[an error occurred while processing this directive]

CRITICAL ELEMENTS OF A DISASTER RECOVERY & BUSINESS/SERVICE CONTINUITY PLAN

By Pat Moore


The numerous community-wide disasters, as well as singular disasters that municipalities, institutions, businesses and government agencies have suffered in the last dozen or so years have shown us that planning for disaster recovery only is simply not enough. We must also plan beyond the emergency response phase for business and service resumption and continuity. In addition to planning for the recovery of critical information services and applications, we must address equally important issues such as human resources, vital records, telecommunications, risk management, loss control, security, environmental concerns, and the facility which houses the work environment itself.

More often today it is the Emergency Response Coordinator, Risk or Insurance Manager, Administrator, Facility or Safety Manager who is being asked to complete the plan. These additional issues also directly affect the bottom line, including service and business interruption, and loss of public confidence.

Where do you begin, and what issues must you address? I am going to assume that your Emergency Response Plan, addressing fire brigade, evacuation, health and safety issues is well in place and has been tested many times. No plan is more important than that for human health and safety. As you now address business and service issues concerning disaster recovery, business/service resumption and business/service continuity, let's take a look at some of the areas of concern you must include in your contingency plan.

SINGULAR–COMMUNITY WIDE DISASTERS:

You must write your plan so that your recovery procedures and processes can be switched instantly from one disaster scenario to the other. For example, the same resources that you depend upon to respond to your needs from a singular disaster such as a fire, or water damage at your building, must be able to respond equally well to your needs and your community's needs in a regional or community wide disaster. How thoroughly have you identified and pre-qualified your resources and alternates in this area? It would be helpful to discuss with your resources their own disaster recovery plans to see whether or not they are going to be able to respond if they are disabled by the same geographical disaster which affects you.

You will have major notification, mobilization and acquisition concerns that may be more difficult to address in a community wide disaster than in a singular one. Your planning process must identify your needs and resources in both situations. Make sure your pre-qualified resources are able to respond 24 hours a day, 7 days a week with sufficient personnel and supplies, and your contacts with them are updated. If they are local resources only—make sure they have a regional or national arm of their company that can come in to assist them in assisting you, or in providing you with the necessary supplies if they are affected by the same disaster. Always consider singular, community wide and hazardous material incidents when qualifying resources.

NOTIFICATION PROCEDURES

Some of the critical notification concerns you must address involve determining who gets notified, how are they notified (and you must consider whether or not the phone lines are operable), who notifies them, how often is your notification list updated, where is a copy of that notification list kept (always keep a backup copy offsite) and what mobile communications equipment will you need to provide in advance?

In addressing notification concerns, it is also important to have an updated listing of which facilities you own, lease space in, or are joint ventures. This information is critical in understanding who has legal responsibility for the physical recovery procedures and costs involved.

DELAYED ACCESS/SITE ASSESSMENT

Do not write your plans assuming the moment the fire is put out, or the water contained, that you will be allowed right back in the building or even into the geographical area in which your facility(s) is located. When damage occurs, and once the loss is stabilized, there can be a need for assessment of structural integrity, forensic investigations, or testing for toxic contamination, and this can delay your re-entry. Allow for at least a 24–72 hour delay in accessing your facility and if hazardous materials are involved, you may not have access for several weeks or longer.

Also identify in advance those areas of the building that you would need priority access to in order to do an initial emergency damage assessment, and make sure your special hazmat resources have the required training and certifications. Establish a dialogue in advance with the proper authorities, and perhaps, depending on the type of damage involved, it may be possible for you or your special resource to go in to the building, under proper escort and assess certain specified areas fairly quickly. This would provide you with initial assessment information, allowing you to activate certain areas of your disaster recovery plan more quickly.

It is also important to keep a current inventory of any hazardous chemicals or materials you may have on site, facility by facility and make sure you are in compliance with SARA Title III. Your disaster recovery planning process must allow access to this information immediately.

Your disaster recovery and business continuity plans must address potential extended recovery time frames. For example, as you look at structural recovery, if a portion of your building can be made tenable, which departments will go back into the facility first, and what will their needs be? All this must be identified in your plan.

RELOCATION

At what point do you temporarily relocate your employees and processes, and in what time frame must you consider a permanent relocation? Your organization probably has a plan in place to bring up your critical business applications offsite, but where will you relocate the remainder of your business units, and what are the time frames in which you must do this?

It is important to identify in advance not only the specific building or buildings you will utilize, but whether or not they can provide you with at least your minimum requirements in the areas of:

• Sufficient Square Footage
What is the minimum amount you will need for each of your departments to function in? Which departments will need to be in close physical proximity to each other?

Voice/Data Communications
Does your new site provide you with the necessary capacity, circuits, etc?

• Security
Does the new site offer you the potential for a secure environment?

What additional security provisions would you need in this new site?

• Fire Protection
Is the building properly configured to meet your minimum requirements?

• Environmental Controls
Can the building meet your needs for a clean room, data center, vital records area, etc.?

• Production Area, Warehouse Space, Chemical Storage Area, Shipping & Receiving Capability
What are your minimum requirements for these, and can the new site provide them to you?

• Parking & Public Transportation
What are your minimum requirements here, and can your employees or customers easily get to your new location? Where do they park?

• ADA Compliance
Will your new site meet these requirements immediately?

• Employee Needs
If you are presently providing food access and/or day care at your facility, will your new site have the same capability?

As you review these, and other questions, in relation to your own specific needs, make sure, in advance, that the alternate facilities you identify can provide you with at least your minimum requirements in these and other areas you identify. Begin identifying alternate facilities, costs involved in acquiring alternate space, and legal arrangements that must be put in place for acquisition. Do not identify an alternate site in close proximity to your existing one. There is a very good chance that this close alternate site could be affected by the same geographical disturbance as your existing facility.

EMERGENCY AUTHORIZATION PROCEDURES

As you review your list of emergency supply and acquisition requirements, also consider who can authorize major emergency purchases, at what dollar levels do those authorizations change and will the authorized individuals be available when you need them? Set procedures in place with backup authorization to help facilitate your recovery.

You should also determine in advance if special accounting procedures need to be in place for these emergency purchases. For example, it will be important for you to document that these purchases had to be made as a result of the damage that occurred. In addition, in order to make the building tenable, did you have to keep it open 24 hours so that the proper personnel could perform necessary repair and restoration, thus increasing your utilities and labor costs for that period of time? This data will be important for your loss documentation.

INSURANCE

Insurance considerations, both before and after the disaster, must address all possible disaster scenarios, including coverage for delayed access back to the facility if the geographical area surrounding the building is inaccessible. An example of this type of incident occurred four years ago in downtown Philadelphia, where officials were concerned that a building which had just suffered severe fire damage could fall down. General access to about a one square block area was denied until the structural integrity of the building was determined, and this took almost thirty days due to the tremendous amount of damage involved.

The individual who handles this critical risk management area should be an integral part of the Crisis Management Team. It will also be important to let members of the recovery teams know what documentation on the loss will be needed for settlement from each one of their areas.

PUBLIC RELATIONS

All too often, the individual(s) who is to act as the municipal or corporate spokesperson has not been identified in the plan, or if they have been, identification of that individual(s) has not been communicated thoroughly to all employees.

In addition to the media, it is equally important to address both internal, as well as external public relations so that your employees and community will feel comfortable with the way the recovery is being handled. For example, it will be important to let your employees and resources know quickly that they will still receive payment for their services.

It will also be important to let the community know that your plans are for continuing your community services. The designated spokesperson(s) should be responsible for communicating all necessary information.

COMMAND CENTER REQUIREMENTS

It is recommended that you have two disaster recovery command centers, along with your Incident Command Center. If your responsibilities include equipping these centers, here is a suggested list of some of the items you will want to include. One center is normally dedicated to the recovery of the service or business operations, and a second command center would manage the actual recovery.

Command Center For Recovery Of Service/Business Operations will normally require a subset of current operational equipment, such as LANS, sufficient communications, including phones, terminals, shared print capability, such as high speed laser printers, fax machines (individual or a fax pool), sufficient cabling, etc. These equipment and capacity needs will be driven by your current service and business operations. You will also need cubicles, furnishings, lighting, and will want to set up desk supply kits for recovery teams so that they can be immediately functional. Of course, food and bathroom facilities must be available. If at all possible, you should consider showering facilities as well.

Command Center For Managing The Recovery should include the necessary configured computer equipment, including PCs, printers, fax machines (outgoing and incoming), software to manage the recovery, a news intercept program, paper forms for itemizing problem issues and resolutions (separate forms for each), wall boards to track the progress of the recovery teams and to list problem areas, a building board specifically for facility restoration issues, and an environmental board on which you can track transportation exposures and utility issues.

Sufficient communication equipment will be critical and should include phones (at least one shared incoming line and one outgoing line per EOC member, monitors, scanners, TV & VCR, radio, pagers, cellular phones, and any other equipment which is specific to your organization's recovery.

Many recovery plans also include planning for a War Room which is fully equipped to handle voice and data, has a subset of the necessary computer equipment, radio, TV and VCR, news intercept, and in many cases includes a direct link such as an intercom to the other two command centers. This War Room is normally occupied by such individuals as the City Manager, County Commissioner, Risk Manager, Legal Counsel, and Public Information Officer.

The Command Center or War Room might be set up in advance, fully equipped and utilized during normal business operations as a regular conference room. Most important of all, there must be an area designated for your Emergency Operations Center, (how ever many you have) and you must know and plan in advance what your requirements for operating that center(s) will be. You will, of course, have already determined what your own security incident command center or facility management command center will require.

VITAL RECORDS RECOVERY

Although many of your vital records may be backed up and stored offsite, your facilities house numerous paper records containing information critical to the continuation of your services and business. Those documents could include vendor contracts, deeds, permits, tax records, administrative records, personnel files, building engineering drawings and updates, material safety data sheets, fire safety evacuation plans, compliance documentation for EPA, OSHA, DOT, asset inventories, etc., as well as other archival documents which are required, through legal retention schedules, to be saved for specific periods of time.

In addition, what work in progress, which is not yet backed up and stored offsite and is critical to the continuity of your business or services, remains in your facilities each night? How, for example, would you plan for the recovery of your claims files, litigation files, financial information, pending applications, contracts, administrative orders, etc.?

It will be important in your disaster recovery and business/service continuity planning process for you to interact with your Vital Records Manager so that you will know what you have stored on site and what retrieval systems to have in place in the event you need to move those records out quickly. Has your Vital Records Manager identified for you which records would need to be recovered and relocated first? Have they pre-qualified their resources for providing physical restoration of the vital records, whether they are paper, magnetic media, micrographic, etc.? Have they located an alternate site for these records once they are restored if your original or new facility is not available immediately? What procedures or alternate facilities and equipment do they need you to have in place for them?

MANAGEMENT'S COMMITMENT TO THE RECOVERY PLANNING PROCESS

As we review this partial list of concerns which must be addressed (and we have not even begun to address in this article the critical areas of information systems (including LAN/WAN recovery), electronics and telecommunications recovery, and establishing of a crisis team and their tasks), it is easy to see the amount of manhours which will be involved in accomplishing the development of the plan. As time is money, how important is this planning process?

We must understand what is the true nature of cost of risk to an organization or community. We know that cost of risk is a way of measuring the degree of risk by examining several of the worst possible loss scenarios.

Once identified, these scenarios should be communicated to upper management so they, too, can begin to see and support the value of disaster recovery/business continuity planning efforts. Failure to support these efforts can directly affect the business or the business and community's public image and bottom line.

A business impact analysis (BIA) is a proven method of determining this cost of risk. A business impact analysis (BIA) can also assist you in accomplishing this enormous disaster recovery and business continuity planning process in an expeditious and cost-effective manner.

As you begin the planning process for your organization, whether from the entire institution structure, or for individual departments or locations, it will obviously be important to initially define the impact of business or service disruptions, and target those operations and processes which require recovery planning. This entire data gathering and analysis process can be accomplished quickly and easily by utilizing the latest technology in business impact analysis tools. The output of this critical information will also need to be presented to your management in professionally designed graphs and charts so that the impacts are easily understandable. This should be part of any BIA product.

Once your critical areas have been identified, your software planning product should enable you to easily and quickly develop the plans, enter and maintain the data critical to your recovery and provide you with a swift and successful plan activation. Although many plans start out in a word processing document, if a disaster occurs, you don't want to have to be searching through a manual looking for action lists, notification procedures, recovery team members names, numbers and tasks. Automation of the planning process allows one to more thoroughly create the plan, maintain it and, when necessary, activate it in a constantly changing and downsizing environment.

A well designed, implemented and tested contingency plan is a teamwork effort. Through thorough input from the managers of the areas we have discussed here, as well as others, (including the possible use of external consultants) your plan can be successfully responsive to unexpected circumstances and their requirements for business/service resumption and continuity.


About the author:
Pat Moore is Vice President—Business Continuity Education for Strohl Systems, headquartered in King of Prussia, Pa. and is a Certified Disaster Recovery Professional (CDRP), as well as a Fellow of the Business Continuity Institute (FBCI). Strohl Systems and its global network of distributors provide disaster recovery, business continuity, and business impact analysis software and consulting services. Pat is known internationally for her real world expertise and experience in the disaster recovery and business and service continuity industry, and lectures worldwide on these subjects.

For more information call Pat Moore at (800) 634-2016 or (610) 768-4120. Fax (610) 768-4135. This article is an excerpt from one of the author's additional works. You can also visit the website Strohl Systems.

This article may not be reprinted, reproduced, distributed, reduced to any electronic medium or machine readable form in part, or in total, without the express written consent of the author. All Rights Reserved. Copyright ©Strohl Systems 1996

[an error occurred while processing this directive]