll checks by hand. A thoughtful analysis of each critical function makes it pos- sible to describe and document similar manual work-around processes for use when the expected technology processes fail or are fully or partially unavailable. Note that the busi- ness continuity process does not focus on why technology is down (electrical storm, failure of the data center, inter- nal sabotage, malware infection, or an external distributed denial of service [DDOS] attack). What matters is recogniz- ing that the technology upon which a core process or activity normally depends may not be available and documenting how the process or activity can be performed manually dur- ing the period of operational duress. While many essential functions can be performed at least partially or for a short period of time without supporting tech- nology, many may not be recoverable until predecessor technol- ogy processes are themselves recovered following a disruption. When faced with the loss of a core process, the airport’s busi- ness continuity plan can consider several kinds of responses: • Abbreviate the process. If accounting runs its general led- ger process each night, a decision can be made that during

22 major disruptions accounting can get by with running the ledger process every fortnight, if the impact of the reduc- tion in frequency can be tolerated. If mowers are broken, the maintenance department can cut the grass every 2 weeks instead of every week for an extended period of time. • Complete the process manually. If a technical resource for accomplishing an activity becomes unavailable in some way, the airport should devise manual processes to use until the supporting resources become available again. For example, if the power to jet bridges is lost, crews can use manually moveable stairs to deplane passengers. Similarly, if a shared services baggage claim carousel is down, extra handlers could be directed to deliver arriving luggage manually, using hand-operated dollies. The cost to the airport in terms of passenger frustration, long lines, crowd control, and pressure on bathroom and food service establishments in the arrivals area may be great, but the airport can meet its baggage delivery obligations for a short time by manu- ally moving luggage with extra staff and rolling stock. • Live without it. The airport may be able to suspend many processes during prolonged disruptions. The business con- tinuity plan should identify every process that the airport or FBO can afford to suspend temporarily until normal operations are recovered. For example, if a disruption causes overcrowding of an airport terminal, can the use of courtesy people movers (normally used to transport those with special mobility needs) be curtailed since they cannot move through the crowds? (If so, the manual work-around might be to hire more red caps to use hand-pushed wheel- chairs as temporary replacements.) Similarly, when technology is unavailable as the result of a disruption, the airport’s business continuity plan can also consider various responses: • Transfer loads to back-up sites. Bringing up a “warm” or “hot” IT site that may be situated on a different power grid can help airports recover technology capacity with minimum downtime. System crashes that require some- times lengthy restart routines can present the airport with the requirement for a gradual recovery of numerous IT-based applications; this in turn necessitates a plan for the orderly recovery of applications based on the criti- cality of the application and its interdependencies with other applications and processes (as documented from the BIA). • Transfer to back-up vendors. The airport can pre-plan transfer of technical services to back-up vendors using stand-by or just-in-time MOUs and contracts that define when and how the replacement vendor’s systems must be prepared to be made available. For example, if payroll is down, airports might alternatively process checks with one of the large payroll processing vendors for 2 weeks until recovery. • Trigger manual work-arounds. Some processes at the airport that depend on technology can be accomplished manually, at least for some abbreviated period of time dur- ing disruptions. While the payroll application example is a highly automated process, for airports with smaller staffs, the accounts payable department may be able to write paper checks for one or two pay cycles while waiting for the tech- nology to come back online. Highly labor-intensive manual delivery of checked baggage can be planned for a scenario in which the automated baggage moving system fails. • Live without it. There may well be a number of applica- tions that airports can simply manage without for a brief period of time, with acceptable loss of service and capabil- ity. The business continuity plan should identify each of these technologies and how long they can remain unavail- able before more profound damage is done. Airports operating in a shared services model, where key resources, functions, and technology are centrally operated and used by airlines and other lessees on a per-use basis, should focus their business continuity strategy on technol- ogy systems redundancies. Alternatives to the Status Quo—Physical Location Every department in the airport or FBO has a primary location for staff, office furnishings, tools, equipment, com- puters, and supplies. The business continuity process should address how the airport plans to move its essential functions to alternative locations if a disruption renders primary loca- tions unusable or unavailable. One role of the plan is to document the places to which each essential function, office, or operation would be relo- cated if a disruption made their normal location inaccessible or unsuitable. Relocation plans should take into account the size of the staff that would be relocated and, if the reloca- tion site currently houses another group, whether that site is large enough to accommodate both. Contention for reloca- tion space should be resolved in the de-confliction portion of the airport’s plan so that a workable space is available for every function. Plans should also document which essential equipment, tools, and supplies will have to be moved to the alternative location (or prepositioned there) in order for each depart- ment to be functional in the new location. Plans should also document how the staff is expected to get to the alternative location, whether by personal or public transportation or by using airport-provided transportation. Each essential air- port or FBO function should have a designated primary and secondary relocation site, assessed for viability by the staff ’s

23 answers to questions about how essential people, processes, plant and equipment, and technology can also be relocated there or effectively used elsewhere. Disruptions can present airports with the loss of physical assets and infrastructure ranging from the fundamentally critical (e.g., loss of a runway due to flooding or power fail- ure) to minor and inconvenient (e.g., loss of one of its three parking garage exits). In these instances, airport management can respond in one of several ways: • Temporarily work around the loss. In the lost parking example, increasing staff and activating additional exit sta- tions or kiosks at one of the alternative exits can provide extra capacity until repairs can be completed on the one that is damaged and unavailable. • Schedule dependent activities differently. If an airport runway or taxiway is unavailable, for example, the air- port can pre-plan with the FAA how to manage flight operations with the remaining operational runway con- figuration. Long-term parking lots can be used until the short-term lot is available, using additional buses. Alter- native offsite city or county parking facilities may also be accessible. • Offload the activity to an alternative resource. The air- port can establish one or more alternative resources to help it manage until it recovers the lost assets, vehicles, or equip- ment. In large regional incidents, the airport might rely on MOUs for support from a DOG to move some airport functions and capacity to neighboring facilities or obtain emergency resources, in coordination with any affected carriers and the FAA. • Use back-up suppliers. Airports can create and maintain a list of stand-by resources and vendors that offer just-in- time services such as disaster management and recovery vendors that can ship in trailer-based assets (e.g., technol- ogy, back-up power sources, etc.); these can be brought online within hours. Alternatives to the Status Quo— Skilled Staff Availability When disruptions affect the availability of essential staff in any core airport function, the challenge is how to replace this particular talent pool, temporarily or over the long term, so that operations for which they are responsible will not go unperformed. This is a special business continuity challenge when affected staff members are highly specialized, maintain unique skills, or have job-specific training, certifications, or professional status. Many airports have employees with a high level of institutional knowledge (of processes, policies, practices, or contact information for key people) that has not been docu- mented. This makes the recovery of staff after disruptions critically important because the absence of these knowledge- able people can bring functions to a halt. At airports, risk is elevated because these responsible, knowledgeable people may not actually be located at the airport, but at the airport operator or government office if key airport functions are managed there. They may also be employees of commercial tenants and contractors who per- form certain essential airport functions. Any lack of cross- training or documentation of these people’s job knowledge creates a very real risk that while one or two key people may know how a function is performed, the airport organization may not know how it is done or how to recover the function if the most knowledgeable people become unavailable during a disruption. Routine personnel reductions and normal staff attrition from death, relocation, retirement, sickness, or dismissal increase business continuity risk because specialists who become absent for any reason represent single points of failure if no one else knows what they do or how they do it. If a pandemic impacts the availability of a large portion of the staff, entire airport departments could cease to function appropriately for days or weeks until the return or replace- ment of vital personnel. The possibility of disruption in the availability of essen- tial staff is why the airport or FBO business continuity plan should document essential functions, processes, procedures, and call trees so that they are accessible to replacement staff and management in the absence of the specialists who nor- mally are available. The business continuity plan should identify these skilled staff requirements or determine that, for an abbreviated period, a particular function can be performed by someone who is not fully credentialed. The business continuity plan should also document how to locate and acquire the services of replacement staff with commensurate skills, attributes, certifications, and professional credentials. For example, essential financial roles at the airport may require the replacement of certified public accountants (CPAs). Replacing staff for planning, design, structural, or infrastruc- ture positions may be require professional architects, licensed engineers, or people certified in computer-aided design (CAD) applications. Heavy equipment operators or other skilled air- port maintenance workers may need to have apparatus-specific certifications or to be licensed tradesmen. Public safety staff may have to be sworn law-enforcement officers. ARFF staff might require certification on the use of specific firefighting apparatus. Employees in the airport infirmary might have to be registered nurses or licensed nurse practitioners. Planning for the replacement of these types of personnel during disruptions must take these requirements into account.

24 Some jobs may require specific demographic attributes: operators of some vehicles or equipment might have to be of a minimum height; firefighters may have to be capable of car- rying a personal equipment load of a certain weight up lad- ders or meet other endurance tests; some security roles may require staff who are fluent in another language or of a par- ticular gender. Essential workers may have to be members of a particular union. Union contract rules may not only require replacements with certain skills, seniority, or trade skills, but also may legally limit where union workers can be asked to relocate and work, even during workplace disruptions. The airport’s business continuity plan should consider all such limitations to the airport’s ability to replace skilled staff and document how it will overcome these limitations so the organization understands exactly how it will replace spe- cialists of all kinds if the disruption makes the current staff unavailable for any impactful length of time. When faced with not enough of the right people to ade- quately perform each core function identified in its business continuity plan, airport management can decide to take sev- eral types of actions: • Do it differently. Management can ask different people (who have been cross-trained) to perform the function or find someone who can perform an automated process manually. The recovery plan for each airport function should address whether and how staff members from a related department should be cross-trained to perform temporary tasks. • Do it less often or less thoroughly. Similarly, managers should consider questions such as these: – Can we perform this task or run this process weekly instead of daily? – Can we complete the process with a sample of incidences instead of all instances? – Can we monitor this procedure for exceptions, rather than confirm every completion? Any of these approaches reduces dependence on people who are unavailable for a period of time. • Do not do it at all. When considering the importance of a task or process and recovery priority, managers might ask these questions: – Is this process absolutely critical in a time of duress? – Can we get by for an hour, a day, or a week without some- one doing it? – Do we put the operating certification of the airport at legal or regulatory risk if we stop doing this? – Do we put people at unacceptably high levels of risk if we stop doing this? – Do we abrogate our responsibilities under our leases or loan covenants, to significant legal detriment, if we tem- porarily stop doing this function? Determining what not to do during disruptions can help mitigate the requirement for strained human resources. Effective business continuity plans include two processes for ensuring the availability of essential replacement staff during disruptions: • Delegations of authority. These are formal assignments of specific authority to make defined decisions, such as approving leaves of absence, expenditures, timesheets, and travel. If a staff member is unavailable during a disruption, his or her authorities should pass seamlessly to a primary, secondary, or even tertiary replacement, so essential deci- sions can continue to be made. • Succession planning. If an essential staff member is perma- nently unavailable as part of a disruption (i.e., is disabled or deceased), a formal succession plan should pre-establish who will take over the job. Fundamental to both delegations of authority and succes- sion planning is the BCP objective of identifying and docu- menting how every element of every essential function in a job description is accomplished, ensuring that successors to the function know exactly how to operate the function when called upon to do so during disruptions. This establishes sus- tained institutional knowledge that cannot be lost if essential staff members become unavailable. During prolonged airport disruptions, the business conti- nuity plan should detail an approach to managing all essential airport or FBO functions by replacing lost people, processes, and plant and technology resources, or managing without them at some minimally acceptable level. By analyzing each airport function and documenting its resource mix and recovery priority, the BIA process equips the airport BCP team to identify alternative resources that the airport might call on in order to perform key tasks a dif- ferent way. Requiring Contractors, Tenants, and Suppliers to Have Business Continuity Plans Because airports often rely on outside, non-employee firms for many essential functions and processes, it is important that airport management require these key, third-party com- panies to develop their own proprietary business continuity plans. This can be done by contractually requiring vendors, contractors, and lessees to develop continuity plans for the essential functions they perform at the airport (fueling, gen- eral aviation management, maintenance, security, etc.) so the airport has confidence that their functions include a recovery and restoration process after disruptions occur. It is a good idea to attach these plans as appendices to the airport’s final

25 plan for reference and to invite third-party firms to partici- pate in business continuity exercises and testing. Documenting the Business Continuity Plan The documentation of the business continuity strategy for all an airport’s business and operating functions should be integrated into a plan that includes the following types of information. Administrative Content Administrative content should include the following: • Plan confidentiality statement. This limits the accessi- bility of the plan to those personnel that the BCP team and airport or FBO management specifically designate. Limits on distribution are important because business continuity plans contain a great deal of highly confiden- tial information. • Introduction and overview. This section should define the purpose and scope of the business continuity plan and document the assumptions made in developing the plan; this section should also describe the “Concept of Opera- tions,” which provides the structure and operational guide- lines for using the plan. • Organizational chart and responsibilities. Three relevant types of organizations should be named and described, the crisis management team (CMT), the damage assessment team, and the business recovery teams. The airport’s CMT evaluates disruptive events that impact the airport and makes decisions as to the deployment of recovery resources for the entire airport. The damage assessment team iden- tifies the extent of the physical damage and helps deter- mine the resulting duration of the outage. The business recovery teams manage and coordinate each department’s or function’s response to and recovery from any disrup- tive crisis that affects it. The names and mandates of these organizations may vary widely among airports. • Emergency contact information. The plan should estab- lish a dial-in number and/or website or social media page(s) that enable employees and relevant stakeholders to access updated information about the disruption and recovery. Business Continuity Plan Elements This should be the main section of the business continuity plan. For FBOs or small airports, it might be relatively lim- ited, based on the size and complexity of the organization. For larger hubs, this section will be far more extensive. In order to develop this core part of the plan, organizations should assemble the following information for each essential business and operating function at the airport: • List of the essential functions performed in the depart- ment, the person(s) responsible for each, and a sense of the relative recovery priorities for the functions • List of any essential functions that are outsourced to a tenant, contractor, or vendor; the person or company responsible; and a list of any essential “inputs” to these functions that the airport must provide to the responsible contractor • A description of “manual work-arounds” essential for functions—in other words, how these functions are accom- plished if the technology upon which they normally depend is absent—and who is assigned to these work-arounds • List of files or vital records required to perform essential functions, their locations, and recovery priorities • Any data control requirements for information used in the functions • Identification of audits, validation, or formal approvals required to complete essential functions, and who or what entities perform these reviews or audits • The names assigned to the business recovery team for each essential function, their roles, and contact information • Number of staff members or full-time equivalents needed to perform each essential function and any specific licenses, training, certification, or qualifications required for replace- ment personnel in those roles • Names of the entities that provide this licensing or certification • An estimate of how long it would take to replace essential staff • List of any external personnel, contracting agencies, or unions and their contact information • Identification of essential staff members, their primary and secondary replacements, and licensing/certification, union membership, or contractor information • List of everyone in the department, or outside of it, who must be notified if the essential functions are disrupted, along with contact information • The normal location at which the function is located, man- aged, or coordinated and the normal location at which any “field operations” take place for the function • At least one alternate location for the function in case the primary location is unavailable; the address, capacity, and number of departmental staff required to locate there; and information on whether the airport provides transporta- tion to the alternate location

26 • Types of any function-specific physical facilities required at alternate locations, the sources of these facilities, and their specifications • List of any special infrastructure support services required by the function, their sources, and specifications • Any special security measures required by the functions, their sources, and specifications • List of any function-critical materials and supply items, minimum quantities required to be on hand, minimum reorder quantities, their sources, and specifications • List of any function-specific equipment or tools, order quan- tities, minimum quantities, sources, and specifications • Number of computers used in the function, their types, quantities, sources, and specifications • List of function-essential software applications, where they are stored or hosted, the criticality of recovery for each, the suppliers, and their contact information • List of function-essential communications devices, quan- tities required, sources, and specifications • List of essential office equipment, quantities required, sources, and specifications • Description of any other function-critical devices, quanti- ties required, sources, and specifications • List of all organizations, agencies, or entities that need to be contacted during prolonged operational disruptions, the criticality and timeliness required for contacting them during disruptions, and their contact information Recovery Time Objectives The RTO for each of the airport’s business and operating functions should be listed in a table. The RTO is the amount of time each function’s operations can be suspended before the resulting negative impact becomes unacceptable. It is the tolerance for downtime for a particular function. RTOs can be stated in minutes (for functions that must be recovered at once), hours, days, or weeks, based on priority. Each organi- zation will establish RTOs that meet the requirements of their unique circumstances. Alternate Work Space If the decision is made by the airport’s CMT to activate the business continuity plan, the Alternate Work Space sec- tion of the business continuity plan instructs each function to follow the business relocation procedures as documented in their section of the plan. It defines both the relocation that will take place immediately after the declaration of a disruption through some airport-specific timeframe and medium- to long-term relocation strategies. This section of the plan also addresses recovery site activation and tasks the appropriate team with communicating the appropriate instructions for relocation to each of the airport’s business recovery teams. Essential Operating Functions This section of the plan should include a subsection for each business and operating function that is included in the business continuity plan. Every subsection should include this content: • Overview and basic information about how the function operates • Table of the business recovery team members and emer- gency call lists • Complete list of the essential services provided by this airport function • Definition of the recovery priority of the function as a whole and each of the key components of the function (expressed in RTOs or some similar ranking methodology) • Lists or tables of essential resource requirements for the function—staffing, services, equipment, communications devices, office equipment, technology, and vital records • Delegation of authorities and succession plans • Alternate location information for recovering functional operations elsewhere during disruptions • Functional recovery procedures • Continuity plans for outside third-party companies that operate essential airport functions and processes under contract Additional Business Continuity Planning Information Business Continuity Planning Team Responsibilities This section should describe and clarify the roles and responsibilities of the various BCP teams and their leaders to minimize any confusion among plan constituents. Definition of Disruptive Incidents Each airport and FBO should define what it considers to be disruptive incidents in terms of their impact on essential operations. The airport or FBO should distinguish among those disruptions that may be non-impactful emergencies and those that are likely to cause material disruption of key functions. Phased Approach Strategy This should be an airport-specific strategy for defining its overall RTOs—the maximum amount of time that each function at the airport can be suspended before causing a

27 severe impact to one of the airport’s recovery objectives (such as meet contractual commitments, maintain regulatory com- pliance status, preserve reputation, maintain financial and operational controls, and maintain employee commitment and morale). In this section, the airport should establish standard RTO intervals (e.g., 4 hours or 2 days); this will optimize consis- tency among the business units in determining functional criticality and recover priority. Standard intervals enable each airport function to evaluate resource needs and facilitate the allocation of recovery resources in the event of a site outage affecting multiple business and operating units. Consistency reduces the risk that a less important function may recover before one that is more critical. Plan Activation This section should define the factors that will prompt the organization’s management to activate its business continuity plan. The triggers for activating the plan may be obvious— loss of power (because it can eliminate all systems), loss of water pressure (because it can reduce critical ARFF capabili- ties), or an IT network failure. Activation triggers may also be less obvious—a growing pandemic degrades availability of critical staff, a local transit strike keeps many workers at home indefinitely, or meteorologists predict a high wind and flooding event within 2 weeks. Plan De-activation In some cases, when the kinds of elements that trigger business continuity plan activation are eliminated, the plan is de-activated. Restoration of power or water supply, net- work restoration, or the end of a pandemic are examples. However, the closure of the triggering event may not auto- matically mean that contingent systems, equipment, or tech nology impacts that were a result of the primary trig- gering event have been addressed. Plan de-activation may be delayed until these dependent impacts can be resolved and essential functions associated with them restored. For example, the IT department may have restored the data cen- ter, but the data required to be recovered for other essential functions may not be restored for another day or week. In this case, it would be premature and counterproductive to de-activate the plan until all necessary elements are back in place. Plan Distribution Airports should use this section to document the people to which the plan will be distributed and how in order to control access and to maintain confidentiality. Plan Testing and Maintenance This critical section of the plan should describe the air- port’s testing objectives for its business continuity plan. This section should also define the type and scope of exercises the airport intends to facilitate to keep the plan current and well practiced, establish a formal test/exercise schedule, and define the components of the tests. A more detailed discussion of plan testing and maintenance is presented in following sec- tion, “Plan Testing, Exercises, and Maintenance.” Stakeholder Recovery Plans Because so many essential airport functions may be the re - sponsibility of contractors, FBOs, and government agencies, the airport’s business continuity plan should incorporate copies of the contingency plan or COOP of each of those outside part- ners for the functions it specifically performs at the airport. Plan Testing, Exercises, and Maintenance When the business continuity strategy is developed and the plan is documented, it should be continually maintained and regularly tested and exercised. This is to ensure that it remains up to date, reflecting periodic changes in the airport or FBO operating circumstances, and that employees and other stakeholders understand the plan and how to use it during prolonged disruptions. Ideally, business continuity should be an airport-wide pro- cess. While the plan itself may be developed by the members of the BCP project team, it is important for airport man- agement to socialize the plan and provide training well into senior departmental ranks so everyone in the organization, as well as its other stakeholders, is aware of the plan and under- stands its implications and their specific roles and responsi- bilities during disruptions. Maintaining a state of business continuity preparedness depends on the airport regularly testing its plan and the assumptions built into the plan and running periodic exer- cises that simulate the various types of disruptions that the airport may face. Without such exercises, the business continuity plan is nothing more than a documented compendium of informa- tion. Its effectiveness during real disruptions may be compro- mised if the airport has not tested the effectiveness of the plan through exercises that familiarize the staff with its provisions and reveal areas of the plan that can be improved. Plan testing should be used to do the following: • Determine the state of readiness of the recovery organiza- tion to respond to and recover from a disruption to busi- ness, operations, and systems

28 • Determine whether the required resources for recovery are available at recovery locations • Determine whether the business continuity plan has been properly maintained to reflect changes in the airport’s business, operations, and technology • Manage the expectations of the business units at the air- port regarding what they can expect in the event of an actual disruptive incident • Instill a sense of calm and confidence across the airport by showing that there is a demonstrable state of readiness for a potential disruption of services • Demonstrate compliance with applicable regulatory requirements and good airport industry practices Exercises are classified based on the extent of the actual resources being employed and the manner in which they are tested. Airports should consider using three types of exer- cises: a structured walk-through, component testing, and an integrated simulation/full operations test. Structured Walk-Through A structured walk-through is a paper evaluation of the air- port’s business continuity plan or a portion of the plan. It is designed to exercise the plan’s effectiveness without incurring the expenses or using the personnel resources associated with performing a full test. The objectives of the structured walk-through are to do the following: • Verify the contents of the plan • Prepare for simulation testing • Train new members and create employee awareness • Maintain preparedness while limiting use of resources • Confirm that the strategy documented in the plan is viable • Educate critical personnel on their responsibilities during a disruption • Confirm that the information in the plan is current and accurate • Identify areas of the plan that need revision or updates A structured walk-through exercise is a cost-effective method for evaluating the adequacy of a plan. This exercise can be performed regularly on different parts of the plan and under different disruption scenarios. Component Testing Component testing is an off-hours exercise that airports should use to test a particular part of their recovery plan more aggressively. It serves to verify the correctness of oper- ating procedures, hardware components, and the ability to restore a business unit’s critical functions. An example of this type of test is a limited systems restoration and a connectivity test at a function’s recovery site. Component testing differs from the structured walk- through in that it involves actual recovery activities being exercised. It differs from a full operations test in that it does not require the use of the actual recovery sites. The objectives of component testing are to do the following: • Demonstrate the accuracy of the execution of the plan • Verify the appropriate operating and incident escalation procedures • Train and increase awareness of personnel • Validate previous modifications of the BCP, including the DR plan Integrated Simulation/Full Operations Testing Integrated simulation/full operations testing should be per- formed at the airport’s actual recovery site(s) and should use the resources for the specified tasks of the test (i.e., recovery site systems and workspace). This method of testing requires some processing activities to be performed at the recovery sites and requires the most advance preparation of all the test types. Integrated simulation/full operations testing demonstrates the adequacy of systems and business recovery procedures as well as the compatibility of back-up resources, providing vali- dation of the time needed to restore critical airport functions. The objectives of integrated simulation/full operations testing are to do the following: • Test the entire plan or a portion of the plan under emer- gency scenarios • Validate operational effectiveness and business unit inter- dependencies • Provide measurable technical and administrative results It is advisable to schedule an exercise of this proportion after hours or during a weekend. There are three test categories that are classified by the extent of the overall plan that is being tested. Element testing exer- cises a particular part of the airport’s plan, such as its call trees. Business unit testing exercises the recovery plan of an individual business or operating unit, such as winter operations. Full pro- cess (integration) exercises test business unit interdependencies and the integration of departmental plans with supporting business processes, along with how parts of the plan work together as a complete disruption response.

29 Test Schedules The senior business continuity officer should coordinate the administration of the review, maintenance, and testing schedules. This person should also be responsible for follow- ing up on any revisions to the plan that may be required as a result of tests. The business continuity steering committee should review and approve any revisions. As a matter of regulatory compliance, many airports should test their operational recovery capabilities on an annual basis. They should use the preceding year’s test results as a basis from which to develop the test objectives for the current year. Consideration should be given to changes to the airport’s RTOs and resource requirements, the inclusion of new busi- ness units and processes, business units experiencing signifi- cant personnel changes, regulatory changes, and changes to the airport’s IT environment from the previous year. Conducting Tests Preparation, execution, and review of test results are the key components of a successful airport BCP testing program. (See Appendix D for a sample test evaluation form.)

30 – The facilities that the plan covers – The number and identity of the business and operating functions addressed by the plan • Objectives—describes the goals set by the airport for the business continuity plan and distinguishes it from other plans (e.g., the emergency management plan, crisis com- munications plan, IROPS plans, etc.) • Assumptions—describes the following: – The extent of the plan activation (i.e., how long it will take to recover disrupted functions when following the plan) – The factors addressed in the plan (essential functions, resources, and support) – Any exclusions (i.e., that the emergency management plan, the IT DR plan, or the crisis communications plans are not part of the business continuity plan) – How the plan is integrated with other incident manage- ment plans that the airport maintains – How staff members who have responsibilities under the plan are to be trained and prepared – How the plan will be regularly exercised, updated, and maintained Concept of Operations Concept of operations includes roles and responsibilities, individual plans for functional recovery, functional recovery prioritization, plan activation, and plan deactivation. • Roles and responsibilities—the responsibilities of all staff with formal recovery roles on various teams when the business continuity plan is activated: – Steering committee, plan manager or coordinator, busi- ness process owners, and plan administrators – Crisis management team – Damage assessment team – IT recovery team What the Business Continuity Plan Should Look Like Effective business continuity plans should include the ele- ments listed below (based on accepted business continuity standards and practice) applied intelligently to each airport’s specific operating environment. While plans can be docu- mented in hard copy, it is increasingly popular to develop them using a software tool so that they remain easy to access, update, and distribute and can be more effectively used for training and exercises. Cover Page The cover page includes the date, version number, and offi- cial declarations: • Date—the date of the plan as subsequently updated • Version number—so every update is recorded • Official declarations—indicating approved uses (e.g., “official use only”) or any necessary disclosure approvals or permissions Introduction The introduction includes organization of the plan, distri- bution and access, mission statement, scope, objectives, and assumptions: • Organization of the plan—describes and defines the plan’s sections and layout • Distribution and access—defines to whom (people, roles, and organizations) the plan is distributed and provides any official access restrictions to the plan • Mission statement—defines the plan and what it is meant to accomplish for the airport • Scope—defines what the business continuity plan covers, in terms of the following: – Impact to identified functions that are essential to the continuity of the airport’s operations

31 – Functional recovery teams—team leaders, members, and those with financial, crisis management, or public safety or security roles during recovery activities • Individual plans for functional recovery—an explana- tion that the master airport plan is a “roll-up” of the recov- ery plans and requirements of the essential business and operating functions at the airport is given in this section • Functional recovery prioritization—a listing of the many essential departments and functions operating at the air- port or supporting it with a general recovery prioritization • Plan activation—a section defining those incidents or dis- ruptions that will result in official activation of the busi- ness continuity plan • Plan de-activation—conversely, a section defining events that will de-activate the plan and return staff and depart- ments to normal roles and responsibilities Functional Recovery Plans This section is the “meat” of the business continuity plan. It documents the recovery plans and the resources that are essen- tial to the recovery of every essential function at the airport. For each function, this section provides a functional descrip- tion or overview, mission-essential functions and recovery priorities, business recovery teams, critical resources, vital records and data, alternate facilities, delegations of authority, succession planning, and alert notification procedures and call lists: • Functional description or overview—a definition and description of the department or function • Mission-essential functions and recovery priorities— including the following: – Identification and prioritization of all sub-functions or business processes within the function – RTOs – RPOs – Internal interdependencies – Any special safety and security measures required dur- ing recovery • Business recovery teams—identifies those within the func- tion who are formally assigned roles and responsibilities for recovery • Critical resources—an inventory that documents the mix of systems, plant and equipment, materials and supplies, per- sonnel, mutual aid and assistance, and technology resources that are essential to the operation of the function or business process • Vital records and data—an inventory that documents all the electronic and hard-copy files, data, and vital records that are essential to the operation of the function or busi- ness process • Alternate facilities—including the following: – Pre-established facilities and space to which the func- tion will relocate if it cannot use its current space (includ- ing prepositioned equipment, supplies, materials, and furnishings) – Emergency acquisition procedures for alternate space if the primary relocation facility is unavailable – Provisions and procedures for working from home, when possible – Relocation procedures and procedures for taking essen- tial equipment, supplies, materials, and furnishings to the new facility • Delegations of authority—formal assignment of author- ity and approval of leave, travel, procurement, time sheets, contracts, and so forth, if the person who normally provides these becomes unavailable • Succession planning—formal plan for assuming the posi- tions, roles, and responsibilities of someone who is perma- nently unavailable • Alert notification procedures and call lists—lists of inter- nal and external contacts who should be notified or con- sulted during functional disruptions, including staff, family contacts, suppliers and vendors, contractors, airport opera- tor personnel, first responders, and others, as well as infor- mation on preferred methods and means of communication Devolution This section describes in detail what will occur if the busi- ness continuity plan fails to recover the function. It provides for temporarily transferring the administration, rights, pow- ers, property, and responsibility for the function to an outside organization or entity, such as the airport operator, the city or county, another airport, the military, or another appropriate entity. Reconstitution This section describes how the airport overall (or each func- tion per se) will return to its normal operation once the busi- ness continuity coordinator determines that the disruption has ended, all danger is over, and the plan is de-activated. This requires a damage and situational assessment of the essential elements that make up and support the function or the air- port. Some disruptive incidents may have caused extensive damage that precludes speedy reconstitution of some airport functions. When the airport returns to normal operations, a desig- nated person from each function should notify the coordina- tor of its business continuity activation and relocation status, operational and communication status, and the time neces- sary to return to its normal location. Plans are described for

32 allocating space and moving people, equipment, supplies, materials, records, files, and furnishings to their normal locations—in coordination with local government, mutual aid agencies, DOGs, and even state or federal emergency support agencies. Employee claims (workers’ compensation, overtime, etc.) associated with the dislocation and relocation must be pro- vided for in this phase, as well as a system of accounting for all personnel throughout the recovery process. Plan Testing, Training, and Exercises This section of the business continuity plan should describe how staff is trained on the plan; how the plans or segments of the plan are tested and improvements are integrated into a plan revision; and how often, to what extent, and over what scope the plan will be exercised. The provision for regular testing, training, and exercises is critical to the plan’s effec- tiveness in meeting its mission of supporting the resilient operation of the airport. Without these regular improvement activities, the business continuity plan may become irrelevant “shelf-ware” that fails to provide effective and realistic recov- ery guidance or to prepare staff adequately. Plan Review and Maintenance This section describes the timetable for the official review of the business continuity plan, as well as provisions for maintaining it as the airport’s operations evolve and as real disruptions and exercises reveal the need for edits, updates, and improvements to the plan. Business Continuity Plan Appendices The appendices to the plan can include information such as the following: • Lists of airport staff assigned to various business continu- ity groups or committees • Recovery plans of various contractors, lessees, and sup- pliers that operate essential airport functions, or support them • Employee preparedness plans to support them and their families during incidents • Employee support information or policies • Plan maintenance calendar • Testing, training, and exercising calendar • Lists of vital records, applications, data, and other support- ing elements Using the Resulting Business Continuity Plan Creating the business continuity plan is only the starting point of the larger objective of actually ensuring the organi- zation’s readiness and capacity to provide operational conti- nuity during and after disruptions. The business continuity plan itself is nothing but a printed document, a website, or a software application, and its quality is dependent on the level of support it receives from senior management. To optimize the effectiveness of BCP, airports should make BCP a fun- damental part of departmental goals and objectives, exercise plans regularly, and maintain and update them as the airport or FBO evolves and its imperatives change. The business continuity plan should be a framework for operational recovery, for responding to the impact of any type of disruptive incident or event. The plan should include a com- prehensive inventory of essential resources that are required to operate effectively and be a reference document that defines core functions. It should align with the business continuity or contingency plans of the contractors, government agencies, vendors, and commercial tenants that are responsible for many essential airport functions. Finally, the plan should remain a flexible, living document that evolves along with the airport. It is important to appreciate that the business continuity plan is not an incident-specific action plan that describes for all BCP participants the steps they should take for recovery of their disrupted business and operational processes. Incident- specific action plans can most effectively be generated once the particulars of the disruptive emergency have been established and confirmed. Instead, the business continuity plan is more of a frame- work and inventory that describes how every essential func- tion works at the airport, how important things get done, and what mix of resources are required to do so. That informa- tion provides airport management and the BCP team with the information they need to determine a specific course of action in response to the particulars of any type of incident.