SPCI 511
Critical Infrastructure Systems: Government Services, Banking, and Finance

Introduction

Welcome to SPCI 511! This course provides an introduction into the ways organizations ensure they will survive a disaster. We will start by describing the concepts and tools organizations use, and then apply them to government and banking/financial infrastructures. We will take full advantage of recent developments in the dynamic field of crisis management, including lessons learned through the 9-11 hearings.

Banking/finance and government represent two of the 13 critical infrastructure sectors identified in the National Strategy for Homeland Security (July 2002). These two infrastructures—along with the information and telecommunications, energy, transportation, chemical industry, and postal and shipping sectors—make up our economy. We will look at the organizations that form the government and banking/financial infrastructures as

• discrete business units (including government units), all of which have survivability as an objective;
• parts of a system—links in chains that make up the larger infrastructures; and
• partners that recognize the interrelationships and interdependencies that contribute to the survivability of the infrastructure as a whole.

In this course we will identify, examine, and integrate the diverse crisis management, disaster recovery, and organizational continuity issues facing government and the banking/finance sectors, including the following concepts:

• disaster/crisis management
• business impact analysis
• contingency planning
• continuity of operations, contingency planning and business resumption planning models, and
• risk reduction tools.

Throughout the course, we will emphasize the strategic importance of crisis management, disaster recovery, and organizational continuity to private, not-for-profit and public-sector organizations.

Case studies, team activities, and discussions will keep you actively involved in your learning process.

Course Prerequisites

There are no prerequisites for this course.

Technology Requirements and Skills

See the Online Student Handbook for the technology requirements and skills necessary for this course.

Course Goals and Objectives

My hope for you in this course is that you will gain sufficient practice in the experiential learning cycle that you will be able to apply it to your future work. I also want you to be able to understand why government and business/finance are considered vital infrastructures.

By the end of the course you will be able to

• describe the similarities and differences between governmental (public sector) emergency management;
• identify vulnerabilities in government and business/finance;
• describe how business and industry (private sector) addresses crisis management;
• apply a framework in which to view an organization's survivability—that is, identify an organization's mission-critical functions; and
• apply the "What, So What, Now What" model of inquiry to issues of vulnerability.

About the Readings

You will need to purchase the following materials:

• Bingham, R.D. (ed.), Managing Local Government. Sage Publications, Newbury Park, CA. 1991 ISBN 0-8039-3939-6
• Florestano, P.S., The States and the Metropolis. Marcel Dekker, Inc., New York, NY. 1981. ISBN 0-8247-1287-0
• Schneier, Bruce. Beyond Fear: Thinking Sensibly about Security in an Uncertain World. Springer, 2003. ISBN 0-387-02620-7

You may also want to read the following book, although it is not required for this course:

O'Hanlon, Michael E. et al. Protecting the American Homeland: A Preliminary Analysis. Washington DC: Brookings Institute Press, 2002 ISBN 0-8157-0651-0

Other required readings include manuals and government reports, and most are gleaned from the Internet. You'll find links to Web sites or PDF documents in relevant lessons. Some materials are on e-reserve through the University of Washington library system, and you will be provided with a link to access them online (note that you will need your UW NetID to access the e-reserve system). Where possible, the developers have downloaded the most current documents and re-formatted them as PDF documents, but it is best to do a quick Web search to make sure the documents are current. Note, these documents tend to be written for those who have to read them, and they are not reader-friendly. The best way to approach them is to do a quick scan of the entire document, and then go back and read, in depth, those sections you've determined to be important.

Overview of the Course

This course consists of ten lessons. In the first two lessons, you will be introduced to basic terms and concepts and given a framework through which to view the government and banking/finance infrastructures. Lessons Three, Four, and Five describe government as an infrastructure, and Lessons Six, Seven, and Eight do the same for banking and finance. The final two lessons provide an opportunity for you apply these concepts by drafting a Business Impact Analysis (BIA) and suggesting risk reduction strategies.

About the Lessons and Assignments

• In Lesson One: Introduction and Overview we will discuss why businesses and industries are concerned with crisis management and how they are addressing the challenges of that field. We will also introduce key concepts related to crisis management, building on the concepts you learned in SPCI 501. You'll have a chance to apply these concepts to a crisis situation in a hypothetical organization. In Assignment 1, you will move from the "what" associated with the events of September 11, 2001, to the "so what" and "now what" phases, from the point of view of an organization affected by the disaster; work in a team to create a crisis management program for your chosen organization; and begin your glossary of key terms.
• Lesson Two: A Framework to Support Preparation of a Business Impact Analysis explores crisis management concepts including business contingency, business resumption, and continuity of operations; expands on the vocabulary introduced in the previous lesson; and provides you with a foundation for preparing a business impact analysis. In Assignment 2, you will research vendors of "business contingency," "continuity of operations," and "business resumption." You will also work with your team to begin analyzing an organization's "what."
• Lesson Three: Government as Infrastructure examines the basic outlines of government, the complexity of the structures that go to make up what we know as government, and the extent to which government encompasses many of the functions of other infrastructure elements. In Assignment 3, you will discuss several analogies for the structure of governments, and explore the bases of governmental authority and structure at several levels of government; you will also analyze governmental entities near your home.
• Lesson Four: Provision of Government Services explores how government goes about doing things and how that affects, and is affected by, its place as an element of infrastructure. In Assignment 4, you will comment on the services rendered by local governments versus larger entities, and on the trend toward privatization (hiring entities in the private sector) of government services. You will also work with your team to comment on whether or not government is the infrastructure that makes it possible for all others to function.
• In Lesson Five: Criticality of Government Services we'll ask just how critical government services are, especially at the federal level. What, really, does "critical" mean when we're talking about federal agencies and, for that matter, many state agencies? In Assignment 5, you will work with your team to assess infrastructure preparedness at various levels of government. After researching and gathering information, your team will assess your results.
• Lesson Six: Critical Functions of the Banking and Financial Industry will introduce you to the many functions that support the business of banking, which in turn support the economic vitality of the United States. We will also begin to look at the types of decisions banks make to protect their business from threats, which in turn protect their customers from financial harm. In Discussion Forum 6, you'll discuss three different types of banks and the customers they serve. In Assignment 6, you will list all your activities during a typical day, and note which activities require a money transaction. You will then speculate how your day would be changed by a major power outage.
• Lesson Seven: Business Continuity Planning for Banking focuses on preparing a business continuity plan for a small community bank called "Little Bank." This will help you gain a foothold in the planning process, overcome the inertia brought on by the question, "Where do I start?," and understand the business continuity planner's role in planning. In Assignment 7, you'll report on your investigation about how and when you'd be able to get your money from your own bank following an disaster. You'll also work with your team to analyze Little Bank, preliminary to creating a Business Continuity Plan. Finally, on your own, you'll do the preliminary analysis for making a Business Continuity Plan for your own company .
• In Lesson Eight: Business Continuity Planning for Banking, we will consider how to document business continuity plans and how to build a response plan. In Assignment 8, you will compare services of several emergency management organizations and business emergency networks and use the results to make recommendations to Little Bank's management. You will also investigate service delivery to your home after two major emergencies; and, working with your team, you will describe how you would manage an major emergency at Little Bank.
• In Lesson Nine: Preparing a Business Impact Analysis (BIA) in preparation for a Contingency or Continuity of Operations Plan we will apply the concepts you've learned in the previous lessons to create a Business Impact Analyses. We'll gain an understanding not only of why a Business Impact Assessment is needed, but of why this tool is evolving. In Assignment 9, you will work with your team to analyze the points of vulnerability; effects/impacts/consequences of disruption; criticality; adequacy of existing safeguards; and need for additional safeguards, about your team's chosen organization —the first steps in creating a BIA.
• In Lesson Ten: Reducing Risks of Not Being Able to Survive a Crisis we will learn how to translate these impacts to mission-critical functions into contingency planning, business resumption, and continuity of operations vulnerability-reducing strategies. In Assignment 10, you'll work with your team to compare mission-critical functions to risks in your chosen organization. Your team will then choose a plan or planning approach from among several examples, and outline the approach you've chosen. You'll also submit the glossary you have been creating throughout this course.

All reading assignments are to be completed prior to the lesson. You are expected to

• have completed readings and research assignments prior to team activities;
• actively participate and contribute to the team's work; and
• take your turn assuming the lead in reporting and presenting team products to the entire class.

All individual and group assignments are to be submitted on or before the date due. Where this is not possible, it is your responsibility to make arrangements with your instructor for an alternate due date. On the "About Your Instructor" page on the course syllabus, you will find instructions on submitting your assignments.

Your Glossary of Key Terms

As you discovered in SPCI 501, crisis or disaster management is an emerging field that is still developing its vocabulary; for the present, you can expect similar words to have difference meanings, and similar concepts to be described with different words.

For this reason, you will be required to create a glossary of key terms pertinent to this course. You will be required to turn in your dictionary at the end of the course. Although it will not be graded, you must complete it to pass this course.

Your glossary should include all key terms from each lesson, with your definitions of each team. Your definitions will help determine the ways you use these terms in your written assignments and in discussions with your classmates. By the end of the course you will have an extensive and functional list of terms applicable to crisis management. Lesson One includes further information about this course-long project.

Teamwork

At the beginning of this course, your instructor will assign you to a working team and you will work in your team throughout the course. Each team will have a team discussion forum where you will communicate with your teammates. Several of the assignments in this course are team projects.

Generating Effective Communication

Effective communication is essential to all types of management, including business and industry crisis management. To help facilitate effective communication and participation in this course, we will apply a modified form of the experiential model and learning cycle offered in the FEMA Higher Education Business and Industry Crisis Management, Disaster Recovery, and Organizational Continuity Course. The three steps they suggest are easy to follow and help to focus analysis:

• Learning activity—experiencing (the "what" of learning).
• Generalizing (the "so what" of learning).
• Applying (the "now what" of learning).

During the course you will be asked to go beyond the "what" to include the "so what" and the "now what" of the learning process—that is, to generalize and apply concepts from this and previous courses you've taken. The modified experiential learning cycle we will use includes the following activities:

• Learning Activity—Experiencing
  We will present the instructional content (the "what?") through a combination of reading (including the online lessons in this course), group online discussions, case studies, and so on, and sharing reactions to the "what" to help make sense of the information.
• Generalizing
  Next we will make the inferential step from the "what" to the "so what," by applying the learning. This step will make the overall learning experience realistic and practical.
• Applying
  In a real-life work, setting this step involves applying the "what" and "so what" to answer the question "Now what?" In the context of this course, you will apply concepts you have learned to case studies, tabletop exercises, and so on, as well as to your individual work experiences.

For example, remember in Lesson Eight of SPCI 501 you were asked to apply the concepts learned in a natural-hazards environment to terrorism. In this course, you will revisit your work for that assignment, to

• reconstruct the "what" that happened on 9-11;
• describe the "so whats" or realizations and impacts that have occurred; and
• analyze the "now whats" or disaster-management actions that are being taken by the private sector (principally banking), and government organizations.

Grading

You will receive a numeric grade for this course. The numeric grading system used by the University of Washington relies on a decimal scale between 1.7 (low) and 4.0 (high).

University of Washington Grade Scale for Graduate Students:

4.0 - 3.9 = A
3.8 - 3.5 = A -
3.4 - 3.1 = B+
3.0 - 2.9 = B
2.8 - 2.5 = B-
2.4 - 2.1 = C+
2.0 - 1.7 = C

For graduate courses, grades below 1.7 are recorded as 0.0 and no credit is earned.  A minimum of 2.7 is required in each course that is counted toward a graduate degree. A 3.0 cumulative average in graduate work is required to receive a graduate degree.

Instructors may choose to rely entirely on the grades and interpretations given below, or may "interpolate" grades between these standards as they see fit.

Numerical Grade	Criteria
4.0	Excellent and exceptional work for a graduate student. Work at this level is consistently creative (where appropriate), thorough, well-reasoned, insightful, well written and shows clear recognition and incisive understanding of the important materials and issues. All assignments submitted are of good professional quality. The value of individual contributions to this course is considerable and positively affects the learning of all participants.
3.7	Strong work for a graduate student. Work at this level sometimes shows signs of creativity, is thorough and well reasoned, and demonstrates clear recognition and good understanding of the important materials and issues. Assignments submitted lack professional quality but demonstrate effort and concern for quality. The value of individual contributions to the course is strong and occasionally significant.
3.3	Competent and sound work for a graduate student. Work is well reasoned and thorough but not especially creative or insightful. The student shows adequate understanding of the important materials and issues although that understanding may be somewhat incomplete. Work submitted is competent but not remarkable. The value of individual contributions to the course is such that they do not influence the quality of the course one way or the other. This grade indicates neither exceptional strengths nor exceptional weaknesses, but is the grade for 'average' graduate performance.
3.0	Adequate work for a graduate student. Work is moderately thorough and well reasoned, but with some indications that some of the important materials and issues is less than complete and perhaps inadequate for graduate study. The value of individual contributions to the course is minimal. However, the work is above the minimal expectations for the course.
2.7	Borderline work for a graduate student. Work barely meets the minimal expectations for the course and may occasionally fall below them. Understanding of the important materials and issues is incomplete or has not been demonstrated. There is little positive value in the individual contributions to the course and there may even be negative effects on the overall learning. Consistent overall performance at this level would be below that of adequate graduate student performance.

Weighting of Assignments

Your course grade will be calculated based on the following components:

Participation in group discussions	20%
Individual and group assignments	50%
Written term project	30%

Note that assignments are to be concise, succinct, and brief. Assignments that do not meet this requirement will be returned to you ungraded.

Late Assignments

To earn credit, you must complete assignments on time.

If unforeseen circumstances prevent you from completing an assignment by the due date, please contact your instructor before the assignment is due to obtain permission for a late submission. Without such permission, your assignment will not be accepted.

 

About the Developers

The course has been developed from written and Web-based materials, interviews with practitioners and the FEMA Higher Education Business and Industry Crisis Management, Disaster Recovery, and Organizational Continuity Course prepared by: Gregory Shaw, Institute for Crisis, Disaster, and Risk Management George Washington University Washington, DC.

Bob Freitag

Bob is the Director of the Institute for Hazards Mitigation Planning and Research at the University of Washington. He came to the University after 23 years with the Federal Emergency Management Agency (FEMA). While with FEMA, Bob worked in a wide range of emergency management activities including training and education, exercise and design, the National Flood Insurance Program, federal response planning and hazard mitigation. He has managed response and recovery programs in over 50 Presidential disaster declarations, involving hazards including floods, storm surges, hurricanes, wind-driven fires, and tornadoes. He has served as the Federal Coordinating Officer (FCO) in Idaho, Alaska, Washington and Idaho. While with FEMA he helped develop many mitigation related activities, including FEMA's most recent initiative, Project Impact.

John R. Labadie, Ph.D.

Dr. Labadie has had over twenty-five years' experience in the management of hazardous materials and emergency preparedness planning and operations for federal agencies and state and local governments.

Dr. Labadie developed a Comprehensive Hazard Mitigation Plan for the City of Renton, WA in 2003. He has developed Comprehensive Emergency Management plans for newly-incorporated cities in Washington and has developed and conducted emergency management exercises, including local participation in Soundshake '98. He developed a Comprehensive Emergency Management Plan for the Washington State Department of Health and Emergency Response Plans for WDOH facilities. He has conducted Disaster Planning training courses for public utilities, sponsored by Green River Community College.

Dr. Labadie served as the Emergency Management Director for the City of Salem, OR during a Presidentially-declared flood disaster in 1996; he was also responsible for the management of budget, training, and operations of the City's Hazardous Materials Response Team . He has provided support to Oak Ridge Associated Universities in developing, conducting, and evaluating emergency management plans, training, and exercises for Department of Energy facilities.

Dr. Labadie has conducted emergency preparedness research, planning, and assessment for FEMA, Commerce, and other federal agencies regarding war-caused and natural hazards. He conducted an all-hazards vulnerability assessment and developed a Crisis Management Plan for a major drug corporation. He investigated the effects of natural and man-made disasters on industrial production, including: aerospace manufacturing, chemical production, petroleum refining, electric power, primary metals, pharmaceuticals, semiconductors, and munitions.

Dr. Labadie is currently teaching two web-based courses ("Practical Applications in Emergency Management" and "Emergency Management and the Challenge of Terrorism") as part of a nine-course certificate program in emergency management offered by Western Washington University.

Cheryl Kosky

Cheryl Kosky is a graduate of University of Washington and a 30-year-veteran of banking. In 1983, when the regulations were enacted that required creation of business continuity plans for the entire bank (not just data processing), she was asked to participate in the startup planning effort. After 12 years of selling the importance of creating plans, working with business managers to build plans, and coordinating the business plans with the data processing plans, Cheryl moved to other projects within the bank. Contingency planning remains high on her list of important issues to address in each future project.

Cheryl takes pride in the fact that during her years in business continuity planning, the bank's culture was modified so that maintaining quality plans became an important measure of success for all managers.

---

©2003–2007, University of Washington. All rights reserved.
No part of this publication may be reproduced in any form or by any means without permission in writing from the publisher.