The Risk is known, Now is the Time to Plan!

Having just returned from working in the Seattle area, the business continuity buzz is all about the impact associated with the “significant chance of flooding in South King County’s Green River Valley.”  Check this out  http://www.youtube.com/watch?v=66Nc0s9XMa8 What’s interesting from a business continuity planning perspective is that all you seem to read and hear about is “flood insurance”?  But is flood insurance really the answer?  The government guarantees flood damage to $500K for structures on a replacement value basis, and $500K for contents on an actual cash value basis.  This means if your equipment has even partially been depreciated, you will not get enough money in flood insurance to pay for new equipment.  On top of this, the access to additional flood coverage via normal insurers has dried up, no underwriter wants the risk.  The issue is not about the cost of coverage; it is that there is no coverage available.  See this Seattle Times article this week. http://seattletimes.nwsource.com/html/localnews/2009961102_floodinsurance26m.html#

Companies in Kent/Auburn/Tukwila and Renton, really only have one answer –  A plan to respond to the event, resume critical operations and the resumption of one’s business over time?  I saw very little reference for the need to plan to deal with the event.  Planning is imperative, if your organization is concerned about the continuance of business following the event.

The direction being given is from the 30 thousand foot level.  It needs to be more granular if an organization is to survive the flooding event.  Simply identifying essential services, critical functions, establishing resiliency via flood insurance and ensuring one’s staff is personally prepared is NOT going to ensure the continuity of one’s business.  It’s bigger than that!

An organization that is truly concerned about their ability to deal with the event, the resumption of their critical processes, and their recovery over time needs to invest the time to “do it right” to ensure their plans viability, and thus continuity.  They need to determine – who is going to be involved, what is it they can do (not to mention what resources they are going to need), why does it need to be done, where will it be done (now that’s an interesting question), when does it have to be done and how will they make it happen.

The above level of preparation takes time.  It will be time well invested.  After the event will be too late.  I agree that one should encourage personal preparedness.  It is well know that by ensuring your staff is prepared, will ensure their availability to assist in bringing the organization back on line.  However, it’s also time to consider, and put in place solutions for addressing technology – critical systems, applications, access to data and work area recovery.

Developing a detailed business continuity plan, documenting and putting into motion policies, practices, solutions and procedures, will hopefully ensure a limited impact on your key operations.  Not planning is NOT an option, if continuity of your deliveries is an issue.  Every business should plan – Plan to stay in Business!

You Must Ensure the Recoverability of Your Critical IT Infrastructure!

If it were possible I would ask for a show of hands, but it’s not, so let’s pretend.  How many of you have a disaster recovery plan?  By a disaster recovery plan I mean a formal documented plan that would allow you to recover your critical technology assets. I mean a specific plan to recover the systems, the applications and the data?  Oh yeah, don’t forget ALL the platforms, the desktops and the telecommunications environment – voice and data.  How many of you test the DR plan?  Do you bring the entire critical Information Technology environment up to ensure it would work if need be – from the ground up?  How many of you test more than once a year or when technology changes?

If you raised your hand to all of the above, congratulations – you are definitely in the minority.  Depending on what survey you read, very few organizations that have a plan test their plan – especially the small / medium businesses.  Fewer yet, regardless of size, actually identify measurable test goals and objectives and/or track the results.

When you factor in Symantec’s 2009 disaster recovery statistics – 25% of all disaster recovery tests fail, and only 15% of those surveyed indicated they have never had a test fail.  If you have never tested – your odds of full recovery are not good, especially in a timely fashion.

When you consider an event that requires the actual restoration of businesses information technology that supports the critical business functions; not having tested the restoration process is a scary thought.  Are you the one who would have to explain to senior management that you were unable to restore the technology environment to the level the business units and clients were expecting?

Testing is the ONLY way to ensure the recoverability of your critical infrastructure!  IT-Lifeline clients that test prove that every day.  They are ensuring the recoverability of the technology it would require to support their organization and thus their customers, should they experience a business disruption that affects their technology assets.  Can you say the same?

Oops!  Another Lesson Learned – The Hard Way!

 If you had access to our local paper on Saturday you may have come across an article entitled “Nonprofit agency loses data to overnight theft of computers”.  It seems that four computers were stolen from this organization’s location that contained “irreplaceable data”.  The computers contained critical information that included grant information, donor lists, e-mail addresses, supporter information and promotional material.  The local paper reported that an agency spokesman indicated that they had insurance, the equipment needed to be replaced anyway, but that “it’s the data that’s irreplaceable”.  The agency spokesman went on to say from now on “we are going to make sure we back up the data.”

Although I am sorry for their loss, the above is a lesson that is often learned the hard way.  All too often someone loses their computer or computers either through theft, fire, water or simply computer hardware failure only to find out that the data that resided on the system was “irreplaceable”.   Data backup today is simple, easy and often times can be done in a hands-off type environment.  In other words – automatically, on a regularly scheduled basis, and better yet it is relatively inexpensive.  If you compare the cost of the backup, to the expense of recreating what was lost, if that’s even possible, it can truly be cost effective.

As a business continuity planner, I am still amazed that data backup doesn’t get the attention it requires, not only from small businesses, but medium and large businesses as well.  I constantly see no backup or limited backup.  In addition, some of those that do backup there data don’t give much thought to where that data is stored once it is backed up.  Some leave on it on site (Hum!), some take it home and others hand it off to someone who doesn’t have a clue about protecting or securing magnetic media.

Where do you stand on this issue?  Is your data backed-up in a timely fashion?  How often?  Where is it kept?  Do you know?   If you don’t and might be the one charged with recreating the lost data, if you can, you might just want to ask the “someone” charged with ensuring that the process is performed in a timely fashion and that the media is stored in a safe and secure location.

Audit Your Business Continuity Process

How comfortable are you with your business continuity planning efforts?  Does it meet regulatory expectations? Could you respond to a significant business disruption?  Does the plan ensure timely resumption of operations and processes during adverse circumstances?  Could you recover your business over time?  Does it reflect your current business operating environment?  Have you considered conducting a strategic audit of your business continuity planning process?

Someone once said “if you don’t know where you’ve been, it’s hard to figure out where you are.   If you don’t where you are, how can you decide where you want to go?  If you don’t know where you’re going, any road will get you there.”  Interesting, but how does that apply to the auditing of your business continuity plan you ask?

There is great value in reviewing the road an organization has traveled to get to the place it is today as it relates to their business continuity planning process.  A best practices audit helps paint a picture of the level preparedness resident in the business continuity plan.  A clear picture of how your organizations resources have been allocated enables you to see where your assets (people, capital, facilities, and equipment) have been deployed.  If you have invested time, effort and real dollars in the business continuity planning process, by reviewing the returns associated with these investments, you will be able to make decisions with inherently more confidence and higher expectation of superior results.  In our current economy and at time of event this could make a significant difference.  Find out if the road you took to get you there was indeed the right one.

Perhaps now is the time to consider conducting an audit of your business continuity planning process?  Conducting a best practices audit will answer all the questions noted above and perhaps offer you a better night’s sleep.

As the winter weather worsens in the Pacific Northwest, I am continually reminded of the need for PREPAREDNESS.

A series of heavy snowfall since mid-December has left Spokane buried. We broke the 24-hour, 48-hour, 72-hour, 7-day, and 1 month records for most snowfall in a given period just to give you an idea if you reside outside of this area (Mayor Mary Verner spoke to this issue and others in a press conference on 1/7/09). We experienced roof collapses all over the city – 28 buildings so far – and then came the bad news – we would be getting 6-10 more inches of snow followed by rain. Why was that such bad news, you may ask? The added weight that the rain would add to the existing snow on structures all over the area would be a major concern for buildings and structures with flat or low-pitched roofs – we would be approaching 30lbs per square ft, dangerously high. They closed all Spokane School District #81 schools, along with numerous others 4 days already this week because of safety concerns regarding the structural soundness of the buildings. On top of those issues, flooding will start to become a real threat as the rain melts the snow buildup causing transportation, drainage, and safety issues all over the state.

That is a lot of information to take in all at once so I will get back to my main point in writing this post – you must be prepared at all times, for best to worse case scenarios! We were smack in the middle of the biggest snowfall this city has ever experienced, a state of emergency on its own, and then came the next event (more snow and rain leading to heavier snow), and the next (expected flooding all over Washington state)….

As the City of Spokane tried to raise awareness of these events through Press Releases and media, they also spoke to the theme of preparedness. They wanted people/ businesses to be aware of the possible dangers and who they could turn to/ where they could go for assistance should they need it.  

Take the time to plan … plan for the next event!  Figure out NOW what you need to do before you find yourself scrambling to figure out what your next move will be, should you experience a business disruption as the result of that event – whatever it might be; this article speaks to that point. The rest of this winter should be interesting!

The media has been filled with stories about snow and more snow, freezing temperatures, high winds, broken water pipes, collapsed roofs and fires of late.  These events have disrupted a lot of businesses in our area.   I wonder how many of those businesses affected by these events had a response plan to deal with the situation.  Do you have a response plan that is part of your overall business continuity plan?  Sadly, the majority of existing plans that I review for our clients / prospects do not have a response element in place.  The above topics serve as a reminder as to why an organization should have a response plan.

Response can be defined as, the reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required.  Response planning should address the policies, procedures and actions following an emergency.  This needs to be done in advance and in anticipation of an emergency – yes, even a weather related incident.  It needs to define the proverbial who, what, why, where, when and how,

Examples of actions and measures that need to be predefined include:

• Response procedures to minimize harm to personnel and assets.
• Incident management processes to control and mitigate damage to facilities and equipment.
• Crisis management strategies to address operational, service, and public image impacts of an event.
• Crisis communications tactics to address who and how information will be managed and communicated.

The primary goal of the response stage of a business continuity plan is to manage the disaster from the beginning and to position your organization for the resumption of business.  Once again, defining in advance and making sure you have the right people, in the right place, and at the right time will go a long way to ensuring your recovery.

In the meantime, for those of us in our area that have predefined our “Sight Emergency Response Teams” perhaps we should consider renaming them for the time being to the “Snow Emergency Response Teams”…..

Forget the Economy (for now) – Got Snow and Ice?
At time of event it’s going to be all about people and resources!

If you live in the Pacific Northwest, or other parts of the country for that matter, you have been subjected to some pretty nasty weather this last week; Spokane Valley even declared a State of Emergency due to the record snowfall. Spokane discusses what officially declaring a state of emergency would mean in this clip, and Spokane’s Mayor Mary Verner addresses the city’s issues in this news clip.  If you are in business, you more than likely had to make some decisions regarding keeping things going on the work front.  Issues dealing with people, resources and your ability to deliver your products and services were no doubt at the top of the list.

Those of you that have worked with IT-Lifeline in the development of your business continuity plans probably get tired of me preaching “right people, right place, at the right time.’  The recent snow event in Spokane, Seattle and Portland proved that little sermon to hold true.

We know in plan development you have to have the right folks in place to evaluate risk and impact to your business from a major business disruption – including a snow event.  When it comes to responding to the event and resuming your business definitely requires the right people.  If you based your response and resumption planning around your organizational chart you may have experienced some difficulties over the last week.  I encourage you to dig deeper (no pun intended) into your planning efforts to ensure you will have the resources – people and things in place when the time comes.

Many of our clients experienced a shortage of “key” staff members – they couldn’t get to work due to impassable roads, impaired local transportation, or issues on the home front. At Spokane International Airport we experienced numerous cancellations and delays after the worst of our storms.  They couldn’t get the job done with those that were able to get to work.  This raised the issue of cross training or the lack there of.  I even heard of one local business that couldn’t even get the door open – the person with the key was stuck.  Others were looking for employees with 4 wheel drive vehicles, but then what do you do when the local law enforcement agencies are saying “stay off the roads”? Do we close?  Do we remain open?  Is there someplace else we can go to get things done – even if it’s only to answer the phones? What about our suppliers? How do we get the word out to our customers and clients?  The list of issues and questions goes on and on.  You probably have your own list.

The bottom line is this – you need to think about the issues pre-event, not during the event.  Snow and ice are not new to us here.  The length and strength of the storm was unprecedented, even in our neck of the woods.  It may be obvious to some, but as a business continuity planner, and speaking on behalf of the remainder of the staff at IT-Lifeline, I can tell you that advance planning makes all the difference in the world when it comes to responding to an event and resuming your business following a major business disruption – even a prolonged snow event.

God forbid — what if there had been a secondary event?  A broken water pipe?  Loss of power? A fire?  Could you have gotten the right people, to the right place, in the right amount of time to respond to the above events and resume your critical business operations?

We ensured we were open to our clients, but that is our business – we had the right people, in the right place, at the right time – did you?  Tell me about your success stories.  Share your list / solutions with others!

Vendors / Providers of Critical Services Beware!

I recently read an article that was written by Colin Roe, MBCI that was published on the Continuity Central Website (http://www.continuitycentral.com/feature0628.html) that got me thinking about what this year has taught us about outsourcing critical services.

As VP, of Business Continuity Practices for IT-Lifeline, I consistently work with those whose responsibility is Vendor Management.  In March of 2008, the FFIEC, a regulatory group that oversees business continuity practices for the financial institutions issued specific guidelines that pertain to 3^rd party providers of services to banks and credit unions.  Those of you in other industries should take note!

In summary, the financial institutions were directed to hold 3^rd party providers of key services to the same standards for the development and maintenance of their business continuity planning process that are expected of the institutions themselves.  Specifically, the professional practices that pertain to business continuity planning;

·         Process Management

·         Risk Management & Evaluation

·         Business Impact Analysis

·         Defined Recovery Strategies

·         Defined & Documented Plan Procedures

·         Training & Awareness

·         Plan Testing & Exercises

·         Audit, Maintenance & Certification

If you are a provider of services to financial institutions you need to be aware of the above.  The financial institutions have been given a directive to inquire as to your efforts regarding these practices.  The options they have been given to your response are 1) accept the provider’s position, 2) Encourage the provider to develop / complete the planning process, or 3) Seek another provider for the service.  I can tell you from firsthand experience that I have seen all of the above options exercised by our bank and credit union clientele.

If you provide key / critical services to other industries you can expect this standard to rapidly become a professional best practice regardless of industry. Your clients will be asking how you approached your business continuity planning process.

Same message, just more food for thought….

When it comes to business continuity planning or personal preparedness, is it the probability or the consequences of the outcome that should drive ones actions? Often when trying to introduce awareness of the need for emergency or business continuity planning, I often overhear such things as – “What are the chances that will ever happen?” or “We’ve never had a major business disruption so what makes you think we’ll have one?”, and the list goes on and on!

Ah yes, the big dilemma – to plan or not to plan, that is the question. If you have knowledge of your local risk, and thus the risk to your business, can you afford not to plan? That is the question! Whether it is personal preparedness at home or planning for an event that would impact your ability to conduct business, are the consequences of not panning worth the risk and probable negative end results?

Prepare your plan today; It is consequential and the end result will be preferable. Try this site as a resource: www.ready.gov.

So What Are you Spending on Your Business Continuity Resources?

It appears that in this time of financial crisis several organizations are looking at what they are spending on business continuity planning and the process of preparing for a major business disruption. Many are looking to “cut back” and yet others currently evaluating what resources need to be set aside are looking to cut corners. What to do? What to do?

Do you really know what you are or should be spending and for what level of protection? Are you spending too much? Are you spending enough? Either way what are you getting for your money? What level of protection have you achieved? Most folks don’t know and don’t have a clue. They see an expense but little else. Do you have the technology you need? Have you defined what your telecommunications environment should look like? How about workspace for your required personnel? Again is it too much or too little?

I’m still amazed at the number of organizations that have literally taken a “shotgun approach” to defining what is needed to protect their organization from a major business disruption. This scattered approach usually has them spending too much or too little, and whether they know it or not they are gambling with their ability to resume business should they experience that business interruption.

Unless you have done a formal business impact analysis to identify what is critical to the continuance and recovery of your business operations, and matched that to specific resources and specific recovery strategies such as data back-up, specific key hardware, applications, telecommunication and people, my guess is you really don’t know if what you are spending is adequate to protect your organization.

If you have a plan – conduct a business impact analysis. Follow that up with a resource analysis. See if you have the right solution in place – maybe you have too much? Maybe you have to little in place? It will tell you how much money you will need to spend to meet your defined recovery time objectives. If you are just now defining your resources required for resumption / recovery, and have not conducted a business impact analysis, do so and follow that up with a resource analysis. This will tell you how much you need to spend to meet your specific recovery time objectives.

My suggestion is that you review your business impact analysis annually and that you perform a formal business impact analysis every other year. Make sure this process becomes part of your program management to ensure the right monies are being spent for the right solution.

Make sure you are matching the needs of business to the money you are spending to protect the same.