Disaster Preparedness and Recovery Plan

Version 1.1

Sponsored by:

Community Foundation Leadership Team (CFLT) Fiscal and Administrative Officers Group (FAOG) Program Network (ProNet)

CONTENTS Overview ............................................................................................................................. 3 Risks and Event Scenarios .................................................................................................. 3 Plan Activation.................................................................................................................... 4 Responsibility and Delegation of Authority ....................................................................... 4 Incident Response Team (IRT) ........................................................................................... 5 Incident Response Team Roles & Responsibilities ............................................................ 6 Business Impact Analysis ................................................................................................... 8 Recovery Activity Summary & Needs Assessment.......................................................... 10 Recovery Activity Summary and Needs Assessment ....................................................... 12 Vital Records .................................................................................................................... 14 Disaster Notification/Communications ............................................................................. 15 Personnel & Board Contact Information .......................................................................... 16 Building Evacuation.......................................................................................................... 17 Emergency Operations Center .......................................................................................... 17 Business Recovery Locations ........................................................................................... 18 Information Technology/Operations Preparedness........................................................... 19 Emergency Grant Making Procedures .............................................................................. 22 APPENDIX A Risk Assessment ................................................................................... 24 APPENDIX B-1 First Person On Site Checklist .......................................................... 26 APPENDIX B-2 Incident Commander (IC) Checklist ................................................. 28 APPENDIX B-3 Finance Coordination Checklist ....................................................... 30 APPENDIX B-4 Administration Coordination Checklist ............................................ 32 APPENDIX B-5 IT and Telecom Coordination Checklist ........................................... 33 APPENDIX B-5.1 Sample Hardware .............................................................................. 33 APPENDIX B-5.2 Minimum Hardware Requirements................................................... 33 APPENDIX B-5.3 Hardware Recovery Order ................................................................ 33 APPENDIX B-5 TableTop Simulation Suggestions .................................................... 33 APPENDIX B-6 Human Resources Coordination Checklist ....................................... 37 APPENDIX B-7 Public Relations & Communications Coordination Checklist .......... 40 APPENDIX B-8 Program Coordination Checklist....................................................... 40 APPENDIX C List of Key Service Providers ............................................................ 41 APPENDIX D Vital Records ..................................................................................... 43 APPENDIX E Communications Information ............................................................ 45 APPENDIX F-1 Pre-Evacuation Checklist .................................................................. 50 APPENDIX F-2 Functional Area Checklist ............................................................. 51 APPENDIX F-3 Building Emergency Procedures .................................................... 52 APPENDIX F-4 Evacuation Community Resources .............................................. 54 APPENDIX F-5 Pre-Evacuation Report .................................................................. 55 APPENDIX G Mutual Aid Agreement ...................................................................... 56 APPENDIX H Emergency Personnel Policies .......................................................... 56 GLOSSARY ..................................................................................................................... 59

Page 2

Overview
Community foundations have proven themselves to be cornerstones of support to the community, especially in times of need and disaster. When emergencies or disasters strike, the Foundation must be well-prepared to quickly and effectively help itself in order to be able to help others. This plan outlines the organizations strategy for responding to emergency or disaster, provides information essential to continuity of critical business functions, and identifies the resources needed to: ensure safety of personnel communicate effectively with internal and external stakeholders provide timely emergency support and grant making service to the community protect assets and vital records (electronic data and hardcopy) maintain continuity of mission-critical services and support operations The first step in developing your plan is to define the goals of the plan. For example: 1. Protect life and health 2. Protect business assets 3. Protect organizational reputation Please note that no two emergencies are identical. Therefore, no single plan of action can anticipate and address every possible circumstance. The instructions contained in this plan are intended to serve as guidelines only. They may not be appropriate in all cases. At no time should you risk your personal safety in complying with any of its provisions.

Risks and Event Scenarios

Disasters are events that exceed the response capabilities of a community and/or the organizations that exist within it. Risks to be considered include those from natural hazards, neighbors, building environment, political or social unrest and risks connected to IT and data security. This Foundation is primarily at risk to disasters caused by: <Insert your Foundations risks here. See Appendix A for examples.>

These events may impact business operations of the Foundation on several Levels: 1 1-2 Day Business Disruption An emergency or disaster that exceeds the capabilities and capacities of a city and/or county government response but has a short duration such as a service outage, building outage, major fire, or site utility failure. May affect a large number of people for a short amount of time. All operations resume on-site in < 48 hrs. A crisis moderate to severe in scope. A foundation may have partial access to facility

1 - 2 Week Business Disruption

Page 3

and/or primary IT systems. Examples include service loss, building access loss or local utility failure. May also include a regional event such as terrorism, contagious diseases or weatherrelated disaster. Some business operations moved off-site. Small-scale work-fromhome/alternate site and remote access. All operations resume on-site in < 14 days. 3 > 2 Week Business Disruption A disaster including a complete loss of facility and/or primary IT systems. Regional utility failure. All critical business operations moved off-site. Large-scale work-from-home/alternate site and remote access. All operations resume on-site in < 30 days or a new site is required.

During a disaster or emergency, the Foundation must maintain normal operations required to address time-sensitive, disaster-specific issues. No plan can anticipate or include procedures to address all the human, operational and regulatory issues raised during a disaster or emergency. This plan addresses issues required for continuation of essential business functions, such as needs assessment, communication, volunteer outreach and coordination, grant making and community assistance under rapidly changing circumstances.

Plan Activation
The Foundation CEO, an appointee, or successor may activate this Plan when it is necessary to manage and coordinate a disaster response. The decision to activate will be made in consultation with members on the Incident Response Team.

Responsibility and Delegation of Authority

The individuals included in the list below will be responsible for the tasks listed. A checklist for each person is attached to this document in Appendix B-2 to B-8. To complete this chart, you should determine the person(s) best suited to handle various aspects of an emergency or disaster. As part of the list, you will need to review your banking authorizations signature cards, authorizations to raise and/or transfer cash, etc. <If the appropriate people on this list can not sign checks or transfer funds, your plan will not operate as intended.> If the first person listed in each role below is not available, then the second person and so on will take primary responsibility.

Page 4

Incident Response Team (IRT)

Name 1. 2. 3. 1. 2. 3 Administration Coordinator - Person who will plan for resources. Information Technology Coordinator See Appendix B-4 1. 2. 3 See Appendix B-5 1. 2. 3 1. 2. 3 Public Relations & Communications Coordinator 1. 2. 3. 1. 2. 3. See Appendix B-7 Title Responsibilities See Appendix B-2 Contact Information (See chart page 16)

Role in Disaster Incident Commander - Person who will lead. Finance Coordinator - Person who will secure resources.

See Appendix B-3

Human Resources Coordinator

See Appendix B-6

Programs/Grants Coordinator

See Appendix B-8

IMPORTANT: For the FIRST PERSON ON SCENE WHO IS IN CHARGE, no matter what role in disaster, see Appendix B-1 for Checklist. If a designated individual is unavailable, authority will pass to the next individual on the list. Unavailable is defined as: The designated person is incapable of carrying out the assigned duties by reason of death, disability, or distance from/response time to the facility. The designated person is unable to be contacted within an appropriate time period for the emergency or disaster. In a High Level disaster (see definitions on pages 8 and 9), this time period is defined one hour. If the person cannot be contacted within an hour, the second person should be contacted. In a Medium Level crisis, this time period is defined as four hours. In a Low Level emergency, this time period is defined as more than eight hours. The designated person has already been assigned to other emergency activities. <INSERT EMPLOYEE NAME> is required to update the succession list above as well as the contact information in the Personnel & Board Contact Information Chart (page 16) as changes occur.

Page 5

Incident Response Team Roles & Responsibilities

Board of Directors Be available for emergency meetings, conference calls, approvals, etc. CEO/Executive Director usually the Incident Commander IC Declare disaster to activate plan and command center. Manage the overall response. Establish appropriate staffing for the recovery and monitor effectiveness. Exercise overall responsibility for coordination between Emergency Operations Center (EOC) and Program Officers in the field. Act as The Foundations public face to the community. Move Foundation toward stated recovery objectives. Administration Ensure that the Foundations offices are returned to normal operations as quickly as possible. Assist in the development of an alternate site as necessary. Assist staff with any aspect of travel including transportation and lodging. Oversee the investigation of property and equipment damage claims arising out of the event. Notify insurers and third party administrators as needed. Coordinate paperwork required by insurers to initiate claims process. IT/Telecom Recover computer and telephone technology (hardware and software). Fund Development Advise existing and new donors about donations. Provide customer service to existing, potential, and new donors. Program Department Supervise the Foundation's community response. Review community communications. Approve grants and loans to nonprofits in the affected areas. Liaise with other foundations and appropriate city and county offices. Human Resources Is responsible for the human aspects of the disaster including post-event counseling and next-of-kin notification; answer questions related to compensation and benefits. Provide current roster of personnel. Provide emergency contact information for notification of next-of-kin. Track, record, and report all on-duty time for personnel working during the event. Ensure that personnel time records and other related information are prepared and submitted to payroll. Maintain a file of injuries and illnesses that includes results of investigations associated with the event. Oversee the investigation of injury claims arising out of the event. Finance/Grants Management Maintain daily cash funding of all essential business processes. Prepare and maintain a cumulative cost report for the event.

Page 6

Ensure easy access to necessary capital. Process and track emergency grants. Coordinate vendor contracts not included in the current approved vendor lists. Coordinate with IC on all matters involving the need to exceed established purchase order limits. Establish and manage disaster accounts. Notify insurers and third party administrators as needed. Collect and maintain documentation on all disaster information for reimbursement from private insurance carriers, FEMA, SBA, and other agencies. Coordinate all fiscal recovery with disaster assistance agencies. Public Relations Is responsible for developing the media messages regarding any event. Is responsible for all stakeholder communications including the Board, Foundation personnel, donors, grantees suppliers/vendors and the media. Serve as the primary media contact. Update and maintain Web site. Monitor media coverage and provide rumor control.

Page 7

Business Impact Analysis

Not all business activities can be continued following a disaster. The Foundation and its business groups must determine what is required for survival of the organization. Disaster Recovery is the phased restoration of mission-critical services, products and operations. A Business Impact Analysis is done to determine which tasks and functions are critical for the Foundation to stay in business. This is done by asking a series of questions to determine the value of the task or function, for example: If not performed at all, how much loss would the Foundation suffer? If not performed in a timely manner, how much financial loss would the Foundation suffer? Is the task/function required to meet: o Legal and/or contractual obligations? o Regulatory compliance obligations? How long can the Foundation go without performing this task/function? Are there single points of failure (one person departments, only one source of information, etc.)? This recovery is usually associated with specific timeframes and criticalities to the business. High Level Immediate restoration required. Maximum outage/downtime is between 1 and 5 days before the Foundation suffers severe legal, reputational or financial impact.

Medium Level Function can continue in default mode (e.g. Payroll) or not performed for 2-4 weeks. Immediate restoration not required. Failure to perform these will eventually impact performance of high level functions, but will not result in severe legal, reputational or financial impact. Low Level Function can continue in default mode (e.g. Payroll) or not performed for 31+ days. Function can be delayed until operating environment has been restored to normal.

In advance of a disaster or emergency the Foundation should list each mission-critical service and product it offers as well as its operational functions and assign it as a High, Medium or Low Category item based on the above criteria. The template below should then be used to list each of these items, where the functions will be performed and by whom. For example, a Level High function could be Grant Processing in that such a function is a mission critical activity of the Foundation. This caption could include several activities such as grant approval, check writing, check delivery. Each activity would include the location and person or area responsible for performing the work. The location would be contingent on the business recovery locations grid on page 18.

Page 8

High Level: Immediate restoration required.

Department / Function Activity

Maximum outage or downtime is 1 to 5 days.

Location

Performed by

Medium Level:
Department / Function

Function can be suspended for 2-4 weeks or will operate without personnel action or intervention for 2-4 weeks. 4

Activity

Location

Performed by

Low Level:
Department / Function

The following activities can be suspended for 31+ days without causing immediate or irreparable damage to the Foundation:

Activity

Location

Performed by

Page 9

Recovery Activity Summary & Needs Assessment

The following chart identifies the critical operating procedures for each department function. Enough information should be included in case the person who normally performs the work is not available and someone else has to fill in to perform the tasks. The checklist in this section is what will be used to perform those tasks. Following is a brief description of each of the data fields included in the worksheet: Functions These are the functions that are identified in the Business Impact Analysis. All critical functions identified in that step should have recovery times specified as 24 hrs, 48 hrs, 72 hrs, one week, two weeks or 31+ days. People These are the names of the employees who will perform these functions in the given time-frame. Note: It is assumed that once a team member reports following a business interruption, they continue from that time forward with the task i.e. only list them once. Total # Of For each successive time frame, include only people who were added in People that particular time frame. Do not include people listed in previous time frames, as noted in People explanation above. # Of Work List the total number of work spaces (desks, chairs, etc.) needed to Spaces support people added in this time frame. Assume that the area is the equivalent of a 6-foot table per person. If more than that is needed, it must be stated. # Of Phones List the total number of phones needed to support the people in this timeframe. List only those that are new . Phone means standard handset with dial tone and voice mail. List any special needs such as conference call, call-forwarding or call-waiting. List any phone numbers that must be routed to support the functions as noted in the BIA. These may include 800 numbers, calls routed routinely, calls routed randomly to a group of people, modem lines, fax lines, etc. Include transferring information and other critical information on how to manage phones after an event. Examples include main numbers, employee hotline, customer hotlines, and 800 #s. # Of Faxes List the total # of fax machines needed to support the people in this timeframe. List only those that are new . Also, can the fax be shared with another department or not? In some cases, faxes cannot be shared to maintain confidentiality. # Of Computers List the total # of computers needed to support the people in this time frame. List only those that are new . List the type of computer that is required and any special requirements. Note if employees will be using their portable laptops. # Of Printers List the total # of printers needed to support the people in this time frame. List only those that are new . Assume the printers are standard black and white printers with no special functions or fonts. Note any special printer needs under the special needs section. Also note if printers can be shared with another department. Additional This could include thumb or flash drives, zip drives, scanners, special hardware connectors, docking stations, etc. Computer List all applications needed to perform the functions in the given time Applications frame aside from MS Office and Email. Paper List all documents or forms that must be used to perform the functions in documents & the given timeframe. Only list the document/form once. If it is restored in forms the 3-5 day time frame, it does not need to be listed in later time frames.

Page 10

Mail/Shipping Needs

Vital Records Alternate Site

Staff Special Needs Critical Operating Procedures (COPs) Internal Contacts

List the needs for mail service to perform the functions in the given timeframes. If any service other than standard US Postal Service is required, include it here. This may include: overnight delivery, 2 or 3-day delivery, messenger service, interoffice mail, etc. Note specific carriers such as Fed-Ex or DHL, if required. List any paper or hardcopy vital records needed to perform these functions. See Vital Records on page 14 Management will determine strategy, with a work-from-home option as first choice. If the department will be working from home, note which days that strategy will be in effect and for how long. Also indicate if you need to work with other departments and if so where that will happen. Do any employees have special needs that will need to be accommodated? For example childcare, elderly parents, pet care, etc. What tasks must be done in order to complete the tasks noted? Imagine that you or other essential staff from your department are not available and someone else has to perform your tasks for you. This is the checklist that someone else can use to perform your functions. These are the departments you work with or are connected to in a Give and Get relationship. (This could be physical proximity or electronic linkages.) What departments should you be close to in order to do your work? This information is useful when determining where departments will be located and near whom. Include names and contact information including home phone numbers. (See Page 16 for Personnel & Board list.) Survey employees to determine if they have company issued equipment (cell phone, PDA, laptop, etc) and a permanent computer and a highspeed connection at home.

Employee Equipment

Page 11

Recovery Activity Summary and Needs Assessment

Activity
Department Functions Names of People Total # of People # of work spaces # of phones (include special phone requests # of faxes (can you share?) # of computers # of printers Additional hardware Computer applications other than Microsoft Office, Email

24 hours

72 hours

One Week

31+ days

Paper documents and forms Mail/shipping requirements

Page 12

Activity
Vital records Alternative locations Staff special needs Critical Operating Procedures

24 hours

72 hours

One Week

31+ days

Internal Contacts (Use Personnel & Board Contact Information on Page 16 and Business Recovery Locations on Page 18 for reference) Employee Equipment

NOTE:

Assess impact of disaster on recovery of internal operations, staffing, and services. Assess functions likely to be in high demand from communities, other non-profits, and the Public. Assess functions likely to be in low demand during disaster recovery. Identify community recovery needs and assistance required from Foundation.

Page 13

Vital Records
As a separate document each Foundation should maintain a document retention policy listing all vital business records and documents and a policy for the retention of those documents. Appendix D provides a list of items that should be considered vital records for the Foundation. Not all vital records would be needed to recover from an emergency or disaster. Those Vital Records crucial for the start-up and recovery for each Department are in the locations listed below. (Sample vital records to be considered are listed below)

Vital Record
Corporate insurance policies Current general ledger Grants database Donor database Donor paper files

Activity
Process insurance claims Process gifts and grants Process grant requests Process gifts/ communicate with donors Donor services

Location

Each of these records should be included in a functional area evacuation checklist in Appendix F-2.

Page 14

Disaster Notification/Communications
The Public Relations and Communications Coordinator will notify Foundation personnel of plan activation and event status using the following methods: Employee/board call/e-mail tree Phone forwarding Employee hotline (1-800 or local number) Conference call bridge (determine vendor) Web site as information center (document vendor and instructions/passwords) Media contacts (See Appendix C List of Key Service Providers) See Appendix E for telecommunications information. <Complete the attached list, keep it electronically and assign someone to be responsible for maintaining the list. If you decide to keep a hard copy, consider using a color so it will stand out.>

Page 15

Personnel & Board Contact Information

Ensure that contact information, including after-hours and emergency numbers, are up to date.

Business Resumption and Emergency Contact List

Name Home Address Title Work Phone Cell/Pager E-mail/ Alt. E-mail Home Phone Emergency Contact Emergency Phone

Page 16

Building Evacuation
Any decision to evacuate the building will be made by Foundation s management or Incident Commander. When the order to evacuate is given, follow the steps outlined in the Building Emergency Procedures Appendix F-3. <The evacuation checklist and specific checklists appropriate for your foundation should be included in employee handbooks and posted in appropriate staff areas in your offices.> Appendix F-1, the Pre Evacuation Checklist, includes some guidance if you have notice of evacuation such as a hurricane. EVACUATION CHECKLIST - GENERAL 1. Remain calm. 2. Immediately proceed to the nearest, safe exit. Assist visitors and colleagues whenever possible without jeopardizing personal safety. 3. Take personal belongings with you. Assume you have no more than one minute to safely collect your belongings. 4. If possible, shut down critical equipment/operations quickly and safely before exiting. 5. Proceed to the Foundations designated assembly area: <INSERT> 6. Once at the assembly area, check in with the Human Resources Coordinator. (See Incident Response Team list, page 5.) 7. Remain at the designated assembly area until instructions are received. 8. Dont interfere with emergency personnel. Within Foundation space, a backpack(s) will be wall mounted by <INSERT LOCATION>. <INSERT employee name> is responsible for keeping this kit current. The backpack includes the following materials: 1. 2. 3. 4. 5. Current Foundation staff and board contact list (See page 16.) Flashlight and back up batteries First aid kit Map of Foundation space <If applicable. If not, DELETE this item.> One of the backpacks should include a battery powered radio with backup batteries.

<Insert specific employee names and/or titles here. Based on the Incident Response Team members and their proximity to the backpacks.> will take the backpacks when exiting the building for use in the designated assembly area.

Emergency Operations Center

In the event of a disaster or emergency, the Incident Response Team will convene at a physical location known as the Emergency Operations Center (EOC). From this location the IRT will manage the recovery process. The primary EOC may be on-site. The alternate EOC should be located off-site. If neither is available, Incident Response Team members should call in to the conference bridge number shown below. Primary Location: <Insert name, physical address, location within the address if applicable and phone number if available.> Alternate Location:

Page 17

Conference Bridge:

Business Recovery Locations

In the event of a disaster, the following business functions may be performed off-site at the locations shown below.

Department / Function
Ex. Finance/Check Processing

Location
Director of ITs Home

Performed By
Finance staff

Page 18

Information Technology/Operations Preparedness

Preparation before the fact is the first step in successful disaster recovery. Advance planning is particularly important in making the IT recovery process easier, smoother, and faster. Data Backup Think through data backup issues and consider each one based on your Foundation's situation. For example, backup media can include tapes, external hard drives, etc. Perform nightly backups of your data; include: o FIMS, Foundation Power, Blackbaud or other primary database o Email o Network files o SharePoint o Shared documents Store Foundation files on a server or PC that is backed up nightly. Rotate your backups off site: Employees home or formal storage facility. Store all backups off site except what you will need for the next backup. If you do incremental or differential backups vs. full backups, make sure you understand the difference. Only let qualified people perform the restore. If you use tapes, how many tapes are in your tape rotation? If your server was destroyed today (weekday, weekend, month end, year end, etc) how much data would you have access to on your media? Determine how your recovery process would change if the disaster happened overnight, on a weekend, at 9 a.m. or at 4 p.m. Test your restore procedures. The number one failure during a disaster recovery process is the media. Set up a media test interval of no less than 6 months. Perform a recovery, either live or test, every 6 months. Perform a full test restore at least once a year. Make sure you have a drive available as backup that is compatible with your backup media. Finding a compatible drive during a crisis may be difficult for some kinds of media or, in some cases, impossible. Investigate web-based backup, which is available for some systems, such as SafetyNet for NPO clients.

Page 19

Software What software is being used by the Foundation? Do you have the application on CD and, if so, is a copy also stored off site? What software is critical to day-to-day operation of the Foundation? # of Licenses Inventory Microsoft Office Microsoft Windows Small Business Server Adobe Acrobat Adobe Creative Suite QuickBooks Google Earth Bank Access software FIMS/Blackbaud Hard drive clone software (Ghost) Version If appropriate Product Key if required

Location of CD

Notes

Store installation instructions off site, with written notes so that a non-technical person can install if necessary and appropriate. For software that is not commonly used, include instructions about special settings or replies required during the install process. Even a technical person needs to know proper replies and parameters in order to install the software correctly. Take notes during your recovery testing and keep them with the install instructions. Hardware During a disaster, it is critical to have easy access to a complete list of hardware used by the Foundation. If the hardware itself is destroyed, the list will allow you to replace what is needed without forgetting key components. The fields shown below are important in tracking hardware for a disaster as well as day-to-day IT work. You will notice fields like date acquired and purchase price. While this information may have no value in a disaster, it is essential to the normal hardware inventory process. Other fields are more pertinent to disaster recovery. You should add or delete fields based on your needs. Asset Class Asset Description Department Location Make Model Serial Number DateAcquired Purchase Price Comments Description CPU Memory Hard Drive Purchase/Lease Replacement Cost Replacement Cost Date Retired Y/N Retired Date

Page 20

Listed below are some of the types of hardware that you will need to track in the spreadsheet or database. Make an inventory list of the following: o Servers o Hubs o Routers o PCs o Cables o Backup tape drive o Modems o Fax machines o Phone system o Copiers o Printers o Scanners o Tools for PC and LAN setup o Surge protectors o UPS o Switches Determine the minimum equipment needed to function in a disaster. See suggested list in Appendix B-5.2. Make a list of the equipment to take if you needed to leave the building in 15 minutes. Make a list of the equipment to take if you had a day to prepare. Prioritize the list. Indicate the location of each piece of equipment, so that you know what equipment is in each office and what type of hardware you have overall. Make a list of all passwords. Give a copy to the IT coordinator and at least two other Foundation staff members on the IRT team. Include passwords for special software such as accounting, finance, bank applications, Web site access. Other Issues and Considerations Do you scan documents and store them on the LAN? This could be critical if all hard copy documents are lost in a fire. Do you have a reciprocal IT agreement with another foundation? What does it include? Determine IT recovery order. What will be brought up first servers, workstations, email, etc based on critical business processes identified on page 10? See Appendix B-5.3 for suggested order. Identify tasks that can be handled by non-technical people. This will allow IT staff to focus on the tasks that only they can complete. Assign responsibility for the nontechnical tasks as part of the planning process. Conduct a table-top IT recovery exercise. Keep it short and focused. Ask participants to make notes on other issues that may come up or can be covered in the next exercise. See suggestions listed in Appendix B-5.4.

Page 21

Emergency Grant Making Procedures

Ahead of any disaster, the Foundation needs to: Develop criteria to determine which organizations to work with following a disaster. Identify a list of key direct service organizations that could meet the immediate needs of vulnerable residents based on populations and regions served. Examples: Crisis centers, food banks, shelter programs, and neighborhood centers. Work with local organizations to gather suggestions and input into this list. Perform due diligence on organizations that are to be included on the list before a disaster occurs so that during a time of need grants can be made rapidly and responsibly. Share this list with other foundations to assure equitable distribution of resources during a time of emergency or disaster. Review this list annually for updates and to familiarize staff with organizations.

Immediately following a major disaster or regional catastrophe, the Foundation will begin accepting grant requests from this list of organizations. During a significant disaster, Foundation priorities will shift to address time-sensitive, disasterspecific issues, while maintaining normal operations as much as possible. Emerging issues will be evaluated quickly and will be placed ahead of routine operations. Grant making will focus on areas of greatest community need. As the disaster response continues, the Foundation will accept emergency grant requests from other organizations in the community. It is important to recognize that the long-term recovery phase for a major disaster can last for years, so the long-term needs of nonprofits should be considered in making grants.

Activating Emergency Grant Making Procedures Procedures would be invoked during a Level Two or Level Three community disaster at the discretion of the CEO or designee, based on the need to respond rapidly and the fact that communication and transportation issues may prevent the Board from meeting. The CEO or designee will have the ability to approve emergency grants up to $__,____ per grant without Board approval. Emergency Grantmaking Process 1. Process Immediately following the disaster event: a. b. Program staff should contact appropriate grantees on the emergency disaster grant making list. Foundation signature of appropriate program officer or any management team member is required for all emergency grants. Management team members have been included in case no program officers are available.

Page 22

Within first five days: a. b. Grantee must complete a simple emergency grant application for emergency grants. Staff has discretion to waive usual due diligence process and required paperwork for those organizations on the approved emergency grant making list. Grantee signs a simple emergency grant contract titled The Grant Agreement for Emergency Grants.

c.

2. How will the Foundation reach out into the community to determine need? a. b. c. d. Program staff will reach out to their contacts in the community. Web site will include emergency grant information and application procedures. Collaboration with emergency response and recovery organizations. Collaboration with other nonprofits and foundations.

3. Emergency check supply a. See Appendix F-2 for functional area checklist for blank check stock. b. All checks should have the appropriate number of signatures as required by the community foundation. During a time of emergency those able to sign a check should be expanded to include at least three additional signers.

4. Grant tracking a.

Emergency Grants will be tracked using a special identifier in the community foundations grant management system. If the system is not accessible, tracking will be done manually until the system becomes available.

Board Response As soon as possible, an emergency Board meeting will be held by conference call or in-person. The Board will assess the disaster and its effect on the community, the status of emergency grant making, and the need for additional funds and will determine appropriate next steps.

Page 23

APPENDIX A

Risk Assessment

Risk mitigation is the planning and allocation of resources to reduce financial, human and property loss. Once risks are identified and assessed, decisions need to be made on which risks to mitigate. The Foundation should keep in mind: Likelihood of risk Life safety and impact to life Convenience (would it be a pain to mitigate) versus Cost (would it be too expensive) Risks to consider include: Natural Hazards & Weather Related Risks Hurricane Tornado Flood Snow/ice storms/winter storms Lightning Mudslides Wind damage Solar Storms Neighbors within a one-mile radius Rail lines Freeways Airports Manufacturing plants Consulates/embassies/government buildings Controversial Companies Building Environment Community health: o SARS o TB o Influenza A, pandemic Asbestos Polychlorinated Biphenyls (PCBs) Indoor Air Quality (IAQ) o Toxic mold o Sick building syndrome Unrest Political unrest Social unrest Economic activism Eco-terrorism Terrorist attach Arson, bombing, sabotage Building Safety Systems Fire sprinklers, panels and alarms Emergency water/cisterns Public address systems Generators/UPS or diesel fuel

Page 24

Chemicals on-site Seismic bracing Hurricane or tornado roof support IT and Data Data Center physical security (including transit protection and backup procedures) Information security breach Network security o Foundation records and data o Personnel data o Financial transactions o Stolen laptops and flash drives o Password protection and change procedure

Page 25

APPENDIX B-1 First Person On Site Checklist

NOTE: This checklist is to be used by the first person that assumes initial control of the situation. That person is called the Incident Commander (IC) until the designated IC per the IRT arrives and is up to speed. .

Immediate Response Go to scene if appropriate and safe to do so. Initial Assessment Assess facts as known.

Continuing danger? Take action to protect anyone in danger. Assess situation and initiate further evacuation if necessary. Emergency Response Services (Police, Fire, Medical, Hazardous Materials, ATF, FBI) Has 9-1-1 been called? Have Floor Wardens been activated? Have they responded? Do they have any information to report on personnel or building status?

Communication Assess what has been done and what hasnt. Determine where help is needed.

Who needs to be notified? Has Senior Management been notified? Other key personnel? Have key business unit managers been notified? department phone trees? Have they activated their

Do I need assistance with communication? If so, who do I need help from and what do I need them to do o o o Develop messages and updates Deliver/coordinate delivery Deal with the press

Will the Emergency Hotline be activated for this incident? Has it been done? Who is handling the recording and updates? Has the Board been notified? If so, who has done the notification? Who will provide the updates?

Building and Systems Assessment Conduct the initial damage assessment (Facilities and Building Management).

What is the status of utilities (water, electricity, gas)? What is the status of the phone system? What is the status of the IT system? Is the building habitable now? Short-term outage? Longer-term outage? Do key vendors need to be contacted immediately (general contactor, other vendors)?

Page 26

Does the damage require a restoration vendor (water, fire, or smoke damage)?

Security / Facility Control Does the incident area need to be secured? Does the Foundation need to hire its own security? o o If so, how many security staff do we need? Where? If so, what entrances and exits need to be secured?

Escalation

Who can be put in place until additional security arrives? Can staff enter the area to begin clean-up or are authorities still in control of the area?

How could this situation escalate in severity? What preparation is needed in case it does escalate? Are any controls needed? Does the Foundation need any assistance from the Board, the City or other nonprofits? If so, who does it need help from and what help is needed?

Family / Employee Concerns

Do families of victims need to be notified? Who will do the notification? When and how will it be done? Is there a need for professional crisis intervention, group debriefings, etc? o If so, notify Employee Assistance Program (EAP) Provider. (Name Number )

Do Foundation personnel need any other support? Do their families? What are the main concerns of staff and employees? How are rumors being addressed and managed? Is the Emergency Hotline number updated at least every four hours?

Page 27

APPENDIX B-2

Incident Commander (IC) Checklist

Read completely through checklist before taking action

Declare disaster to activate plan and Hot Site. 1. Respond immediately and review situation. 2. Review the appropriate level of activation based on the situation as known. Determine the probable length of business interruption. See page 3. 3. Determine the Level of business impact, (i.e., High, Medium or Low Level) See page 8 4. Obtain the most current briefing from whatever sources are available. 5. Activate plan at the appropriate level. 6. Activate the computer Hot Site if necessary. 7. Activate emergency grant making if necessary. Manage the overall emergency response. 1. Ensure that the Emergency Operations Center (EOC) is properly set up and is ready for operations. 2. Hold action plan meeting within the first hour of activating: o Determine the initial objectives (to focus the EOC and the recovery effort). o Define the operational period (how long till the next briefing and review of the objectives). o Review staff levels to resolve any major shortfalls. o Establish strategic objectives. o Estimate duration of the incident. 3. Determine priorities for response, allocation of resources, and procurement. 4. Review the potential of this event to become a sustained operation (extending over 24+ hours)? If so, ramp up logistical support immediately; ensure sufficient staffing for the next 36+ hours (spread staff out). 5. Brief Board on status. 6. Ensure that activity logs are being kept that include who, what, where, when, and how (including costs) for all actions taken and/or requested. Establish appropriate staffing for the recovery and monitor effectiveness. 1. Mobilize appropriate personnel for the initial activation. 2. Assign all the recovery checklists to <someone>. First Person On-Site Who Is In Charge Checklist Incident Commander (IC) Checklist Finance Checklist Administration Checklist IT and Telecommunications Checklist Human Resources Checklist Public Relations & Communications Checklist Program Checklist 3. Pace yourself and monitor stress levels in the EOC and the team members. Exercise overall responsibility for coordination between Emergency Operations Center (EOC) and program managers in the field.

Page 28

Act as the Foundation public face to the community. 1. Review all external communications for accuracy.

Move Foundation toward stated recovery objectives.

After Action Report After the disaster, the IC or his/her designee will complete an after-action report. This internal document will help to strengthen the Foundations response in future events. The report includes: Description of the event Description of the Foundations response to the event Staff observations and comments External observations and comments Recommendations with timelines and assignments of responsibilities for tasks

After the report is completed, the emergency plan will be revised as necessary, and training will be conducted for all staff.

Page 29

APPENDIX B-3

Finance Coordination Checklist

Read completely through checklist before taking action

Maintain daily cash funding of all essential business processes. 1. Ensure adequate funds are available to meet operating and recovery needs. 2. Project additional cash needs in relation to expected claims reimbursements. Prepare and maintain cumulative income and expense report for the event. 1. For community events, coordinate with Incident Commander and communications department to construct public reports for use with external constituents and media. 2. For Foundation oriented disasters, develop financial reports that are easy to understand for use by staff and board members. 3. Prepare and maintain an expense report for the Incident Commander. Report should include cumulative analyses and total expenditure for the event. 4. Organize and prepare records for audit. Ensure easy access to necessary capital. 1. Monitor liquidity of assets based on projected expenses during the recovery. 2. Work with Finance and/or Investment committee to determine allocation of resources during recovery. Coordinate all new vendor contracts. 1. Verify cost data in the pre-established vendor contracts and/or agreements. 2. Prepare and sign contracts as needed. Obtain Incident Commander concurrence as necessary. 3. Ensure that all contracts identify the scope of work and specific site locations. 4. Negotiate rental rates not already established or purchase price with vendors. 5. Finalize all agreements and contracts as required. Coordinate with Incident Commander on all expenses exceeding pre-established limits. 1. Establish and maintain documentation of all purchasing activities. 2. Keep the Incident Commander informed of all significant issues involving the finance function. Establish and manage disaster funds and general ledger accounts. 1. Establish and maintain all necessary documentation for recovery process. 2. Track costs for use of equipment owned and leased. 3. Process and track emergency grants. Notify insurers and third party administrators as needed. 1. Prepare required documentation (insurance carriers and government agencies) as necessary to recover all allowable disaster response and recovery costs. 2. Provide information regarding insurance coverage as necessary. Oversee the investigation of injuries and property and equipment damage claims arising out of the event. 1. Track the total inventory of equipment, supplies and other items that have been lost, impacted or damaged. 2. Maintain a chronological log of property damage reported during the event. 3. Coordinate the investigation of all damage claims as soon as possible.

Page 30

Coordinate paperwork required by insurers to initiate claims process. 1. Coordinate the preparation of appropriate forms for damage claims and forward them to the insurers within the required time frame. Collect and maintain documentation on all disaster information for reimbursement from private insurance carriers, FEMA, SBA, and other agencies. Coordinate all fiscal recovery with disaster assistance agencies. 1. Act as the liaison between the Foundation and the disaster assistance agencies to coordinate the cost recovery process.

After the Event Ensure that insurers and third party administrators honor contracts and pay claims; update reports on insurance recoveries until claims are closed.

Page 31

APPENDIX B-4 Checklist

Administration Coordination

Read completely through checklist before taking action

Ensure the Foundations offices are returned to normal operations as quickly as possible. 1. Assess disaster site immediately. 2. Communicate with landlord (if renting) as soon as possible to determine status and access. 3. Identify key issues affecting facility. 4. Contact vendors for assessment and repairs as necessary. 5. Place and recovery/restoration vendors on notice. 6. Provide oversight and monitoring of response and operation activities. 7. Coordinate and manage restoration vendors to restore site. Assist in the development of an alternate site as necessary. 1. Order catering and other logistical support for the EOC as necessary. 2. Oversee vendors involved in response and recovery operations. 3. Arrange for delivery of mail, UPS and FedEx to active Foundation sites. 4. If a long-term outage is suspected, immediately assess damage to region regarding space issues. 5. Determine space and technology requirements. 6. Search for appropriate leased space as necessary. Assist staff with any aspect of travel including transportation and lodging. 1. If activated at Hot Site, ensure those working have what they need to conduct business. 2. Review needs for lodging and transportation with team at the EOC. 3. Review needs for lodging and transportation for team if activated as Hot Site. 4. Contact appropriate vendors to arrange for transportation (shuttle, buses, vans, cars, air, train, etc.) lodging, etc.

Page 32

APPENDIX B-5

IT & Telecom Coordination Checklist

Read completely through checklist before taking action

This checklist makes the assumption that a Hot Site or alternative site has been selected as the recovery solution. Recovery of the computer and telephone technology (hardware and software). Activation Phase: Task List Place <insert Hot Site / Technology Equipment Vendor> and <insert Vital Records Recovery / Backup Tape Vendor> on notice of a potential disaster declaration. Operational Phase: Task List Contact <insert Hot Site Vendor> to declare a disaster and reserve the space and equipment. If space is unavailable, have equipment shipped to alternate recovery location or enlist the mobile recovery unit. Contact <insert Vital Records Recovery/Backup Tape Vendor) and dispatch disaster recovery kit (includes backup media and specific systems recovery procedures) to the recovery location. Go to the recovery location. Set up workspace and stage equipment for recovery of systems. Set up Internet connectivity and obtain a static IP address. Contact Web Hosting vendor to change website/emails DNS settings to the new IP address. When disaster recovery kit arrives from <insert Vital Records Recovery Vendor>, begin recovery of the web server, email server, and Citrix server. Once web, email, and Citrix servers have been recovered, move on to missioncritical application (e.g., FoundationPower, Blackbaud, or FIMS). Enable mission-critical applications to be accessed via remote access over the Internet using Citrix. Recover data server. Begin recovery of secondary applications (e.g. ADP Payroll, Visio, MS Office) Enable applications to be accessed via Citrix. Recovery of desktops: Rebuild a desktop and use Ghost disk imaging to replicate the installation to other desktops. Setup shared, network printer. Setup additional phones for staff.

Page 33

APPENDIX B-5.1

Sample Hardware

Insert Excel spreadsheet here or provide link on line.

APPENDIX B-5.2

Minimum Hardware Requirements

Minimum Hardware Needed To Resume Foundation Business

2 Servers (1 in virtual environment) FIMS (file server as well?) Exchange (ISP to host?) Tape Drive Tape Drive Cables Tapes UPS Router/Firewall Ethernet Switch or Hub Size Switches High Speed Internet Modem (ISP provide) X PCs with Monitors/keyboards/mice X LAN Cables X Laptops X Surge Protectors X Extension cords KVM Switch Other Considerations: Sprint PCS Wireless Connection Card Battery backup will want if electrical power source is unstable Projector Wireless capability this can remove cabling issues Cat5/6 Jumpers (15) Monitor/Keyboard/Mouse 1 color copier/printer (color optional?) 1 HP printer 1 fax machine Phone System (CPU,stations,cabling) Voicemail System Tools screwdriver, pliers, flashlight Workstation images

Page 34

APPENDIX B-5.3

Hardware Recovery Order

Suggested order: 1. Phone and internet 2. Critical PCs 3. Servers physical setup and data recovery 4. Network 5. PCs the rest 6. Printers 7. FAX 8. Scanner 1. Phones: Contact phone company to move or forward numbers. Make a practice run to find out if you have the right contact information to make this process as fast as possible. Next, locate and/or acquire phones and physically position them. You may have to use cell phones on an interim basis. 2. Critical PCs: Several people may be involved writing checks or preparing press releases for external audiences or internal memos to staff and board. This may be done before any network is restored, and the documents stored on PC, website or written by hand for delivery by phone. If e-mail is not available, documents can be delivered in person to the media. 3. Servers: Once the critical PCs are available, work can begin on the server to recover data and databases from your latest backups. 4. Network: Consider using a wireless network to reduce or eliminate the need to physically reconnect all machines. This should be configured and tested as part of disaster preparation. Otherwise, set up your switches, routers and modem (COX, ATT, etc) and get prepared for internet connection when it becomes available. 5. PCs for the rest of staff: Connect these to the network as they are brought up. 6. Printers: Add as needed and available. Share printers where you can. Dont forget to have the driver CD for each printer. 7. FAX: Install as needed and time allows. 8. Scanner: Install as needed and time allows. NOTE: Divide the work among several people if possible in order to get the most done as quickly as possible. Non-technical staff can handle tasks such as reassigning phone numbers, contacting key people or organizations or performing clerical functions.

Page 35

APPENDIX B-5.4

Tabletop Simulation Suggestions

Definition (DR Journal): A method of exercising plans in which participants review and discuss the actions they would take without actually performing the actions. Representatives of a single team, or multiple teams, may participate in the exercise typically under the guidance of exercise facilitators. Gathering around a conference table to test a disaster plan is a proven way to find out how prepared your organization really is. But preparation is key to making this exercise successful. Before scheduling the meeting(s), determine the scope of the exercise and appoint a facilitator to keep things on track. The facilitator should not be a participant, even though they may have knowledge of the situation. Their job is to define the scope of the simulated disaster, the time allowed for the exercise and the appropriate level of detail for discussion. NOTE: Setting up a series of short meetings can help maintain focus and interest as well as prevent the discussion from degenerating into side issues. Also, after going through the process a couple of times, it is easier for all participants to stay on point. Keep in mind that you will not be able to cover every possible situation in a short period of time. Instead, start with getting a small number of key people together to determine which situations are most likely to affect your Foundation, e.g. earthquake on the west coast, hurricanes on east coast and Gulf regions, chemical spills near railroad tracks or highways. The next step is to bring together those who have the appropriate knowledge to discuss how the disaster will be handled. This group may vary, depending on the disaster scenario. Also consider disasters which may force you to abandon your work site for an extended period of time. What if your building has not been destroyed, but power, telephone or internet service is not available there for an extended period of time? Each organization must decide whether they prefer to group by incident, e.g. fire, tornado, earthquake, or by asset availability, e.g. total loss, partial loss, building not habitable, remote capability, or a combination. Grouping by asset availability may make sense and be more efficient in most cases, because the recovery action may be similar for various asset losses.

Page 36

APPENDIX B-6 Human Resources Coordination Checklist

Read completely through checklist before taking action
Account for personnel at the assembly area in the event of an evacuation and account for personnel after an after-hours disaster. Be responsible for the human aspects of the disaster including post -event counseling, next of kin notification; answer questions related to compensation, benefits and travel policy. 1. Determine what human issues need attention. 2. Determine whether the psychological needs of affected staff are being addressed. 3. Recommend other activities that may be needed (memorial services, etc.) to the Incident Commander. 4. Assist in creating updates to the Emergency Hotline. 5. Partner with communications in creating employee communications. 6. Determine what psychological support is necessary. 7. Coordinate Critical Incident Stress Debriefing (CISD) sessions as needed. 8. Provide immediate assessments before employees leave the location if needed. 9. Offer support to employees and significant others. 10. Keep the Incident Commander informed of significant issues affecting human resources and payroll. Provide current roster of personnel and emergency contact information for next of kin notification. 1. Ascertain what the immediate and on-going plans are to communicate with Foundation personnel and their families. 2. Provide emergency contact notification information to managers of affected employees. Track, record and report all on-duty time for personnel who are working during the event. 1. Establish and maintain documentation of all payroll activities. 2. Ensure records are accurate and complete. All EOC staff must be keeping time sheets (exempt or not) as their time may be reimbursable by insurance. 3. Provide instructions to all employees to ensure time sheets and travel expense claims are completed properly. Ensure that time records, travel expense claims, and other related information are prepared and submitted to payroll. Assess payroll cycle and implications of the date of incident. Maintain a file of injuries and illnesses associated with the event that includes results of investigations. 1. Notify state OSHA of any fatalities or serious injuries on the job. 2. Maintain a chronological log of injuries and illnesses reported during the event.

Page 37

3. Coordinate the investigation of all injury claims as soon as possible. 4. Coordinate the preparation of appropriate forms for all verifiable injury and damage claims, and forward them to insurers within reasonable time frames. 5. Answer insurance coverage questions as needed. Notify insurers and third party administrators as needed. 1. Place service providers on alert. 2. Notify workers compensation carrier of injuries.

After the Event Refer or make available counseling services for employees and their families. Provide necessary recovery time (time-off) for staff assisting with recovery efforts.

Page 38

APPENDIX B-7 Public Relations & Communications Coordination Checklist

Read completely through checklist before taking action
Be responsible for notifying personnel and pertinent stakeholders of plan activation. Methods of communicating may include: 1. Employee/board call/e-mail tree. 2. Phone forwarding. 3. Employee hotline (1-800 or local number.) 4. Conference call bridge. 5. Web site as information center. 6. Media contacts (See Appendix C.) Be responsible for developing the media messages regarding any event. 1. Prepare initial communication materials for all pertinent stakeholders and obtain approval from the Incident Commander to distribute. Be responsible for all stakeholder communications including the Board, employees, donors, grantees, suppliers/vendors, and media. 1. Prepare update for the employee emergency hotline. 2. Update web site. 3. Prepare all communications for stakeholders. 4. Develop talking points for executives. 5. Record and update messages on the Emergency Hotline. 6. Maintain website with current disaster updates. 7. Gather information on the emergency situation and response actions and maintain status boards and maps. Serve as the primary media contact. 1. Establish contacts with the media. 2. Monitor television and radio reports. 3. Release media only" telephone numbers and public number if appropriate. 4. Open media center if a number of reporters arrive in person. Maintain Media Center status boards and maps. Post hard copy of news releases. 5. Arrange media briefings/press conferences on a regular or "as needed" basis. 6. Receive and handle non-emergency media calls Provide rumor control. After the Event Record "non-emergency message on the employee hotline Gather all records kept during the emergency or disaster. Prepare a summary of events, actions taken, inquiries and responses. Collect media coverage (include TV videotapes as well as clippings)

Page 39

APPENDIX B-8

Program Coordination Checklist

Read completely through checklist before taking action

Supervise the Foundation community response. 1. Begin second-tier assessments of community needs. Work with identified nonprofits (intermediaries) to determine support levels. 2. Detail staff to key community outposts to monitor and assess ongoing needs. Feed that information to Development and Public Affairs. Review community communications. 1. Work with Development and Communications to inform donors and community about areas of critical needs based on key grantees reports. Approve grants and loans to nonprofits in the affected areas. 1. Check on Department staff. Work with CEO/Executive Director and key grantees on specific needs, and consult with program officers. 2. Have Finance and Grants Management begin working on moving grants to key grantees. 3. Process key grants. 4. Work with Finance and Grants Management to process grant payments to intermediaries. Liaison with other foundations and appropriate city and county offices. 1. Contact Program Departments to ascertain status and needs after disaster. Report back to CEO/Executive Director and appropriate relief agencies if individuals have special needs. 2. Feed information on needs to Development and Public Affairs obtained from nonprofits. 3. Collaborate with other area funders and/or recovery agencies (e.g., Red Cross, United Way, Salvation Army, NGOs, other foundations, City Offices o f Emergency Services, etc.)

Page 40

APPENDIX C

List of Key Service Providers

One method to help ensure this information is current is to create a code for your Disaster Recovery contacts on FIMS, Foundation Power or your primary database. Use this code to produce a report on a periodic basis. <Consider storing this information electronically.> Service Contact Phone Acct. # or EMail (Regular/Cell) other info Building Services Building Manager/Landlord Building Owner Building Security Janitorial Mechanical (A/C) Maintenance Emergency Repair / Cleanup Electricity Gas Water HazMat Spill/Cleanup Emergency Medical Ambulance Doctor Hospital Urgent Care HR Benefits Admin EAP Payroll Media Media Consultant Local Newspaper Local Television Local Radio Legal Legal Counsel Local Government Fire Police Public Works Business Chamber of Commerce Finance & Banking Accountant Bank Billing/Invoicing Insurance Agent Creditor Insurance Insurance Agent (Broker)

Page 41

Insurance (Claim Filing) Vendors Software Office Supplies Caterer Health Insurance Vendors Network tech/Consultant Alternate Tech Consultant Microsoft Support Microedge Support E-mail support AntiSpam &/or AntiVirus Web Site Hosting Planned Giving Design Center DNS Hosting Online Credit Card Processor E-mail Support Phone Co Phone System Copy Machines Printer Repair/Purchase New Hardware Coffee Mail Meter Truck Rental

IT/Ops

Page 42

APPENDIX D

Vital Records

Vital records are essential for a Foundation to conduct business. They contain information critical to the continued operation and survival of the organization immediately following a disaster. This information is necessary to recreate the organizations legal and financial status and to preserve the rights and obligations of stakeholders, including employees, donors, grantees and others being served. Records may be required to be in their original form to meet or fulfill evidential requirements. Here is a suggested list of some of the corporate, financial, and other vital records. Consider how these copies will be obtained (electronic scans, paper, microfilm) and where they will be stored (on line, off site). Corporate Records: o o o o o o Incorporation documents By-laws Tax-exemption documents (e.g. application for tax exemption, IRS Form 1023; IRS determination letter; and related documents) Board meeting documents including agendas, minutes, and related documents Conflict of Interest and Nondisclosure statements Correspondence with legal counsel and/or accountants not otherwise listed

Financial documents, including: o o o o o o o o Annual information returns going back seven years (e.g. IRS Form 990, 990-EZ, or 1065) Audit and management letters Audit work papers Equipment files and maintenance agreements Treasurers annual reports going back three years Bank statements, canceled checks, check registers, investment statements and related documents going back seven years Investment performance reports Investment manager contracts and correspondence

Donor and Fund Records o o o Fund files including fund agreements and fund statements Gift documentation Grant documentation

State charitable registration documents Lease Agreements Deeds, mortgages, notes, security agreements for real estate held for sale Personnel and payroll records including employment applications and employee manual

Page 43

Insurance forms with policy numbers Signed contracts with vendors Scholarship records (depending on type of organization) Commercial software licenses, including: o o o o Copies of installation CDs Product keys Serial numbers End User License Agreements

National Standards materials, if applicable (This may include many vital records as well as publications and other items the Foundation may not consider a vital record.)

Page 44

APPENDIX E

Communications Information

Communication via Foundation Emergency Hotline Consider setting up a telephone calling tree, a password-protected page on the Foundation website, an email alert or a call-in voice recording to communicate with personnel and or Board in an emergency or disaster. Designate an out-of-town phone number where employees can leave an "I'm Okay" message in a catastrophic disaster. The Emergency Hotline is available to provide Foundation personnel with facility status information and business continuity plans during an emergency or disaster. Text Message (SMS) Text messages can be sent to almost any wireless phone in the U.S. by addressing messages to the 10-digit wireless telephone number. The foundation should ensure each employee who has a cell phone, knows how to send and receive text messages. Numerous free SMS message sites can be located on the Web by doing a Google Search for send text message. Email The ability to contact others via email will depend on the availability of power and the operation of the servers. If a recipient has different Internet Service Provider email addresses, use all of them. Those located off site may have the best chance of reaching the team member in a regional emergency or disaster. Foundation Phone Tree A wallet card can provide Foundation personnel with instructions on how to get information in an emergency situation, what numbers to call in-area for information, and what numbers to call outof-area to report in and give an Im OK message. A Phone Tree should show who calls whom. Communication via Foundation Website In the event of a widespread phone failure, a message with disaster updates will be placed on the Foundation website. Messages should be updated frequently during the business week. Emergency Hotline How to Change the Message NOTE: The procedure outlined below may vary with the Foundation's phone system. Use this as a template only. Before you change the message: Listen to the existing message to be sure no one else has changed it. To change the message: Dial __________________________. password _______, then press #. When greeting begins press ____ and enter

Page 45

Press ___ to check messages Press ___ to hear more options Press ___ to change name and/or greeting When emergency messages are updated, always include the time and date of the update. For example: You have reached the __________ Foundation Emergency Hotline. This is the Monday, August 13, 4 p.m. update regarding the tornadoes.

After you record the initial message: Send a broadcast email to all staff reminding them to check the Emergency Hotline for future updates.

Updates Event in Progress The Emergency Hotline message should be updated at a minimum every four (4) hours during business day even if there is no new information to report. This will ensure the message stays current and provide callers with the assurance that the information they receive is up-to-date.

Once the situation is resolved, change recording to report the time and date it was resolved. Leave that message on for 24 hours.

Updates Event is Over Once the emergency or disaster is over, change the message to the non-emergency message. (See next section for sample messages.)

Sample Messages
Non-Emergency Message You have reached The ______________________ Foundation Emergency Hotline. There are no emergencies to report at this time. If there were an emergency, this hotline would provide you with information regarding the affected site. After any major event, please call this number for instructions. If you are unable to reach this number, follow your departments disaster plan. Thank you for calling The ____________ Foundation Emergency Hotline.

Sample Message after an Emergency You have reached The ______________________ Foundation Emergency Hotline. Today is (todays day, date and time). The Foundation office is closed due to a building emergency. [You may or may not want to state the nature of the emergency.] The building is expected to reopen at (note time and date).

Page 46

This message will be updated, as new information becomes available. Thank you for calling the ___________________ Emergency Hotline.

Call Forwarding the Main Foundation Phone Number NOTE: The procedure outlined below may vary with the Foundation's phone system. Use this as a template only. The main number has a (fill this space in with length of time the battery will last) UPS power supply. If power is not restored within that time frame, .. (Name) ... will call-forward the number to an alternate number. This will be the new main number. Voice mail Forwarding main phone number on-site: LIft receiver Press Dial ___________ # ___________ You will hear another dial tone If call is answered, call forwarding is working, if busy or no answer repeat steps Forwarding main phone number remotely: Dial Enter Enter PIN Enter Dial Cancel call forwarding: Lift receiver for dial tone Press ___________,# ___________, ___________, ___________, ___________, ___________, then dial prompts then press # key then press # key then press # key WILL WILL NOT transfer.

You will hear dial tone

Analog / Emergency Phone Locations Following an emergency or disaster, analog phones (direct dial phone lines) may work even if the Foundation phone switch has failed. An analog phone is located in the administration evacuation box. See Appendix F-1.

Nearby Pay Phones Pay phones are part of the national emergency phone system and always get dial tone first. The following pay phones are located near the Foundation offices.

Page 47

Location 1 2 3 4 5

Phone Number

Conference Call Bridge Instructions

<Insert your Foundations instructions here>

Page 48

APPENDIX F-1

Pre-Evacuation Checklist

This checklist covers some basic planning information to consider before any evacuation as well as information if an evacuation is imminent. Basic Planning Information 1. Make a video or take photographs of the building and its contents annually and store offsite. 2. Provide instructions for shutting off water and gas lines coming into Foundations offices . Assign an employee to take care of this procedure in the case of a known evacuation. 48 hours until evacuation 1. Go shopping One gallon of water per day and food for all essential employees and volunteers for at least three days. 2. Go shopping Other response supplies identified 3. Remind board, employees and volunteers of communication plan, check-in times/locations and method of communication 4. Have employees and board members complete evacuation contact information if different than normal contact information 5. Remind employees of disaster plan 6. Communicate with vendors, donors, grantees, etc. concerning information in plan 7. Gather vital records according to plan 8. Begin working on IT recovery portion of the plan 9. Start Incident Commander checklist 24 hours until evacuation 1. Gather evacuation boxes see IT section of plan as well as Evacuation Checklist by functional area 2. Record new voicemail message, as stated in Telecommunications Instructions. 3. If appropriate, raise electronics off the floor and away from windows 4. File all papers and lock cabinets 5. Withdraw petty cash 6. Pack up equipment to be evacuated 7. Lock all windows, close every interior door, post contact information in waterproof cover conspicuously (in case emergency crews need to contact you) and lock office as normal 2 hours until evacuation 1. Gather evacuation boxes see IT section of plan as well as Evacuation Checklist by functional area 2. Record new voicemail message. as stated in Telecommunications Instructions. 3. If appropriate, raise electronics off the floor and away from windows 4. File all papers and lock cabinets 5. Lock all windows, close every interior door, post contact information in waterproof cover conspicuously (in case emergency crews need to contact you) and lock office as normal.

Page 49

APPENDIX F-2

Functional Area Checklist

Administration In <Insert employee responsible>s workspace, an emergency office supply

box will be maintained. The box includes the following: 1. 2. 3. 4. 5. 6. 7. 8. 9. Stationery and envelopes One box of each One ream of paper Twenty file folders and five file pockets Three boxes of pens and pencils Two staplers with staples One roll of first class stamps One box of paperclips both sizes Sticky notes Specialized stationery acknowledgement, grant letters, etc.

<Insert employees name> will take the office supply box with them with exiting the building and will receive instructions from the incident commander at the designated assembly area.

Finance The following items should be readied during an evacuation, as time permits, by the
finance staff: <Each foundation should include who is responsible for each item, either by name or title.> 1. 2. 3. 4. 5. 6. 7. Unprocessed gifts and checks A box of check stock A box of deposit slips and stamp Payroll information and personnel files Insurance documentation Last months bank statements Policy and procedure manual

<There are many other items you might need to include in this list if you dont have the documents electronically. This plan assumes if the documents are electronic, they will be accessible in a reasonable time frame electronically. However, any document that is electronic but you feel you may need before computer service is available, should be included.>

Information Technology See Appendix B-5 for details.

Page 50

APPENDIX F-3
ACCIDENT/ILLNESS 1. 2. 3. 4. 5. 6.

Building Emergency Procedures

Call 911 Do not move the injured/ill person unless it is necessary to avoid further injury Use first aid kits located <INSERT> Have a designated individual meet the emergency personnel at reception Notify Human Resources Ensure management notifies the employees emergency contact

All employees should be familiar with the first-aid supply kits located <INSERT>. <If your foundation has other emergency equipment such as defibrillators, blankets, etc., list here.>

FIRE PROCEDURES 1. Do not panic 2. Call 911 3. Pull fire alarm 4. Take personal belongings with you. Assume you have no more than one minute to safely collect your belongings. 5. If possible, shut down critical equipment/operations quickly and safely before exiting 6. Do not shut off overhead lighting 7. Exit the building using the stairwells. DO NOT USE THE ELEVATORS. 8. Never open a door that may have a fire behind it. Feel the door with the back of your hand. If it is hot, DO NOT OPEN IT. 9. Follow the evacuation route posted in the building 10. Go to the designated meeting place at <INSERT> 11. Once at the assembly area, check in with the Human Resources Coordinator. 12. Never attempt to fight a fire unless it can easily be put out. Fire extinguishers are located <INSERT> If you hear an alarm, you should immediately assume you are at risk and prepare to leave. Do not, under any circumstances, use the phone system for any reason at this time. You may prevent the system from contacting 911. If there is smoke, it may be necessary to crawl. There is usually good air and visibility about 18 inches from the floor. Once in the stairwell, keep moving. Stay quiet to hear any instructions from arriving police and fire personnel. POWER FAILURE 1. Stay where you are and await further instructions 2. If instructed to evacuate, use stairwells Battery-powered emergency lights will automatically come on. Telephones may not operate but FAX lines should operate. ELEVATOR EMERGENCIES 1. Press emergency button 2. Wait for assistance

Page 51

SECURITY SYSTEM <Each foundation will need to complete based on their own systems access, alarms, video, etc. This should include panic button information, building security, after hours security and emergency telephone numbers> BOMB THREAT 1. 2. 3. 4. Record information concerning the call Keep the caller on the line long enough to obtain as much information as possible Attempt to get the caller to reveal specifics, i.e. location, detonation time, etc. Listen for noises that may provide clues as to the location of the caller, i.e. motors, music, street noises, etc. 5. Listen closely to determine gender, emotional state, accents, speech impediments, etc. 6. Call 911 7. Notify management SUSPICIOUS MAIL AND PACKAGES 1. 2. 3. 4. Do not open, shake or smell it Handle with care. Do not shake or bump. Contact management to help evaluate the situation and determine next steps If a parcel is open or threat identified, notify management and follow the precautions below.

For a bomb: 1. Evacuate immediately 2. Call 911 For radiological threats: 1. Limit exposure. Dont handle. 2. Evacuate the immediate area 3. Shield yourself from the object 4. Call 911 For biological or chemical threats: 1. Isolate package. Dont handle 2. Call 911 3. Wash hands with soap and warm water Possible signs of a suspicious package: Protruding wires Lopsided or uneven Rigid or bulky Strange odor Oily stains or discolorations Excessive tape or string Wrong title or addressed to title only Misspelled words or badly written No return address Excessive postage Possibly mailed from a foreign country

Page 52

EARTHQUAKE PROCEDURE 1. 2. 3. 4. 5. 6. 7. Evacuate the building using the posted evacuation routes Move away from the building Go to the designated meeting place Once at the assembly area, check in with the Human Resources Coordinate. Be aware of falling debris Do not re-enter the building unless given permission by city officials Remember that being outside does not guarantee your safety. Watch for flying glass, collapsing walls, falling trees, power lines and ground fissures.

TORNADO /SEVERE STORM PROCEDURES 1. 2. 3. 4. Exit your exterior office and close the door. If able, open window a small amount. Move away from exterior glass. Move to the lowest floor, interior of the building. Exit stairwells or windowless corridors are safest. 5. Once in a safe area, crouch or kneel down facing the wall. Lower your head and cover it was clasped hands. 6. Remain in the safe area until the immediate danger has passed. Do not attempt to evacuate the building unless you are instructed to do so. CHEMICAL HAZARDS 1. Turn off air conditioning systems. 2. Close all windows and doors. 3. Wait for instructions for emergency personnel. AREA EVACUATION PLAN 1. If an area evacuation plan is activated, do NOT meet at the designated area. Follow the instruction of emergency personnel. <INSERT information on your own communitys/area evacuation plan> <Attach floor plans of your building and/or office space to this appendix.>

Page 53

APPENDIX F-4

Evacuation Community Resources

Insert locations below based on the nearest to your offices or most likely to be used facilities that would be used in case of a disaster, both localized and regionally. Type Hospital Fire Station Police Station Mass care facility Supermarket/Convenience Store, etc. Name Phone # Address Contact Person

Ex. Andrew High School

Page 54

APPENDIX F-5

Pre-Evacuation Report

If the Foundation is preparing for an evacuation and time permits, each employee should complete the following report and provide a copy to both the Incident Commander and the Incident Response Team Coordinate for their department.

Pre-Evacuation Report
Updated on:_________ by:_________ Name Evacuation Destination: Address City Phone Cell Phone Bank Routing & Account Number(for payroll) Emergency Contact Name Phone Relationship Email State Email Text Msg? Zip: Role

Yes

No

Projects & Deadlines Please list all projects you are working on now and in the next month. Briefly describe important tasks, contacts (phone and email), financial obligations, goals, progress and deadlines for each. Attach additional pages if necessary. Project Deadline

Project

Deadline

Project

Deadline

Page 55

APPENDIX G

Mutual Aid Agreement

In consideration of the mutual commitments given herein, each of the Signatories to this Mutual Aid Agreement agrees to render aid to any of the other Signatories as follows: 1. Request for aid. The Requesting Signatory agrees to make its request in writing to the Aiding Signatory within a reasonable time after aid is needed and with reasonable specificity. The Requesting Signatory agrees to compensate the Aiding Signatory as specified in this Agreement and in other agreements that may be in effect between the Requesting and Aiding Signatories. 2. Discretionary rendering of aid. Rendering of aid is entirely at the discretion of the Aiding Signatory. The agreement to render aid is expressly not contingent upon a declaration of a major disaster or emergency by the federal government or upon receiving federal funds. 3. Invoice to the Requesting Signatory. Within 90 days of the return to the home work station of all labor and equipment of the Aiding Signatory, the Aiding Signatory shall submit to the Requesting Signatory an invoice of all charges related to the aid provided pursuant to this Agreement. The invoice shall contain only charges related to the aid provided pursuant to this Agreement. 4. Mutual Aid to the Requesting Signatory. When it is feasible and possible to do so, the Aiding Signatory will provide the following to the Requesting Signatory. a. b. c. d. e. A conference room Use of phones, fax and copy machines Use of computer printers If available computers and the use of an internet service provider The above will be provided for a minimum seven days to be negotiated at time of disaster.

5. Charges to the Requesting Signatory. Charges to the Requesting Signatory from the Aiding Signatory shall be as follows: a. Labor force. Charges for labor force shall be in accordance with the Aiding Signatory's standard practices. b. Phone. Phone charges accrued during the disaster by the Requesting Signatory. c. Office materials. Charges for office materials such as paper, pens and other standard office items used by the Requesting Signatory, shall be at the reasonable and customary rates for such materials in the Aiding Signatory's location. d. Meals, lodging and other related expenses. Charges for meals, lodging and other expenses related to the provision of aid pursuant to this Agreement shall be the reasonable and actual costs incurred by the Aiding Signatory e. Counterparts. The Signatories may execute this Mutual Aid Agreement in one or more counterparts, with each counterpart being deemed an original Agreement, but with all counterparts being considered one Agreement. 6. Execution. Each party hereto has read, agreed to and executed this Mutual Aid Agreement on the date indicated. Date ________________________ Entity _________________________________ By __________________________Title _________________________________

Page 56

APPENDIX H Emergency Personnel Policies

The board should approve policies for employees which, at a minimum, answer the following questions: 1. 2. 3. 4. 5. 6. May employees work flexible or reduced hours? How will employees be classified essential/non-essential? Will the foundation pay employees overtime during response? Are employees paid during evacuation/displacement? For how long? Should the foundation consider business interruption insurance? Once the foundation office is reopened, do evacuated employees get charged vacation/personal leave? How long do employees have to return to work before termination? Eligibility of employees for unemployment insurance? What are the options on coverage for the foundations benefit plans? Will the foundation continue to pay for evacuated employees who have not returned to work and for how long? Should the foundation consider developing a specialized leave policy for disasters or emergencies where the community if effected but not the operation of the foundation? What resources should the foundation consider for the support of the employees in an emergency or disaster?

7. 8. 9.

10.

11.

Page 57

GLOSSARY
Business Continuity Plan (BCP) A plan implemented after an event to recover critical business functions. Business Impact Analysis (BIA) An evaluation of the impact to the foundation if major business processes are lost or there is a prolonged interruption. Damage Assessment The process of evaluating the extent of damage to the physical site, site contents and computing and other mechanical equipment. Disaster A disaster is defined as a sudden calamitous emergency event bringing great damage, loss or destruction. Disasters may occur with little or no warning (earthquake, flash flood) or they may develop from one or more incidents (wildfire). Disaster Recovery The recovery of the technology of an organization that includes hardware, applications, data and telecommunications. Emergency An emergency is a condition of disaster or of extreme peril to the safety of persons and property. In this context, an emergency and an event could mean the same thing, although an emergency could have more than one event associated with it. Emergency Operations Center (EOC) This word has two meanings: the physical location for managing an event and the process/people that meet there to manage the event Incident Command System (ICS) Created by the fire service in California in the mid-70s. The structure of the EOC is modeled after the Incident Command System (ICS), used by all government bodies and first response providers such as police and fire. Using this structure expedites the communication with civil authorities, and provides a framework and system that enables EOC members to effectively execute their responsibilities. It has five functionsCommand, Operations, Logistics, Planning & Intelligence and Finance. Incident Commander (IC) The Incident Commander is the single person responsible for the site planning, response, and restoration of site services. The Incident Commander must also ensure that an up to date plan is in place, that training is ongoing, and that employees are aware of the program. The IC is also the primary contact with external public safety organizations. Major Business Processes Those processes, functions or activities whose loss or prolonged interruption would result in a major negative impact to the Foundation. These have been discovered in the Business Impact Analysis. Mutual Aid Mutual-aid agreements are the means for one organization to provide resources, facilities, services, and other required support to another organization during an incident. As the term implies, this is often a joint agreement where each organization agrees to provide the same services in return. Preparedness The state of being prepared. Often associated with activities related to personnel readiness, preparation of plans, resources inventorying, training and exercising. Recovery Taking all the actions necessary to restore the area to pre-event conditions or better if possible. Response The actions taken to address the direct effects of an event or disaster. This could include saving lives and property, care of casualties, containing and controlling the hazards.

Page 58

Vital Record A record that must be preserved and available for retrieval if needed. Record that contains information necessary to recreate an organizations legal and financial status and to preserve rights and obligations of stake-holders; including employees, donor and investors.

Page 59