While the debate on climate change continues, the analysis of the impact weather-related events can have on an...
organization is a key part of risk assessments and business impact analyses.
Recent severe hurricanes -- such as Harvey and Irma -- and their aftermaths remind us that we must be even more diligent with how we plan for and respond to these events. Are current natural disaster recovery plans sufficiently robust?
Typically, we have advance warning for hurricanes, and, to a lesser extent, tornadoes. These are the two most damaging weather-related situations we face. But how would a natural disaster recovery plan handle, for example, a microburst? We hear news reports of ultra-high winds and several inches of rain suddenly appearing from out of nowhere, with no warning, and with devastating results.
Some of the more recent hurricanes also remind us that, despite extensive preparations by local, county, state and federal government emergency agencies, we cannot handle all possible weather and climate-related events. Issues such as emergency evacuations on a massive scale and providing shelter and food for thousands of homeless storm victims are outside the scope of a typical natural disaster recovery plan.
How do we plan for these severe weather-based events using traditional BC and DR techniques? A traditional BC/DR plan takes an all-hazards approach, but even that is limited when faced with a Category 4 or 5 hurricane. The best advice -- as we'll note in the following paragraphs -- is to prepare carefully, do the homework, train employees on what to do in an event and conduct periodic emergency exercises for all employees.
Research weather and climate events
First, be sure to include weather- and climate-based events when performing a risk assessment. The National Weather Service and National Oceanic and Atmospheric Administration can provide extensive historical data on weather and climate conditions for the continental United States. And, of course, use your own experience -- as well as your fellow employees' expertise -- from being in a specific area as part of your natural disaster recovery plan research.
Next, when performing a business impact analysis, identify the mission-critical functions, data and personnel needed to sustain your organization; analyze the historical climate data; and identify situations that could damage your key business assets.
Here are some important questions to ask:
- Is your office located in a flood plain?
- What impact would six to 10 feet of floodwater have on your offices?
- If power is lost, how long can you keep your critical systems operational?
- Can your employees work remotely?
- Where else can they work if their homes are damaged by flooding?
Once you map these elements together and find where they intersect, you can develop one or more strategies to protect your key assets in a severe weather event. Think in terms of how to recover the business if the offices are flooded, or if the building is destroyed or severely damaged so that it is uninhabitable. Build your natural disaster recovery plan around these situations and strategies accordingly.
Technology is a key survival strategy
If your organization is in a danger zone, have all key electronic assets -- such as systems, data, databases and servers -- and resources backed up and available for rapid activation and operational recovery following a destructive event.
Cloud-based services make this strategy a reality. Assuming you take advantage of such resources, perhaps the most important BC/DR plan activity you can perform is regular testing of cloud-based data backup and system recovery services. That way you'll know how quickly you can recover and resume business operations.
Additional cloud-based resources may include an emergency notification system (ENS) to communicate information and instructions about an event to all employees. Naturally, events like hurricanes provide advance warning, and ENS technology can ensure that any changes in a storm's track or evacuation notices from the authorities can be delivered quickly to all employees.
Can an ENS notify people of a microburst? Probably not in time, but the system could be used to alert employees that weather conditions favorable to the development of microbursts are present.
Based on hurricanes Harvey and Irma alone, it's clear this past season will be one for the record books. Use advances in technology to protect your critical business information assets and ensure that your employees are trained and ready to respond to severe weather.
Incorporate natural disasters in BC/DR planning
DR site location is important for data protection