Preparing For The Worst
As strange as it sounds, a sailboat torn from its moorings on the Chesapeake Bay nearly sank operations at a Maryland bank.
That was in October 2003, when the remnants of Hurricane Isabel clobbered the Bay. At the storm's peak, winds ripped the sailboat from its slip and drove it into a power station, sparking a fire that knocked out power to a nearby branch of BankAnnapolis, a community bank based in Annapolis, Md.
"But we were ready," recalls Mike Haske, the bank's vice president of technology. "We had a disaster plan in place, and we were prepared to deal with whatever Isabel threw at us."
Not all small businesses are as fortunate, however. Consider the devastation along the Gulf Coast brought on by the wave of hurricanes—particularly Katrina and Rita—in late summer, and you soon realize the impact a disaster can have on a business.
Even so, only 38 percent of small businesses in this country have any type of emergency preparedness plan, according to a study by the National Federation of Independent Businesses, a small-business advocacy group in Nashville, Tenn. The other 62 percent will have to weather disasters on the fly.
To prepare for a disaster, whether natural or man-made, a company must have a three-pronged strategy. The first part is the physical plan, which must include both a response and a recovery approach to ensure the welfare of the company's people and assets. Secondly, a business needs an economic plan that takes into account the long-term and day-to-day needs of maintaining the company in the wake of a disaster. And finally, there must be a dissemination plan to make sure the company's employees know the disaster strategy and are kept abreast of any changes.
Working without such a strategy is a bad gamble, says Kristen Noakes-Fry, disaster planning research director for the Gartner consulting company of Stamford, Conn. A ready-to-roll disaster recovery plan can make the difference between a manageable business interruption and financial catastrophe, Noakes-Fry says.
"It's something that everybody needs to have in place," she says. "A hurricane can hit a small business just as easily as a large business."
Averting a Crisis
Any disaster plan should detail how to respond in three areas: physical, economic and financial.
Odds Suggest a Plan Is Prudent
• 30% of U.S. small businesses have been closed 24 hours or longer at some time in the last three years because of a natural disaster.
• 21% have lost electric power at their main location for at least 24 hours within the last three years.
• 62% struck by a natural disaster say the chief challenge was the loss of sales and customers.
Source: National Federation of Independent Businesses
At a minimum, a company should plan for the immediate physical safety of its employees and business site, says Richard Breazzano, a counselor for the Orlando, Fla., chapter of the Score Association, a nonprofit organization in Washington, D.C., that provides small-business advice and training. Business owners, Breazzano says, need to ask themselves a series of questions: "Do we have a flashlight with batteries in it? A power generator? Some tarps?"
Depending on the type of business and its customers' service needs, a company also might want to consider purchasing a generator to provide temporary power to keep systems up and running before, during and after a disaster. If a company calculates the cost of lost business for set periods and considers its disaster risk factors (such as its location in a major hurricane zone, for example), then it can evaluate the investment value of a generator.
The physical-response plan needs to include procedures for regrouping the workforce. Employee coordination is important to business recovery, says Donna Childs, CEO of investment firm Childs Capital, whose New York headquarters was shuttered for weeks after the Sept. 11, 2001, terrorist attacks. Business owners need to assign duties to specific employees. "You need to note who has the data backups, the keys and the knowledge to get a business restarted," she says.
Businesses should also make sure that critical data is routinely backed up and stored in a safe location.
Although Stephan, Oringher, Richman and Theodora, a Los Angeles law firm, has never suffered a disaster worse than an occasional computer failure, IT director Chad Cooper is well prepared for whatever fate may throw at his company. The law firm has invested in technology to back up and safeguard its critical data, including uninterruptible power supplies and line filters to keep its systems running even if power fails or falters—as it did in September when a utility employee cut a power cable and caused a sweeping blackout across Los Angeles. Cooper also has installed software to secure and replicate data.
"We have a strong earthquake potential, as well as the risk of having a power outage at any time," Cooper says. "Also, being in a high-rise building, we're susceptible to things that happen above and below. If the water main breaks above you, it becomes your problem."
The physical recovery plan should include a current list of office furniture, business machines, and IT and telecommunications equipment. It's a good idea to designate someone in the company to update this list regularly. "These things change constantly, and if you don't have an official list somewhere of everything you have, you're going to have a problem," Gartner's Noakes-Fry says.
Navigating Rough Waters
An economic plan must emphasize how to keep a business afloat in the wake of a disaster. It should list and describe insurance coverage—including claims contact information—as well as various government agencies and utilities that can help the business. You'll need all this information for your systems and your IT service providers, too.
Some companies establish a rainy-day fund with enough cash to sustain the business—buy new IT gear and acquire temporary processing services through third-party IT vendors—for a month or so without revenue. Your business executives need to consider what resources are available for an emergency loan if you need to finance long-term operations or reconstruction, Noakes-Fry says. You'll want to talk to your banker about these possibilities in advance so that the policies and loans can take effect quickly, she adds.
The financial plan is the day-to-day counterpart to the broader economic plan. To support the financial response, a company should analyze the effect various types of short- and long-term shutdowns will have on its ability to remain open for business. With that information in hand, a company can identify steps to minimize the impact for distinct scenarios, Noakes-Fry says. As part of the analysis, Gartner recommends that a company develop a flowchart for all its processes, so that any manager can take over in a pinch. Maybe, for instance, a business can limit some of its IT services to support primary work and keep revenue coming in. A final suggestion: Include a list of contacts among customers and suppliers who can help the business restructure its production and delivery schedules.
Perhaps the most important aspect of a disaster recovery plan is its dissemination. A plan won't help if no one knows there is one or what it entails. Discuss the plan with employees and make sure everyone has a copy. And keep copies of the plan in several places to increase the chances that managers can get to it after a disaster.
Disaster is a subject no business owner or manager likes to think about. Yet inaction won't make a disaster less likely to happen and will, in all probability, heighten its impact.
BankAnnapolis' Haske likes to believe in the maxim that action can ward off danger: "If you plan for the worst, it never happens."
1. Make backup copies of all critical records, such as accounting and employee data, as well as customer lists, production formulas and inventory. Keep a backup copy of your computer's basic operating system, boot files and critical software. Store a copy of all vital information onsite and a second in a safe offsite location. Make it a critical part of your routine to regularly back up files.
2. Make pre-arrangements with computer vendors to quickly replace damaged vital hardware. Keep invoices, shipping lists and other documentation of your system configuration offsite so you can quickly order the correct replacement components. Take care of credit checks, purchase accounts and other vendor requirements in advance so that the vendor can ship replacements immediately.
3. Surge-protect all computer and phone equipment through power and phone lines. A power surge through a telephone line can destroy an entire computer through a connected modem. Invest in a surge protector that has a battery backup to assure that systems keep working through blackouts.
4. Maintain an up-to-date copy of phone numbers, computer and Internet login codes and passwords, employee phone numbers and other critical information in an accessible location. Develop an employee telephone tree to rapidly contact employees in an emergency.
Source: Small Business Administration
The Institute for Business & Home Safety in Tampa, Fla., offers a free kit on its Web site at www.ibhs.org that can help even the most novice owners make sure their companies are prepared to ride out a disaster.
The kit includes a series of information guides and forms that a company can use to inventory its business, assess its vulnerabilities and create a disaster response plan.
For instance, some basic pointers the institute offers that apply to getting a company's IT operations back up and running include:
- establishing arrangements with suppliers of IT goods and services in advance and maintaining them;
- setting up agreements with backup vendors in case a disaster incapacitates primary IT sources;
- ordering something occasionally so suppliers view a company as an active customer.
Having survived Hurricane Katrina, IT consultant Jeffrey Wagar has learned a few lessons
• Keep an extra server, preconfigured and backed up, to grab and take with you in an emergency.
• If possible, line up an Internet access provider in an alternate location so that you can get back online quickly.
• Line up skilled IT personnel who can help you reconfigure your systems at that alternate location.
• Outline a plan for how you'll communicate with your employees. Employees of Wagar's firm used their private e-mail accounts to send messages.
• Keep notebook PCs on hand that are preconfigured for a wide area network.
Louisiana law firm finds its disaster plan lacking in wake of Hurricane Katrina.
When Hurricane Katrina slammed into the Gulf Coast, thousands of small businesses were scattered to the winds.
"Most of my clients had a very simple disaster plan: Grab your main computer and depart," says Jeffrey Wagar, a consultant who manages systems for about 10 small businesses in the New Orleans area.
That's what his brother's law firm did. "When the government ordered the evacuation, we saved our critical documents on a hard drive and took it with us," says Chip Wagar, managing partner of Chopin, Wagar, Richard & Kutcher of Metairie, La.
The law firm had a contingency plan to regroup at another nearby location. "But this hurricane was on such a scale that that plan wasn't feasible," Jeffrey Wagar says.
Katrina's devastation made it impossible for the firm's employees to communicate with one another. "The communications side of things became the most frustrating part of all this," Chip Wagar says.
All landlines and cell towers were down, so any mobile phone with a 504 or 985 area code was useless. The firm's partners bought new cell phones with functioning area codes and started calling hotels and other locations where employees might have taken refuge, Chip Wagar says. It took a week for the firm to locate all 40 of its employees.
Although the firm had no backup plan for relocating, it did manage to find a place through a personal connection—the office manager's husband worked at a Baton Rouge telecommunications company that had extra space.
Meanwhile, Jeffrey Wagar bought a half-dozen notebook PCs, configured them with networking software and cellular cards, and set up a temporary wide-area network. That enabled at least some communication among people scattered across several states.
Bursting with Katrina refugees, Baton Rouge was running short on everything—especially things such as network and PC gear. "It's like one of those gold-rush towns from the Wild West," says Chip Wagar. It took 17 days for the firm to get Internet access at its new space in Baton Rouge. Although they each had a PC, they were crowded, sitting two to a desk with only one computer outlet to share.
Under normal circumstances, systems administrators would install a $35 switch so that several computers could hook up through the same connection. "But, guess what? Everyone else in Baton Rouge is looking for these switches," Jeffrey Wagar says. "There's been a big run on all the electronics stores for basic things like cables and switches."
This means the lawyers must take turns. "We have lawyers who make $1,000 a day, and only one of them can plug into that wall outlet at a time," he says.
There's also a tremendous shortage of technical help because so many businesses are trying to set up temporary shops around the area.
As if the personal suffering and property damage weren't enough, another effect of Katrina is the cost of businesses being down during and after the storm, Jeffrey Wagar says. "Customers will say, 'I'm going to use a bank or a bigger law firm because they'll be better prepared.'"
Be prepared; get answers to these questions from your IT manager:
- Does our disaster recovery plan include a strategy for quickly replacing damaged IT equipment?
- Are software and data backups, and copies of our disaster recovery plan, stored in a safe yet easily accessible place?
- Do we have backup power sources?
- Can we replicate our IT operations at a remote site?
- Do we back up our data often enough to avoid serious financial loss?
- How can we make our employees aware of their role in disaster recovery?