It's my Christmas blog!
Like the 12 Days of Christmas carol, I’m giving you a list of twelve things you can do to create a simple disaster plan. Take an hour for the next twelve days and review each section of the blog. Write down your answers, and you will have a basic business continuity plan for crisis events. If you commit to doing this, you will give yourself a present at the end of having a contingency plan in place in less than two weeks. By investing just 12 days and a minimum of 12 hours, you can have a basic contingency plan that will help you to respond and recover from disasters. Even if you don’t celebrate Christmas, that’s okay; the format can still work for you.
Day 1 - Hazards planning
Hazards planning helps you to think about all of the crises that are most likely to impact you and your business. Start by creating a list of all of the things that are most likely to threaten your business. Consider if your location(s) is prone to natural disasters like ice storms, tornadoes, hurricanes, fires, floods, earthquakes, or other significant adverse events. As you brainstorm, make a list of every risk you can think of, whether natural or human-made.
Next, write down if your business is in an urban, rural, or suburban area. Think about what disasters could happen because of the physical environment around you. Then, consider if there is something unique about where the business is that it could make it prone to crisis events. If you live in a city pr historical area, decide if you are at risk of riots, protests, or terrorist incidents. Last, write down if there are there any other factors that could threaten or harm your company.
Day 2 - Risk assessment
Now that you have your hazards list, write down next to each one if it could cause a short-term or long-term outage. Consider if the event would make all work production cease for an extended period. For example, a crisis could happen because your office is on a busy street, and there is the risk of traffic accidents. An event like this could keep customers from visiting you. If you are at risk for long and short-term outages, write down what circumstances that could cause these circumstances. When completed, you will have created a list of the hazards with your most significant risks.
Next, you want to understand the level of risk associated with each hazard. Take the list you made and rank the dangers in order of probability. The things that are most likely to occur should be ranked highest on the list as most threatening to disrupt your business. Keep it simple and rank them in order. Use your gut. You know your business and environment best — last, list what assets would be vulnerable if the hazard event occurs. For example, note if you could lose access to your location, your people, your infrastructure or access to your supply chain. Ready.gov has a good overview of the topic of Risk Assessment.
Day 3 - Business impact analysis
A Business Impact Analysis (BIA) is a crucial part of developing a disaster plan. Assessing the impact of the risks you identified is the next step. The BIA is used to identify and evaluate the potential effects that financial, life safety, regulatory, legal or contractual, reputation, and work stoppage has on your business operations. The analysis can get very technical, and professionals who create contingency plans can use complex formulas to calibrate results. Going with our down and dirty, bright, and shiny theme, we are going to keep this simple.
Consider the main impacts of a work stoppage due to any of the hazards you listed that could be a risk to your business. Typically, most companies are at risk of losing access to the workplace, personnel, technology, or vendors not being able to provide contracted services. Decide what the cost is of interruption over time and if it would impact your brand image. Write down any legal considerations if you would break any contracts with customers or any liabilities. Last, note if an interruption could cause you to lose customers or external relationships.
Day 4 - Create your plan
After you are clear on the impacts of a disaster on your business, you need to document how you would recover from disaster events. First, you will want to understand what your actions are when an emergency happens. OSHA has good Evacuation Plans and Procedures eTool that can guide you through this process. Then, create a section of the plan that contains crisis management procedures that says what you will do for each of the hazard events you identified as a risk.
Finally, list what your action steps will be if for loss of your workplace, personnel, technology tools, and suppliers, or vendors. Making the plan will take some time, but I suggest you do not make it too complex to start. Remember that you can always refine your project as you exercise and test it or when you experience actual events.
People often try to throw every contingency into their planning document. I have found that the more high-level the procedures, the more likely you will use it when a disaster happens. The strategies you create should be realistic for how you will respond and recover from an event. Keeping them straightforward and practical will help you when a crisis strikes. Usually, circumstances require some flexibility in-real time as every event is unique, but your procedures are your guiding framework.
Day 5 - List alternative locations
Once you have the plan in writing, you will need to identify where you will continue operations if your workspace is not available. If you can work from home, then capture that in your plan. You will also want to make sure you will have access to all the necessary tools. If you already have a home office, then consider if you can go to a local coffee shop with WiFi that you can work from comfortably. If that is not possible, then determine if a local business or hotel would allow you to use their facility.
There has been a trend in alternative workspaces in the marketplace that can help in these instances. Here on Cape Cod, a company like Cape Space might be an option for alternative workspace. In the U.S., companies like WeWork or Rentsys Recovery Services can also provide opportunities. The key here is to determine where you will go ahead of the business interruption and document it.
Day 6 - List role and personnel back-ups
This section is pretty straightforward. Your goal is to work with your team to determine who will do what. Build a disaster response team(s) in your plan and list each member’s responsibilities. If you are a more significantly sized business, you can draw on people’s strengths and create planning, crisis, and recovery teams. If you are a small group, you will have a group performing multiple tasks.
Key roles like who will be in charge, who manages communication internally and externally, along with who helps to execute plan procedures, need to be determined ahead of time. By having a clear structure in place, you will limit confusion and overlap when a crisis occurs. Regardless, contact information and plan details should be updated regularly. After establishing the team(s), designated back-ups for each role with someone who can do the job if the team member is unable to do the job.
Day 7 - List vendor contact information
Another helpful section of the document is to list the vendor and contact information for each supplier. The vendor section should include all available contact information you have available, whether it is a name, mobile, email, or the company’s main telephone number. If you do not have an account representative, it is helpful to have customer service numbers.
The main point is that you want to have this information easily accessible. You don’t want to have to go searching for it in your Smartphone or files when a disaster happens. And, it’s always good to have this information in a secondary place like your disaster document just in case you other sources get destroyed.
Day 8 - Create a crisis communication flow
In my experience, communicating well is always the hardest part of good disaster response. So, it is helpful to decide how you will communicate both internally and externally when an emergency happens. In the past, many people used call trees to do this. My suggestion is to create a workflow outlining how you will communicate and with who. People do not think as clearly during times of stress, so making things easy to follow works best.
Once you create your crisis communications process, share it with your team, and make sure everyone understands it. Create a process that outlines how you will share news and updates with employees and customers. Many crises communications experts recommend that you draft what you will say ahead of time so that you have it ready when you need it. This messaging can be tailored to hazard types, to specific audiences or both.
Day 9 - List additional key contacts
Another useful area of a disaster plan is creating a section for additional key contacts. These can be non-business contacts like having local government or law enforcement numbers on hand. Or, it may be business-related company information that is not related to your vendors, but that may be needed. It may be helpful to have a list of banking, credit card companies, and insurance contacts. Taking a few minutes to add this list of names, numbers, and emails will save you time post-disaster.
Day 10 - Create a backup plan if your tech fails
IT is an important area to build into your planning document. Few people truly appreciate the impact that technology has today on running a successful business. I am amazed at how few people outside of the tech field genuinely understand the complexity of all of the tools we take for granted or its impact on disaster planning. If you haven’t read my recent blog, The Two Faces Of Disaster Recovery, it outlines more about my journey in understanding the criticality of recovery for critical tech infrastructure.
Regardless of your knowledge level about IT, you need it to run pretty much any business today. So, you need a back-up plan if your infrastructure or access to your applications fail. In my Halloween blog, I wrote more about some of the scary statistics about not having disaster planing. A large part of the blog is related to disaster recovery or cybersecurity issues.
Day 11 - Test and update your plan every year
If you made it through this process to the eleventh day, then you are almost done. I referenced it earlier, but this document is only viable if your employees understand it, and it’s kept up to date. The best way to do that is to review and exercise the plan together at least once a year. I suggest you start by choosing one of the hazard types that is the most significant risk to your business and developing a scenario to test the plan.
The exercise can be as simple as picking a natural disaster scenario and then developing a timeline for when the event happens and how it would affect your business over time. Top concerns for many companies include severe weather, cyber attacks, infectious disease, and incidents that can ruin a company’s reputation.
Day 12 - Make a personal disaster plan
Now that you created the continuity plan to assist you with emergencies and recovery, there is one final step. The step is for you and your team to do personal emergency planning. One of the most significant failure points of disaster response and recovery is when personnel is unprepared. If you, your people, and families have not prepared for a crisis, your plan will not be successful.
Over time, I have witnessed many cases of people fleeing their jobs to take care of their disaster impacts. Although there will always be extreme circumstances, I know that people are better able to help in the workplace when personally prepared. Employees have better focus when they know their loved ones and homes are safe. The same applies to you, bosses, out there. Excellent sources of information are ready.gov and the American Red Cross.
Twelve little disaster planning presents!
There you have it, my twelve days of gifts to help you with disaster planning. It’s as good to give as to receive, so please share your comments below. Let me know if this helped you to build a plan. Have a wonderful holiday season, everyone.