Comprehensive Business Continuity Planning Guidelines

This detailed guide outlines the essential steps for creating effective business continuity plans, emphasizing the identification of key processes, risk analysis, design of treatments, plan execution, and regular testing. It also covers the specific requirements outlined in IATF 16949-2016 regarding contingency planning, including risk evaluation, preparation of supply continuity plans, periodic testing, review processes, documentation, and employee training. Cybersecurity considerations are integrated throughout the document to ensure resilience against cyber threats.

• Business Continuity
• Risk Management
• Contingency Planning
• IATF 16949
• Cybersecurity

odysseus Follow

Uploaded on Jul 17, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

Presentation Transcript

1. Business Continuity Planning External January 10, 2023

2. Business Continuity Planning Step One: Identify Key business processes (Identify) Establish key business processes Rank key business processes Determine activities that constitute each process Step Two: Analyze (Evaluate) Business Impact Analysis Analysis of operational and / or financial impacts Step Three: Design (Define) Continuity Treatments Identify and evaluate options Select alternate activities and resources Validations Step Four: Execute (Prepare) Implement continuity treatments Implement preparatory controls Prepare the Business Continuity Plan Stake Holder Communications Contingency Planning is part of Business Continuity Life Cycle Step Five: Measure (Test) Test the plan Maintain the plan 2

3. IATF 16949-2016 6.1.2.3 Contingency plans The organization shall: (a) Identify and evaluate internal and external risks to all manufacturing process and infrastructure equipment essential to maintain production output and to ensure that customer requirements are met; (b) Define contingency plans according to risk and impact to the customer; (c) Prepare contingency plans for continuity of supply in the event of any of the following: key equipment failures (also see section 8.5.6.1.1); interruption from externally provided products, processes and services; recurring natural disasters; fire; pandemics, utility interruptions; cyber attacks on information technology systems; labor shortage; or infrastructure disruptions; (d) Include. as a supplement to the contingency plans, a notification process to the customer and other interested parties for the extent and duration of any situation impacting customer operations; (e) Periodically test contingency plans for effectiveness (e.g., simulations, as appropriate); cybersecurity testing may include a simulation of a cyber-attack, regular monitoring for specific threats, identification of dependencies and prioritization of vulnerabilities. The testing is appropriate to the risk of associated customer disruption; Note: Cybersecurity testing may be managed internally by the organization or subcontracted as appropriate. 3

4. IATF 16949-2016 6.1.2.3 Contingency plans The organization shall:(Cont d) (f) Conduct contingency plan reviews (at a minimum annually) using a multidisciplinary team including top management, and update as required; (g) Document the contingency plans and retain documented information describing any revision(s), including the person(s) who authorized the change(s). (h) Include in contingency plans the development and implementation of appropriate employee training and awareness The contingency plans shall include provisions to validate that the manufactured product continues to meet customer specifications after the re-start of production following an emergency in which production was stopped and if the regular shutdown processes were not followed. Note: Cybersecurity planning is handled at a corporate level directly by the IS organization, who maintain and exercise their systems in compliance with normative requirements. While referenced herein, IS contingency planning is out of scope for this document. 4

5. Business Continuity Planning The following guidance has been used in development of the BCP program IATF16949, 6.1.2.3, Contingency plans ISO 22301,Societal security Business continuity management systems Requirements The SEMI Business Continuity Guideline for the Semiconductor Industry and its Supply Chain Leveraging local experience, expertise and standards Microchip Documentation SPI-50343, Corporate Guidance Business Continuity Key local documents All key documents on yearly reviews Key documents may have many underlying detail documents Key local documents will not be provided outside of Microchip These documents and the underlying documents may be reviewed on site as appropriate 5

6. Business Continuity Planning Established Business Continuity Steering Committee Sr Manager, ESG Sr Manager, Site Services and Risk Loss Sr. Manager, Quality Systems Director, Corporate Planning Sr. Manager of Corporate Supply Management BCP Program Management Implemented Corporate Contingency Plan Testing Yearly Table-Top Exercise Local sites perform regular simulation or live scenario testing Testing may include fire drills, shelter in place, other drills and may be performed in conjunction with local 1st responders or other cognizant organizations. Supply Chain Mapping 100% of CPN / MPC have been mapped using existing Product and Planning tools Customer specific mapping is available (see example last slide) 6

7. Business Continuity Planning Communications - Internal Microchip maintains a worldwide presence. We leverage this presence to obtain and evaluate real-time information. Microchip engages with NGOs and Public and Private resources on a daily basis to evaluate global conditions and provide enhanced reaction time in order to respond to potential incidents and events. Microchip Maintains an internal communication site devoted to Business Continuity where all relevant employees can ask questions, provide input and obtain current information concerning potential incidents and events. Communications - External Only an authorized Microchip spokesperson shall communicate outside of the facility or company 7

8. Site Documentation All Microchip Manufacturing sites have documented Business Continuity Plans Corporate HR and IS maintain their own systems and although there may be overlap, are internal to their organization. All sites prepare contingency plans based on local Risk and Key Hazards to include natural hazards (Geological, metrological, biological), Human-caused events and/or technological-caused events The following are site examples and not meant to be inclusive MTAI (SPI-91038-007) - Flooding, Typhoon, Power, Pandemic. MPHL (SPI- 91038-004) Flood, Typhoon, Volcanic Ash, Earthquake GRSH (SPI-50367) Flood, Volcanic Ash, Earthquake, Severe Weather MCSO (SPI-60197) Flood, Fire, Severe Weather 8

9. BCP Wafer Fab Microchip owns three wafer fabs (Fab 5) Colorado Springs, CO (Fab 2) Tempe, AZ (Fab 4) Gresham, OR Many technologies are dual sourced Microchip has identified all devices which are dual sourced and alternate sourced. Dual / Multiple Sourcing no interruption anticipated Microchip has the capability to engage Tier 1, technology and product qualified or capable, alternate Fab locations in the event of an incident. Predicted 26 40 weeks to full recovery based on a complete shutdown Gating factors include spinning mask sets, device / technology qualification and customer PCN acceptance 9

10. BCP Wafer Probe Microchip owns three internal wafer probe sites Chandler, AZ Laguna, Philippines Chacherngsao, Thailand Microchip has additional internal capable and qualified probe facilities not used for production with the capability to be upgraded in case of emergency Microchip has identified all devices which are dual sourced and alternate sourced. High running devices tend to be dual sourced Dual / Multiple Sourcing no interruption anticipated Microchip has the capability to engage Tier 1 alternate Probe locations in the event of an incident. Predicted 26 weeks to full recovery based on a complete shutdown Gating factors include equipment availability, device / technology qualification and customer PCN acceptance 10

11. BCP Assembly and Test Microchip owns two assembly houses MTHAI MMT MPHIL (Test) Microchip engages with multiple tier 1 assembly and test houses Microchip has identified all devices which are dual sourced and alternate sourced. High running devices tend to be dual sourced Dual / Multiple Sourcing no interruption anticipated Microchip has the capability to engage Tier 1 alternate Assembly / Test locations in the event of an incident. Multiple sites build the same package, but device is not qualified Impact 4 16 weeks recovery Gating factors include qualification and customer PCN acceptance 11

12. BCP Subcontractor Microchip Subcontractors and Foundries All subcontractors and foundries are tier 1 and have mature BCP programs in place Subcontractor program reviewed as part of quarterly business review Appropriate detail documents are available on-site for customer review 12

13. Supply Chain Mapping Example Wafer fab Wafer probe Assembly Final test Part number Prime GRSM8 GRSM8 MCSO MCSO TC11 TPME8 TPME8 TC06 TC11 TPME8 Back-up TMPE8 * * * * * * * * * TTR Prime MTAI MTAI MPHIL MPHIL MTAI MTAI MTAI MTAI MTAI MTAI Back-up CHAN CHAN MCSO ** MCSO ** CHAN ** CHAN CHAN CHAN ** CHAN CHAN TTR Prime MTAI MTAI ANAP ASSH MTAI MTAI MMT ASAC MTAI MTAI Back-up MMT MMT *** ASSH *** ANAP *** ASAC *** JCET MTAI *** MTAI ASAC *** MMT TTR Prime MTAI MTAI ASSH ASSH MTAI MTAI MTAI MTAI MTAI MTAI Back-up NSEB **** ANAP **** ANAP ANAP ASAC **** ANAP **** MMT **** ASAC *** ASAC **** ANAP **** TTR Dual Source 40 weeks 40 weeks 40 weeks 40 weeks 40 weeks 40 weeks 40 weeks 40 weeks 40 weeks 24LC02BT-I/OT 24LC512T-I/SN AT24C01C-SSHM-T AT24C128C-SSHM-T dsPIC33EP128MC206T-I/PTA3 MCP120T-270I/TT PIC12F615T-I/MS PIC24FJ256DA210T-I/PT PIC32MX795F512HT-80I/PT TC4427AEOA713 Dual Source Dual Source 26 weeks 26 weeks 26 weeks Dual Source Dual Source 26 weeks Dual Source Dual Source Dual Source 12 weeks 16 weeks 16 weeks 16 weeks Dual Source 12 weeks Dual Source 16 weeks Dual Source 16 weeks 16 weeks Dual Source Dual Source 16 weeks 16 weeks 12 weeks 16 weeks 16 weeks 16 weeks Microchip reserves the right to change non qualified back-up locations without notice TTR - Time to Recovery - 100% recovery based on total loss of primary facility * Technology / Product is not currently qualified at an alternate location although Microchip has the ability to engage with internal Fabs as well as multiple tier 1 foundries ** Site is capable, device is not qualified *** Site is qualified for package assembly, not qualified for this device **** Site is capable for package test, not qualified for this device Dual Source product may not identify Primary and Back up. Company Name Acronym Address SPECIAL ECONOMIC ZONE. NSC compound, KM. 22 East service road, South expressway, Cupang, Muntinlupa city, Philippines 1771 Country GPS 14 26 19.25 N 121 2 48.2 E 22 47 23.51 N 113 48 27.46 E 31 11 55.42 N 121 31 40.85 E 33 18 15.81 N 111 52 55.8 W 45 31 17.39 N 122 26 45.59 W 31 50 17.1 N 120 20 11.76 E 38 47 20.32 N 104 48 22.3 W 13 43 4.31 N 101 2 34.42 E 13 47' 1807"N 100 57' 9.71"E 14 12 52.64 N 121 05 24.93 E Amkor Philippines ANAP Philippines Interion of Zhen An Hi-Tech Industrial Park, Zhen An Road, Chang An Town, Dongguan City, Guangtong Province, 523850 People s Republic of China UTAC Dongguan Limited ASAC China No 669 Guoshoujing Rd., Zhangjiang Hi-Tech Park,Pudong New Area,Shanghai 201203,P.R China ASE Shanghai ASSH China Microchip Chandler 2355 W Chandler Blvd, Chandler, AZ 85224 CHAND United States Microchip Gresham 21015 SE Stark St, Gresham, OR 97030 GRSM8 United States Jiangsu Changjiang Electronics Technology Co.,Ltd #25 door, No.78 Changshan Rd. Jiangyin Jiangsu, China JCET China Microchip Colorado 1150 E. Cheyenne Mountain Blvd.Colorado Springs, CO 80906 USA MCSO United States Microchip Thailand Wang Takhian, Mueang Chachoengsao District, Chachoengsao 24000, Thailand MTAI Thailand 17/2 Moo 18, Suwintawong Road, Saladeang, Bangnumpriew, Chacherngsao 24000 Thailand Microchip Thailand MMT Thailand 102 Accuracy Drive corner Excellence Ave.,Carmelray Industrial Park I , Canlubang , Calamba City, Laguna 4028 , Philippines 78/1 Moo5, WELLGROW INDUSTRIAL ESTATE BANGSAMAK, BANGPAKONG, CHACHOENGSAO, 24180 THAILAND Microchip Philippines MPHIL Philippines 13 32 56.74 N 100 36 56.8 E 33 24 54.88 N 111 58 17.35 W 45 37 10.41 N 122 27 18.94 W UTAC Thailand Limited NSEB Thailand Microchip Tempe 1200 S 52nd St, Tempe, AZ 85281 TMPE8 United States Taiwan Semiconductor Manufacturing Corp. (Fab 11) 5509 NW Parker St. Camas, WA 98607 TC11 United States 13