This past weekend, the weirdest thing happened - our neighborhood was hit with a blackout. In my area, this hardly ever happens. Short of earthquakes (knock wood), we're pretty devoid of the threats the midwest or the east coast face. And while it wasn't long enough to be significantly impactful (it did end up being about 36 hours), it was long enough to make us seriously reevaluate our disaster preparedness. Because we had a gas stove, we could still boil and fry things, but forget about using the oven. It did, however, make me rethink how much we take things for granted (ie: the uninterruptible power we've come to so rely on) and further our ability to bounce back. After the novelty wore off and there was no ETA for repair, my mind started racing through all the "what ifs?" Which made me think about our clients and their ability to bounce back from a truly impactful business disaster.
But, beyond backup and disaster recovery lies the concept of "business continuity". A true Business Continuity Plan really goes to how you keep your business running in spite of a disaster. A true Business Continuity Plan is more than the steps required to restore some files. It's about how to ensure uninterrupted operation of your business or at least minimize as much as possible the interruption you might experience during a catastrophe. Often times, the difference between the two (un-interruption vs. minimal interruption) is based on cost and assumption of risk more than anything. Unfortunately, it seems smaller companies commonly ignore the need for a BC plan, which leaves them highly vulnerable in the wake of a disaster. While on the other hand, many larger companies who have BC plans themselves are starting to demand that their suppliers provide them with their Business Continuity Plan. The more critical the parts or service a company provides, the more detailed the plan must be. This requirement is actually a good thing, since without that push, smaller businesses tend to investigate Business Continuity only after a loss, not before.
Just like every aspect of a consultative approach to IT, the Business Continuity Plan is based on the business' goals and objectives. An accounting firm may not need to be back up and running for 24 hours (unless, of course, it's during tax season). But, an investment advisor may lose millions of dollars if they're down at any point during market hours. Unfortunately, we're living in a time where CEO's still think anything (and everything) can be recovered at any time without any consideration to realistic costs or realistic preparedness. So setting the correct expectations from the outset is key. And one of the keys is the foundation of an off-site backup. Another way to avoid a disaster is to keep your servers elsewhere all the time, relying on virtual desktop technologies, Infrastructure-as-a-Service, or Software-as-a-Service. Keep in mind though, the use of application hosting of any kind makes internet access that much more critical. So you need to consider the added cost of having a backup ISP available. Adding to this complexity is the twist of remote workers working from home. Remote and mobile employees are constantly testing your BC plan.
Which leads to another piece to the puzzle - it’s critical to look at the human element. In smaller businesses, one person may do four things. You need to understand those jobs and document them so that someone else can take over if necessary. How will you contact employees to coordinate the new working situation after a disaster? Decide on your phone call list now. Do you have a list of all employees’ home and personal cell phone numbers? Is that list stored off-site? Also, think beyond the typical IT equipment list. If you’re working from home, can you cut the checks needed? Who cuts checks if the printer is gone? Such back-office operations are easy to forget, and many businesses with older accounting software may be limited to certain printers. Follow the workflow of back-office operations as part of your BC planning. As you can see, a proper plan requires that all of these complexities have been addressed beforehand.
And conceptually, any BC plan is sort like insurance - you pay for something that you hope you'll never have to use. But boy, when you need it, you're sure glad that you did it. And lastly, always, always, always remember to consider where you store this plan and who has access to it. If you store it on your inhouse servers, it's just like you don't have one!
Just like anyone hit with a disaster, we're now shoring up own our home disaster preparedness. Candles - check. Matches - check. Generator for wifi hot spot - check. Never having to use any of this - priceless!