1. Greg Shaw 202-994-6736 glshaw@gwu.edu http://www.gwu.edu/~icdrm How do we turn private sector preparedness into an investment rather than a cost of doing business?

2. Business Crisis and Continuity Management The business management practices that provide the focus and guidance for the decisions and actions necessary for a business to prevent, prepare for, respond to, resume, recover, restore and transition from a disruptive (crisis) event in a manner consistent with its strategic objectives. The business management practices that provide the focus and guidance for the decisions and actions necessary for a business to prevent, prepare for, respond to, resume, recover, restore and transition from a disruptive (crisis) event in a manner consistent with its strategic objectives.

3. Assumption Business Crisis and Continuity Management (BCCM) is evolving as a strategic program for organizations supporting the organizational imperatives of survival and economic viability. Business Crisis and Continuity Management (BCCM) is evolving as a strategic program for organizations supporting the organizational imperatives of survival and economic viability.

4. The Case for Integrated BCCM Federal Government: National Strategy for Physical Protection of Critical Infrastructure and Key Assets (2003) National Strategy for Physical Protection of Critical Infrastructure and Key Assets (2003) National Response Plan (2004) National Response Plan (2004) National Incident Management System (2004) National Incident Management System (2004) NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs (2004) NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs (2004) 9/11 Commission Report (2004) 9/11 Commission Report (2004) Ready.gov – READY Business Project (2004) Ready.gov – READY Business Project (2004) Draft National Infrastructure Protection Plan (2006) Draft National Infrastructure Protection Plan (2006)

5. The Intelligence Reform and Terrorism Prevention Act of 2004 Section 7305 – Private Sector Preparedness: “Preparedness in the private sector and public sector rescue, restart, and recovery of operations should include, as appropriate – (A) a plan for evacuation; (A) a plan for evacuation; (B) adequate communications capabilities; and (B) adequate communications capabilities; and (C) a plan for continuity of operations. (IRTPA 2004)” (C) a plan for continuity of operations. (IRTPA 2004)” NFPA 1600 standard “establishes a common set of criteria and terminology,” and charges the Department of Homeland Security to “work with the private, as well as government entities. (IRTPA 2004)”

6. The Case for Integrated BCCM Private and Not-For Profit Sectors Securities Industry Association Best Practices for Business Continuity Planning (2003) – “Each firm should have an executive and corporate group responsible for overseeing the Business Continuity Program.” Securities Industry Association Best Practices for Business Continuity Planning (2003) – “Each firm should have an executive and corporate group responsible for overseeing the Business Continuity Program.” Business Roundtable Principles of Corporate Governance (2002) – Charges the “Board of Directors to review management's plans for business resiliency and designated management level responsibility for business resiliency.” Business Roundtable Principles of Corporate Governance (2002) – Charges the “Board of Directors to review management's plans for business resiliency and designated management level responsibility for business resiliency.” Securities and Exchange Commission Interagency Paper of Sound Practices to Strengthen the Resilience of the Securities and Exchange Commission Interagency Paper of Sound Practices to Strengthen the Resilience of the U. S. Financial System (2003) – “Senior management and the Board of Directors should review business continuity strategies to ensure consistency with risk management strategies.” U. S. Financial System (2003) – “Senior management and the Board of Directors should review business continuity strategies to ensure consistency with risk management strategies.” ASIS International Business Continuity Guideline (2004) – “Regardless of the organization – for profit, not for profit, faith based, non governmental – its leadership has a duty to stakeholders to plan for its survival.” ASIS International Business Continuity Guideline (2004) – “Regardless of the organization – for profit, not for profit, faith based, non governmental – its leadership has a duty to stakeholders to plan for its survival.”

7. Business Roundtable - Committed to Protecting America: CEO Guide to Security Challenges (2005) “Evolving security threats and the potential for devastating damage following a terrorist attack require an enterprise-wide governance model to develop crisis management, business continuity and disaster recovery programs.” “Without direct CEO involvement, crisis planning and recovery programs might not be elevated to a high enough level across the corporation.”

8. How do we turn private sector preparedness into an investment rather than a cost of doing business?

9. Thank you Questions?