When a disaster event is over and the dust has settled, what happens? Assuming you have a business continuity (BC) plan, you'll begin by bringing your employees back, restarting your systems and operations and recovering your business.
Your business continuity and disaster recovery plans will help you launch your recovery, and should be designed to accommodate even the worst-case situations, such as a "smoking crater." In such a situation, you may be faced with relocating to temporary office space (while your original offices are being rebuilt) or completely new office space. And there are many other considerations, not the least of which is ensuring that -- to the outside world -- your organization is operating in "business as usual" mode.
To give you a better idea how your plans can facilitate recovery, we are suggesting specific actions you can take on Day 1, Day 3 and Day 7 following a disaster event. Days in between these days are assumed to be continuation of the activities previously initiated (i.e., Day 2 activities are a continuation of Day 1 activities).
Your primary post-disaster activity is to take care of your employees. On Day 1, your focus is on ensuring that all employees are safe and those who are injured are receiving proper care.
Sadly, if there are fatalities, you will need to meet with first responders, law enforcement, families, employees, healthcare organizations, the media, lawyers and others. Your emergency response teams are coordinating activities with these and other organizations to establish a flow of activities to begin the process of rebuilding the firm.
Other teams, such as damage assessment teams and public safety authorities, may be sifting through the damage looking for forensic evidence on how the event occurred.
Additionally, you should:
- Schedule meetings to examine and act on options for alternate office space, alternate manufacturing facilities (if needed), working from home for employees and alternate special arrangements, such as contact centers.
- Set meetings with banks and other financial institutions, insurance firms, government agencies, accountants and law firms to address many operational issues to ensure that the organization can get re-established on a solid footing.
- Work with various organizations to ensure that critical systems are restarted, virtualized systems and database are recovered, critical business data and vital records are recovered, and remote access for employees to work at home has been established.
As we mentioned earlier, Day 2 activities should be a continuation of Day 1 activities. Assuming you have addressed your most pressing people issues, your various emergency teams and department leaders are now hard at work recovering and restarting their activities. The IT organization has been working around the clock to ensure that all critical systems and other IT assets are operational, that sufficient network resources are available to connect everyone, that email and other basic office necessities are working, and that any other technology issues that have not been resolved are in a queue for resolution.
Additional important activities that should be in progress on or before Day 3 include:
- Finding space to move office and related operations so that people can return to a more-or-less normal office environment.
- Obtaining furniture and supplies, depending on the type of space selected. This may take a few days, so it is important to ensure that employees can work from home as well.
- Ordering additional conference bridge services, if necessary, to facilitate communications among departments and their employees.
- Holding regular meetings to identify what is working, what's not working and what's being delayed.
- Determining what's arriving on time and who is having trouble adjusting to the "new" environment, and responding to complaints from unions, if applicable.
- Reviewing what will be said at the next media briefing, if applicable.
- Examining the organization's financial status for such things as processing purchase orders.
A week later, it is likely your organization will have most of its people issues addressed. Alternate work areas will be identified and may already be occupied (or be in the process of being populated). Employees will be returning to the new/temporary office space. Manufacturing operations will be in the process of being reactivated. Departments will have synchronized with each other and will be operating almost normally. Investigations into the incident will be continuing, and meetings of the various emergency and operating teams will continue, but not at the same frequency as earlier.
Most IT systems and networks will be actively supporting the business's operational needs. The organization's financial situation will be reviewed on a daily basis to ensure sufficient cash and other financial instruments are available. Meetings and conference calls are being scheduled with the firm's primary stakeholders and key customers to provide more detailed updates on the event and how the company is managing. Finally, based on the nature and severity of the incident, planning for a return to business as usual should be underway.
Business continuity and disaster recovery plans focus on preparing for a disaster event by recommending preventive measures to mitigate the severity of an incident, providing contact lists for various teams, vendors and other resources, and offering detailed procedures for responding to an incident and then recovering the business. While the level of procedural detail in the recovery phase may vary by plan, all plans should nonetheless provide recovery guidance for all disaster scenarios identified.
Unless a BC plan specifically includes detailed post-disaster initiatives, such as the ones we've described here, many business recovery activities will of necessity be identified and initiated on the fly. It is essential that potential post-disaster issues and activities are identified and detailed procedures are documented so that post-event recovery can be launched as soon as possible and business as usual (or almost as usual) can be re-established.
Five things you must do before a hurricane to protect your business
Why the change management process is important for DR
Conducting a tabletop exercise for disaster recovery testing