According to the Association of Records Managers and Administrators, about 60 percent of businesses that experience a major disaster such as a fire close within two years. According to Labor Department Statistics, over 40 percent of all companies that experience a disaster never reopen and more than 25 percent of those that do reopen close within two years.
Disasters happen! Floods, fires, storms, accidents, outages, whatever. And it's not just about you. A disaster could hit one of your key suppliers or a major transportation service provider. Suddenly you can't deliver. How you and your firm react will determine your fate. Your customers will still want their orders filled and services provided, and if you can't come through, they'll go somewhere else!
It can happen to you!
Disasters are unavoidable. Sometimes it's as simple as a leaky roof, severe weather or a traffic accident. Most computer system outages are triggered by minor incidents like broken water pipes, fire and smoke damage, electrical equipment failures, or computer viruses.
Sometimes a large geographic area is impacted such as the Northeast Blizzard of '78, the San Francisco Earthquake of '89, the nationwide AT&T network failure of '90 or the Great Northeast Blackout of 2003. It's inevitable. Your business will be impacted by a disaster of some kind before long.
Ten steps could save your business
The steps that follow are grouped around three critical elements for creating an effective survival strategy: people, process and technology.
PEOPLE: Preparing to deal with the human factors is the single most important aspect of surviving a disaster. People are your organization's most valuable asset. Reassuring and educating them in advance of an emergency situation is the first critical success factor. By defining how people should react to a crisis and providing them information and tools to manage that reaction, the impact will be lessened and the transition to emergency operations smoothed.
1. Assemble a multi-disciplined planning team.
The planning team will create the roadmap for managing a disaster. Which departments to include on the team will vary from company to company. Consider representation from customer service, facilities, finance, human resources, manufacturing, network management, operations, purchasing, sales, security, and/or systems administration.
2. Select an executive-level sponsor and a planning team leader.
Someone on the executive management team must be an active participant in the planning process. The efforts required will span the entire company and require cooperation from multiple departments. This person must be able to clear roadblocks and resolve issues.
3. Define roles and choose participants for the recovery team.
The recovery team is responsible for overseeing execution of the survival plan. Team members coordinate survival activities and lead the recovery efforts within their respective operational areas. They will choose the individuals to perform specific survival activities after any declared disaster. Think about including representatives from key customers, suppliers and outside service providers on the recovery team.
PROCESS: The next major element is process. There are dozens, hundreds, perhaps thousands of business processes that your organization executes every day. Some are mission-critical, some are secondary and the rest are supportive. You'll need to define which processes really matter to your business and how you'll keep those processes operating when disaster strikes.
4. Catalog your business processes.
A disaster survival plan can't justify the expense of including every business process, each piece of equipment and all software applications in the survival effort. Take an inventory of major business processes. Ask middle and senior level managers to define the activities within their departments that are most critical to the business. Think about what really matters to the survival of your business. Processes that don't make the inventory list may be vital to the long-term success of the company but not critical to short-term survival.
5. Conduct an impact analysis.
Ask the following question about each process. What would be the impact on the business if this process could not be performed for several days? Now prioritize your business processes based on the impact analysis. Use three levels of priority. For example:
A) Processes that need to be resumed within 24 hours to prevent serious business impact, such as loss of revenue.
B) Processes that need to be resumed within 72 hours to maintain near normal operations and adequate levels of quality.
C) Processes that can take more than 72 hours and may not be needed at all unless the disaster is unusually long.
6. Assess business survival options
Based on the impact analysis, consider multiple business survival strategies. Think about manual processing options, engaging an outside firm to take over some or all operations or, establishing a remote, redundant site for mission-critical operations.
Define the specific criteria for declaring a disaster and who is authorized to make the declaration. Create a procedure for determining which business processes are impacted by the disaster. Be ready to act quickly and decisively. Consider a phased approach whereby you might declare a "pending disaster" at the earliest stages when you're not quite sure about the impact an event will have. This gets your team mobilized, minimizes losses and accelerates return to normal operations.
7. Document and test the survival plan.
Don't write a book. Keep the documentation simple and actionable. This document will have to evolve over time so you don't want to create a large maintenance task. Include network configuration diagrams, company directory, roles and responsibilities for the recovery team (see step 3), and specific survival procedures. The recovery team will have responsibility for maintaining the accuracy, accessibility, and distribution of the survival plan.
At least once a year, conduct a mock disaster. Walk through the plan and be sure it's still valid. As your business evolves and grows, the plan will have to change. Always conduct a postmortem after each test to surface needed improvements in the plan.
TECHNOLOGY: Finally, there's the technology element. Consider computers, software, production machinery, network equipment, printers, telephones, fax machines, copiers, etc. Some or all of this technology may be unavailable during a disaster. Don't let your business succumb to a technology failure. There are a variety of options available.
8. Identify critical systems.
Your business is likely to have many desktop and server computers. There are also firewalls, routers, switches, printers, scanners, fax machines, copiers, telephones, and so forth. Determine which of these devices are truly critical. Criticality is measured by your ability to conduct business without that device.
Is there a substitute device, for example, using a mobile phone instead of a land line? Can the work be done just as well manually though at reduced speed? Would one of your business processes be completely unavailable without some piece of equipment? Identify alternate equipment and suppliers who can respond quickly in a crisis.
9. Examine system administration procedures
Review how your major systems are maintained. It is quite surprising how simple disasters can often be avoided by following proper administration procedures. Are computers backed-up regularly? Are the backup media stored offsite? Is antivirus software installed and updated regularly?
Don't forget about the paper files. Are copies stored offsite? Have you digitized and archived them for safety? Can your business operate without them?
10. Consider redundancy options
Finally, think about duplicating or mirroring critical systems. This can be done onsite and/or offsite depending on the needs of the business. The subject of "failover" (switching to a redundant system when the primary system fails) is complex and the solutions can be very expensive. If your customers depend upon you for 24x7 operation or you have contractual obligations for such, then redundancy is essential.
Once you've completed these ten steps, you'll be ready to face any severe disruption to your business with confidence. You've explored the options, planned for the worst, executed a test and verified the results. You're ready!
Vin D'Amico is Founder and President of DAMICON, your ADJUNCT CIO. He is an expert in using open-source software to increase worker productivity and reduce IT costs.
This article appeared in Vin's monthly Virtual Business column for the IndUS Business Journal in July 2004.
To learn more about how DAMICON can help your business, please take a look at our service programs.
This column appears monthly in the IndUS Business Journal.