Continuity of Operations Planning for Small Airports (2016)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

6 CHAPTER TWO CONTEXT FOR CONTINUITY PLANNING AT AIRPORTS CONTINUITY PLANNING AT SMALL AIRPORTS Small airports serve an important role in the National Airspace System (NAS) and may fall under multiple FAA classifica- tions such as general aviation airports or reliever airports (FAA, Airport Categories 2015). The largest group of airports in the United States is general aviation airports, which includes both public and private airports. Some public use facilities in this category may also offer scheduled airline service. Because airports are critical to the nation’s infrastructure and to the economies of entire cities and counties, they should be interested in developing continuity plans, not only for emergency situ- ations but also for the ongoing functionality of all airport business and operations. Addressing continuity planning at small airports can be a complex undertaking, because each airport is different. Small airports have a multitude of operational differences, including their forms of governance, management structures, contractual service arrangements, and operating characteristics. The research conducted for this report indicates that very few airports of any classification—including small airports—have adopted formal BCPs or COOPs. Many of the airports that responded to the survey said they did not know the state of their continuity planning process, it had just started, or it was nonexistent. A relatively small number of airports reported having a mature, written BCP. Through the continuity planning process, small airports can focus on business function recovery as well as emergency management. Like any business, airports must consider human resource needs, budgetary constraints, risk management, administrative policy, contractual agreements, and a host of other administrative and business-related functions. Airports must focus not only on aeronautical recovery but also on the business side of the house (S. Walsh, personal communication, Oct. 15, 2015). If a business system is down, the airport “needs to determine how to recover, not why the system is down” (S. Corzine, personal communication, June 17, 2015). FEDERAL, STATE, AND LOCAL REQUIREMENTS FOR AIRPORT BUSINESS AND OPERATIONS CONTINUITY PLANNING The FAA does not mandate that airports adopt business continuity plans; however, there is clearly a trend toward continuity planning requirements at the federal level. Federal directives (e.g., National Security Presidential Directive 51 and Homeland Security Presidential Directive 20) encourage business continuity planning, and it is becoming a greater priority for airport access to FAA programs. For example, in October 2012, the FAA Office of Airports (ARP) issued Program Guidance Letter 13-01, Airport Improve- ment Program (AIP) Grant Oversight Risk Model Policy (Sample 1, Appendix G). The guidance is intended to improve the ARP’s risk-based approach to airport grant oversight and associated documentation. To comply with this provision, airports must complete a risk assessment checklist to certify documented procedures for grant management, including processes that confirm business continuity pertaining to grant management and technical methods of storing grant documents. Individual state and local requirements may also mandate business continuity at municipal and county levels. These mandates may indirectly subject airports to business continuity planning through governing body continuity of operations planning for offsite departmental support resources. STAKEHOLDER RELATIONSHIPS AND BUSINESS CONTINUITY PLANNING Every airport is different, and the differences can include governance, classification, number of stakeholders, nature of opera- tions, layout, management structure, and geographic location.

7 The responsibility for various functions at airports may reside with different stakeholders, many of whom are not under the direct control of airport management. Communication among stakeholders regarding business continuity planning is required to improve coordination and avoid jurisdictional issues within their governance structure or with government agencies such as the Transporta- tion Security Administration (TSA) or the FAA, which may have their own recovery or contingency plans for handling operational disruptions. For example, in determining whether an airport is open or closed, ACRP Synthesis 60 (Smith et al. 2015) found that— Although the decision to open, close, or reopen an airport begins and ends with the airport operator or certificate holder, they must take into account binding agreements and approvals that have been incorporated in the airport’s ASP and ACM. They also must ensure that agencies having an interest or legal jurisdiction, such as FAA, TSA, CBP, FBI, and CDC, are respected, involved, and informed throughout the decision processes leading to recovery. (pp. 36–37) Because of these variables, comprehensive business continuity planning practices can be complex. This report underscores the need for airports of all sizes to coordinate and communicate with stakeholders in the development of a BCP. Regardless of airport complexity, business continuity is about the people, processes, facilities, and technology required to keep the core mission going in the face of any type of disruption. BUSINESS CONTINUITY PLANNING PROCESS All airports experience disruptions of their essential functions. These disruptions may affect staffing, plant and equipment, technology, or normal business processes. Effective business continuity evaluates available resources and determines how to use them to recover from disruptions (Figure 2). FIGURE 2 Resources impacting effective business continuity. Every function at an airport requires certain resources that enable it to work, including human resources, physical plant and equipment, technology, and processes. Planners must carefully consider what resources are available or can be made available during a disruption to maintain business functions until those defined as critical, important, and convenient can be restored. ACRP Report 93 (Corzine 2013) is a comprehensive resource that provides guidance to airport operators to help them plan and prepare for business recovery actions. The report provides detailed guidance on business continuity planning for all airports and includes a software tool that can be used to create a basic BCP. Small airports follow the same steps as larger airports to begin the continuity planning process, although they may have far fewer staff members available to develop and execute their plans. Larger airports have more core functions, but the process of risk assessment and development of recovery priorities is the same at small airports—only on a smaller scale. ACRP Report 93 (Corzine 2013) provides detailed guidance on the preliminary process, which may involve developing an airport-specific risk profile, developing the scope of the plan, and forming a business continuity planning team. Development of the actual BCP begins after the scope of the plan is determined on the basis of the airport’s specific risk assessment, operational functions are analyzed, and both internal and external stakeholders are identified and included.

8 PRIORITIES FOR RECOVERING AND MANAGING DISRUPTIONS The business continuity planning team must define the business and operational priorities of the airport and how disruption impacts will be measured. For example, will the disruption result in loss of revenue, inability to deliver service, or regula- tory impact? This determination will help planners prioritize the functions to be recovered and the recovery time objectives (RTOs). The team should use a business impact analysis (BIA) to identify essential business and operational functions, assess how they work (including the resources needed to maintain and recover them), set RTOs for these functions, and rank the priority of recovery. ACRP Report 93 (Corzine 2013) also provides a critical framework for determining recovery priorities, which can be used to evaluate how critical function recovery is to airport operation. This kind of process mapping helps identify the operational and business functions that have the greatest impact on the mission of the airport. The recovery of a particular function may be less critical if the negative impact is felt over time rather than immediately. The key is to identify the functions that are essential to the airport’s mission and those that are merely convenient or even nonessential. For small airports, the process may boil down to an order of recovery based on how resources will be used to keep priori- tized airport functions operational during disruption and to recover fully after the disruption. Minden-Tahoe Airport (MEV), a general aviation airport near Lake Tahoe (chapter four, Case Example 3), works with the county on business continuity planning and suggests that small airports, “have a plan, even if it is just a page long” (B. Thompson, personal communication, Oct. 14, 2015). BUSINESS CONTINUITY PLANNING AND INTERFACE WITH OTHER PLANS The airports surveyed in this study use a combination of tools and resources, including functional plans, to address opera- tional recovery after disruptions. Functional plans that address specific issues and disruptions include AEPs, irregular opera- tions (IROPS) recovery plans, hurricane plans, H1N1 flu (swine flu) plans, and snow and ice plans. A number of airports responding to the survey indicated that they do not have a formal BCP because business continuity issues are handled as part of other plans (Table B28, Appendix B). AEPs and IROPS recovery plans were the two most often cited resources for operational recovery. Airport Emergency Plans Many airports have become proficient at emergency response and possess a well-developed and practiced airport emergency plan that addresses functional components of emergency response, roles and responsibilities, and hazard-specific emergency response. FAA Advisory Circular 150/5200-1C, Airport Emergency Plan (2009) provides guidance on AEP development. ACRP Synthesis 60 (Smith et al. 2015) cites FAA Advisory Circular 150/5200-31C, which states that an AEP is not required to reflect all phases of an emergency: [The AEP] does not need to reflect all four phases of Comprehensive Emergency Management (CEM). Rather, its focus should be mainly on response and the initial recovery issues. Detailed Mitigation Plans, Administrative Plans, or Recovery Plans can be handled separately. (FAA 2009, pp. 2–3) While AEPs are important emergency management documents, they are not developed to specifically address business continuity needs. Emergency plans are incident-specific protocols to protect life and property, while COOPs and BCPs address the recovery of essential operating and business functions and processes, and the data that support those processes. Airports governed by Federal Aviation Regulation (FAR) Part 139 are required to have an FAA-approved AEP. For this reason, if an airport sponsor chooses to incorporate business and operations continuity practices into an AEP, it may be useful to incorpo- rate them by reference, so the FAA can skip them when it reviews the emergency practices in the plan. Irregular Operations and Recovery Plans Many airports with commercial airline service have IROPS and recovery plans to deal with issues they face as a result of circumstances within the larger air transportation system, on or off the airport. For example, weather-related delays at one location may adversely affect an airport at another location, creating issues involving handling passengers or coordinating facility use. IROPS plans were developed primarily to deal with passenger impacts, and many small airports do not deal with

9 these issues. ACRP Report 65: Guidebook for Airport Irregular Operations (IROPS) Contingency Planning (Nash et al. 2012) provides guidance regarding IROPS. Other Plans Interfacing BCPs or COOPs with other plans may include the process of coordinating continuity practices with those of stakeholder plans. Savannah/Hilton Head International is an example of an airport that has incorporated business continuity planning practices into airport functional plans (chapter four, Case Example 6). At many airports, important operational and business functions are handled by contractors, fixed-base operators (FBOs), or government agencies. The airports manage these relationships in various ways, including basic coordination or requiring compliance with the airport BCP through a lease agreement, letter of agreement, or memorandum of understanding. SUMMARY The practice of business or operations continuity planning is not formally established at many airports, especially smaller ones. Continuity planning is not the same as emergency management. Every airport uses some mix of business functions, whether handled internally or offsite. The development of a BCP will enhance the airport’s ability to recover from common operational and business function interruptions. This can be a simple process for small airports, and airports have effectively used various approaches to continuity planning, depending on local circumstances. Small airports that are considering the development of a BCP might be able to leverage city or county resources to address continuity planning. A good place to start is to identify the city or county department, official, or staff member responsible for continuity planning and inquire about training or resources that might be available to help the airport develop its own plan. Depending on the airport’s business structure, coordination with airport stakeholders can also be an important part of the process. ACRP Report 93 (Corzine 2013) is a comprehensive resource that provides guidance to airport operators to assist in planning and preparing for business and operational recovery actions. Airports have demonstrated that this does not have to be an overly complicated process; it can be simple and inexpensive. The case examples in chapter four offer various approaches to business continuity planning, and chapter six describes tools and resources used by airports for business con- tinuity and recovery practices.