Continuity of Operations Plan

Prepared By

Approval

This Business Continuity Plan (BCP), also called Continuity of Operations (COOP), was prepared by the Office Risk Management & Safety Services in order to develop, implement and maintain a viable COOP. This plan complies with Executive Order 1014 and supports recommendations provided by the Governor's Office of Emergency Services (OES) and Federal Emergency Management Agency (FEMA). This COOP plan has been distributed internally within Sonoma State University and with external entities that may be affected by its implementation.

Certification 

By my signature below, I certify that I approve this Continuity of Operations Plan and fully understand the continuity of operations procedures that are to be followed in the event of an emergency that impacts the facilities and employees for which they are responsible.

 

 

Plan Maintenance

The University plan is developed and maintained by Risk Management and Safety Services. The employee below is designated as the “Continuity Coordinator” for the purposes stated in Executive Order 1014.

For comments, questions, or suggestions, please contact:
Kendall Newman
Emergency Services and Business Continuity Manager
Risk Management and Safety Services
(707) 664-2470 / newmank@sonoma.edu

History of Changes

History of Changes

Version	Last Updated	Action
2006.1	May 30, 2006	Initial Plan - Pandemic
2012.1	February 15, 2012	Initial Full BCP
2012.2	July 15, 2012	Update
2012.3	December 1, 2012	Update
2012.4	August 23, 2013	Update
2018.1	July 1, 2018	Full Revision
2023.1	June 1, 2023	Update
2023.2	July 10, 2023	Update

 

Introduction and Background

Executive Summary

This Continuity of Operations Plan (COOP) was designed to facilitate the continuing operation of the University following a natural or man-made disaster, or other business-interrupting event. The COOP defines the groups who will be responsible for the post-disaster evaluation of the status of critical University systems and the planning and design for post-disaster University operations. Chronologically, the plan follows, and coordinates with, the University’s Emergency Operations Plan (EOP).

Sonoma State University's (SSU) continuity operations objectives are:

• Minimize loss of the academic mission;
• Continue to serve the campus population; and,
• Maintain administrative operations.

The COOP is meant to be a guide in a post-disaster environment while SSU protects and provides for students, faculty, staff, and visitors in the event of a major interruption of our mission or operation. The plan includes a framework for operational prioritization and analysis and the authority for decision making. The University COOP is not intended to be a detailed all-inclusive plan for each and every aspect of the University’s operations; those departments that have responsibility for defined essential functions will develop specialized plans to address the needs and procedures for restoration of specific functions. Department plans will be attached to the University plan as appendices.

Staff having responsibilities in response actions will be trained in this plan and in the basics of emergency operations. The plan will be tested periodically, pursuant to Executive Order 1014, to insure its efficacy and viability. As with all emergency management documents, this plan is designed to be a “living” plan. It will be updated annually and as needed.

Introduction

The SSU Continuity of Operations Plan (COOP) explains how the campus will perform its essential functions following an emergency or situation that may disrupt normal operations significantly. It is intended to provide a framework for the restoration of non-emergency functions as soon as feasible. Continuity operations may begin while emergency response is ongoing, winding down, or may occur in circumstances that do not warrant an emergency response as described in the University Emergency Operations Plan. The priority is always the preservation of life, the preservation of property and the preservation of the environment. These priorities outweigh the objectives of the continuity organization and, therefore, continuity operations shall never interfere with emergency response and the activities of the Emergency Operations Plan.

Advance planning is key to minimizing injuries, loss of life, property damage, financial losses and the disruption to academics. While most natural disasters and emergencies cannot be predicted, the University will strive to plan for predictable emergencies and for planned events to ensure that disruption to normal University operations is as minimal as possible.

During an emergency, employees trained in emergency management assume the role of Emergency Operations Center (EOC) Director and report directly to the President or designated Administrator in Charge (Acting President). The University operates in compliance with the SEMS and NIMS systems of incident management, which are State and Federal response protocols. The EOC is primarily charged with managing the University’s response to the emergency and providing coordination and support to the personnel who are managing the incident from the field. Continuity operations must be considered as an emergency stabilizes so that restoration of essential functions can be planned with as minimal of an interruption as possible. As emergency operations are ending, many of the same leadership will transition to continuity operations. For many incidents, initial continuity operations may be launched in the EOC.

There are also circumstances where the University may not experience an emergency that warrants activation of the EOC but where University operations are significantly disrupted. Such an emergency may require continuity operations considerations and planning absent the integration with emergency operations.

Plan Location and Maintenance

The University COOP will be kept and is available in the following locations:

• University primary and secondary EOC locations
• University Continuity Coordinator
• Division Continuity Coordinators
• Electronically in cloud storage, available to Continuity Response Team (CRT) members

Please note that electronic versions stored in public online sites will not have personal phone numbers or other sensitive University information. Department-level plans will be made accessible on the designated cloud storage platform, a hardcopy will be held with the department, and the EOC will have a copy as an appendix of the main plan.

The University and departmental COOP plans are to be updated as often as is necessary to keep contact and other pertinent information current, but at least annually by July 1.

Purpose

This Continuity of Operations Plan provides the framework by which the University will mitigate impacts and restore essential services and operations. This plan identifies the overall concepts to manage University continuity objectives, identify operational priorities, clarify continuity of leadership, and activate processes and procedures for use during continuity operations.

Applicability

This Continuity of Operations Plan applies to all SSU departments and personnel. This plan describes actions that will be taken to activate continuity operations within 12 hours of a significant disruption, and sustain continuity operations for up to 30 days.

This plan does not apply to short-term disruptions of service, including minor technology system or power outages or any other scenarios where essential services can be readily restored. This plan is not intended to govern immediate emergency response procedures, which are primarily included in the University Emergency Operations Plan and building emergency plans.

Training and Exercise

At least annually, the Coordinator will identify a scenario for a multi-department exercise to be conducted as a tabletop or functional exercise. An After Action Report detailing the exercise goals and areas for improvement will be completed for the annual exercise. This exercise should consider how the continuity functions are performed in conjunction with the activation of the campus Emergency Operations Center.

Assumptions

The following assumptions were made when developing this plan:

• Delegations of Authority and Orders of Succession have been addressed in the EOP; unless otherwise determined, these delegations remain for the duration of the recovery period.
• The EOP and COOP will be operating simultaneously and will transition as the event is managed. Key operational personnel will be acting in multiple capacities (in EOP and COOP) during an event. Upon stabilization of an emergency, a move to normalize operations will be initiated.
• Resources and funding shall be available for the planning, implementation and maintenance of the COOP, and shall be consistent with those EOP procedures already in place. Required resources shall be dedicated in a timely fashion following activation of the plan.
• Employees will be instructed about their responsibilities under the activation and relocation phases of the plan.
• Off-campus emergencies will impact the University’s ability to continue to support essential functions and to provide support to the operations of clients and external agencies and will, therefore, be considered in continuity planning and plan activation. These emergencies may impact supply availability, employee and student access to campus, or other external impacts.
• The University may rely on support from resources located outside the affected area to continue essential functions.
• Pre-designated staff members may be unavailable to participate in the recovery. Materials must be prepared in advance to support untrained members.
• University users may function with limited technology, automation, and level of service until full recovery is made.

Essential Functions

Definitions

An essential service is one that must continue or resume quickly after a disruption of normal operations. These functions enable the university to provide vital services for students, faculty, staff, and visitors to support the teaching, research, and administrative operations of the University. The level and manner of support needed to continue essential services is dependent on the nature of an event.

The university provides prioritization for the continuity and recovery of essential services. In the event of an emergency and subsequent recovery, essential services will be evaluated and prioritized based on the situation, and re-evaluated as necessary during the recovery or as the incident progresses and the availability of resources. This serves as an operational guide to facilitate the allocation of resources in the event of a significant disruption, so that the most critical operations are recovered with priority.

Identification of Essential Functions

Table 3.1: Federal and State Essential Functions

Essential Function	Federal	State of California
1	Preserve Constitutional Government	Government Leadership
2	Provide Visible Leadership	Public Safety
3	Defend the Country	Emergency Management
4	Maintain Foreign Relations	Public Health & Medical
5	Protect the Homeland	Social Services & Education
6	Provide Emergency Response/Recovery	Critical Infrastructure
7	Maintain a Stable Economy	Financial, Economic & Business
8	Provide Critical Government Services	Information Technology/Communications
9	N/A	Agriculture
10	N/A	Environment
11	N/A	Information Collaboration

 

Based on these defined essential functions, SSU followed a model developed by the University of California which further developed the state essential functions to define “Campus Essential Functions.” Table 3.2 lists the Campus Essential Functions and the responsible departments at SSU are as follows:

Table 3.2: Sonoma State University Campus Essential Functions

1	Provide Visible Leadership	President and Cabinet
2	Maintain Continuity of Administration	Administration & Finance
3	Maintain the Reputation of Campus	University Advancement
4	Maintain Law and Order	University Police
5	Provide Emergency Services	Fire, Medical, University Police
6	Maintain Relationships with Partners/Stakeholders	All Leadership
7	Maintain Economic Stability	Financial Services and Budget Office
8	Provide Basic Campus Services	Housing, Culinary Services
9	Safeguard Campus Research	Academic Affairs
10	Restore Teaching	Academic Affairs

Within each of these broad functions are many activities or roles that fulfill these functions on a regular basis. It is those functions that were evaluated and prioritized as the essential functions for the University. Table 3.3 lists those functions that were defined by the workgroup and which State Essential Function they reference.

Additionally, each function is assigned a priority of A, B, C, or D. Priorities are based restoration of services within the following timeframes:

• Priority A: 0 – 2 Hours
• Priority B: 2 – 12 Hours
• Priority C: 12 Hours – 72 Hours
• Priority D: 72 Hours – 30 Days
• Priority E: More than 30 days; service is deferred

Table 3.3: Sonoma State University Essential Functions List

Priority	Function	Department
A	Executive Leadership	Office of the President
A	Life Safety	SSUPD
A	Building Maintenance	Facilities Management
B	Security & Access	Facilities Services & SSUPD
B	Housing of residential students	REACH
B	Emergency Management/EOC	Risk & Safety
B	Law Enforcement	Police Department
B	Sanitation & hygiene	Facilities Services
B	Tech Services	Information Technology
B	Food Service	Culinary Services
B	Public Information and crisis communications	Strategic Communications
C	Campus Building Official	Capital Planning Design and Construction
C	Environmental Health & Safety	Risk Management
D	Financial Aid Processing	Financial Aid
D	Fundraising Activities	Development
D	Cash Management	Financial Services
D	Procurement	Financial Services
D	Accounts Payable	Financial Services
D	Receiving	General Services
D	Payroll	Human Resources
D	Health/Medical Services	Student Health Center
D	Instruction	Academic Affairs
D	Title IX compliance	Office for the Prevention of Harassment and Discrimination
D	Basic Needs & Student Services	Student Affairs
D	Equity access services for students, including disability services	CAASE
D	Mental health services	CAPS
D	Recruitment Activities	Admissions & Records
D	Labor Relations/Compliance	Human Resources
D	Library Services	Library
D	Landscaping	Facilities Management
D	Worker's Compensation	Human Resources
D	Transportation & Parking Services	Entrepreneurial Activities

Academic Continuity

An incident or disruption may affect the University’s ability to offer instructional activities. Schools are encouraged to identify essential services and supporting critical resources in order to develop academic continuity strategies. In the event of a disruption, faculty will communicate to Deans who should work directly with the Provost and Continuity Response Team to communicate priorities and resource needs. Alternative course delivery strategies, including distance-learning or self-study, should be considered where appropriate. Advance planning efforts from departments will significantly expedite requests and execrate return to instruction.

Though departments share the common goals of academic course delivery and conducting research, there is a great deal of variability in these activities across schools. Some departments maintain complex research and academic operations that require unique space and equipment resources. These typically have complex operations with a significant impact analysis identified and require significant continuity planning efforts.

Some colleges utilize a more conventional model, with research and academic operations that have common space needs, such as lecture halls and wet/dry laboratories.

Resource Requirements

In considering how services are to be delivered during and after an emergency, departments must consider what resources are needed to provide service or complete a function. The concept of continuity planning requires development of contingency plans for how a function will be completed without those resources that normally contribute to that function’s success. Those resources may include:

• Physical facility or site – This may be a specific facility or site that has unique attributes that make it uniquely appropriate for that function or it may be a type of site with general attributes
• Communication Systems – Very few functions can be fulfilled without any means of communication. Whether communication involves the transmission of data, telephonic communication, electronic communication, or other means, departments must consider what types of communication is necessary for the function to be successfully completed.
• Key Personnel – Departments should consider specific individuals or positions who are necessary to perform certain functions. This may be due to legal delegation, certification or licensing, training, or access to systems or facilities that are unique to an individual.
• Essential Records and Databases – These are all records, physical or electronic, that include information that departments will need in order to identify how or to whom to deliver services or provide the means by which services are delivered.
• Vital Systems and Equipment – These are physical assets that departments need to perform functions. While many systems and equipment make the delivery of services more convenient or efficient, focus should be on those systems and equipment that are vital in the delivery or that would otherwise prohibit the delivery of that service.
• Key Vendors – These are those vendors who provide critical services, products, equipment or systems to the University. The vendor need not be the only supplier available but departments should consider those providers they rely upon on a regular basis.
• Supporting Government Agencies or Departments – Departments should include all government agencies that provide regulation, authority, oversight, or support to their critical functions. Additionally, this includes all CSU and SSU departments that provide support and/or oversight to the function.

Once the resources have been identified, departments need to perform one, or, preferably, both, of the following tasks:

1. Resource Protection: If a resource is identified as being required to perform a function, the department should take any reasonable and cost-efficient steps to protect the resource. Cost-benefit analysis should be considered in protection of resources. Protection of electronic resources should cover back-up, encryption, cloud storage, and employee access. Protection of physical resources should include storage, reinforcement, or identification of back-up or alternate resources. Protection of human resources should include establishment of back-ups, training, desk manuals, procedures and protocols, or mutual aid agreements.
2. Alternate Resources: If a resource is identified as being required to perform a function, protection may not be adequate. Alternates should be evaluated for all resources. This could be alternate systems, vendors, facilities, procedures, or outcomes. Alternates may present new resource requirements which should undergo the same evaluation.

Functional Dependencies

Functional dependencies are outcomes or products that are necessary for the delivery of a service or a function that are not controlled by the University. For example, since the University does not print pay warrants but is responsible for the very critical function of pay warrant distribution, the printing and delivery of the pay warrants is a functional dependency that the University relies upon the State Controller’s Office to complete.

Departments should identify the dependencies, the source for such dependencies, the time frame in which the University can accept a lapse in delivery, and whether or not that source provides adequate resolution. If the timeframe is inadequate, the department should consider alternatives, if possible.

Institutional Priorities 

Based upon the resource requirements and functional dependencies identified by department plans, the University will identify institutional priorities and will seek operational efficiencies when requirements and dependencies overlap. The Institutional Priorities Plan will also designate resource allocation for University and CSU resources to align with institutional priorities based on operating conditions. The Institutional Priorities Plan will be updated at least annually or more frequently to align resources and priorities.

Concept of Operations

The Continuity of Operations Plan is designated as the campuswide plan to govern operations when the University is disrupted by a significant event, loss of facility, or loss of workforce. When the disruption is caused by an emergency, the University will strive to provide rapid response and effective support to the field operations to address the immediate hazards associated with the incident and then turn the attention to continuity operations. During extended incidents or once emergency response transitions towards recovery, the University will ensure continuity operations run parallel to emergency operations to ensure the University continues to honor its obligations, protect its interests, and ensure that instructional and academic activities can resume with minimal disruptions.

Continuity Operations will be managed using state, federal, and CSU guidelines and consistent with the CalOES Continuity Planning Guidance Manual, dated January 2018 and CSU Executive Order 1014.

Emergency Operations will be managed using state, federal, and CSU guidelines and consistent with the Standardized Emergency Management System (SEMS), the National Incident Management System (NIMS), and CSU Executive Order 1056. Please refer to the University Emergency Operations Plan for more information about emergency operations.

Much like emergency operations, continuity operations are broken into different phases before, during, and after an incident. Those are described in this section.

Guiding Principles

While there are some technical aspects of Continuity of Operations, University response to emergencies or interruptions of service is meant to focus on restoring essential services. Response to such incidents should first consider incorporating the following supportive principles:

• Apply orders of succession and delegations of authority
• Establish communication with supporting and supported organizations and stakeholders
• Perform essential services (infrastructure, academic, and research) in order of prioritization
• Manage human capital
• Acquire space and equipment as necessary for essential services
• Establish means for accessing vital records, files, and databases
• Prepare for the reconstitution of essential services

Phase I: Readiness and Preparedness

Like the Emergency Operations Plan, this Continuity of Operations Plan is considered to be in effect at all times to provide authorization to perform all duties necessary to make plans and engage in continuity operations activities before an incident occurs. Preparedness activities include the development, review, and revision of the University and department plans, testing, training, exercises, and mitigation of risks.

Phase I activities also include the review of the campus Hazard and Threat Assessment (which aligns with the Emergency Operations Plan) and Vulnerability Assessment.

Hazard and Threat Assessment

The Hazard and Threat Assessment is the process of collecting and evaluating the risks associated with various hazards and threats to campus and the impact that would be experienced to campus. Threats are divided into three categories:

• Natural Hazards: Including flood, wildfire, earthquake, severe weather, or epidemic/pandemic
• Technological Hazards: Hazardous materials incidents, utility failure, technology failures
• Adversarial (Human-caused) Hazards: Terrorism, Active Shooter, Civil Disturbance/Disobedience, Cyber Threat, Bomb Threat/Incident

At least every five years, Sonoma State University will update the threat assessment. This may be done using a tool that is accepted by either industry or the government to adequately weigh the likelihood of an incident occurring on campus against the impact that such an event would have on the community. When considering the impact, preparedness and mitigation activities should be considered. This analysis will result in a ranking of incidents from higher to lower risk. The University will select the top incidents as those that should be incorporated into both continuity and emergency planning.

Vulnerability Assessment

A vulnerability assessment considers the vulnerabilities associated with each identified essential functions. The vulnerability assessment for each function may vary based upon the specialization of that function.

However, assessments should include, at minimum, an evaluation of vulnerabilities caused by the following:

• University or dependent facility disruptions
• Region-wide facility disruptions to other government agencies
• Communications systems disruptions
• Disruption to access to essential records or databases
• Disruption to availability of specialized equipment or systems
• Loss of services from a vendor or government agency
• Unavailability of personnel

Based on the identified vulnerabilities, departments that are responsible for carrying out essential functions are expected to develop contingency plans for delivery or recovery of the essential function within the designated timeframe.

Phase II: Activation and Relocation

Operational disruptions that exceed the capabilities of the affected units or otherwise impair the ability of the University to deliver services may require the activation of additional management resources and increased coordination between departments. Activation of the COOP occurs when the President, Acting President, or EOC Director determines the need for management and oversight to restore critical infrastructure and essential services.

Continuity Response Team

The President, Acting President or EOC Director may activate the Continuity Response Team (CRT) to coordinate continuity and recovery strategies and objectives. The CRT is a team of continuity coordinators or other key University staff who are designated to coordinate the activation of the plan for multiple functions and the relocation of University personnel, facilities, or functions. This group is distinct and different from the Emergency Operations Center (EOC) although some staff may be members of both. Departments who have appointees to both the EOC and the CRT should ensure adequate back up to ensure both functions can be fulfilled as it is possible to have CRT and EOC activated simultaneously.

It is not necessary for the CRT to be activated in order for activation of the COOP or for COOP activities to be occurring at the department level or to be coordinated through the EOC. The CRT is only a tool to provide increased coordination and resources.

Membership to the CRT will be solicited from the Continuity Coordinator annually and updated by affected department leadership.

Alert, Notification, and Implementation Process

Depending upon the nature of the incident, alert and notification to affected community members may be managed by the Emergency Operations Center or the Emergency Services and Strategic Communications functions of the University. If a department becomes aware of an incident that will significantly disrupt their ability to deliver essential services, the department head is responsible for ensuring that University leadership is aware of and prepared to support that department in communication of the incident. This should generally happen through the department head’s chain of command (hierarchy of authority) or directly to the Office of Emergency Services.

Depending upon the urgency and threat associated with the incident, the Office of Emergency Services and/or the Office of Strategic Communications will determine which means are appropriate to communicate with the campus and surrounding community. This may include, but is not limited to:

• SSU Alert – Emergency Notification System (only for life safety emergencies)
• Emergency Hotline
• Social Media
• University Website
• Local Media – radio, television, press
• Department Communication Plans – Department phone trees, hotlines, or other communications means are to be defined in Department Emergency Plans (DEPs)

Leadership

Departments will be notified by the EOC when they are authorized to conduct independent operations during an emergency or during recovery operations. Departments who are unsure of the status of EOC operations should contact the Office of Emergency Services, the University Emergency Operations Center, or other authority in their chain of command.

Devolution

Devolution is the capability to transfer the authority and responsibility for essential functions from an agency’s primary operating staff and facilities to other employees and facilities, and to sustain that operational capability for an extended period.

Devolution will be considered first to continue functions that support instructional activities that can be conducted off-site and managed by non-University employees. Those functions that are conducted in a very similar or the same manner are most likely to be appropriate for full devolution. Administrative departments are responsible for identifying other California State University campuses (or the Office of the Chancellor) that could support and manage University essential functions after an emergency. Any such agreements should be documented in writing and reaffirmed on a periodic basis.

It is generally accepted that instructional activity cannot be transferred to other educational institutions and employees but may be considered for temporary relocation (see 4.3.5) within the immediate region.

Relocation

Relocation involves mobilization of resources and relocation of equipment and personnel to alternate facilities to support essential functions. This may include unaffected campus facilities, non-campus facilities, or employees working from home.

Departments whose work could be conducted from an employee’s home are responsible for defining which positions or employees may be eligible, what type of access to documents or systems is necessary, ensuring compliance with CSU regulations regarding off campus work, and collective bargaining restrictions.

During the relocation phase, only those most critical services should be considered. This may include processing of payroll, distribution of pay warrants, student housing, provision of medical services to students, emergency operations, food service, and/or sanitation services. It is important to note that some services that can be interrupted during certain times of the year or month may be more critical during certain periods so not only those services in Priority A should be evaluated. Services that can be interrupted for longer periods and/or may function in an alternate location for extended periods of time will be considered in the “Continuity Facilities” section.

Phase III: Recovery and Restoration

As the emergency stabilizes, the University begins to move into the recovery and restoration phases. The recovery phase aims to resume essential services necessary to facilitate the delivery of student services, employee services, and the instructional activity. During the recovery phase, those activities identified as Priority E and those services not identified as essential may continue to be suspended or delivered in a modified or reduced manner. The restoration phase aims to return all essential functions to the pre-emergency condition or to a new service delivery condition that is equivalent to the pre-emergency condition. Recovery and restoration conditions can be in place for years following a major emergency, especially one that involves the loss of facilities.

During this phase, the University will shift its focus into the following activities, as applicable:

• Identification of services critical to repopulate student housing
• Identification of services critical to resume instruction
• Identification of services critical to support all students
• Identification of facilities to support all functions
• Identification of personnel to support all functions
• Identification of equipment and systems to restore all functions
• Identification of funding to restore the University to pre-emergency condition

Continuity Functions

In identifying alternate Continuity Facilities (including work from home agreements), the University will consider the following:

• Employee and student safety
• Employee and student access (including Disability and Access and Functional Needs (D/AFN))
• Network services
• Availability of the site (longevity)
• Collective bargaining requirements

Personnel

An emergency is considered to have significantly impacted personnel when the incident directly affects 25% or more of University personnel. During such incidents, personnel are unable or unwilling to report and perform their assigned duties.

This is most frequently due to a major disaster in the region or due to an epidemic or pandemic. An epidemic is defined as a widespread occurrence of an infectious disease in a community at a particular time. A pandemic is defined as a widespread occurrence of an infectious disease that affects a large region or continent and has a high risk for mortality or disabling illness. Both an epidemic and a pandemic can lead to significant absenteeism, travel restrictions within communities, or the need for mass immunizations.

Following an emergency that significantly impacts the University’s personnel pool, the following will be considered during the recovery and restoration phase:

• Likelihood and timeline of return for return of affected staff
• Specialization of vacant positions
• Temporary or permanent reorganization of departments or reassignment of duties to facilitate a reduced staff
• Prioritization and reassignment of vacant and filled positions
• Alternate personnel supply for temporary delivery of services
• Reduction, removal, or contracting of functions

In addition to the unavailability of staff, regional emergencies could lead to conditions that impede the ability of personnel to report to the campus or to assigned alternate sites due to interruptions in infrastructure, destruction of transportation conveyances (vehicles, mass transit), public health travel prohibition, or other employee hardships associated with the incident. The University will consider means to provide access to worksites for essential services when possible.

Mission-critical Systems and Equipment

Departments are responsible for the identification of any systems or equipment that are essential to the delivery of any of the established essential functions or those that are dependencies of the essential functions. Departments that control such systems must also develop plans for the restoration, substitute sources, operational alternates, or other means to continue delivery of essential services without access to the system or equipment.

Infrastructure Recovery Plans

In addition to plans to address essential functions, departments that control critical infrastructure are tasked with the development and maintenance of infrastructure recovery plans. These plans are most frequently developed to plan for the loss of information technology resources including network, telecom, and data management, and for the loss of utility infrastructure, including electricity, domestic and waste water, and natural gas service.

Infrastructure recovery plans outline the capacity of existing systems, contingencies for function without service, and plans for restoration of service. The CRT will consider the capacity of such dependent resources when prioritizing restoration of campus services.

Essential Files, Records, and Databases

Any files, records, or databases that are needed to support essential functions following any emergency are critical to the successful operation of the University during and after an emergency or disruption of service. Departments are responsible for identifying any essential records for which they are directly responsible. Such records should be maintained and stored in a manner that ensures that such records will be protected during an emergency and that they will be available for use as needed to deliver essential services. Information Technology will support such efforts to the extent possible to ensure consistency, security, and reliability in electronic document storage.

When considering means to properly maintain essential records, departments may consider the following alternates:

• Natural state of the record and relative security and accessibility of the record
• Ability to duplicate and alternately store hard copy records
• Necessity (by regulation or other restriction) to maintain hard copy records
• Operational ability to maintain duplicate hard copy/electronic records
• Availability and/or security of secondary storage locations (physical or electronic)
• Historical significance or sensitivity of hard copy records
• Frequency of updates to records

Records that are held electronically must be retrievable by multiple employees. Records that require additional security may coordinate with the Continuity Coordinator or Information Technology on plans to ensure access to records while protecting data during normal operations.

Communications

The University employs a variety of mission-critical communication systems necessary to perform essential functions. Departments that are responsible for the delivery of essential functions are responsible for the development and maintenance of communication plans to ensure continuity of communications after an emergency and that assume the disruption of one or more communications systems. Systems to be considered include:

• Mobile phone
• Satellite phone
• VoIP or analog phone service
• Email
• Cloud-based services
• Fax
• Two-way radio
• Satellite internet or mobile service

Support for Operations

The University will leverage existing contracts and/or ratify new contracts to support continuity operations at alternate sites or at campus locations that have been altered in their intended use to the extent financially viable. Contracts with suppliers and vendors who may provide services necessary in the recovery from an emergency should include language allowing service provision during emergencies, when possible and appropriate. Departments are responsible for identifying such suppliers and coordinating emergency language for contracts with Contracts and Procurement.

Improvement Planning

Following any emergency incident or disruption of service, the University shall endeavor to identify successes and areas for improvement through a process that solicits feedback from stakeholders through a variety of means. The findings of this process will be compiled in an After Action Report/Improvement Plan that will be made available to the campus community. The means for availability will be established based upon the sensitivity of the findings, scope of the impact of the incident, and community interest. The Continuity Coordinator is responsible for working with the CRT and department

Continuity Program Responsibilities

Members of the CRT will generally include the following positions or their designees:

• Continuity Coordinator
• Chief Planning Officer
• AVP for Human Resources
• AVP for Facility Services
• AVP for Academic Resources
• AVP for Student Affairs
• Academic Scheduler
• Associate Vice President for for Risk Management
• AVP for Information Technology/CIO
• Director of Campus Planning
• Emergency Services and Business Continuity Manager
• Labor and Employee Relations representative
• Contracts and Procurement representative

Implementation and Multi-year Training/Exercise Plan

This plan seeks to centralize and coordinate the University-wide Continuity of Operations Plan, the department plans, and the infrastructure recovery plans. In addition to this plan, Kuail Ready, a continuity data system, has been established since 2018 and is utilized by campus units to develop and maintain COOP plans.

In order to ensure the safety and continuity of University operations and ensure proper implementation of the plan and program, there will be an incremental implementation plan that prioritizes the most critical tasks. The following schedule is established and will be evaluated annually as part of the annual plan review.

Year	Implementation Task
2023-2024	Update infrastructure recovery plans
	Update Priority A – C plans
	Update University plan

 

 

Implementation and Multi-year Training and Exercise Plan

	Reevaluate essential functions
	Exercise Priority A continuity plans
	Train Priority B units
2024-2025	Multi-department continuity tabletop exercise
	Enter all infrastructure requirements into Agility Recovery plans
	Update Priority A – C plans
	Update University plan
	Train Priority C units
2025-2026	Offer continuity planning and support to all non-identified functions
	Update infrastructure recovery plans
	Update all department/function plans
	Update University plan
	Reevaluate essential functions

Appendix A: Authorities and References

This plan is pursuant to and authorized by the following:

State and Federal Authorities:

• • California State University Executive Order 1014
  • Presidential Policy Directive/PPD-8: National Preparedness
  • Presidential Policy Directive/PPD-21: Critical Infrastructure Security and Resilience
  • Homeland Security Presidential Directive/HSPD-5: Management of Domestic Incidents
  • Robert T. Stafford Disaster Relief and Emergency Assistance Act, Public Law 93-288, as amended 

University Authorities/References:

• Sonoma State University Emergency Operations Plan
• Administrator in Charge directive; Current version available from the Office of the President

Appendix B: Operations Checklists

This section contains operational checklists for use during a COOP event. A checklist is a simple tool that ensures all required tasks are accomplished so that the organization can continue operations at an alternate location. Checklists may be designed to list the responsibilities of a specific position or the steps required to complete a specific task.

Sample operational checklists may include:

• Department Phone trees
• Key personnel roster and critical functions checklist
• Critical Function Recovery Team Checklist (Attached)
• Telecommute/Alternate Work Location Safety Checklist (Attached)
• Emergency Equipment Checklist

Continuity Response Team Checklist

Continuity Response Team Checklist

Action	Completed (Date/Time)	Comments
Receive incident briefing from EOC Director or other reporting party
Determine if activation of CRT is appropriate; if so, callout CRT members and appropriate department planners		Which departments?
CRT identify interrupted essential functions		List functions or attach sheet
CRT identify unavailable facilities or personnel		List facilities or personnel
Develop communication to affected employees/students
Re-route critical phone numbers including reception lines		List phone numbers

 

 

 

Identify additional resources such as hardware, telephones, copiers, printers, office supplies, software)		Identify
Establish schedule for CRT and/or support department in scheduling recovery staff
Estimate timeline for full recovery and restoration; conduct planning for long-term continuity operations as appropriate		Attach recovery plan if appropriate

 

 

• •