We are past the first anniversary of SuperStorm Sandy, which was a real wakeup call about the fury of mother nature and the real possibility that storms of such ferocity will occur more often than previously estimated because of climate change (more energy in the atmosphere). I just learned of about half a dozen homes in my own community which are still not habitable a year later. Preparing for an emergency, minimizing human and property loss, and being able to resume operations in a relatively short time are critical issues for the very survival of your business. Studies are still being performed, but hundreds of businesses were ruined physically and financially by Sandy.

There is no procedure or magic design of a building that will guarantee safety, no injuries or fatalities, or no damage to a building struck by a disaster. All you can hope for are two things: to minimize physical damage and injury; and to be able to resume operations as fast as reasonably possible. Studies of storms and other disasters indicate that every incident is unique; when you thought you prepared for every possible problem, a new one rears its ugly head. All you can do is plan smartly to lower the risks. Here are some strategies to consider and implement:

1. Your level of emergency preparedness should be based on your needs. If yours is a small firm in a small facility in a region with historically few storms, your needs will be fewer than a large facility with many employees, storing potentially dangerous chemicals in an area often hit by storms. While all firms should prepare, your level of preparedness should be based on your specific needs.

First, invest some time and catalog the number of times your area has been hit by hurricanes, tornados, snowstorms, outages, extreme heat, even terrorism in the last few decades. Perform an elevation study to determine if your buildings are in the 100-year or 500-year flood plains. What could happen to your facility or business if a severe event occurred? What could be your losses (building, data, inventory)? Are they recoverable? Might you lose your customer base? These answers should dictate the level of detail of your disaster preparedness program.

2. Modify physical structures to minimize risk. See my blog in August about this issue (www.CCESworld.com/blog) with specific strategies to reduce risk from severe storms. For example, make sure water from a storm has somewhere to go, to a path less destructive of the building. Always focus on preparedness and minimizing human loss. Ensure that critical, expensive equipment is raised to an elevation above potential floods. Yes, many of these strategies cost money and will have a small or non-existent payback. But reducing risk of catastrophic loss is critical. Implement and test those that make most sense for your facility. Make sure to have a Health & Safety Plan (HASP) and that it is up to date and tested.

3. Data. Because we don’t “see” data, we generally take it for granted and may not safeguard it. However, in my experience working with a variety of businesses, data may be the most important part (besides employees and customers) of a business for survival. Some businesses have suffered greatly from lost computer data from storms, outages, or accidental deletion. Data loss or destruction should be protected robustly. Many a business has not recovered from data loss.
It should be noted that while the emergency situations discussed above impact data, there are other ways to impact your data, including Internet or phone lines being down, insufficient AC in IT room, server crashes, key IT employees sick or on vacation, database corruption, power outages, and accidental data deletion.

There are three aspects of protecting data:

a. Backup. Have backup data (if main data is lost)

b. Recovery. Have a plan to get both your data and your computer infrastructure up and operating after the disaster

c. Continuity. You should be able to use backed up and/or recovered data and systems to allow you to continue your business operations as normal as fast as possible. Don’t skimp here.

It is important to develop a reliable backup system for your data. It should be independent of a disaster, and physically in another location or “cloud”. Backup data should itself be secure from potential catastrophes. It should be retrievable; a useful, current form can be recovered. Therefore, if your data system changes, your backup files must change too (i.e., tapes) for use in a modern system. Backup data should be updated regularly so it is current, based on your needs (manufacturing may need daily updating; routine paperwork: less often). Backup data, like regular data, should be appropriate historically, based on your policies. Data required to be retained for a certain time period must do so in both regular and backup files. The USEPA will not accept an excuse such as a disaster destroyed all the historical data for a Title V permit requirement to store data.

Therefore, planning is needed for data, too, not just for equipment or people. In the lingo of data, it is important to define a Recovery Time Objective (RTO). Might data loss hurt the bottom line in a matter of minutes? Weeks? A time in between? Also, determine a Recovery Point Objective (RPO). How much and which data can you tolerate losing permanently? Are there compliance issues requiring access to certain data (i.e., Sarbannes-Oxley)? Invest accordingly.

Work with an IT security specialist to write and implement your plan. Ensure that your backup and retrieval strategies are automated. Do test them periodically.

CCES has the experience and technical knowhow to help you assess your emergency preparedness needs and can bring in the right specific professionals to help you write and implement the proper plans to lower your business risks from a number of potential catastrophic problems. Contact us at karell@CCESworld.com or at 914-584-6720.