| Your business may be a thriving place | | | | Even if your company is located away from the |
| experiencing consistent growth. During these | | | | coastline and the potential for hurricanes, your |
| times of growing revenue and increasing profits, it | | | | locale could be vulnerable to a catastrophic event, |
| may seem like nothing could go wrong. Of course, | | | | particularly if you are located in a large |
| assuming such an attitude is naïve, as every | | | | metropolitan area that attracts a lot of tourists. |
| savvy businessman knows. Whether your | | | | Other geographic locales can be prone to specific |
| business is booming or going through an | | | | disasters. If you are located near a desert, your |
| adjustment period, it's highly recommended you | | | | area could be prone to choking dust storms, |
| strategize and create a business continuity plan. If | | | | rivers regularly flood and mountainous areas are |
| your business doesn't have a formal plan in place, | | | | prone to avalanches. Perhaps you live near an |
| it's time to create one. | | | | earthquake fault line. The disaster potential of |
| A BCP (Business Continuity Plan) provides a | | | | where you live is important so that you can plan |
| framework for ensuring business operations run | | | | accordingly for business continuity. |
| regardless of virtually any possible or unforeseen | | | | The types of disasters that create a business |
| event occurring in your absence. Within the plan, | | | | disruption are in the thousands. Disgruntled |
| critical business operations are identified that, | | | | employees seeking to sabotage the company |
| should there be a disruption, would have | | | | present a risk for business disruption. In particular, |
| devastating consequences on your business. A | | | | a disgruntled IT employee who has access to |
| priority is made to keep these business | | | | your most sensitive data and business-critical |
| components running and, should a disruption occur, | | | | operations could have a devastating effect with a |
| a BCP defines (in order of priority and chain of | | | | few clicks of the mouse. Other employees, |
| command) how to keep your business fully | | | | located in various departments of your company, |
| operational while minimizing downtime. | | | | may steal computer equipment. Besides the |
| Critical technology components consist of all | | | | monetary loss of the physical piece of equipment, |
| assets (including people) used to facilitate core | | | | if the hardware included sensitive files or a critical |
| business processes, as well as applications that | | | | backup files, the potential to disrupt business |
| support employee productivity and IT | | | | operations is magnified. |
| infrastructure that manages these critical | | | | Regardless of the event, communications failures |
| applications throughout your company. | | | | can create revenue losses. Typically, |
| The degrees of impact of core business | | | | communications lines are down when power lines |
| processes going down must also be considered in | | | | are down, but not always. How would |
| a well-developed BCP. Consider the far-reaching | | | | communications occur at your business if the |
| costs of an essential process going offline. For | | | | primary method of communications failed? |
| example, your firm may use an accounting | | | | Hardware crashes can also prove detrimental. |
| application that produces daily financial reports for | | | | Most often, these happen as hard-drive failures |
| clients. On one level, the only employees affected | | | | where data becomes inaccessible, but information |
| are those kept idle by not being able to use the | | | | technology always has a potential for failure. |
| application. However, should the network go down | | | | Locating the origins of what caused an actual |
| when company management is set to attend a | | | | failure can consume a lot of time. |
| board meeting, without essential financial reports, | | | | A catastrophic network failure can have a huge |
| the consequences become significant. | | | | impact on your business. Preparing for one is |
| Applications that enhance productivity have a | | | | essential to recover from such an event. Network |
| different impact on business operations. Customer | | | | tools must be in place, and used, to offset the |
| contacts may be kept in a certain database. How | | | | potential for unforeseen network failures. Viruses |
| are they kept without this database? If the | | | | penetrating your internal network can bring about |
| solution is pen and paper, the potential is high for | | | | hardware failures, bring down communications or |
| critical business contact information to be lost. In a | | | | potentially create a catastrophic failure of the |
| different perspective, if your business relies on | | | | network. |
| the Internet to establish business contacts around | | | | Of course, disasters don't have to be dramatic to |
| the world and the Web site crashes, the | | | | cause serious downtime for your company. |
| recovery effort becomes impossible because the | | | | Brownouts often occur during the summer |
| information was never retained in the first place. | | | | months when demand for power is at a |
| Be sure to keep vendor contact information | | | | maximum. Temporary power outages can also |
| backed up and accessible so vendors can be | | | | occur during traffic accidents involving a |
| contacted in the event of a disaster. Establish | | | | transformer. Without auxilary power, your critical |
| contacts that can assist you in the disaster | | | | IT processes are not functioning. It is essential to |
| recovery effort, including off-site backups of | | | | plan for these occasions should they occur; even |
| critical business files, fuel suppliers for on-site | | | | if you don't perceive it as likely. |
| power generation and proper insurance coverage | | | | Many companies don't understand the actual costs |
| information. | | | | involved with disrupted business operations until |
| Not only must a BCP be in place at your business, | | | | they become very real after the fact. To |
| employees must also understand the recovery | | | | understand how these costs add up, you must |
| process should the need arise. It is essential that | | | | consider costs both tangible and intangible. Tangible |
| your company document policies that address | | | | costs are the quantifiable ones directly associated |
| BCP objectives. Take the time to communicate | | | | with the downtime such as lost production, idle |
| BCP objectives during orientation and remind | | | | hourly employees, lost revenues and costs |
| employees of BCP objectives annually during | | | | associated with recovering data losses. |
| yearly employee performance reviews. As the | | | | To attach specifics to these costs, understand |
| BCP objectives change, it is critical to keep staff | | | | that the average hourly rate for a professional |
| informed. | | | | employee in the United States is approximately |
| Your BCP will contain RTOs (Recovery Time | | | | $42 USD per hour. Take that figure and multiply it |
| Objectives) that define the critical time period | | | | by the number of employees at your firm, and |
| during which business functions must be restored. | | | | you have one of the tangible costs of downtime. |
| Should critical business process remain offline past | | | | Keep in mind, this is but one cost, and it's per |
| this time window, you face disastrous | | | | hour, so the tab is running. |
| consequences at your company. This time | | | | Intangible costs are much more difficult to |
| window has progressively shrunk with the | | | | quantify and too often, these are the causes that |
| development of technology that enhances | | | | keep a business from ever opening its doors |
| business operations. | | | | again. These are the lost opportunities your |
| Employees should know in advance their | | | | business had because the doors were closed. Has |
| responsibilities in the wake of an unforeseen | | | | your business reputation been damaged? Have |
| event. Also, specific employees should be selected | | | | you lost customer loyalty? What are the costs |
| to communicate contingency plans should the | | | | associated with replacing your best employees? |
| need arise. The fact is your business is only | | | | With all the talk of gloom and doom, hopefully the |
| capable of the cumulative total of the work | | | | point has been made: Your business needs a BCP. |
| effort put in by staff and the technology that | | | | Your BCP should include steps that minimize |
| supports your business architecture. | | | | downtime. Here are five smart tips to help you |
| Before the advent of the Internet, businesses | | | | achieve that goal: |
| often defined RTO as a period of three days. | | | | " Define and document an emergency response |
| Now that the Internet is a primary means of | | | | policy. This includes the definition of the chain of |
| communication for many businesses, RTOs are | | | | command at your company and how |
| often defined in seconds and minutes. Define this | | | | communications are carried out. |
| figure by attaching a monetary value to the cost | | | | " Define and document a contingency plan for |
| of the critical business processes going offline and | | | | employee communications should the primary |
| what that loss would mean to your company. | | | | means become inaccessible. How would you keep |
| Keeping the need for BCP in mind, it is important | | | | critical communications flowing if your |
| for the reader to ask themselves these questions: | | | | communications network was destroyed? If |
| " If your office space was destroyed in a | | | | traditional communications are down, critical |
| disaster; do you have the proper steps in place to | | | | employee data such as contact information must |
| recover from this situation? | | | | be accessible should the need arise. |
| " Do you have a contingency plan in place to | | | | " Develop a plan to handle business inquiries in the |
| recover from a significant loss of employees due | | | | event of a disaster. A server virtualization |
| to a disaster or pandemic? | | | | strategy can provide essential backups offsite in |
| " What is your contingency plan and where can it | | | | the event your physical office has been |
| be found offline? | | | | destroyed. Provide updates on the company Web |
| " Do you have a clearly defined chain of | | | | site about what is happening locally. |
| command at your company and do you | | | | " Consider the dimensions of IT capacity at your |
| coordinate communications? | | | | business and develop redundancy in your critical |
| Business may be booming and the potential for | | | | systems. Maintaining off-site backups is essential |
| disaster may be minimal, but don't let that sense | | | | to keeping these mission-critical applications |
| of security keep you from developing a BCP. If | | | | functioning. Consider mirrored off-site data |
| you can't clearly answer the questions above, | | | | redundancy located off-site from your primary |
| then you don't have a plan in place that would | | | | business operations. |
| keep your business functioning following a disaster. | | | | " Regularly review the BCP, making changes and |
| Businesses throughout New York City were given | | | | updates when necessary. A BCP is dynamic and |
| a rude reminder of the need for a BCP following | | | | evolves with your business. Establish quarterly |
| the 9/11 disaster, as were businesses throughout | | | | business reviews of the BCP to keep it in line with |
| the Northeast following the devastating blackout | | | | technology enhancements at your firm. Be sure |
| that left one-seventh of the United States | | | | to train IT staff on the recovery process and |
| population without power on August 14, 2003. | | | | don't depend on a core group to carry out the |
| We were all reminded of the potential for a | | | | plan. Backup employees must also be trained on |
| catastrophic disaster when Hurricane Katrina hit | | | | the process should the primary employees |
| New Orleans in 2005. Total monetary losses have | | | | become unavailable. |
| soared well over $200 billion. Of this total, the | | | | Too often the lessons learned from the lack of a |
| greatest sum can be attributed to business | | | | BCP occur when a disaster strikes. However, |
| disruptions when facilities were damaged and | | | | these lessons have been well documented and |
| destroyed, and employees were displaced for an | | | | your business can learn from these examples to |
| extended period of time. The Katrina disaster | | | | prepare for such an occasion. The key is to not |
| provides the best example for Americans to | | | | allow your business to become a statistic on |
| understand the need for a business contingency | | | | disaster unprepared ness, but one that continued |
| plan. Could your business continue after such a | | | | its operations after a devastating catastrophe. |
| catastrophe? | | | | |