



Columbia University Year 2000 Approach and Guidance Executive Summary The University’s program to address the year 2000 problem in areas beyond the central computing offices began in 1997. Typically, this activity has involved school and departmental Year 2000 Coordinators, with some orientation from the University’s Year 2000 group, using materials included in the University’s Year 2000 Tool Kit. Many schools and departments have made substantial progress in addressing the year 2000 problem but there are also schools and departments that are off to a relatively late start. A recent review of the University’s year 2000 progress indicates the need for additional assistance and guidance, and the need for more effective ways to monitor our progress. Within this context, the University has initiated an expanded year 2000 support program, to provide: Additional direction and guidance for the tasks involved in future project phases Additional direction and guidance that will permit the accomplishment of essential tasks in the shortest possible time New support services available from the University’s year 2000 Project Office A standard approach to documenting progress toward compliance. For schools and departments that have been using the Tool Kit guidance, much of the new guidance is a direct extension of the Tool Kit advice. However, new guidance for testing and continuity plans goes beyond the Tool Kit advice and, in areas of high risk, may require considerable effort. At a high level, the University’s recommended year 2000 approach is as follows: Major functions are identified, and classified as to the degree of risk if the function can not be performed. This initial understanding of functions is used to determine the importance of the various components that support each function. Longer term, this understanding of functions is used to identify areas where continuity plans may be required. (Functions include educational, research, and administrative activities such as teaching, research projects, key administrative processes, and key support services; and components include technology subject to year 2000 failures such as software, computer hardware, networks, and devices with embedded microprocessors.) Components subject to year 2000 problems are identified and analyzed to determine if the component has year 2000 problems, or is apparently free of year 2000 problems. Components that have year 2000 problems are remediated and tested. (Remediation might include modifications to computer programs or upgrades to software packages and computer hardware.) Important components that are apparently free of 2000 problems are tested to prove that there are no problems. Continuity plans are developed for important functions. In the University’s approach, functions are classified as to the degree of risk, using the following risk classifications: University Risk - failure could impact the entire university High Local Risk - failure could impact an entire school or department Low Local Risk - all other less significant local risks. At the University, and at all organizations addressing the year 2000 problem, testing has become a major challenge. Comprehensive testing is very time consuming, and frequently requires special environments and special expertise. At the same time, the experience of hundreds of organizations is that without testing, some number of year 2000 problems will go undetected. Accordingly, the University’s approach requires testing of components that support functions with University or High Local Risks. Even with testing, there is still a degree of risk that a critical component may fail. Accordingly the University’s approach requires continuity plans for functions with University and High Local Risks. Continuity plans typically involve a workaround procedure that can sustain a function for a period of days or weeks, while a failed component is being repaired. The overall responsibility for achieving year 2000 readiness rests with the responsible PIs, Deans, Department Chairs, and Administrative Directors and Managers, and much of the work involved can only be performed by individuals within the various schools and departments. However, there are opportunities to reduce the time required to achieve year 2000 compliance. To achieve all possible efficiencies, the University’s has established a central Year 2000 Project Office that will provide the following services: Provide additional guidance, tools and techniques for tasks such as inventories, assessments, testing and continuity plans For components that are widely used throughout the University, perform assessments and offer advice for local testing Where appropriate, work one-on-one with Year 2000 Coordinators to complete inventories and assessments For designated high risk schools and departments, University-wide target dates for major year 2000 compliance milestones have been established as follows: January 29, 1999 - Functions identified and risk levels assigned February 26, 1999 - Component inventories completed March 15, 1999 - Component analysis completed March 31, 1999 - Remediation and testing projects planned and approved March 31, 1999 - Remediation and testing projects started May 14, 1999 - Continuity strategies determined & development projects planned. Ideally, earlier target dates would be advisable, and many schools and departments are proceeding with earlier dates. However, for schools and departments that are still in an early phase of their year 2000 program, the above dates should be achieved, and every effort should be made to complete work at earlier dates. Finally, you should know that the University’s year 2000 organization has recently been expanded to include an Executive Committee comprised of : John Masten (Executive Vice president for Finance and the University’s Year 2000 Executive Sponsor), Emily Lloyd (Executive Vice President for Administration), and Jonathan Cole (Provost & Dean of Faculties). Descriptions of the University’s approach and expanded guidance are included in a document titled "Columbia University Year 2000 Approach and Guidance", and include: Steps in the recommended approach Examples of University and High Local Risks Guidance on roles and responsibilities for inventories, analysis and testing Techniques that can reduce the time required for inventories, analysis and testing Recommendations for minimum documentation and status reporting.