- Shopping Bag ( 0 items )
In each case, real-world examples are provided to illustrate how the authors' recommendations can be put into action. Childs and Dietrich also debunk the myth that contingency plans are unreasonably expensive. Of course they require an investment of time and money; however, sound contingency plans can successfully combat daily "small" disasters, such as mistakenly deleting computer files, while also improving the overall efficiency of business processes regardless of whether a disaster occurs. The smooth operation of business in a time of disaster benefits not only the small business community but also the national and even the global economy. By following the authors' guidance, your small business can alleviate its risks and recover quickly when disaster strikes.
The first step in preparing a disaster contingency plan is a rigorous assessment of your business. In this chapter we are going to guide you through a plan of preparation for your critical IT assets and for a program of insurance. We want to share with you what we have learned about the need to put in place redundant technology and financial assets so you can recover more quickly when disaster strikes. We preface this guide with some questions for you to keep in mind as you work through this section of the book. The questions that we hope to provoke, and the answers that only you and your employees can provide, will help you to identify areas on which to focus in developing your contingency plan.
You must identify the critical business assets that you wish to protect. Now is the perfect time to assess past events that have affected your business (Have you had prior experience with natural disasters? Is your business located in a flood zone?) and your business's current status. Consider how you would react to the categories of disasters we have identified and take into consideration how your clients and suppliers would be affected should your business experience a disaster. For example, if your business operations were temporarily disrupted, would your clients seek alternate sourcesof the products and services you supply to them? Could you mitigate this risk by diversifying your production and operations sites? Would your suppliers have difficulty sending shipments to an alternate business location that you might use on a temporary basis?
Given the existing resources of your small business, define the scope of the endeavor that you think is reasonable. Define some intermediate goals and estimate the costs of developing your contingency plans relative to the potential benefits. You will have to make some assumptions, and you will have to identify some risk factors for your business. For example, contingency plans have most often included the provision that only one building will be affected in a disastrous event destroying the site, but the attacks on the World Trade Center invalidate this assumption in cities with major structures that could be attacked from the air.
You also may have to consider a wider range of disaster-affected areas as you begin to develop your contingency plan. A former colleague works in a small business in Lower Manhattan that backed up its data nightly and placed those backup tapes securely in a bank safe deposit box. Unfortunately, that particular bank branch was located in the shopping concourse of the World Trade Center. I (Donna) used to bring backup CDs home with me when my contingency plans contemplated worst-case disaster scenarios such as a fire destroying my office building. I had not contemplated a scenario that would simultaneously affect both my home and my place of work. I have since revised my contingency plan for recovering electronic data.
Developing your contingency plan should not become a large bureaucratic effort. Indeed, to be effective, your small business's contingency plans should be a model of clarity, understood by every member of the company. It begins with key management leaders and includes all of the employees, because in a disaster situation every person who is knowledgeable and prepared can make a critical difference to a successful outcome. Employee training is key, because each person must understand the importance and necessity of contingency planning and response to a disaster and know what his or her role will be. In a real emergency you cannot afford to delay your response because roles had not been clearly defined. Indeed, we would like to suggest to you that in order to build employee consensus about the need for contingency planning, you educate your employees and encourage them to develop their own personal and family contingency plans. Such an effort will likely yield extraordinary dividends-small businesses are often wonderful places to work in part because we are like families, not large, impersonal bureaucracies. The sincere care and concern you show for your employees will result in higher productivity.
To illustrate our point, we would like to share with you three real and painful stories of families that suffered in disasters. These are examples of suffering that could have been alleviated had the families done some personal contingency or disaster planning. The first concerns a friend who suffered a head injury from the force of falling debris in a burning building. His relatives almost certainly saw the disaster reported on the local television news. Imagine the mental torture they suffered as they worried about what had happened to him. If he had maintained an "In case of emergency ..." card in his wallet, medical staff who treated him could have contacted his relatives and informed them of his status. Until he was able to communicate himself (he was heavily sedated following major surgery), his relatives were left to frantically call his apartment in the hope that he would answer or return the messages that they had left on his answering machine. We both have nurses in our families, and each of us has a laminated card in our wallets advising whom to contact on our behalf in the event of an emergency. We provide secondary contacts in the event our first contact cannot be reached. We also recommend that you verify this information annually because people do move, change employers, and so forth, and outdated information is of little use.
Let us give you a second example. I (Donna) was told the following story by a neighbor. We have a neighbor who worked in the World Trade Center and has not been seen since September 11. She is presumed to be dead. Her father came to New York City to inquire if anyone had seen her and showed photographs of her to the other tenants of the building. This lady had day-care arrangements for her child, but no one, including the child's grandfather, knew what they were. Presumably, the day-care provider had been given an emergency contact person, but imagine the anxiety that the child's grandfather suffered that might have been mitigated if he had been made aware of the child-care arrangements and knew how to directly contact the day-care provider.
Finally, I want to share with you a personal example that had a happier ending. My (Donna's) mother suffered a traumatic head injury that required extensive medical intervention. My parents, as part of their contingency planning, had prepared advance health-care directives and durable powers of attorney in the event that one or both of them should become incapacitated. I was able to sign consent forms authorizing the forms of treatment that were consistent with her wishes. (I'm happy to report that she is alive and well.)
Most people generally don't give such thought to these matters. We are not by nature ghoulish, but we each have nurses in our families and my (Donna's) grandfather was a firefighter, so we probably have a greater awareness of the incidence of disasters. We don't intend that our loved ones should suffer needless worry about us and you shouldn't either, and neither should your employees. Encourage your employees to bring the methodology of contingency planning and disaster recovery home with them. Make them aware of the first aid classes that are offered by the Red Cross. Ask them if they can remember when they last replaced the batteries in their smoke alarms at home. It is hard to concentrate on the business task at hand if you or your employees are worried about the safety of your families. If your son was missing following a disaster, how productive would you have been at work during the period that he was unable to call you and the medical staff treating him had no family contact information? Make careful planning a way of life and of business for everyone in your extended small business family.
You will also discover that you should do some general process engineering on how your company works. If your business has clear lines of responsibility, defined processes that are established and followed, and documents that are properly filed, you will likely be successful in establishing a good disaster recovery scheme. If your normal business day is characterized by managing the crisis du jour in an atmosphere of confusion, you will likely have difficulty implementing a disaster recovery plan.
Many companies that we visited were actually not ready to implement disaster recovery solutions. Many of them had gone through so many computer and system upgrades, using many different "bundled" applications, that they were faced with not only a wide collection of similarly named documents in various locations, but they also had documents that could not be assigned to any former activity because it was no longer possible to read them without going through a major deciphering effort. This is much more an issue for small businesses, because large businesses usually have standardized roll-out IT platforms and consolidated user data storage.
Now you understand why any contingency planning effort must be conducted in concert with a major review of your business, not only to identify the critical assets that you need to protect, but also to identify and organize all related items. As you can imagine, although it will be time-consuming at first, your small business will benefit as a result.
Once you have reviewed your business operations, you will be ready to order your priorities and select the areas on which to focus. Some of these areas you may consider because they are located in offices that appear to be at high risk. You may consider other offices as candidates for a contingency provision with a remote backup site. An alternate business site is needed if your original site is out of service or inaccessible. An excellent solution for small businesses with multiple sites of operations is to share disaster contingency space distributed over all of your offices or other facilities. So if one business location goes down, the other locations would provide space and IT services for some key employees. You could also consider integrating a telecommuting setup in your temporary disaster recovery provisions whereby key employees would work from home using services provided from an off-site IT setup.
Once you have developed a thorough plan, you must be prepared to revisit it regularly and revise it, if necessary. Take the opportunity to schedule a disaster shutdown of your company's operations, for example, on the weekend following a regularly scheduled fire drill. Once your backup location is ready, you should regularly update and train your key staff on disaster mode operation. As your small business grows, your needs will change and you will need to adapt your disaster contingency plan accordingly. We also advise you to prepare an inventory of your property, plant, and equipment.
For IT assets you need to keep a record of:
Hardware assets: manufacturer, model name and number, quantity, serial numbers, service tags/configuration code, maintenance dates, support phone, location, and replacement cost.
Software assets: manufacturer, title, version, quantity, serial number/license key, support phone, location, and replacement cost.
IT staff/human capital: employee's name, position, telephone (work, home, mobile), and responsibility during disaster.
System data assets: system name, operating system, location, if backup unit available and where, backup frequency, and person responsible.
User data: system name, operating system, location, if backup unit available, location, backup frequency, and person responsible.
Third party: service name, provider name, and phone (support desk, emergency number).
Printers, network, and other peripherals: manufacturer, model name and number, serial number, maintenance dates, phone (support desk, emergency number), and replacement cost.
This information will be important in your recovery efforts as you need to know which equipment (and which personnel) can be redeployed and which assets your insurance policy may replace. Now that we have completed our "preparation" overview, we are ready to "drill down" to specific areas on which to focus in developing your contingency plan. In this chapter, we discuss topics such as proper handling of office mail, developing an IT infrastructure, and putting together an insurance program. Before we delve into the specifics, however, we would like to conclude this section with two thoughts.
First, notice that this chapter (Preparation) is longer than the following two chapters ("Response" and "Recovery"). We didn't plan it that way, but we noticed that was the result when we completed our manuscript. That should be the result: planning is the most important activity you will undertake. Risk management and disaster recovery specialists have an expression: "To fail to plan is to plan to fail." The time and effort you invest in preparation will expedite your recovery from disaster.
The second point we would like to emphasize is that because successful contingency planning is closely connected with a thorough understanding of your business operations, contingency planning almost always yields benefits to your business-even if disaster never strikes. I (Donna) know a small financial services company that began to consider how it would treat mail delivery following the anthrax scare in the fall of 2001. As the company began to review its existing procedures for handling mail, it discovered something shocking: it was spending $9,000 annually to send interoffice documents by overnight express delivery, when an electronic document delivery system would have done the same work at negligible cost. Now, $9,000 is a lot of money to a small business, and we are certain that any small business owner can think of better ways to invest that sum. In the process of developing a contingency plan, this small business improved its operating procedures and has realized a return on the time and effort invested in contingency planning-even though disaster has, thankfully, not struck. Your small business can, too. With that point in mind, let's consider a contingency plan for proper handling of business mail.
BUSINESS MAIL PROCEDURES
Since letters tainted with the deadly bacteria anthrax were delivered through the U.S. Postal Service beginning in early October 2001, concern about the safety of our mail has prompted many businesses to reconsider their procedures for handling incoming mail. Public health authorities have confirmed 18 anthrax infections to date, including 5 fatalities. Five individuals in Florida; the Washington, DC, area; New York; and Connecticut died from inhaling anthrax spores contained in letters.
Excerpted from Contingency Planning and Disaster Recovery by Donna R. Childs Stefan Dietrich Excerpted by permission.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.
|Assignment of Authors' Royalties||xiii|
|Chapter 4||Sample IT Solutions||191|
|Appendix||Basic Safety Practices||211|
Posted November 8, 2002
This book is chock-full of relevant and timely information to "disaster-proof" your business. I have not seen another book like it anywhere. The authors cover topics from developing a back-up system for your business records to obtaining a cost-effective insurance program. They wrote from the perspective of business owners (which they are) not consultants. I found something useful for my business on each and every page.Was this review helpful? Yes NoThank you for your feedback. Report this reviewThank you, this review has been flagged.