For professionals in the business continuity field, it is that time of year again: hurricane season. If you haven’t started to exercise hurricane planning procedures, it isn’t too late.
I believe that it was The National Hurricane Center that stated that 2009 would be a moderate or “near-normal” year for hurricanes, and it’s not likely the southeastern United States will see anything like Katrina or Ike.
However, that doesn’t mean you shouldn’t plan or test your existing hurricane preparedness plan.
Digging Up Resources
Beginning your hurricane planning all starts with a solid business continuity plan, but not every company has one in place. A good first step is to know the disaster recovery and hurricane resources that are available. There are many Web sites that track potential storms and provide evacuation routes as well as alerts and best practices to protect from potential risks.
- National Hurricane Center: This is the National Oceanic and Atmospheric Administration section that monitors all severe storms and is usually the first to project the path and category changes.
- The Florida Division of Emergency Management site is a good resource for family/home disaster planning.
- FEMA
- Ready America
- American Red Cross
- Disaster Recovery International Institute: DRII is an excellent resource for BCP and is a consortium of business continuity professionals dedicated to setting industry standards and sharing knowledge around the practice of business continuity management.
Companies that are successful in recovering from a hurricane have usually prioritized the recovery of their communication and other business-critical servers, as well as exercised the plans regularly. The first priority of any hurricane planning is the safety of the people — having well-published evacuation routes available. Plans for relocating to a disaster recovery facility should be well-known.
Communication is also a critical step when planning. Make sure there are methods in place for reaching and communicating instructions to first responders, employees and family members. Don’t rely on your cellphone. If there is anything positive to come out of the hurricane Katrina devastation, it is learning what worked and what didn’t. Cellphones don’t work when the towers are missing, so rechargeable two-way radios will be more effective in an actual disaster.
Build a Team
With a few simple preparedness steps, many businesses have successfully evacuated safely and resumed business operations from remote locations. There are 10 professional practices for business continuity planning; all are equally important and, if followed appropriately, will create a solid foundation for successful hurricane planning, exercise and recovery.
For a company, roles and responsibilities should be identified, along with the priority of the infrastructure that needs to be recovered in order to resume a functional level of business operations. Start with building a dedicated team that is committed to hurricane preparedness planning, and select team members who can effectively manage responsibilities for their portion of the plan.
The next step of a business continuity plan is the risk evaluation and business impact analysis; however, with hurricane preparedness, you have already identified the risk and can assume the worst — that all business operations will halt — as the impact to the business.
The next goal is to identify the strategy that will be used to help recover company assets and resume business operations as quickly as possible. The IT infrastructure that is in place — and whether there is a disaster recovery data center available — will determine the path and priority of the recovery solution that is implemented.
The first recovery step, after all employees have evacuated or been relocated to safe areas, will be to recover the communication systems. Next will be to recover business-critical system that will allow the company to return to a functional level of operation. Last will be the tier two and tier three servers that don’t have rapid recovery-time or recovery-point objective requirements. Categorizing and documenting the priority of the servers that need to be recovered will help to meet defined recovery point (RPO) and time (RTO) objectives. Once in place, there should not be any question as to what should be recovered first in the event of a hurricane outage.
Opening Options
A hurricane doesn’t have to mean complete data center destruction, so there are different levels, from mild to severe, that will require different courses of action. A company can still be impacted by a hurricane even if it isn’t a direct hit. Power outages are a more likely risk that a majority of organizations face from hurricanes. The process for recovery is the same but may not be taken to the full extent of an actual data center loss. With extensive power interruption, companies will usually pick and choose what should be failed over or recovered, and elect not to roll the entire data center. This is when defining the different levels of interruption is important. Plan for the flexibility to choose which path is best.
The previous steps allow companies to design and implement a comprehensive strategy that meets their requirements and objectives. I have seen companies try to shortcut these steps and immediately skip to implementing a solution, only to find out that their infrastructure doesn’t have enough power, bandwidth, resources or executive approval to support the controls implemented. The lesson: Don’t try to take shortcuts and jump into something you have never done before. Following the above steps will allow you to proceed and likely avoid difficulties during the deployment and execution of your plan.
The last two practices, crisis communication and coordinating with external agencies, is really the culmination of the above practices and will ultimately be a large factor in the success or failure of your plan. In the event of a disaster, communication is critical to coordinating with emergency responders and your own business-continuity team to make sure evacuations and safety procedures are implemented effectively.
Planning and testing is your best friend when it comes to hurricane preparedness. Starting with executive buy-in though budget, infrastructure, process, procedures, testing and ultimately execution, you can’t plan or test enough. When it’s done right, companies will have the confidence needed to recover business operations to a functional level quickly and safely.
Brace Rennels is CBCP (certified business continuity professional) at Double-Take Software.
Loading ...
