Bob Lewis
Columnist

The basics of recovery and continuity planning

analysis
Jun 17, 20053 mins

Dear Bob ... Just curious--in your experience, what can businesses do to "fireproof" or disaster-proof their businesses and protect their workforce (beyond insurance) make their individual situations as safe as possible in the event that circumstances beyond their control truly strike? I'm a part-time firefighter, and there are some really basic tenets we pass along to the public on how to prepare (without bein

Dear Bob …

Just curious–in your experience, what can businesses do to “fireproof” or disaster-proof their businesses and protect their workforce (beyond insurance) make their individual situations as safe as possible in the event that circumstances beyond their control truly strike?

I’m a part-time firefighter, and there are some really basic tenets we pass along to the public on how to prepare (without being paranoid) for these situations, and I was wondering if many businesses have models for surviving and overcoming emergencies or disasters? In addition, do many corporate boards and management teams run drills or exercises so that their whole team is familiar with what to do or at least have a moveable chain-of-command so that business can continue with as small an interruption as possible? In my personal experience I have seen a lot of businesses, at least small ones anyway, that go legs-up in the grass when even a smallish incident throws them completely out of sync.

It strikes me that in today’s marketplace with its pace, this would be a valuable survival skill to have.

Hey…maybe we have the germ of consultancy-style business here…

– Not in the game, but thinking of it

Dear Gamer …

Sadly, others beat us to the punch. By a couple of decades, in fact – the disciplines are called disaster recovery (or business recovery) planning and business continuity planning. There are some differences between the two. The former expects downtime in case of a disaster and tries to minimize the time needed to get back into the game; the latter tries to create a business architecture in which essential business services continue, even in the event of a disaster.

To answer your question: After 9/11, I think it’s fair to say that just about every publicly held corporation has developed some form of disaster recovery or business continuity plan. The basic steps for either are to:

1. Catalog the potential types of disaster for which a plan is required (loss of the data center, loss of an entire facility, blizzard, flood, etc.)

2. For each type of disaster, inventory the business functions that could be taken out of service by the disaster.

3. Establish recovery times for each business function. Generally, customer-transaction functions such as order entry and customer service are first; planning and other long-range functions are last. In the case of business continuity planning, at least the customer-transaction functions have a recovery time of zero: They must remain available regardless, and support functions, such as shipping, must be restored before customers would notice that they’re missing.

4. Figure out how to achieve the recovery times – statements of good intentions aren’t worth very much, after all.

5. Test each element of the plan. While it isn’t always feasible to perform a full-scale test, that’s clearly preferable. When it isn’t, testing the elements piecemeal usually is, and is absolutely necessary. As the saying goes, a business recovery plan that hasn’t been tested isn’t a business recovery plan.

There’s a whole lot more to it than this, but it should give you a place to start if you’re interested.

– Bob

——–