Disaster recovery preparation is a huge buzz phrase in business today. Every day I go into businesses and talk about disaster recovery and ask what steps are taken to protect the business from a disaster. That is when the confusion starts; most companies are confusing disaster recovery with business continuity planning. Business continuity planning is the planning for a disaster; disaster recovery is the implementation of the business continuity plan.
As a business owner, you want to be prepared if a disaster, either man-made or natural, strikes your business. You do not want to be one of the 33 percent of businesses that never recovers from a disaster (FEMA 2005).
Why don’t businesses survive a disaster? They don’t survive due to:
- The overall lack of resources applied to the business continuity planning process
- The overall lack of knowledge and experience that is required for a comprehensive risk assessment
- The lack of time that companies are willing to spend in preparation, including testing the plan, from the CEO level down to the rank and file
According to a Small Business 2005 survey, 80 percent of companies don’t have sufficient plans in place to address network outages or complete systems failures that would affect the flow of data through their organizations. This is a large number when considering that 99 percent of businesses in the United States are small- or medium-sized businesses, and 90 percent of businesses use tape backup as their only means for protecting their data. This tells us that as business owners, we are not giving business continuity or disaster recovery a high enough priority in our overall business planning.
Take this quick survey to see if your business has the basics covered (questions provided by the Institute for Business and Home Safety):
1) Are you concerned about your business being interrupted by a man-made or natural disaster? Keep in mind that every part of the country has some form of natural disaster potential; the FBI 2006 report states that the biggest threats to a business' data are its employees.
2) Have you determined the parts or operating units that need to be operational as soon as possible following a disaster, and have you developed a plan on how to resume those operations?
3) Do you and your employees have a disaster response plan in place to help assure your safety and to take care of yourselves until help arrives?
4) Could you communicate with your employees if a disaster strikes during work hours or after work hours?
5) Can your building withstand the impact of a natural disaster, and are your contents and inventory sufficiently protected so they will not be damaged?
6) Are your vital records protected from harm that could be caused by a disaster?
7) Are you prepared to stay open if your suppliers cannot deliver, your markets are inaccessible or basic needs such as water, sewer, electricity and transportation are not available?
8) Do you have a plan to stay open if you cannot reach your place of business?
9) Have you worked with your community, public officials and other businesses to promote disaster preparedness and develop a plan for community preparedness?
10) Have you consulted with an insurance professional to determine if your insurance coverage is adequate to help you get back in business following a disaster?
How well did you score? If you answered yes to:
7-10 questions, you are well on your way
4- 6 questions, you have lots of work to do
1- 3 questions, you should get started immediately
I have used this survey for a couple of years now in different speaking engagements. On average, most companies score between three and five, and that is just an estimate on what you might or might not be doing to prepare for a disaster. However, if you scored below, seven you need to make business continuity and disaster planning part of your business plan.
Develop a Business Continuity Plan
One of the first things that must be determined when developing a business continuity plan is your business' tolerance for downtime. What is the acceptable level that is going to be tolerated by your clients, prospects, employees and company ownership? Is a week acceptable, seventy-two hours, twenty-four hours or no downtime at all? After this is determined, a technology and business plan can be developed to meet that requirement. Until that is determined, business continuity planning can be a difficult undertaking for any business. The closer we get to no downtime, the more impact it is going to have on your IT and operations budget and the more planning that must go into your business continuity disaster planning.
To get started with business continuity planning, you must first put together a team of people to drive the project. You want to keep the team small, based on the size of your organization. We have found that a team of ten to fifteen people is manageable and decisions can be made. You will want to include department heads (but not a lot of the “O’s” such as CEO, CFO or CIO) in order for the plan to be successful and for them to dedicate the time to plan and participate. Your CPA, attorney, and heads of human resources, insurance, payroll and IT, as well as any others that have an operational effect on your business, should also be included on your team. This team would be charged with determining the overall scope of your business continuity plan, developing a budget for the plan, submitting for approval to the management team, then leading the implementation and testing processes on an ongoing basis.
As the team moves through the process, what are some of the areas they should be identifying? First, regardless of how good a team you may have internally, you must ask yourself what kind of experience they have in the development of business continuity disaster recovery plans. This is a question that must be answered honestly or you will waste time and money. If the answer is little if none, then immediately hire a professional to help you with this process. You will save money and time in the long run. If the answer is “a lot,” then consider some of the following items:
- Creating online electronic backup or offsite storage of magnetic media
- Determining hardware availability—don’t make the assumption that you will be able to run to the store and purchase them. Partner with vendors outside your area for hardware replacement
- Managing and regular updating of the plan
- Testing the plan
- Making alternate work space available to your employees
- Determining where command and control is going to be located
- Outsourcing as much as possible to control costs
- Finding housing for displaced workers
- Establishing a phone system— what happens to your calls, where do they go?
Consider the Basic Needs
Now that you are starting to think about the plan, you must go back to the basic needs, human resources:
- How do you protect yourself and your employees?
- Where do they go during a disaster?
- Where do they go following the disaster?
Keep in mind, disaster recovery starts immediately following a disaster. Regarding physical resources:
- What is the physical impact on your building or premises?
- Who determines if it is safe to remain in your building?
- Who decides where you are going to relocate your business and how much space are you going to require?
- Who is going to make arrangements for phones, computers, desks and transportation?
Other items that must be accounted for include:
- Employees (including owner)
- Suppliers/vendors
- Key contacts and calling lists
- Documentation on critical business functions
- Recovery location or locations
- Vital business records
- Critical phone numbers
- Equipment/machinery/vehicles
- Office equipment
- Printers
- Faxes
- Disaster checklist
- Direct deposit of paychecks
- Child care
- Filing insurance claims
Ensure Accountability
The most important step to the development of a solid, productive plan is the accountability and endorsement of senior management. Senior management must be onboard with this process. They must be willing to endorse a budget and keep the process on the front burner. Some disasters give us warning, but most don’t, so we have to be prepared. Part of that accountability is going to be the management of upstream and downstream damage. Upstream losses occur when one of your suppliers is affected by the disaster and cannot deliver goods and services to your business. Downstream damage occurs when a key customer or the lives of the residents in your community are affected by the disaster. Not accounting for upstream or downstream damage is why a lot of business continuity or disaster planning fails.
Here is an example from the data world: 90 percent of businesses use tape backup as their only means of protecting data. Our experience in dealing with disasters show that not all magnetic media are created equal. Our disaster response teams routinely face the challenge of finding tape drives that will read a specific company’s tape backup. Using old technology is the No. 1 reason companies are putting themselves at a disadvantage. In addition, because of what is called drive creep, the more a tape drive is used, the more out of specification the drive becomes, which is not a problem as long as the tape is matched to the drive. However, once that drive fails or that server is no longer available due to a disaster, we have to find a drive that can match the magnetic tracking on the magnetic tape. When you have failed to plan for upstream damage, finding hardware to match your tapes can be a problem and virtually renders your tape backups useless. We now highly recommend to our clients that we move their backup to an electronic online backup so we know that their mission critical data is safe and secure.
Business continuity disaster recovery planning can be difficult, but it does not necessarily have to be expensive. If you have good partners who know and understand your business, then by leveraging their resources and knowledge, you can develop a plan that fits your business model and budget. You are taking a great risk if you do not plan at all or think you are covered just because you have it on tape. Our experience in working with minor and major disasters, both man-made and natural, provides me with the insight to see that any planning is better than no planning, but planning right can keep you in business after a disaster happens.
Construction Business Owner, January 2008
