The Recent Pacific Northwest Inclement Weather and Snow Events Remind us that Response Plans are a Requirement!

The media has been filled with stories about snow and more snow, freezing temperatures, high winds, broken water pipes, collapsed roofs and fires of late.  These events have disrupted a lot of businesses in our area.   I wonder how many of those businesses affected by these events had a response plan to deal with the situation.  Do you have a response plan that is part of your overall business continuity plan?  Sadly, the majority of existing plans that I review for our clients / prospects do not have a response element in place.  The above topics serve as a reminder as to why an organization should have a response plan.

Response can be defined as, the reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required.  Response planning should address the policies, procedures and actions following an emergency.  This needs to be done in advance and in anticipation of an emergency – yes, even a weather related incident.  It needs to define the proverbial who, what, why, where, when and how,

Examples of actions and measures that need to be predefined include:

• Response procedures to minimize harm to personnel and assets.
• Incident management processes to control and mitigate damage to facilities and equipment.
• Crisis management strategies to address operational, service, and public image impacts of an event.
• Crisis communications tactics to address who and how information will be managed and communicated.

The primary goal of the response stage of a business continuity plan is to manage the disaster from the beginning and to position your organization for the resumption of business.  Once again, defining in advance and making sure you have the right people, in the right place, and at the right time will go a long way to ensuring your recovery.

In the meantime, for those of us in our area that have predefined our “Sight Emergency Response Teams” perhaps we should consider renaming them for the time being to the “Snow Emergency Response Teams”…..

Forget the Downturn in the Economy, these Winter Storms are Fierce!

Forget the Economy (for now) – Got Snow and Ice?
At time of event it’s going to be all about people and resources!

If you live in the Pacific Northwest, or other parts of the country for that matter, you have been subjected to some pretty nasty weather this last week; Spokane Valley even declared a State of Emergency due to the record snowfall. Spokane discusses what officially declaring a state of emergency would mean in this clip, and Spokane’s Mayor Mary Verner addresses the city’s issues in this news clip.  If you are in business, you more than likely had to make some decisions regarding keeping things going on the work front.  Issues dealing with people, resources and your ability to deliver your products and services were no doubt at the top of the list.

Those of you that have worked with IT-Lifeline in the development of your business continuity plans probably get tired of me preaching “right people, right place, at the right time.’  The recent snow event in Spokane, Seattle and Portland proved that little sermon to hold true.

We know in plan development you have to have the right folks in place to evaluate risk and impact to your business from a major business disruption – including a snow event.  When it comes to responding to the event and resuming your business definitely requires the right people.  If you based your response and resumption planning around your organizational chart you may have experienced some difficulties over the last week.  I encourage you to dig deeper (no pun intended) into your planning efforts to ensure you will have the resources – people and things in place when the time comes.

Many of our clients experienced a shortage of “key” staff members – they couldn’t get to work due to impassable roads, impaired local transportation, or issues on the home front. At Spokane International Airport we experienced numerous cancellations and delays after the worst of our storms.  They couldn’t get the job done with those that were able to get to work.  This raised the issue of cross training or the lack there of.  I even heard of one local business that couldn’t even get the door open – the person with the key was stuck.  Others were looking for employees with 4 wheel drive vehicles, but then what do you do when the local law enforcement agencies are saying “stay off the roads”? Do we close?  Do we remain open?  Is there someplace else we can go to get things done – even if it’s only to answer the phones? What about our suppliers? How do we get the word out to our customers and clients?  The list of issues and questions goes on and on.  You probably have your own list.

The bottom line is this – you need to think about the issues pre-event, not during the event.  Snow and ice are not new to us here.  The length and strength of the storm was unprecedented, even in our neck of the woods.  It may be obvious to some, but as a business continuity planner, and speaking on behalf of the remainder of the staff at IT-Lifeline, I can tell you that advance planning makes all the difference in the world when it comes to responding to an event and resuming your business following a major business disruption – even a prolonged snow event.

God forbid — what if there had been a secondary event?  A broken water pipe?  Loss of power? A fire?  Could you have gotten the right people, to the right place, in the right amount of time to respond to the above events and resume your critical business operations?

We ensured we were open to our clients, but that is our business – we had the right people, in the right place, at the right time – did you?  Tell me about your success stories.  Share your list / solutions with others!

Outsourcing Disaster Recovery Should Protect the Continuity of Your Business!

Vendors / Providers of Critical Services Beware!

I recently read an article that was written by Colin Roe, MBCI that was published on the Continuity Central Website (http://www.continuitycentral.com/feature0628.html) that got me thinking about what this year has taught us about outsourcing critical services.

As VP, of Business Continuity Practices for IT-Lifeline, I consistently work with those whose responsibility is Vendor Management.  In March of 2008, the FFIEC, a regulatory group that oversees business continuity practices for the financial institutions issued specific guidelines that pertain to 3^rd party providers of services to banks and credit unions.  Those of you in other industries should take note!

In summary, the financial institutions were directed to hold 3^rd party providers of key services to the same standards for the development and maintenance of their business continuity planning process that are expected of the institutions themselves.  Specifically, the professional practices that pertain to business continuity planning;

 

·         Process Management

·         Risk Management & Evaluation

·         Business Impact Analysis

·         Defined Recovery Strategies

·         Defined & Documented Plan Procedures

·         Training & Awareness

·         Plan Testing & Exercises

·         Audit, Maintenance & Certification

 

If you are a provider of services to financial institutions you need to be aware of the above.  The financial institutions have been given a directive to inquire as to your efforts regarding these practices.  The options they have been given to your response are 1) accept the provider’s position, 2) Encourage the provider to develop / complete the planning process, or 3) Seek another provider for the service.  I can tell you from firsthand experience that I have seen all of the above options exercised by our bank and credit union clientele.

If you provide key / critical services to other industries you can expect this standard to rapidly become a professional best practice regardless of industry. Your clients will be asking how you approached your business continuity planning process.

In Times of Economic Uncertainty, Be Proactive Not Reactive With Business Continuity

Same message, just more food for thought….

When it comes to business continuity planning or personal preparedness, is it the probability or the consequences of the outcome that should drive ones actions? Often when trying to introduce awareness of the need for emergency or business continuity planning, I often overhear such things as – “What are the chances that will ever happen?” or “We’ve never had a major business disruption so what makes you think we’ll have one?”, and the list goes on and on!

Ah yes, the big dilemma – to plan or not to plan, that is the question. If you have knowledge of your local risk, and thus the risk to your business, can you afford not to plan? That is the question! Whether it is personal preparedness at home or planning for an event that would impact your ability to conduct business, are the consequences of not panning worth the risk and probable negative end results?

Prepare your plan today; It is consequential and the end result will be preferable. Try this site as a resource: www.ready.gov.

Business Continuity Planning Done Right – Save Money on Disaster Recovery During the Financial Crisis

So What Are you Spending on Your Business Continuity Resources?

It appears that in this time of financial crisis several organizations are looking at what they are spending on business continuity planning and the process of preparing for a major business disruption. Many are looking to “cut back” and yet others currently evaluating what resources need to be set aside are looking to cut corners. What to do? What to do?

Do you really know what you are or should be spending and for what level of protection? Are you spending too much? Are you spending enough? Either way what are you getting for your money? What level of protection have you achieved? Most folks don’t know and don’t have a clue. They see an expense but little else. Do you have the technology you need? Have you defined what your telecommunications environment should look like? How about workspace for your required personnel? Again is it too much or too little?

I’m still amazed at the number of organizations that have literally taken a “shotgun approach” to defining what is needed to protect their organization from a major business disruption. This scattered approach usually has them spending too much or too little, and whether they know it or not they are gambling with their ability to resume business should they experience that business interruption.

Unless you have done a formal business impact analysis to identify what is critical to the continuance and recovery of your business operations, and matched that to specific resources and specific recovery strategies such as data back-up, specific key hardware, applications, telecommunication and people, my guess is you really don’t know if what you are spending is adequate to protect your organization.

If you have a plan – conduct a business impact analysis. Follow that up with a resource analysis. See if you have the right solution in place – maybe you have too much? Maybe you have to little in place? It will tell you how much money you will need to spend to meet your defined recovery time objectives. If you are just now defining your resources required for resumption / recovery, and have not conducted a business impact analysis, do so and follow that up with a resource analysis. This will tell you how much you need to spend to meet your specific recovery time objectives.

My suggestion is that you review your business impact analysis annually and that you perform a formal business impact analysis every other year. Make sure this process becomes part of your program management to ensure the right monies are being spent for the right solution.

Make sure you are matching the needs of business to the money you are spending to protect the same.