customer profile

International Container Terminal Services, Inc.

Leading container terminal operator enhances its business resilience through sound business continuity planningInternational Container Terminal Services, Inc. (ICTSI) is in the business of acquiring, developing,

managing, and operating container ports and terminals worldwide. As ICTSI’s flagship division, the

Manila International Container Terminal (MICT) is the largest container port terminal in the Philippines.

A significant adverse incident at MICT can have far reaching consequences for ICTSI and its reputation

for managing ports around the world. More importantly, it can have a significant impact on the econ-

omy of the Philippines, as MICT is a major supply chain hub for the whole nation. It was therefore

imperative to implement or improve contingency plans and business continuity capabilities at MICT

to address such adverse incidents. ICTSI commissioned EMC® Consulting to assist in this initiative.

At the outset, EMC consultants set the boundaries right in terms of the overlapping and often-times

confusing disciplines such as business continuity and disaster recovery. Many professionals confuse

these terms and use them interchangeably even though they are different, albeit related, concepts.

Business continuity management is about studying business processes and how to enhance their

resilience in a crisis. It comprises a holistic plan for rapidly resuming mission-critical activities in

the event of a crisis or disruption. Disaster recovery planning, on the other hand, is about increasing

the resilience of information technology (IT). Each has a different emphasis—something that is often

not clearly understood in the industry.

Auditing and establishing a business continuity baseline Once the scope and boundaries of business continuance and disaster recovery were clearly estab-

lished, EMC Consulting was commissioned to conduct an audit of ICTSI’s current business continuity

capabilities. A parallel disaster recovery technology implementation initiative was already underway,

and ICTSI was already writing their disaster recovery plan and procedure to support the technology.

They wanted to go beyond IT and study the resilience of their business processes.

The business continuity audit had the following objectives:

•ToinformICTSI’smanagementoftheircurrentbusinesscontinuityreadiness

•Toestablishabaselinefromwhichfurtherenhancementscouldbebenchmarkedagainst

•Todocumentagapanalysisreportidentifyingweaknessinbusinesscontinuitycapabilities

•Toprovidearoadmapofprioritizedrecommendationsonhowtomovetowardaworld-class

business continuity capability

As an auditing and rating tool, EMC consultants used the Business Continuity Maturity Model® or

BCMM® by Virtual Corporation, New Jersey. This model provided an objective, quantifiable, and

repeatable rating model for ICTSI’s BCM program.

TheBCMMisasix-levelmodelthatassistsorganizationsinevaluatingtheirresiliencebyaskinga

comprehensive set of questions. The answers to the questions contribute to scores in eight character-

istics of a successful business continuity management program. The assessment scores can be used

to obtain executive support, increase business continuity awareness, and quantify improvements

in the business continuity program.

UsingtheBCMM,EMC’sconsultantsconducteddetailedinterviewsandsurveysofseveralkey

business leaders in ICTSI on various aspects of business resilience. Inconsistencies in data were

closelystudiedandre-visited.Theauditwascompletedontimeinfourweeks.Ascorecardwas

generated from the exercise rating the various competencies and attributes of a successful BCM

program and how ICTSI scored in each of these areas. EMC consultants wrote a report interpreting

thescoreswithalistofprioritizedrecommendationsonhowtoimprovebusinessresilience.

“The scorecard and report gave our senior management a bird’s eye view of where we stood,”

said Ms. Catherine Orellano, Information Technology Systems and Services (ITSS) Manager at MICT.

“Weactuallyscoredverywellincertainareaslikesecurityandemergencyresponse.Insomeother

areas, we needed improvement. The scorecard provided the baseline and springboard to plan these

improvements.Fromalistofareastoworkon,ourmanagementchosedevelopmentofDepartmental

Recovery Plans as our top priority.”

An initial in-house, do-it-yourself effort whereby all departments drafted their own departmental

recoveryplansmetwithlimitedsuccess.Theoutputfromeachdepartmentwasnotstandardized

and varied significantly in scope and functionality. EMC business continuity consultants were called

in again to assist.

ThepilotprojectinvolvedEMCConsultingworkingontwopilotdepartmentsand,intheprocess,

training ICTSI staff to roll out the program to the other departments. The project activities involved

conducting a Business Impact Analysis (BIA), business continuity strategy plan, and finally, building

the recovery plan and procedures for each department.

Conducting a Business Impact Analysis and formulating a business continuity strategyDuringtheBIAstage,recoverytimeobjective(RTO)valueswereanalyzedandcalculatedforeach

businessfunctionwithinthetwodepartmentsstudied.TheseRTOvaluesshowedhowquicklya

particularfunctionhadtoberecoveredafterastoppageinordertominimizemajorlossestothe

business. The BIA also identified business functions that were not critical and could be suspended

during a period of crisis, thereby relieving pressure and focusing resources on mission-critical

activities(MCA).ThebusinessRTOvaluesderivedalsopermittedacross-checkontheexisting

technology RTO values to ensure technology RTOs supported business RTOs.

OncetheRTOswereworkedout,EMCwroteabusinesscontinuitystrategypaperthatdiscussed

howcontinuitycouldbeenhancedatvariouslevelsoftheorganization—attheleveloftheholding

company (ICTSI), at MICT, and at grass-root departmental levels.

Developing a gold standard for departmental plansOnce the strategy was accepted, it was time to write the detailed departmental plans, which included

step-by-step procedures and supporting information. To maintain consistency, EMC proposed a draft

departmental plan document to be used as a “gold standard” for departmental plans for the whole

company.Byfollowingthis“goldstandard,”alldepartmentswouldhaveastandardizedwayof

writing plans. For example, section 3.2 of the departmental plan for department A would contain

the “roles and responsibilities” of the recovery teams in that department, while the same section

indepartmentB’splanswouldcoverthesametopic.Suchstandardizationmeanteaseofuseofthe

plan from a developer, auditor, and management point of view.

“Feedback from business continuity managers involved in actual disasters revealed that increasing complexity in plans made them less useful in a crisis. EMC Consulting embarked on a mission to create a plan that was neither too complex to be pragmatic, nor too simplistic to be useless. We believe they achieved this delicate balance.”

Vice President and MICT General Manager

ICTSI’sVicePresidentandMICTGeneralManagersaid,“Feedbackfrombusinesscontinuitymanagers

involved in actual disasters revealed that increasing complexity in plans made them less useful in

acrisis.EMCConsultingembarkedonamissiontocreateaplanthatwasneithertoocomplexto

be pragmatic, nor too simplistic to be useless. We believe they achieved this delicate balance.

Justonelookatthetableofcontentsofthedepartmentalplantoldthewholestory.Therewere

sufficient details and these were all laid out in a logical, unambiguous manner to support ease

of use in a crisis.”

Achieving effective knowledge transferFrom the start, an internal BCM team was selected as ICTSI’s “internal consultants.” Part of their job

was to learn from the EMC consultants in the pilot project and then subsequently roll out the expertise

to other departments. Throughout the project, the internal consultants participated and assisted EMC

in data gathering, analysis, reporting, and documentation. In the process, they learned hands-on in

additiontoclassroomlearningfromworkshopsconductedbyEMC.Bytheendofthepilotproject,

the internal team felt sufficiently confident to be able to roll out the project company wide.

“Thepilot-projectapproach,combinedwithaknowledgetransferfocus,significantlyreducedour

consultingcostsandraisedthein-houseknowledgeofourteamandempoweredthemtocontinue

theprojectbeyondthepilot.Thisworkedouttobeacost-effectivewayofrollingoutBCMwithout

throwing us too much into the deep end. We are now well on our way to achieving company-wide,

full BCM adoption,” Ms. Orellano further stressed.

emc corporationHopkintonMassachusetts01748-91031-508-435-1000In North America 1-866-464-7381www.EMC.com

EMC2, EMC, and where information lives are registered trademarks or trademarks of EMC Corporation in the United States and other countries. All other trademarks used herein are the property of their respective owners. © Copyright 2009 EMC Corporation. All rights reserved. Published in the USA. 06/09 Customer Profile H6358