Disaster Recovery Management: New Regulatory Environment

“PS Prep” - The Voluntary Private Sector Preparedness Accreditation and Certification Program, Title IX of Public Law 110-53

Business Continuity Planning (BCP) and Disaster Recovery (DR) have been important elements of corporate governance for several decades. After 9/11, the Federal Emergency Management Association (FEMA) and the Department of Homeland Security (DHS) focused on developing a program that would encourage the private sector to enhance their BCP and DR capabilities. The law was signed in 2007, became effective in 2009 with implementation standards very recently developed. Companies are beginning to “go live” with voluntary compliance in 2011.

What are the standards?

A number of BCP and DR guidelines have been available since the 1970s with DHS selecting three standards for the PS Prep law (British Standard 25999, business continuity focus; ASIS Standard SPC.1, organizational resiliency focus; and National Fire Protection Standard 1600, all hazards focus). Although they are modestly different from each other, they essentially provide BCP and DR standards for the major operations and functions of a business. In order to conform with the PS Prep law, a company's business continuity management system/program must be in alignment with all aspects of one or more of these sets of standards.

How does your Company become conforming?

  1. Planning: As with all company-wide projects, senior management must endorse the pursuit of PS Prep conformity and assign project responsibility for the process (usually the Disaster Recovery or Business Continuity group). Initially, a representative group of leaders from various parts of the company will walk through the three standards, to perform an initial assessment to: choose the most relevant and appropriate PS Prep standards to pursue and begin to develop a high level plan for the project.
  2. Execution: The next step would be the accumulation of detailed responses to the many requirements of the standard selected. This may involve providing the proof/evidence to support those responses, which requires assistance among the operating departments of the company. The PS Prep team will accumulate responses, internally assess the responses and make recommendations where appropriate to ensure that the company’s procedures, as documented , meet the standards. Project logistics including detail project planning, task management and retention of documentation will key at this stage of the project as well.
  3. Self-Declaration and External Reviews: Current DHS guidance permits the company at this point, to self declare conformity with PS Prep. Should companies choose to, an external review of conformity with the standards by certifying bodies (as recognized by ANAB) can also be obtained which will demonstrate attestible alignment with PS Prep. Finally, developing this project into a repeatable process will retain organizational knowledge and enable the company to be prepared for an external review if not immediately desired.

What tools are available to simplify or streamline the process?

Although there are a number of systems including questions and computer programs to assist with this process, one tool that includes the parameters of all three standards is the Business Continuity Maturity Model® (BCMM®), created by Virtual Corporation. GAP Resources has personnel trained and licensed in this tool (Business Continuity Maturity Model® Assessor - BCMM®A)

Along with aligning to all three of the PS Prep standard requirements, BCMM® also recommends potential proof and evidence as well as the ability to benchmark the company’s results against other companies by size, location or industry type. An anonymous upload to a master database will produce a report allowing for comparisons.

How can GAP Resources help with PS Prep?

GAP Resources has focused on building the expertise in PS Prep including professionals who have field experience in DR and BC planning, management and disaster recovery, as well as the certifications that reflect their expertise. Following are some areas where we could be of assistance:

  1. Support in Planning – As the company reviews the specifics of the standards against actual operations in that first general walk-through, we can help with the decision on the most appropriate set of standards for the company to pursue and assist in planning the project.
  2. Initial Assessments - GAP Resources can assist with initial assessments based on conversations and meetings in order to identify areas of strengths and improvement prior to any accumulation of evidence. Our use of BCMM® software can improve the efficiency and documentation of this process.
  3. Gathering Departmental Responses – We can assist individual departments as they review questions, obtain detailed descriptions of appropriate procedures, processes and safeguards. We can also assist with reviewing the proof/evidence which is the basis for the company's self declaration of conformity with PS Prep. Again, the BCMM® software can be leveraged with this process.
  4. Preparation Before Declaring Conformity or Seeking External Audit – We can be of assistance with the review of evidence prior to a company exercising their Self Declaration Of Conformity (SDOC) or prior to seeking an external audit and attestation of its program. An internal review and audit is required prior to making an SDOC or seeking an external audit.

What is the urgency on PS Prep?

Many people from sophisticated and major corporations have commented that PS Prep appears to be below the radar screen, that it may not be important. Recent events such as the earthquake in Washington D.C. and the tsunami in Japan have raised the awareness of business continuity management and overall preparedness. This fall DHS has enlisted companies/organizations like Boeing and The American Bar Association to be early adopters of PS Prep. These major organizations have committed to undertaking the assessment and will be rolling out the requirement for conformity their suppliers and associates. As a result of these and other large-scale early adopters, it appears that PS Prep will become more visible and valued.

As with Sarbanes-Oxley, this compliance initiative can be most effectively and efficiently carried out with the assistance of experience personnel. GAP Resources has professionals on staff with experience in both the details of the subject and rolling out corporate compliance initiatives. If you would like to learn more about PS Prep, the history, the details, and discuss how your company might get started, please give one of us a call.

Kathy Glynn, Partner CPA, 847.641.9988
Ted Kozenko, Senior Consultant BCMM®A, BCMSAA, 440.668.7401

Copyright(c)2011 GAP Resources LLP All Rights Reserved Home