Assignment Prompt & Instructions
see attached.
– 2 years ago
**files (2)**
– ## CaseStudy.docx
– ## Disaster_recovery_following_th1.pdf
**## CaseStudy.docx**
**Case Study: Disaster recovery following the events of September 11, 2001**
For this assignment, read the below case study, located in the CSU Online Library:
Duchac, J., & Castellino, C. (2006). Disaster recovery following the events of September 11, 2001. Journal of the International Academy for Case Studies, 12(3), 63-72.
[https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337](https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337)
In your case study you must answer the following questions:
1. Based on the case study article, what company was under study, and where was the company’s main site located? Briefly explain the business continuity plan and disaster recovery plan of this company, and include where improvements could be made in each.
2. What methodology did the company focus on to build upon the business continuity process, and why did they choose this method?
3. What is the Tsunami Merrill Plan? What disasters were included in the plan, and what should have been included in the plan?
4. What alternate sites were available to the organization? Was this sufficient or not for disaster recovery?
5. During the September 11 attack, summarize what three issues the company encountered.
6. Explain the three summarized points that were concluded in the case study.
Your response should be a minimum of two pages in length. Use your textbook and this case study as your sources. All sources used, including the textbook, must be referenced; paraphrased and quoted material must have accompanying citations. You must write in APA style.
**## Disaster_recovery_following_th1.pdf**
Disclaimer: This is a machine generated PDF of selected content from our products. This functionality is provided solely for your
convenience and is in no way intended to replace original scanned PDF. Neither Cengage Learning nor its licensors make any
representations or warranties with respect to the machine generated PDF. The PDF is automatically generated "AS IS" and "AS
AVAILABLE" and are not retained in our systems. CENGAGE LEARNING AND ITS LICENSORS SPECIFICALLY DISCLAIM ANY
AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES FOR AVAILABILITY,
ACCURACY, TIMELINESS, COMPLETENESS, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. Your use of the machine generated PDF is subject to all use restrictions contained in The Cengage Learning
Subscription and License Agreement and/or the Gale Academic OneFile Terms and Conditions and by using the machine
generated PDF functionality you agree to forgo any and all claims against Cengage Learning or its licensors for your use of the
machine generated PDF functionality and any output derived therefrom.
Disaster recovery following the events of September 11, 2001.
Authors: Jonathan Duchac and Cara Castellino
Date: May-June 2006
From: Journal of the International Academy for Case Studies(Vol. 12, Issue 3)
Publisher: Jordan Whitney Enterprises, Inc.
Document Type: Case study
Length: 2,845 words
Lexile Measure: 1370L
Full Text:
CASE DESCRIPTION
This case analysis examines the process of developing and implementing a disaster recovery plan. The case (1) discusses some of
the inherent problems that large organizations face in developing an effective disaster recovery plan, and (2) highlights the
challenges of implementing a disaster recovery plan in the face of real world events that vary from the plan's initial assumptions. This
material is appropriate for undergraduate and graduate courses in risk management, information systems, and business continuity
planning. The case is designed to supplement a general discussion of disaster recovery planning, and disaster risk management.
CASE SYNOPSIS
Developing a disaster recovery plan is a challenging process for most organizations, requiring plan developers to strike an
appropriate balance between breadth and detail. In 2001, the Chief Financial Office organization began a disaster recovery process
that was completed in the early part of September 2001. This case reviews the process used by Merrill Lynch's CFO organization to
develop a disaster recovery plan, and the challenges faced in implementing this plan following the events of September 11, 2001.
INTRODUCTION
A broad scope of disasters can incapacitate a company's operations. The "disaster spectrum" can range from natural catastrophes,
such as a tornado or hurricane, to "man-made" tragedies such as terrorist attacks. Developing a plan that can handle the gamut of
possible events is particularly challenging, because plan developers must weigh the benefits of broad applicability against the need
for sufficient detail to be useful in the event of a disaster.
Given that it would be infeasible to formulate specific responses for the entire disaster spectrum, plan developers often struggle to
devise a plan that strikes the appropriate balance between sufficient plan detail and broad based applicability.
If the plan is too focused, the company may find itself with a well formulated plan that does not apply to the disaster at hand.
Conversely, if the plan is too broadly developed its usefulness may be limited in the event of an actual disaster. It is therefore
imperative that companies frame their business continuity planning parameters to ensure some flexibility, while at the same time
providing a detailed enough framework to be effective across the broad spectrum of possible disasters.
One of the most critical aspects in developing a comprehensive disaster plan involves choosing the parameters and assumptions to
use during plan development. These elements define the ultimate structure of the plan and, therefore, its elasticity and effectiveness.
A number of situational factors will often influence this choice. A company's location in southern California, for example, may make it
particularly susceptible to earthquakes; a business site close to the North Carolina coast, on the other hand, may make hurricanes
more pertinent. Aside from explicit spectrum considerations, however, corporate culture or employee biases and attitudes may also
drive the parameters and implicitly affect the assumptions. It is important for developers to consciously recognize these influences so
that they can evaluate what areas on the disaster spectrum are vulnerable.
STRUCTURING DISASTER RECOVERY PLANS
A common error that many companies make in developing a disaster recovery plan is that they focus on developing detailed
protocols at the expense of plan flexibility. These "structured plans" outline in detail the actions that business units and individuals
must take in the event of a disaster. They often include implicit or explicit assumptions about the nature of the disaster event, which
directly influence the design of disaster protocols and recovery procedures. However, the usefulness of the plan could be severely
diminished if the observed conditions vary significantly from the plan assumptions.
While the functionality of "structured plans" can be limited by their lack of flexibility, plans that are developed with insufficient depth
can be equally problematic. If the plan is too broadly developed, it may be thin and without substance, thereby failing to provide
sufficient guidance and structure in the event of an emergency. Thus, the challenge in developing an effective disaster recovery plan
is to provide sufficient detail to provide effective disaster recovery guidance, while at the same time offering enough flexibility to be
applicable across the spectrum of possible disasters. Thus, an effective plan should have substance, while at the same time be
flexible enough to mold to a variety of situations without destroying its functionality.
MERRILL LYNCH CFO UNIT'S DISASTER RECOVERY PLAN AND THE EVENTS OF SEPTEMBER 11, 2001
The events of September 11 provide an unfortunate but useful illustration of the repercussions of implementing business continuity
plans in a real emergency scenario. In this section, we review the development and implementation of the disaster plan for Merill
Lynch's CFO unit following the events of September 11, 2001.
Business continuity planning (BCP) at ML used ten general phases:
Phase 1 Define Business Continuity Program Phase 2 Define Program Objectives Phase 3 Risk and Business Impact Analysis
Phase 4 Current Capability Analysis Phase 5 Requirements Analysis Phase 6 Recovery Strategy Analysis Phase 7 Implement
Recovery Strategies Phase 8 Document Plans Phase 9 Testing Phase 10 Ongoing Plan Maintenance and Testing
The size and diversity of ML's operations and functions, however, precluded the development of a single firm-wide plan. Instead, ML
utilized a business focus methodology that effectively combined structure and flexibility in the company's BCP process. This
approach gave individual units flexibility in structuring their BCP, provided that the process focused on four broad categories.
Phase 1 Program Definition & Setup Phase 2 Analysis: Risk, Business Impact, Recovery Requirements and Strategy Phase 3
Implementation Phase 4 Quality Assurance, Testing & Maintenance
Each division of the company formed a BCP team, which coordinated divisional efforts for recovery, including data gathering,
prioritization of business functions, solving real estate and technology issues, and identification of disaster recovery liaisons.
Once the process was started, the Chief Financial Office (CFO) unit was given a one-year time frame to form a comprehensive
disaster recovery plan for the division. The team operated under ML's "worst-case scenario assumptions." Some of these parameters
were explicit; they were obvious from the division's location, composition, functions, and requirements. The World Trade Center, ML's
neighbor, had already been the target of a terrorist bombing, so the history of the area was a consideration; however, security had
subsequently increased significantly, so further terrorist attacks seemed an unlikely threat.
The group's main site is located in the World Financial Center in downtown Manhattan, which is on the waterfront of the Hudson
River. The BCP teams therefore focused on natural disasters, as was evident in the plan's name: "Tsunami Merrill." The team also
assumed that in the event of a disaster, Merrill would be the only firm affected. This meant that, among other things, other financial
services firms would still be running under normal conditions and the financial markets would remain open. They assumed that the
disaster would occur at the worst possible time of year–year end closing–and that Merrill would receive no extensions or preferential
treatment from the SEC allowing a late filing.
After setting the group's explicit parameters, the team sent templates to managers asking for departmental business requirements,
including major functions, department objectives, and necessary support tasks. The templates encouraged managers to use a three-
tier approach to categorize their processes. Tier One functions include the unit's most essential business functions that must be
maintained to ensure the survival of the company. The inability to perform these functions within four hours of the disaster's
occurrence would be crippling, causing irreparable harm to the firm and a noticeable impact on earnings and profits. Tier Two
functions are the company's essential business functions that must be recovered within a slightly longer time period to avoid severe
financial losses to the firm. Finally, Tier Three functions are the company's remaining business functions that if not performed would
not directly threaten the company's continued existence.
The BCP team reviewed the categorizations of each department to ensure that the business functions were at a high level rather than
the task or process level. The team's focus was predominantly on a critical business function recovery processes through the first six
weeks of a disaster. The likelihood of a longer time frame was remote, and disasters lasting six weeks or longer mandated further
considerations, such as financial, regulatory, reputation, client, and interdependency risks.
The manager templates also gathered critical information about each group, giving the BCP team comprehensive summary
documents for each department. The templates tracked the number of employees in each group and how many were needed during
each of the first six weeks of recovery. This gave the team an indication of space, hardware, and supply requirements. The templates
also listed all critical software applications necessary to conduct business, as well as how quickly these applications needed to be up
and running. The BCP team also asked for primary contacts of internal and external constituencies that departments dealt with
frequently, so that the team could incorporate these interconnections and interdependencies into the recovery plan.
After compiling the results of the group templates, the CFO's BCP team needed to coordinate efforts with the company's real estate
and technology groups. This created some difficulties because of the large number of divisions developing individual disaster
recovery plans. These competing demands were handled by having each department "register" their individual needs with the real
estate department so that space demands could be prioritized and assessed.
Instead of planning for the rental or purchase of additional disaster recovery space, the company planned on using the company's
existing properties in the New York-New Jersey area for disaster recovery. The firm's three downtown Manhattan spaces, two Jersey
City locations, and their new Hopewell facility were all available for recovery space. Since the CFO group was located in the World
Financial Center in downtown Manhattan, they planned recovery in the new Jersey City office across the river. Excess overflow could
go to the Hopewell site, but since many employees lived in close proximity to Manhattan, a major recovery there would cause
commuting strain. The team contemplated several options, including a "shift" based recovery, in which employees would rotate their
work times, and "flex time" schedules with modified workweeks, such as a 4 on, 3 off model.
To ease real estate concerns, the unit also considered using the Global Remote Access System (GRAS) to allow some employees to
work from home. This system, however, had a capacity issue at the time and was initially infeasible. The BCP team also met with
technology to discuss a realistic outlook for technological backup as well as develop timetables for getting critical applications
operational.
IMPLEMENTATION ON SEPTEMBER 11, 2001
On the morning of September 11, terrorists attacked the World Trade Center towers. Employees in the World Financial Center were
unsure what was happening, but most began to leave promptly. Few anticipated the extreme repercussions of these events, and
most employees assumed they would return to work later that day or the next. The CFO unit had just completed their final draft of the
disaster recovery plan. Plan documents were still in hard copy form, and had not yet been input into the company's computer system.
Ironically, the computerization delay was a blessing in disguise. The group had not yet run a test simulation with the plans, so the
events of September 11, 2001 would be the test scenario when the team would see what worked and what needed adjustment. The
team found itself faced with the daunting task of reconciling their plan to the actual circumstances. Without a trial run, it would be an
acid test of the plan's flexibility and effectiveness.
The contingency teams formed 24-hour corporate response teams and command centers. The groups held conference calls and ran
live phone lines that were updated as new information became available. The teams worked in close connection with the human
resources department to track all employees. Counselors came onsite as part of Merrill's Employee Assistance Program, remaining
for an extended period of time to give employees the opportunity to join in group therapy after the tragedy. As the events began to
unfold, it became obvious that the newly developed BCP would have to be altered to fit the characteristics of this specific disaster.
Like in a fast-paced football game, the team had to continually reassess their positions and be ready to "call the audible," changing
their approach in an instant to better react to their surroundings.
The first issue emerged rapidly, snowballing after the team discovered what had happened at the Trade towers. Because of the
extensive damage to all buildings downtown, ML employees had to vacate all three of their downtown locations for a much longer
time period than the recovery teams had anticipated. Prior to September 11, planners had assumed a vacating time frame of up to
three months. On September 12, conference calls with officials and company leaders indicated that they would need to plan on at
least three months. This meant that once the team met with managers and handed them the hard copy recovery plans, groups
needed to reassess necessary headcount. Groups that had conceded to using only three people for the first couple of days when
planning for a six week recovery could now theoretically need space for 35 employees, since all employees would eventually have to
return.
Second, because the damage was more extensive and widespread than anticipated, real estate became a serious problem. Two
other ML divisions had recovery plans using real estate at the 222 Broadway location, which was now unusable. The groups tried to
recover at 101 Hudson Street, in Jersey City, where their support personnel worked, but they needed specialized communication
equipment that would take a week to install. The only other feasible location was 95 Greene Street–the Jersey City location
earmarked for CFO unit's recovery that also housed the company's technology department.
But technology had its own issues. The backup servers were in the same area as the primary servers–downtown Manhattan.
Furthermore, since all three downtown sites were out of commission, there was a shortage of hardware and ready computers. The
technology group had to adapt to the situation. Working around the clock for three days, the group installed approximately 2,500
functioning PCs at the Jersey City location. However, with the addition of three divisions to the building, there were capacity
concerns. The location was originally outfitted for 150 people per floor, and although each desk had two LAN lines and two phone
lines built in, the extra LAN lines were inactive. The company had to physically restructure the space, moving the filing cabinets out of
the building and dropping shelves to desk height. After quickly acquiring chairs, the Jersey City facility was ready for 300 people per
floor–fire code capacity. In addition to finding physical capacity for these employees, the recovery and technology teams needed to
get them connected technologically. With both primary and backup servers located in downtown New York, there was some concern
as to how much technology equipment the Jersey City site could handle. Fortunately, the company had built the location with wireless
capability, which ran off of a different system. The technology capacity constraints could therefore be eased by using about 100
wirelessly connected laptops per floor.
CONCLUSION
Today, the CFO unit's plans are electronically documented and groups are trained on how to access them in the event of a disaster.
Every employee has telecommuting capabilities. BCP groups have implemented "tabletop" exercises, which involve gathering a
group in one space, giving the employees a disaster scenario, having the recovery plans on hand, and assessing the comfort level of
the group with regards to how successful they think the plans could be implemented.
Despite the challenges, the turnaround ML achieved after the Trade Center tragedy is impressive. Immediately after September 11,
downtown Manhattan was completely closed down. On September 12, Merrill convened to execute plans. By the following Monday
morning, the company was fully operational. After two to three weeks, most employees had returned to work. Executive management
and the relevant support functions moved back into the Manhattan headquarters site in the beginning of November, sooner than
anticipated. The remaining units returned to the Manhattan sites incrementally between November and February.
An examination of this application to reality provides critical insight into the implementation of disaster recovery plans. While ML's
team was quick to recognize the explicit parameters, the implicit assumptions had a significant impact on plan flexibility. The
reluctance, for example, to use more remote locations in New Jersey because of logistical problems, could have been potentially
disastrous if the real estate problems at Jersey City were unsolvable or if that site had also been affected.
To summarize, it is useful to remember a short checklist when creating and implementing a business continuity plan. First, assess the
disaster spectrum: recognize where your company's explicit factors place your plan on the spectrum. Candidly assess what implicit
biases your company will face and how they will affect the plan's flexibility along the spectrum. Second, during the planning stage,
aim for a plan that gives your business substance and a foundation in the event of an emergency but at the same time is flexible and
comprehensive enough to cover most of the spectrum. Third, in the event of implementation, be prepared to call the audible. The
effectiveness of any implementation, like the effectiveness of any sports team, will ultimately depend on the ability to make sound
decisions in real time.
REFERENCES
Castellino, C. (2002). [Interview with Nicole Degnan, Merrill Lynch Vice President in charge of Disaster Recovery Planning].
Duchac, J. (2002). [Interview with John Fosina, Merrill Lynch Legal and Regulatory Controller].
Jonathan Duchac, Wake Forest University Cara Castellino, Merrill Lynch
Source Citation (MLA 9th Edition)
Duchac, Jonathan, and Cara Castellino. "Disaster recovery following the events of September 11, 2001." Journal of the International
Academy for Case Studies, vol. 12, no. 3, May-June 2006, pp. 63+. Gale Academic OneFile,
link.gale.com/apps/doc/A166778770/AONE?u=oran95108&sid=ebsco&xid=be5c7628. Accessed 26 Feb. 2025.
Gale Document Number: GALE|A166778770
**## Disaster_recovery_following_th1.pdf**
Disclaimer: This is a machine generated PDF of selected content from our products. This functionality is provided solely for your
convenience and is in no way intended to replace original scanned PDF. Neither Cengage Learning nor its licensors make any
representations or warranties with respect to the machine generated PDF. The PDF is automatically generated "AS IS" and "AS
AVAILABLE" and are not retained in our systems. CENGAGE LEARNING AND ITS LICENSORS SPECIFICALLY DISCLAIM ANY
AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES FOR AVAILABILITY,
ACCURACY, TIMELINESS, COMPLETENESS, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. Your use of the machine generated PDF is subject to all use restrictions contained in The Cengage Learning
Subscription and License Agreement and/or the Gale Academic OneFile Terms and Conditions and by using the machine
generated PDF functionality you agree to forgo any and all claims against Cengage Learning or its licensors for your use of the
machine generated PDF functionality and any output derived therefrom.
Disaster recovery following the events of September 11, 2001.
Authors: Jonathan Duchac and Cara Castellino
Date: May-June 2006
From: Journal of the International Academy for Case Studies(Vol. 12, Issue 3)
Publisher: Jordan Whitney Enterprises, Inc.
Document Type: Case study
Length: 2,845 words
Lexile Measure: 1370L
Full Text:
CASE DESCRIPTION
This case analysis examines the process of developing and implementing a disaster recovery plan. The case (1) discusses some of
the inherent problems that large organizations face in developing an effective disaster recovery plan, and (2) highlights the
challenges of implementing a disaster recovery plan in the face of real world events that vary from the plan's initial assumptions. This
material is appropriate for undergraduate and graduate courses in risk management, information systems, and business continuity
planning. The case is designed to supplement a general discussion of disaster recovery planning, and disaster risk management.
CASE SYNOPSIS
Developing a disaster recovery plan is a challenging process for most organizations, requiring plan developers to strike an
appropriate balance between breadth and detail. In 2001, the Chief Financial Office organization began a disaster recovery process
that was completed in the early part of September 2001. This case reviews the process used by Merrill Lynch's CFO organization to
develop a disaster recovery plan, and the challenges faced in implementing this plan following the events of September 11, 2001.
INTRODUCTION
A broad scope of disasters can incapacitate a company's operations. The "disaster spectrum" can range from natural catastrophes,
such as a tornado or hurricane, to "man-made" tragedies such as terrorist attacks. Developing a plan that can handle the gamut of
possible events is particularly challenging, because plan developers must weigh the benefits of broad applicability against the need
for sufficient detail to be useful in the event of a disaster.
Given that it would be infeasible to formulate specific responses for the entire disaster spectrum, plan developers often struggle to
devise a plan that strikes the appropriate balance between sufficient plan detail and broad based applicability.
If the plan is too focused, the company may find itself with a well formulated plan that does not apply to the disaster at hand.
Conversely, if the plan is too broadly developed its usefulness may be limited in the event of an actual disaster. It is therefore
imperative that companies frame their business continuity planning parameters to ensure some flexibility, while at the same time
providing a detailed enough framework to be effective across the broad spectrum of possible disasters.
One of the most critical aspects in developing a comprehensive disaster plan involves choosing the parameters and assumptions to
use during plan development. These elements define the ultimate structure of the plan and, therefore, its elasticity and effectiveness.
A number of situational factors will often influence this choice. A company's location in southern California, for example, may make it
particularly susceptible to earthquakes; a business site close to the North Carolina coast, on the other hand, may make hurricanes
more pertinent. Aside from explicit spectrum considerations, however, corporate culture or employee biases and attitudes may also
drive the parameters and implicitly affect the assumptions. It is important for developers to consciously recognize these influences so
that they can evaluate what areas on the disaster spectrum are vulnerable.
STRUCTURING DISASTER RECOVERY PLANS
A common error that many companies make in developing a disaster recovery plan is that they focus on developing detailed
protocols at the expense of plan flexibility. These "structured plans" outline in detail the actions that business units and individuals
must take in the event of a disaster. They often include implicit or explicit assumptions about the nature of the disaster event, which
directly influence the design of disaster protocols and recovery procedures. However, the usefulness of the plan could be severely
diminished if the observed conditions vary significantly from the plan assumptions.
While the functionality of "structured plans" can be limited by their lack of flexibility, plans that are developed with insufficient depth
can be equally problematic. If the plan is too broadly developed, it may be thin and without substance, thereby failing to provide
sufficient guidance and structure in the event of an emergency. Thus, the challenge in developing an effective disaster recovery plan
is to provide sufficient detail to provide effective disaster recovery guidance, while at the same time offering enough flexibility to be
applicable across the spectrum of possible disasters. Thus, an effective plan should have substance, while at the same time be
flexible enough to mold to a variety of situations without destroying its functionality.
MERRILL LYNCH CFO UNIT'S DISASTER RECOVERY PLAN AND THE EVENTS OF SEPTEMBER 11, 2001
The events of September 11 provide an unfortunate but useful illustration of the repercussions of implementing business continuity
plans in a real emergency scenario. In this section, we review the development and implementation of the disaster plan for Merill
Lynch's CFO unit following the events of September 11, 2001.
Business continuity planning (BCP) at ML used ten general phases:
Phase 1 Define Business Continuity Program Phase 2 Define Program Objectives Phase 3 Risk and Business Impact Analysis
Phase 4 Current Capability Analysis Phase 5 Requirements Analysis Phase 6 Recovery Strategy Analysis Phase 7 Implement
Recovery Strategies Phase 8 Document Plans Phase 9 Testing Phase 10 Ongoing Plan Maintenance and Testing
The size and diversity of ML's operations and functions, however, precluded the development of a single firm-wide plan. Instead, ML
utilized a business focus methodology that effectively combined structure and flexibility in the company's BCP process. This
approach gave individual units flexibility in structuring their BCP, provided that the process focused on four broad categories.
Phase 1 Program Definition & Setup Phase 2 Analysis: Risk, Business Impact, Recovery Requirements and Strategy Phase 3
Implementation Phase 4 Quality Assurance, Testing & Maintenance
Each division of the company formed a BCP team, which coordinated divisional efforts for recovery, including data gathering,
prioritization of business functions, solving real estate and technology issues, and identification of disaster recovery liaisons.
Once the process was started, the Chief Financial Office (CFO) unit was given a one-year time frame to form a comprehensive
disaster recovery plan for the division. The team operated under ML's "worst-case scenario assumptions." Some of these parameters
were explicit; they were obvious from the division's location, composition, functions, and requirements. The World Trade Center, ML's
neighbor, had already been the target of a terrorist bombing, so the history of the area was a consideration; however, security had
subsequently increased significantly, so further terrorist attacks seemed an unlikely threat.
The group's main site is located in the World Financial Center in downtown Manhattan, which is on the waterfront of the Hudson
River. The BCP teams therefore focused on natural disasters, as was evident in the plan's name: "Tsunami Merrill." The team also
assumed that in the event of a disaster, Merrill would be the only firm affected. This meant that, among other things, other financial
services firms would still be running under normal conditions and the financial markets would remain open. They assumed that the
disaster would occur at the worst possible time of year–year end closing–and that Merrill would receive no extensions or preferential
treatment from the SEC allowing a late filing.
After setting the group's explicit parameters, the team sent templates to managers asking for departmental business requirements,
including major functions, department objectives, and necessary support tasks. The templates encouraged managers to use a three-
tier approach to categorize their processes. Tier One functions include the unit's most essential business functions that must be
maintained to ensure the survival of the company. The inability to perform these functions within four hours of the disaster's
occurrence would be crippling, causing irreparable harm to the firm and a noticeable impact on earnings and profits. Tier Two
functions are the company's essential business functions that must be recovered within a slightly longer time period to avoid severe
financial losses to the firm. Finally, Tier Three functions are the company's remaining business functions that if not performed would
not directly threaten the company's continued existence.
The BCP team reviewed the categorizations of each department to ensure that the business functions were at a high level rather than
the task or process level. The team's focus was predominantly on a critical business function recovery processes through the first six
weeks of a disaster. The likelihood of a longer time frame was remote, and disasters lasting six weeks or longer mandated further
considerations, such as financial, regulatory, reputation, client, and interdependency risks.
The manager templates also gathered critical information about each group, giving the BCP team comprehensive summary
documents for each department. The templates tracked the number of employees in each group and how many were needed during
each of the first six weeks of recovery. This gave the team an indication of space, hardware, and supply requirements. The templates
also listed all critical software applications necessary to conduct business, as well as how quickly these applications needed to be up
and running. The BCP team also asked for primary contacts of internal and external constituencies that departments dealt with
frequently, so that the team could incorporate these interconnections and interdependencies into the recovery plan.
After compiling the results of the group templates, the CFO's BCP team needed to coordinate efforts with the company's real estate
and technology groups. This created some difficulties because of the large number of divisions developing individual disaster
recovery plans. These competing demands were handled by having each department "register" their individual needs with the real
estate department so that space demands could be prioritized and assessed.
Instead of planning for the rental or purchase of additional disaster recovery space, the company planned on using the company's
existing properties in the New York-New Jersey area for disaster recovery. The firm's three downtown Manhattan spaces, two Jersey
City locations, and their new Hopewell facility were all available for recovery space. Since the CFO group was located in the World
Financial Center in downtown Manhattan, they planned recovery in the new Jersey City office across the river. Excess overflow could
go to the Hopewell site, but since many employees lived in close proximity to Manhattan, a major recovery there would cause
commuting strain. The team contemplated several options, including a "shift" based recovery, in which employees would rotate their
work times, and "flex time" schedules with modified workweeks, such as a 4 on, 3 off model.
To ease real estate concerns, the unit also considered using the Global Remote Access System (GRAS) to allow some employees to
work from home. This system, however, had a capacity issue at the time and was initially infeasible. The BCP team also met with
technology to discuss a realistic outlook for technological backup as well as develop timetables for getting critical applications
operational.
IMPLEMENTATION ON SEPTEMBER 11, 2001
On the morning of September 11, terrorists attacked the World Trade Center towers. Employees in the World Financial Center were
unsure what was happening, but most began to leave promptly. Few anticipated the extreme repercussions of these events, and
most employees assumed they would return to work later that day or the next. The CFO unit had just completed their final draft of the
disaster recovery plan. Plan documents were still in hard copy form, and had not yet been input into the company's computer system.
Ironically, the computerization delay was a blessing in disguise. The group had not yet run a test simulation with the plans, so the
events of September 11, 2001 would be the test scenario when the team would see what worked and what needed adjustment. The
team found itself faced with the daunting task of reconciling their plan to the actual circumstances. Without a trial run, it would be an
acid test of the plan's flexibility and effectiveness.
The contingency teams formed 24-hour corporate response teams and command centers. The groups held conference calls and ran
live phone lines that were updated as new information became available. The teams worked in close connection with the human
resources department to track all employees. Counselors came onsite as part of Merrill's Employee Assistance Program, remaining
for an extended period of time to give employees the opportunity to join in group therapy after the tragedy. As the events began to
unfold, it became obvious that the newly developed BCP would have to be altered to fit the characteristics of this specific disaster.
Like in a fast-paced football game, the team had to continually reassess their positions and be ready to "call the audible," changing
their approach in an instant to better react to their surroundings.
The first issue emerged rapidly, snowballing after the team discovered what had happened at the Trade towers. Because of the
extensive damage to all buildings downtown, ML employees had to vacate all three of their downtown locations for a much longer
time period than the recovery teams had anticipated. Prior to September 11, planners had assumed a vacating time frame of up to
three months. On September 12, conference calls with officials and company leaders indicated that they would need to plan on at
least three months. This meant that once the team met with managers and handed them the hard copy recovery plans, groups
needed to reassess necessary headcount. Groups that had conceded to using only three people for the first couple of days when
planning for a six week recovery could now theoretically need space for 35 employees, since all employees would eventually have to
return.
Second, because the damage was more extensive and widespread than anticipated, real estate became a serious problem. Two
other ML divisions had recovery plans using real estate at the 222 Broadway location, which was now unusable. The groups tried to
recover at 101 Hudson Street, in Jersey City, where their support personnel worked, but they needed specialized communication
equipment that would take a week to install. The only other feasible location was 95 Greene Street–the Jersey City location
earmarked for CFO unit's recovery that also housed the company's technology department.
But technology had its own issues. The backup servers were in the same area as the primary servers–downtown Manhattan.
Furthermore, since all three downtown sites were out of commission, there was a shortage of hardware and ready computers. The
technology group had to adapt to the situation. Working around the clock for three days, the group installed approximately 2,500
functioning PCs at the Jersey City location. However, with the addition of three divisions to the building, there were capacity
concerns. The location was originally outfitted for 150 people per floor, and although each desk had two LAN lines and two phone
lines built in, the extra LAN lines were inactive. The company had to physically restructure the space, moving the filing cabinets out of
the building and dropping shelves to desk height. After quickly acquiring chairs, the Jersey City facility was ready for 300 people per
floor–fire code capacity. In addition to finding physical capacity for these employees, the recovery and technology teams needed to
get them connected technologically. With both primary and backup servers located in downtown New York, there was some concern
as to how much technology equipment the Jersey City site could handle. Fortunately, the company had built the location with wireless
capability, which ran off of a different system. The technology capacity constraints could therefore be eased by using about 100
wirelessly connected laptops per floor.
CONCLUSION
Today, the CFO unit's plans are electronically documented and groups are trained on how to access them in the event of a disaster.
Every employee has telecommuting capabilities. BCP groups have implemented "tabletop" exercises, which involve gathering a
group in one space, giving the employees a disaster scenario, having the recovery plans on hand, and assessing the comfort level of
the group with regards to how successful they think the plans could be implemented.
Despite the challenges, the turnaround ML achieved after the Trade Center tragedy is impressive. Immediately after September 11,
downtown Manhattan was completely closed down. On September 12, Merrill convened to execute plans. By the following Monday
morning, the company was fully operational. After two to three weeks, most employees had returned to work. Executive management
and the relevant support functions moved back into the Manhattan headquarters site in the beginning of November, sooner than
anticipated. The remaining units returned to the Manhattan sites incrementally between November and February.
An examination of this application to reality provides critical insight into the implementation of disaster recovery plans. While ML's
team was quick to recognize the explicit parameters, the implicit assumptions had a significant impact on plan flexibility. The
reluctance, for example, to use more remote locations in New Jersey because of logistical problems, could have been potentially
disastrous if the real estate problems at Jersey City were unsolvable or if that site had also been affected.
To summarize, it is useful to remember a short checklist when creating and implementing a business continuity plan. First, assess the
disaster spectrum: recognize where your company's explicit factors place your plan on the spectrum. Candidly assess what implicit
biases your company will face and how they will affect the plan's flexibility along the spectrum. Second, during the planning stage,
aim for a plan that gives your business substance and a foundation in the event of an emergency but at the same time is flexible and
comprehensive enough to cover most of the spectrum. Third, in the event of implementation, be prepared to call the audible. The
effectiveness of any implementation, like the effectiveness of any sports team, will ultimately depend on the ability to make sound
decisions in real time.
REFERENCES
Castellino, C. (2002). [Interview with Nicole Degnan, Merrill Lynch Vice President in charge of Disaster Recovery Planning].
Duchac, J. (2002). [Interview with John Fosina, Merrill Lynch Legal and Regulatory Controller].
Jonathan Duchac, Wake Forest University Cara Castellino, Merrill Lynch
Source Citation (MLA 9th Edition)
Duchac, Jonathan, and Cara Castellino. "Disaster recovery following the events of September 11, 2001." Journal of the International
Academy for Case Studies, vol. 12, no. 3, May-June 2006, pp. 63+. Gale Academic OneFile,
link.gale.com/apps/doc/A166778770/AONE?u=oran95108&sid=ebsco&xid=be5c7628. Accessed 26 Feb. 2025.
Gale Document Number: GALE|A166778770
**## CaseStudy.docx**
**Case Study: Disaster recovery following the events of September 11, 2001**
For this assignment, read the below case study, located in the CSU Online Library:
Duchac, J., & Castellino, C. (2006). Disaster recovery following the events of September 11, 2001. Journal of the International Academy for Case Studies, 12(3), 63-72.
[https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337](https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337)
In your case study you must answer the following questions:
1. Based on the case study article, what company was under study, and where was the company’s main site located? Briefly explain the business continuity plan and disaster recovery plan of this company, and include where improvements could be made in each.
2. What methodology did the company focus on to build upon the business continuity process, and why did they choose this method?
3. What is the Tsunami Merrill Plan? What disasters were included in the plan, and what should have been included in the plan?
4. What alternate sites were available to the organization? Was this sufficient or not for disaster recovery?
5. During the September 11 attack, summarize what three issues the company encountered.
6. Explain the three summarized points that were concluded in the case study.
Your response should be a minimum of two pages in length. Use your textbook and this case study as your sources. All sources used, including the textbook, must be referenced; paraphrased and quoted material must have accompanying citations. You must write in APA style.
**## Disaster_recovery_following_th1.pdf**
Disclaimer: This is a machine generated PDF of selected content from our products. This functionality is provided solely for your
convenience and is in no way intended to replace original scanned PDF. Neither Cengage Learning nor its licensors make any
representations or warranties with respect to the machine generated PDF. The PDF is automatically generated "AS IS" and "AS
AVAILABLE" and are not retained in our systems. CENGAGE LEARNING AND ITS LICENSORS SPECIFICALLY DISCLAIM ANY
AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES FOR AVAILABILITY,
ACCURACY, TIMELINESS, COMPLETENESS, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. Your use of the machine generated PDF is subject to all use restrictions contained in The Cengage Learning
Subscription and License Agreement and/or the Gale Academic OneFile Terms and Conditions and by using the machine
generated PDF functionality you agree to forgo any and all claims against Cengage Learning or its licensors for your use of the
machine generated PDF functionality and any output derived therefrom.
Disaster recovery following the events of September 11, 2001.
Authors: Jonathan Duchac and Cara Castellino
Date: May-June 2006
From: Journal of the International Academy for Case Studies(Vol. 12, Issue 3)
Publisher: Jordan Whitney Enterprises, Inc.
Document Type: Case study
Length: 2,845 words
Lexile Measure: 1370L
Full Text:
CASE DESCRIPTION
This case analysis examines the process of developing and implementing a disaster recovery plan. The case (1) discusses some of
the inherent problems that large organizations face in developing an effective disaster recovery plan, and (2) highlights the
challenges of implementing a disaster recovery plan in the face of real world events that vary from the plan's initial assumptions. This
material is appropriate for undergraduate and graduate courses in risk management, information systems, and business continuity
planning. The case is designed to supplement a general discussion of disaster recovery planning, and disaster risk management.
CASE SYNOPSIS
Developing a disaster recovery plan is a challenging process for most organizations, requiring plan developers to strike an
appropriate balance between breadth and detail. In 2001, the Chief Financial Office organization began a disaster recovery process
that was completed in the early part of September 2001. This case reviews the process used by Merrill Lynch's CFO organization to
develop a disaster recovery plan, and the challenges faced in implementing this plan following the events of September 11, 2001.
INTRODUCTION
A broad scope of disasters can incapacitate a company's operations. The "disaster spectrum" can range from natural catastrophes,
such as a tornado or hurricane, to "man-made" tragedies such as terrorist attacks. Developing a plan that can handle the gamut of
possible events is particularly challenging, because plan developers must weigh the benefits of broad applicability against the need
for sufficient detail to be useful in the event of a disaster.
Given that it would be infeasible to formulate specific responses for the entire disaster spectrum, plan developers often struggle to
devise a plan that strikes the appropriate balance between sufficient plan detail and broad based applicability.
If the plan is too focused, the company may find itself with a well formulated plan that does not apply to the disaster at hand.
Conversely, if the plan is too broadly developed its usefulness may be limited in the event of an actual disaster. It is therefore
imperative that companies frame their business continuity planning parameters to ensure some flexibility, while at the same time
providing a detailed enough framework to be effective across the broad spectrum of possible disasters.
One of the most critical aspects in developing a comprehensive disaster plan involves choosing the parameters and assumptions to
use during plan development. These elements define the ultimate structure of the plan and, therefore, its elasticity and effectiveness.
A number of situational factors will often influence this choice. A company's location in southern California, for example, may make it
particularly susceptible to earthquakes; a business site close to the North Carolina coast, on the other hand, may make hurricanes
more pertinent. Aside from explicit spectrum considerations, however, corporate culture or employee biases and attitudes may also
drive the parameters and implicitly affect the assumptions. It is important for developers to consciously recognize these influences so
that they can evaluate what areas on the disaster spectrum are vulnerable.
STRUCTURING DISASTER RECOVERY PLANS
A common error that many companies make in developing a disaster recovery plan is that they focus on developing detailed
protocols at the expense of plan flexibility. These "structured plans" outline in detail the actions that business units and individuals
must take in the event of a disaster. They often include implicit or explicit assumptions about the nature of the disaster event, which
directly influence the design of disaster protocols and recovery procedures. However, the usefulness of the plan could be severely
diminished if the observed conditions vary significantly from the plan assumptions.
While the functionality of "structured plans" can be limited by their lack of flexibility, plans that are developed with insufficient depth
can be equally problematic. If the plan is too broadly developed, it may be thin and without substance, thereby failing to provide
sufficient guidance and structure in the event of an emergency. Thus, the challenge in developing an effective disaster recovery plan
is to provide sufficient detail to provide effective disaster recovery guidance, while at the same time offering enough flexibility to be
applicable across the spectrum of possible disasters. Thus, an effective plan should have substance, while at the same time be
flexible enough to mold to a variety of situations without destroying its functionality.
MERRILL LYNCH CFO UNIT'S DISASTER RECOVERY PLAN AND THE EVENTS OF SEPTEMBER 11, 2001
The events of September 11 provide an unfortunate but useful illustration of the repercussions of implementing business continuity
plans in a real emergency scenario. In this section, we review the development and implementation of the disaster plan for Merill
Lynch's CFO unit following the events of September 11, 2001.
Business continuity planning (BCP) at ML used ten general phases:
Phase 1 Define Business Continuity Program Phase 2 Define Program Objectives Phase 3 Risk and Business Impact Analysis
Phase 4 Current Capability Analysis Phase 5 Requirements Analysis Phase 6 Recovery Strategy Analysis Phase 7 Implement
Recovery Strategies Phase 8 Document Plans Phase 9 Testing Phase 10 Ongoing Plan Maintenance and Testing
The size and diversity of ML's operations and functions, however, precluded the development of a single firm-wide plan. Instead, ML
utilized a business focus methodology that effectively combined structure and flexibility in the company's BCP process. This
approach gave individual units flexibility in structuring their BCP, provided that the process focused on four broad categories.
Phase 1 Program Definition & Setup Phase 2 Analysis: Risk, Business Impact, Recovery Requirements and Strategy Phase 3
Implementation Phase 4 Quality Assurance, Testing & Maintenance
Each division of the company formed a BCP team, which coordinated divisional efforts for recovery, including data gathering,
prioritization of business functions, solving real estate and technology issues, and identification of disaster recovery liaisons.
Once the process was started, the Chief Financial Office (CFO) unit was given a one-year time frame to form a comprehensive
disaster recovery plan for the division. The team operated under ML's "worst-case scenario assumptions." Some of these parameters
were explicit; they were obvious from the division's location, composition, functions, and requirements. The World Trade Center, ML's
neighbor, had already been the target of a terrorist bombing, so the history of the area was a consideration; however, security had
subsequently increased significantly, so further terrorist attacks seemed an unlikely threat.
The group's main site is located in the World Financial Center in downtown Manhattan, which is on the waterfront of the Hudson
River. The BCP teams therefore focused on natural disasters, as was evident in the plan's name: "Tsunami Merrill." The team also
assumed that in the event of a disaster, Merrill would be the only firm affected. This meant that, among other things, other financial
services firms would still be running under normal conditions and the financial markets would remain open. They assumed that the
disaster would occur at the worst possible time of year–year end closing–and that Merrill would receive no extensions or preferential
treatment from the SEC allowing a late filing.
After setting the group's explicit parameters, the team sent templates to managers asking for departmental business requirements,
including major functions, department objectives, and necessary support tasks. The templates encouraged managers to use a three-
tier approach to categorize their processes. Tier One functions include the unit's most essential business functions that must be
maintained to ensure the survival of the company. The inability to perform these functions within four hours of the disaster's
occurrence would be crippling, causing irreparable harm to the firm and a noticeable impact on earnings and profits. Tier Two
functions are the company's essential business functions that must be recovered within a slightly longer time period to avoid severe
financial losses to the firm. Finally, Tier Three functions are the company's remaining business functions that if not performed would
not directly threaten the company's continued existence.
The BCP team reviewed the categorizations of each department to ensure that the business functions were at a high level rather than
the task or process level. The team's focus was predominantly on a critical business function recovery processes through the first six
weeks of a disaster. The likelihood of a longer time frame was remote, and disasters lasting six weeks or longer mandated further
considerations, such as financial, regulatory, reputation, client, and interdependency risks.
The manager templates also gathered critical information about each group, giving the BCP team comprehensive summary
documents for each department. The templates tracked the number of employees in each group and how many were needed during
each of the first six weeks of recovery. This gave the team an indication of space, hardware, and supply requirements. The templates
also listed all critical software applications necessary to conduct business, as well as how quickly these applications needed to be up
and running. The BCP team also asked for primary contacts of internal and external constituencies that departments dealt with
frequently, so that the team could incorporate these interconnections and interdependencies into the recovery plan.
After compiling the results of the group templates, the CFO's BCP team needed to coordinate efforts with the company's real estate
and technology groups. This created some difficulties because of the large number of divisions developing individual disaster
recovery plans. These competing demands were handled by having each department "register" their individual needs with the real
estate department so that space demands could be prioritized and assessed.
Instead of planning for the rental or purchase of additional disaster recovery space, the company planned on using the company's
existing properties in the New York-New Jersey area for disaster recovery. The firm's three downtown Manhattan spaces, two Jersey
City locations, and their new Hopewell facility were all available for recovery space. Since the CFO group was located in the World
Financial Center in downtown Manhattan, they planned recovery in the new Jersey City office across the river. Excess overflow could
go to the Hopewell site, but since many employees lived in close proximity to Manhattan, a major recovery there would cause
commuting strain. The team contemplated several options, including a "shift" based recovery, in which employees would rotate their
work times, and "flex time" schedules with modified workweeks, such as a 4 on, 3 off model.
To ease real estate concerns, the unit also considered using the Global Remote Access System (GRAS) to allow some employees to
work from home. This system, however, had a capacity issue at the time and was initially infeasible. The BCP team also met with
technology to discuss a realistic outlook for technological backup as well as develop timetables for getting critical applications
operational.
IMPLEMENTATION ON SEPTEMBER 11, 2001
On the morning of September 11, terrorists attacked the World Trade Center towers. Employees in the World Financial Center were
unsure what was happening, but most began to leave promptly. Few anticipated the extreme repercussions of these events, and
most employees assumed they would return to work later that day or the next. The CFO unit had just completed their final draft of the
disaster recovery plan. Plan documents were still in hard copy form, and had not yet been input into the company's computer system.
Ironically, the computerization delay was a blessing in disguise. The group had not yet run a test simulation with the plans, so the
events of September 11, 2001 would be the test scenario when the team would see what worked and what needed adjustment. The
team found itself faced with the daunting task of reconciling their plan to the actual circumstances. Without a trial run, it would be an
acid test of the plan's flexibility and effectiveness.
The contingency teams formed 24-hour corporate response teams and command centers. The groups held conference calls and ran
live phone lines that were updated as new information became available. The teams worked in close connection with the human
resources department to track all employees. Counselors came onsite as part of Merrill's Employee Assistance Program, remaining
for an extended period of time to give employees the opportunity to join in group therapy after the tragedy. As the events began to
unfold, it became obvious that the newly developed BCP would have to be altered to fit the characteristics of this specific disaster.
Like in a fast-paced football game, the team had to continually reassess their positions and be ready to "call the audible," changing
their approach in an instant to better react to their surroundings.
The first issue emerged rapidly, snowballing after the team discovered what had happened at the Trade towers. Because of the
extensive damage to all buildings downtown, ML employees had to vacate all three of their downtown locations for a much longer
time period than the recovery teams had anticipated. Prior to September 11, planners had assumed a vacating time frame of up to
three months. On September 12, conference calls with officials and company leaders indicated that they would need to plan on at
least three months. This meant that once the team met with managers and handed them the hard copy recovery plans, groups
needed to reassess necessary headcount. Groups that had conceded to using only three people for the first couple of days when
planning for a six week recovery could now theoretically need space for 35 employees, since all employees would eventually have to
return.
Second, because the damage was more extensive and widespread than anticipated, real estate became a serious problem. Two
other ML divisions had recovery plans using real estate at the 222 Broadway location, which was now unusable. The groups tried to
recover at 101 Hudson Street, in Jersey City, where their support personnel worked, but they needed specialized communication
equipment that would take a week to install. The only other feasible location was 95 Greene Street–the Jersey City location
earmarked for CFO unit's recovery that also housed the company's technology department.
But technology had its own issues. The backup servers were in the same area as the primary servers–downtown Manhattan.
Furthermore, since all three downtown sites were out of commission, there was a shortage of hardware and ready computers. The
technology group had to adapt to the situation. Working around the clock for three days, the group installed approximately 2,500
functioning PCs at the Jersey City location. However, with the addition of three divisions to the building, there were capacity
concerns. The location was originally outfitted for 150 people per floor, and although each desk had two LAN lines and two phone
lines built in, the extra LAN lines were inactive. The company had to physically restructure the space, moving the filing cabinets out of
the building and dropping shelves to desk height. After quickly acquiring chairs, the Jersey City facility was ready for 300 people per
floor–fire code capacity. In addition to finding physical capacity for these employees, the recovery and technology teams needed to
get them connected technologically. With both primary and backup servers located in downtown New York, there was some concern
as to how much technology equipment the Jersey City site could handle. Fortunately, the company had built the location with wireless
capability, which ran off of a different system. The technology capacity constraints could therefore be eased by using about 100
wirelessly connected laptops per floor.
CONCLUSION
Today, the CFO unit's plans are electronically documented and groups are trained on how to access them in the event of a disaster.
Every employee has telecommuting capabilities. BCP groups have implemented "tabletop" exercises, which involve gathering a
group in one space, giving the employees a disaster scenario, having the recovery plans on hand, and assessing the comfort level of
the group with regards to how successful they think the plans could be implemented.
Despite the challenges, the turnaround ML achieved after the Trade Center tragedy is impressive. Immediately after September 11,
downtown Manhattan was completely closed down. On September 12, Merrill convened to execute plans. By the following Monday
morning, the company was fully operational. After two to three weeks, most employees had returned to work. Executive management
and the relevant support functions moved back into the Manhattan headquarters site in the beginning of November, sooner than
anticipated. The remaining units returned to the Manhattan sites incrementally between November and February.
An examination of this application to reality provides critical insight into the implementation of disaster recovery plans. While ML's
team was quick to recognize the explicit parameters, the implicit assumptions had a significant impact on plan flexibility. The
reluctance, for example, to use more remote locations in New Jersey because of logistical problems, could have been potentially
disastrous if the real estate problems at Jersey City were unsolvable or if that site had also been affected.
To summarize, it is useful to remember a short checklist when creating and implementing a business continuity plan. First, assess the
disaster spectrum: recognize where your company's explicit factors place your plan on the spectrum. Candidly assess what implicit
biases your company will face and how they will affect the plan's flexibility along the spectrum. Second, during the planning stage,
aim for a plan that gives your business substance and a foundation in the event of an emergency but at the same time is flexible and
comprehensive enough to cover most of the spectrum. Third, in the event of implementation, be prepared to call the audible. The
effectiveness of any implementation, like the effectiveness of any sports team, will ultimately depend on the ability to make sound
decisions in real time.
REFERENCES
Castellino, C. (2002). [Interview with Nicole Degnan, Merrill Lynch Vice President in charge of Disaster Recovery Planning].
Duchac, J. (2002). [Interview with John Fosina, Merrill Lynch Legal and Regulatory Controller].
Jonathan Duchac, Wake Forest University Cara Castellino, Merrill Lynch
Source Citation (MLA 9th Edition)
Duchac, Jonathan, and Cara Castellino. "Disaster recovery following the events of September 11, 2001." Journal of the International
Academy for Case Studies, vol. 12, no. 3, May-June 2006, pp. 63+. Gale Academic OneFile,
link.gale.com/apps/doc/A166778770/AONE?u=oran95108&sid=ebsco&xid=be5c7628. Accessed 26 Feb. 2025.
Gale Document Number: GALE|A166778770
**## CaseStudy.docx**
**Case Study: Disaster recovery following the events of September 11, 2001**
For this assignment, read the below case study, located in the CSU Online Library:
Duchac, J., & Castellino, C. (2006). Disaster recovery following the events of September 11, 2001. Journal of the International Academy for Case Studies, 12(3), 63-72.
[https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337](https://search-proquestcom.libraryresources.columbiasouthern.edu/docview/216294669?accountid=33337)
In your case study you must answer the following questions:
1. Based on the case study article, what company was under study, and where was the company’s main site located? Briefly explain the business continuity plan and disaster recovery plan of this company, and include where improvements could be made in each.
2. What methodology did the company focus on to build upon the business continuity process, and why did they choose this method?
3. What is the Tsunami Merrill Plan? What disasters were included in the plan, and what should have been included in the plan?
4. What alternate sites were available to the organization? Was this sufficient or not for disaster recovery?
5. During the September 11 attack, summarize what three issues the company encountered.
6. Explain the three summarized points that were concluded in the case study.
Your response should be a minimum of two pages in length. Use your textbook and this case study as your sources. All sources used, including the textbook, must be referenced; paraphrased and quoted material must have accompanying citations. You must write in APA style.
**## Disaster_recovery_following_th1.pdf**
Disclaimer: This is a machine generated PDF of selected content from our products. This functionality is provided solely for your
convenience and is in no way intended to replace original scanned PDF. Neither Cengage Learning nor its licensors make any
representations or warranties with respect to the machine generated PDF. The PDF is automatically generated "AS IS" and "AS
AVAILABLE" and are not retained in our systems. CENGAGE LEARNING AND ITS LICENSORS SPECIFICALLY DISCLAIM ANY
AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES FOR AVAILABILITY,
ACCURACY, TIMELINESS, COMPLETENESS, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. Your use of the machine generated PDF is subject to all use restrictions contained in The Cengage Learning
Subscription and License Agreement and/or the Gale Academic OneFile Terms and Conditions and by using the machine
generated PDF functionality you agree to forgo any and all claims against Cengage Learning or its licensors for your use of the
machine generated PDF functionality and any output derived therefrom.
Disaster recovery following the events of September 11, 2001.
Authors: Jonathan Duchac and Cara Castellino
Date: May-June 2006
From: Journal of the International Academy for Case Studies(Vol. 12, Issue 3)
Publisher: Jordan Whitney Enterprises, Inc.
Document Type: Case study
Length: 2,845 words
Lexile Measure: 1370L
Full Text:
CASE DESCRIPTION
This case analysis examines the process of developing and implementing a disaster recovery plan. The case (1) discusses some of
the inherent problems that large organizations face in developing an effective disaster recovery plan, and (2) highlights the
challenges of implementing a disaster recovery plan in the face of real world events that vary from the plan's initial assumptions. This
material is appropriate for undergraduate and graduate courses in risk management, information systems, and business continuity
planning. The case is designed to supplement a general discussion of disaster recovery planning, and disaster risk management.
CASE SYNOPSIS
Developing a disaster recovery plan is a challenging process for most organizations, requiring plan developers to strike an
appropriate balance between breadth and detail. In 2001, the Chief Financial Office organization began a disaster recovery process
that was completed in the early part of September 2001. This case reviews the process used by Merrill Lynch's CFO organization to
develop a disaster recovery plan, and the challenges faced in implementing this plan following the events of September 11, 2001.
INTRODUCTION
A broad scope of disasters can incapacitate a company's operations. The "disaster spectrum" can range from natural catastrophes,
such as a tornado or hurricane, to "man-made" tragedies such as terrorist attacks. Developing a plan that can handle the gamut of
possible events is particularly challenging, because plan developers must weigh the benefits of broad applicability against the need
for sufficient detail to be useful in the event of a disaster.
Given that it would be infeasible to formulate specific responses for the entire disaster spectrum, plan developers often struggle to
devise a plan that strikes the appropriate balance between sufficient plan detail and broad based applicability.
If the plan is too focused, the company may find itself with a well formulated plan that does not apply to the disaster at hand.
Conversely, if the plan is too broadly developed its usefulness may be limited in the event of an actual disaster. It is therefore
imperative that companies frame their business continuity planning parameters to ensure some flexibility, while at the same time
providing a detailed enough framework to be effective across the broad spectrum of possible disasters.
One of the most critical aspects in developing a comprehensive disaster plan involves choosing the parameters and assumptions to
use during plan development. These elements define the ultimate structure of the plan and, therefore, its elasticity and effectiveness.
A number of situational factors will often influence this choice. A company's location in southern California, for example, may make it
particularly susceptible to earthquakes; a business site close to the North Carolina coast, on the other hand, may make hurricanes
more pertinent. Aside from explicit spectrum considerations, however, corporate culture or employee biases and attitudes may also
drive the parameters and implicitly affect the assumptions. It is important for developers to consciously recognize these influences so
that they can evaluate what areas on the disaster spectrum are vulnerable.
STRUCTURING DISASTER RECOVERY PLANS
A common error that many companies make in developing a disaster recovery plan is that they focus on developing detailed
protocols at the expense of plan flexibility. These "structured plans" outline in detail the actions that business units and individuals
must take in the event of a disaster. They often include implicit or explicit assumptions about the nature of the disaster event, which
directly influence the design of disaster protocols and recovery procedures. However, the usefulness of the plan could be severely
diminished if the observed conditions vary significantly from the plan assumptions.
While the functionality of "structured plans" can be limited by their lack of flexibility, plans that are developed with insufficient depth
can be equally problematic. If the plan is too broadly developed, it may be thin and without substance, thereby failing to provide
sufficient guidance and structure in the event of an emergency. Thus, the challenge in developing an effective disaster recovery plan
is to provide sufficient detail to provide effective disaster recovery guidance, while at the same time offering enough flexibility to be
applicable across the spectrum of possible disasters. Thus, an effective plan should have substance, while at the same time be
flexible enough to mold to a variety of situations without destroying its functionality.
MERRILL LYNCH CFO UNIT'S DISASTER RECOVERY PLAN AND THE EVENTS OF SEPTEMBER 11, 2001
The events of September 11 provide an unfortunate but useful illustration of the repercussions of implementing business continuity
plans in a real emergency scenario. In this section, we review the development and implementation of the disaster plan for Merill
Lynch's CFO unit following the events of September 11, 2001.
Business continuity planning (BCP) at ML used ten general phases:
Phase 1 Define Business Continuity Program Phase 2 Define Program Objectives Phase 3 Risk and Business Impact Analysis
Phase 4 Current Capability Analysis Phase 5 Requirements Analysis Phase 6 Recovery Strategy Analysis Phase 7 Implement
Recovery Strategies Phase 8 Document Plans Phase 9 Testing Phase 10 Ongoing Plan Maintenance and Testing
The size and diversity of ML's operations and functions, however, precluded the development of a single firm-wide plan. Instead, ML
utilized a business focus methodology that effectively combined structure and flexibility in the company's BCP process. This
approach gave individual units flexibility in structuring their BCP, provided that the process focused on four broad categories.
Phase 1 Program Definition & Setup Phase 2 Analysis: Risk, Business Impact, Recovery Requirements and Strategy Phase 3
Implementation Phase 4 Quality Assurance, Testing & Maintenance
Each division of the company formed a BCP team, which coordinated divisional efforts for recovery, including data gathering,
prioritization of business functions, solving real estate and technology issues, and identification of disaster recovery liaisons.
Once the process was started, the Chief Financial Office (CFO) unit was given a one-year time frame to form a comprehensive
disaster recovery plan for the division. The team operated under ML's "worst-case scenario assumptions." Some of these parameters
were explicit; they were obvious from the division's location, composition, functions, and requirements. The World Trade Center, ML's
neighbor, had already been the target of a terrorist bombing, so the history of the area was a consideration; however, security had
subsequently increased significantly, so further terrorist attacks seemed an unlikely threat.
The group's main site is located in the World Financial Center in downtown Manhattan, which is on the waterfront of the Hudson
River. The BCP teams therefore focused on natural disasters, as was evident in the plan's name: "Tsunami Merrill." The team also
assumed that in the event of a disaster, Merrill would be the only firm affected. This meant that, among other things, other financial
services firms would still be running under normal conditions and the financial markets would remain open. They assumed that the
disaster would occur at the worst possible time of year–year end closing–and that Merrill would receive no extensions or preferential
treatment from the SEC allowing a late filing.
After setting the group's explicit parameters, the team sent templates to managers asking for departmental business requirements,
including major functions, department objectives, and necessary support tasks. The templates encouraged managers to use a three-
tier approach to categorize their processes. Tier One functions include the unit's most essential business functions that must be
maintained to ensure the survival of the company. The inability to perform these functions within four hours of the disaster's
occurrence would be crippling, causing irreparable harm to the firm and a noticeable impact on earnings and profits. Tier Two
functions are the company's essential business functions that must be recovered within a slightly longer time period to avoid severe
financial losses to the firm. Finally, Tier Three functions are the company's remaining business functions that if not performed would
not directly threaten the company's continued existence.
The BCP team reviewed the categorizations of each department to ensure that the business functions were at a high level rather than
the task or process level. The team's focus was predominantly on a critical business function recovery processes through the first six
weeks of a disaster. The likelihood of a longer time frame was remote, and disasters lasting six weeks or longer mandated further
considerations, such as financial, regulatory, reputation, client, and interdependency risks.
The manager templates also gathered critical information about each group, giving the BCP team comprehensive summary
documents for each department. The templates tracked the number of employees in each group and how many were needed during
each of the first six weeks of recovery. This gave the team an indication of space, hardware, and supply requirements. The templates
also listed all critical software applications necessary to conduct business, as well as how quickly these applications needed to be up
and running. The BCP team also asked for primary contacts of internal and external constituencies that departments dealt with
frequently, so that the team could incorporate these interconnections and interdependencies into the recovery plan.
After compiling the results of the group templates, the CFO's BCP team needed to coordinate efforts with the company's real estate
and technology groups. This created some difficulties because of the large number of divisions developing individual disaster
recovery plans. These competing demands were handled by having each department "register" their individual needs with the real
estate department so that space demands could be prioritized and assessed.
Instead of planning for the rental or purchase of additional disaster recovery space, the company planned on using the company's
existing properties in the New York-New Jersey area for disaster recovery. The firm's three downtown Manhattan spaces, two Jersey
City locations, and their new Hopewell facility were all available for recovery space. Since the CFO group was located in the World
Financial Center in downtown Manhattan, they planned recovery in the new Jersey City office across the river. Excess overflow could
go to the Hopewell site, but since many employees lived in close proximity to Manhattan, a major recovery there would cause
commuting strain. The team contemplated several options, including a "shift" based recovery, in which employees would rotate their
work times, and "flex time" schedules with modified workweeks, such as a 4 on, 3 off model.
To ease real estate concerns, the unit also considered using the Global Remote Access System (GRAS) to allow some employees to
work from home. This system, however, had a capacity issue at the time and was initially infeasible. The BCP team also met with
technology to discuss a realistic outlook for technological backup as well as develop timetables for getting critical applications
operational.
IMPLEMENTATION ON SEPTEMBER 11, 2001
On the morning of September 11, terrorists attacked the World Trade Center towers. Employees in the World Financial Center were
unsure what was happening, but most began to leave promptly. Few anticipated the extreme repercussions of these events, and
most employees assumed they would return to work later that day or the next. The CFO unit had just completed their final draft of the
disaster recovery plan. Plan documents were still in hard copy form, and had not yet been input into the company's computer system.
Ironically, the computerization delay was a blessing in disguise. The group had not yet run a test simulation with the plans, so the
events of September 11, 2001 would be the test scenario when the team would see what worked and what needed adjustment. The
team found itself faced with the daunting task of reconciling their plan to the actual circumstances. Without a trial run, it would be an
acid test of the plan's flexibility and effectiveness.
The contingency teams formed 24-hour corporate response teams and command centers. The groups held conference calls and ran
live phone lines that were updated as new information became available. The teams worked in close connection with the human
resources department to track all employees. Counselors came onsite as part of Merrill's Employee Assistance Program, remaining
for an extended period of time to give employees the opportunity to join in group therapy after the tragedy. As the events began to
unfold, it became obvious that the newly developed BCP would have to be altered to fit the characteristics of this specific disaster.
Like in a fast-paced football game, the team had to continually reassess their positions and be ready to "call the audible," changing
their approach in an instant to better react to their surroundings.
The first issue emerged rapidly, snowballing after the team discovered what had happened at the Trade towers. Because of the
extensive damage to all buildings downtown, ML employees had to vacate all three of their downtown locations for a much longer
time period than the recovery teams had anticipated. Prior to September 11, planners had assumed a vacating time frame of up to
three months. On September 12, conference calls with officials and company leaders indicated that they would need to plan on at
least three months. This meant that once the team met with managers and handed them the hard copy recovery plans, groups
needed to reassess necessary headcount. Groups that had conceded to using only three people for the first couple of days when
planning for a six week recovery could now theoretically need space for 35 employees, since all employees would eventually have to
return.
Second, because the damage was more extensive and widespread than anticipated, real estate became a serious problem. Two
other ML divisions had recovery plans using real estate at the 222 Broadway location, which was now unusable. The groups tried to
recover at 101 Hudson Street, in Jersey City, where their support personnel worked, but they needed specialized communication
equipment that would take a week to install. The only other feasible location was 95 Greene Street–the Jersey City location
earmarked for CFO unit's recovery that also housed the company's technology department.
But technology had its own issues. The backup servers were in the same area as the primary servers–downtown Manhattan.
Furthermore, since all three downtown sites were out of commission, there was a shortage of hardware and ready computers. The
technology group had to adapt to the situation. Working around the clock for three days, the group installed approximately 2,500
functioning PCs at the Jersey City location. However, with the addition of three divisions to the building, there were capacity
concerns. The location was originally outfitted for 150 people per floor, and although each desk had two LAN lines and two phone
lines built in, the extra LAN lines were inactive. The company had to physically restructure the space, moving the filing cabinets out of
the building and dropping shelves to desk height. After quickly acquiring chairs, the Jersey City facility was ready for 300 people per
floor–fire code capacity. In addition to finding physical capacity for these employees, the recovery and technology teams needed to
get them connected technologically. With both primary and backup servers located in downtown New York, there was some concern
as to how much technology equipment the Jersey City site could handle. Fortunately, the company had built the location with wireless
capability, which ran off of a different system. The technology capacity constraints could therefore be eased by using about 100
wirelessly connected laptops per floor.
CONCLUSION
Today, the CFO unit's plans are electronically documented and groups are trained on how to access them in the event of a disaster.
Every employee has telecommuting capabilities. BCP groups have implemented "tabletop" exercises, which involve gathering a
group in one space, giving the employees a disaster scenario, having the recovery plans on hand, and assessing the comfort level of
the group with regards to how successful they think the plans could be implemented.
Despite the challenges, the turnaround ML achieved after the Trade Center tragedy is impressive. Immediately after September 11,
downtown Manhattan was completely closed down. On September 12, Merrill convened to execute plans. By the following Monday
morning, the company was fully operational. After two to three weeks, most employees had returned to work. Executive management
and the relevant support functions moved back into the Manhattan headquarters site in the beginning of November, sooner than
anticipated. The remaining units returned to the Manhattan sites incrementally between November and February.
An examination of this application to reality provides critical insight into the implementation of disaster recovery plans. While ML's
team was quick to recognize the explicit parameters, the implicit assumptions had a significant impact on plan flexibility. The
reluctance, for example, to use more remote locations in New Jersey because of logistical problems, could have been potentially
disastrous if the real estate problems at Jersey City were unsolvable or if that site had also been affected.
To summarize, it is useful to remember a short checklist when creating and implementing a business continuity plan. First, assess the
disaster spectrum: recognize where your company's explicit factors place your plan on the spectrum. Candidly assess what implicit
biases your company will face and how they will affect the plan's flexibility along the spectrum. Second, during the planning stage,
aim for a plan that gives your business substance and a foundation in the event of an emergency but at the same time is flexible and
comprehensive enough to cover most of the spectrum. Third, in the event of implementation, be prepared to call the audible. The
effectiveness of any implementation, like the effectiveness of any sports team, will ultimately depend on the ability to make sound
decisions in real time.
REFERENCES
Castellino, C. (2002). [Interview with Nicole Degnan, Merrill Lynch Vice President in charge of Disaster Recovery Planning].
Duchac, J. (2002). [Interview with John Fosina, Merrill Lynch Legal and Regulatory Controller].
Jonathan Duchac, Wake Forest University Cara Castellino, Merrill Lynch
Source Citation (MLA 9th Edition)
Duchac, Jonathan, and Cara Castellino. "Disaster recovery following the events of September 11, 2001." Journal of the International
Academy for Case Studies, vol. 12, no. 3, May-June 2006, pp. 63+. Gale Academic OneFile,
link.gale.com/apps/doc/A166778770/AONE?u=oran95108&sid=ebsco&xid=be5c7628. Accessed 26 Feb. 2025.
Gale Document Number: GALE|A166778770