Newsletter Archive - Dollars & Sense
Disaster Planning - Are you ready??
09/22/2005 - If the recent results of Hurricane Katrina helped show us anything, when a major disaster strikes a community, beyond the obvious personal impact it will also often change the area forever leaving small business owners with few choices but to walk away from the business being grateful at least human life was preserved. And now another major hurricane is bearing down on Texas threatening even more damage.
The U.S. Department of Labor estimates over 40% of businesses never reopen following a disaster. Of the remaining companies, at least 25% will close within 2 years. If most small business is ill equipped for disaster recovery following a major catastrophe, how prepared is your company for such a disaster? All the evidence suggests -- probably not.
A new survey (pre-Katrina) by AT&T and the International Association of Emergency Managers (IAEM) shows that U.S. businesses are sadly unprepared for disasters like those experienced in New Orleans and the Gulf areas in the past weeks. Key findings from the study include:
- Almost two-thirds of companies that suffered a disaster experienced lost business.
- 16% lost between $100,000 and $500,000 per day
- 26% percent admit they don't know how much it cost their company per day.
- Fewer than half of the companies that have had business interrupted by a disaster have updated their business continuity plans in the past six months.
- More than 40% of companies have not established redundant servers or backup sites for their critical business functions.
This is backed up by a somewhat less scientific, but equally sobering survey from the Small Business Pipeline. Although 24% of respondents said that they'd be fully covered in case of a disaster the magnitude of Katrina, 26% said they would only be partially able to cope. A full 50% said their business would be ruined. This is slightly higher than the U.S. Department of Labor results shown above.
Are you ready??
No matter whether you are at the corporate offices or out at some remote sales office, don't get caught without a disaster recovery and continuity plan.
If you want to see what some of the experts are suggesting this link provides 9 factors being recommended to small businesses as they consider what direction to take their small business following a natural or man-made disaster: "Disaster Recovery Decision Making for Small Business"
In all fairness, disaster recovery is a broad topic covering IT, data, buildings, people, customers, financial, etc. Here we've gleaned five general steps to developing a disaster recovery plan:
1) Determine the impact of being out of business for X amount of time.
In the middle of a major book campaigns, the answer to this question can be expressed in monetary terms: "We would lose $xx,000 in sales/potential revenue in a day if our sales effort was stopped." But you should also consider customers who won't be served, print windows that may slip, customers already served that have now gone out of business, employees that are still hoping (expecting) to get paid, etc. etc. etc.
The purpose of this step is two fold. First, it provides you with a benchmark against which you can assess the costs of varying levels of redundancy and backup (in some ways-not all-more protection means more money). Second, it will help position each part of the business within the context of the organization's priorities (e.g., which function must get restored first).
2) Identify potential threats.
A disaster recovery plan, like an insurance policy, is most effective if all the risks and threats are realistically identified. While hurricanes and earthquakes do happen, most threats do not arrive in dramatic, news-making fashion. You will need to prepare for water damage (from broken pipes, backed up drains, failed condensation pumps, roof leaks, ground or flood water, discharging fire sprinklers or the fireman's hose), fire and smoke damage, component and network failures, cable cuts, power losses from blackouts and brownouts, sabotage and lightning strikes. Given the integrated information world most mid to larger size company's operate in, you will also need to identify how your systems will behave if a key component goes down-e.g., what happens to calls when/if a major telecom link fails at a remote site?
3) Take Preventative Measures.
As you identify potential threats and areas of vulnerability, preventative countermeasures will emerge. Hardware and networks are protected primarily through redundancy and diversity in equipment and services. Specific steps usually include subscribing to services from multiple carriers, deploying fire detection and suppression equipment, working with suppliers to identify critical system components you should keep on site, equipping your system for power backup and ensuring you have good wiring and adequate power line protection against lightning strikes and voltage surges.
Regular record keeping and off-site backup is critical to prevention. Key information and database files should be regularly backed up and stored both onsite and offsite.
Let's not forget about your most valuable resource - your employees. Home and mobile contact numbers for key people should be collected. Do you have a plan if you need to totally relocate the whole operation (yep, moving the whole shebang to an alternative site)?.
4) Develop an Escalation Plan.
An effective escalation plan outlines appropriate responses to each potential disaster and specifies the thresholds at which they should be deployed. It should address the following:
- What constitutes a disaster?
- Who in the organization declares a disaster and puts the disaster recovery plan into motion? How can they be reached?
- How will key people inside and outside the organization be notified of a disaster, and what roles will they fill in the recovery effort?
- What's the appropriate escalation plan for the disaster, given its type and magnitude?
5) Practice and Update the Plan.
Your carefully constructed plan will be of no value if it sits on the shelf during a disaster. Reviewing and practicing recovery plans may be reminiscent of school days, but these drills are worth a lot more than nostalgia. Many disasters happen quickly and without warning. People have to know what to do!
These are just some general thoughts. We'd like to hear what your company is doing in this area. Drop us a note at ken@yptalk.com.