|
Experts are predicting that the 2005 Atlantic hurricane season will be an active one. The U.S. National Hurricane Center predicts that 13 named storms, including seven hurricanes, will affect the U.S. Atlantic and Gulf Coast areas this year. The Colorado State University Tropical Meteorology Project (http://hurricane.atmos.colostate.edu/Forecasts/2005/) estimates there will be 15 named storms in the area, of which eight will become hurricanes, and at least four will rise to the level of Category 3 or higher on the Saffir-Simpson scale of hurricane strength. While the predictions vary, what is certain is that hurricane activity has increased over the last decade after a relatively quiet period between the 1970s and the mid-1990s, and experts predict that this high activity level will continue for another decade or more. That quiet period, along with increasing populations in coastal areas, has resulted in a less-experienced population that experts fear could tend to underestimate the impact of these events despite improvements in forecasting and warning procedures. In the end, personal and business survival will depend on awareness, preparation, personal responsibility and a bit of luck. Our recommendations to businesses are as follows:
- Initiate standard business continuity management (BCM) practices.
- Conduct pre-event planning whenever possible.
- Manage post-event BCM procedures with a focus on people.
The 2004 hurricane season ravaged the state of Florida. The sheer number and force of the storms left government agencies and businesses in a never-before-seen state of ongoing emergency. The lessons learned from this experience reinforce many of the recommendations Gartner has made over the years concerning the issues of disaster recovery and disaster avoidance. In this note, the first in a two-part series, we provide advice in four strategic areas: disaster avoidance, standard BCM procedures, pre-event BCM procedures and post-event BCM procedures. Tactical advice about community support, personnel, business recovery, and power and technology are outlined in the second note (see "Tactical Disaster Recovery Advice: Prepare for 2005 Hurricane Season Using Lessons Learned in 2004"). The criticality of implementing standard BCM procedures well in advance of a disaster is highlighted when an event such as a hurricane, earthquake or terrorist attack occurs. This is why Gartner refers to the process as "business continuity management" rather than "business continuity planning." The word “planning” implies that this is something that can be handled as a project: done once and then forgotten until the need for it arises again. In fact, in the year following the Sept. 11 attacks, we began to see that many organizations were taking the project-based approach to business continuity. But business continuity is not a project. It is a program. And it must be managed on an ongoing basis to ensure that a full program management cycle is conducted around how your business will continue in the event of a catastrophic event. Standard BCM procedures that were identified as being critical from the interviews Gartner conducted with Florida-based businesses and government agencies include the following:
- Coordination — Advance preparation ensures that public and private organizations have business continuity and disaster recovery response plans that are in sync with the rest of their facility, utilities, suppliers and key customers, as well as with county and statewide emergency operations. This coordination, in the form of tests (tabletop through simulation), is necessary to recover business operations expeditiously.
- Emergency notification — Everyone in the organization should be trained on emergency notification procedures. These procedures include not only who to notify in case of an emergency, but where to go to seek information in case of an emergency. Every employee should also know how to direct customers, trading partners, suppliers, the press and other community members on how to get needed information or assistance.
- Centralized command center and emergency operations center — Centralizing these operations allows for better organization and coordination throughout the facility in the event of an emergency.
- Emergency management software — For larger disasters, organizations should have emergency management software in place to help coordinate recovery efforts (for further information, see "Automated Emergency Notification Will Speed Disaster Recovery").
- Testing — Regular testing of recovery plans is imperative to ensure the smoothest possible recovery. It is also an opportunity to train new employees and refresh the training of other staff.
- Media relations — Maintaining a good relationship with local media makes good business sense on a day-to-day basis, but it becomes critical when disaster strikes. Companies can be severely impacted by the tone the media takes in reporting on an event, and the organization’s position in the community can be either enhanced or damaged, depending on the slant. If there is a negative impression of your organization in the community today, begin working to repair it now so that you are shown in the best possible light should a disaster strike.
- Technology and service provider resources — Organizations should take the time to understand the ability of their technology and service providers to restore their own functionality after an event, so that they can understand how long it will take to recover their own business processes. It doesn’t matter how fast your organization gets itself up and running if you haven’t coordinated with the rest of your supply chain and they are still inoperable.
- Personnel training — A point that many organizations don't think about is that, during disasters, the first thing employees do is protect their homes and families (or evacuate). Therefore, actual recovery times may be greater than anticipated. This is in direct contradiction to what many organizations assume: that employees will be around to restart the business immediately. Therefore, recovery teams must be formed with primary, secondary and tertiary members, and all recovery team members must be trained in advance to handle their personal recovery needs (see "Tactical Disaster Recovery Advice: Prepare for 2005 Hurricane Season Using Lessons Learned in 2004").
This is not an exhaustive list of standard BCM practices. Consult standard BCM practices from resources such as Disaster Recovery Institute International, PAS56 (in the U.K.) and the National Institute of Standards and Technology's guidelines on continuity of operations. With certain kinds of disasters (such as hurricanes), organizations have advance warning that the event is going to occur. In these instances, pre-event organization and planning can greatly improve the disaster recovery scenario. The best advice in these cases is to start early. Conducting daily conference calls with government agencies, utilities, suppliers and other businesses in advance of the event can go a long way toward reducing chaos and confusion once the event occurs. Discussions should center on how to protect and evacuate people if it becomes necessary. Getting employees safely home should be a top priority.
- Clarify the status of the event
- Result in decisions concerning events such as early closures (because, for example, if all businesses close at the same time, traffic will be affected)
- Increase understanding of alternatives (for example, alternate traffic routes need to be identified should traffic flow be disrupted because of road closings)
- Determine required actions for the day
Sometimes evacuation is not possible. This can happen in the case of unexpected events (such as earthquakes), chemical or biohazards, or if a storm hits earlier than expected or causes more damage than anticipated. In these instances, organizations must be prepared to offer food and shelter for their employees in affected facilities. It is critical to have emergency supplies on hand. Food, water and ice are all required. An often-forgotten necessity is cash. If the power is out, automated teller machines won’t work and businesses that remain open can’t take credit cards. All organizations should have ready access to cash for a limited time period, especially to purchase small items for emergency needs. The amount of cash will vary depending on the organization, but you should plan for a three-day supply of petty cash. Other advice to consider includes the following:
- Post-event supplies — Stage post-event services, supplies and equipment for fast departure after the event. These should include mobile business services (such as those of mobile banking facilities and critical government agencies that will immediately interface with the public), ice, water, and office supplies stored at the command center or emergency operations center.
- Emergency radio equipment — During regional disasters, such as hurricanes, the telecommunications infrastructure, the Internet and other electronic resources might not be operational. Therefore, organizations are advised to deploy emergency radio equipment (900MHz) to key personnel in advance of the event so that communications are not entirely disrupted if power and phone lines fail.
- Emergency contact information — Validate all emergency contact information for critical staff, customers, suppliers and other trading partners.
Post-Event BCM Procedures After an event strikes, whether it was anticipated or not, the first thing an organization must do is account for all its employees. Business continuity recovery is about people first. You must know where your employees are and attend to their health and safety before doing anything else. The second thing organizations must do is assess their property damage. Having a clear understanding of the situation ensures that the proper actions will be taken next. Organizations in the post-event phase should then proceed with the following activities:
- Daily conference calls — Until all the fallout from the event is fully understood and addressed, organizations should continue with their daily conference calls with local government officials, utilities, suppliers and other businesses to assess status, answer questions, make decisions (about reopening, for example) and outline required actions for the day.
- Emergency supply distribution — Organizations should begin dispensing emergency supplies to employees (and community members, suppliers or others, if that has been agreed on) if they are needed.
- Rebuild facilities — Once the immediate needs of employees and the community have been met, organizations should begin to recover and rebuild their physical equipment and facilities.
- Recover business services — As soon as reasonably possible, organizations should seek to restart operations and reopen for business on a full or limited basis.
Recovering and restarting business services after a catastrophic event is obviously the ultimate goal for any organization. However, it cannot take place until people and facility issues have been addressed. Trying to restart business operations, even on a limited basis, before seeing to the health and safety of employees can do irreparable harm to an organization’s long-term reputation as the community recovers and tales of their activities start to circulate. Having a strong BCM program in place — with regularly tested and updated plans to manage all types of scenarios — is the best protection an organization can have against unforeseen disasters. 
|
|
