Business Continuity Planning for Small Businesses

Please direct all correspondence to: Robert Bugtel 1-866-932-2587 ext. 123 info@digitalfortress.biz Digital Fortress, Inc. October, 2007

Business Continuity Defined

Business Continuity (BC) planning is a process of planning ahead to insure that your business remains unaffected by events that would normally lead to serious interruption or even failure. It creates a plan that management and staff can rely on as a road map to get back up and running as quickly as possible eliminating/minimizing losses in the event of an emergency situation. In the event of an emergency (which can range from employee illnesses to complete destruction of the business facility), S2Ms can rely on this predetermined plan of options that present a clear path of action as well as the consequences there of. Many S2Ms operate under the assumption that backing up their computer data is enough. Nothing could be further from the truth. While computer backup is an essential part of BC planning, to be sure, its only a part. Examples of eventualities that S2M companies should plan for are: Severe weather Supply disruptions caused by o Bad weather in port cities or at distribution terminals o Transportation strikes o High fuel prices or fuel shortages Severe seasonal illness, such as the flu (Key Staff Depletion) Denial of access to your premises o Fires o Hazardous waste spills o Gas leaks o Flooding Natural catastrophes Man-made catastrophes Utility disruption o Electric o Telephone o Gas o Internet Computer hardware crash Key production equipment malfunction

As if any more reasons are required for BC planning, consider that if the IRS audits you, even in the aftermath of a catastrophe, accurate records are necessary. Sound business continuity planning is as crucial as financial planning.

Additional Advantages to BC Planning

Besides helping you stay in business, having a BC plan can help get you more business. If you own a S2M business and hope to become a supplier or subcontractor to a Fortune 1000 company or certain government entities, you will quickly find that they require your company to have a BC plan. Many large manufacturers, automakers for example, practice just-in-time purchasing. Rather than tie up money in inventory, they depend upon suppliers to provide them with parts on a tightly orchestrated schedule.

Suppose your company wants to bid on a contract supplying Ford Motor Company with fenders for one of their plants. If the fenders do not arrive in a timely manner, Fords assembly lines come to a screeching halt. In order to secure their production schedule before contracting with you as a supplier, Ford requires a complete business continuity plan that clearly shows how your company will deal with supply interruptions for sheet steel, which you use to make your fenders. They want to know that your problems will not become their problems. Furthermore, Ford Motor Company will also have you sign a performance contract. It states that you must supply the agreed-upon number of fenders with the agreed-upon quality at the agreed-upon time. If you fail to perform, you will not only lose the business that you worked so hard to attain, but you have agreed in advance to pay heavy penalties as well.

Traditional Business Continuity

The vast majority of the worlds most successful companies know the value of BC planning. Many spend millions of dollars each year on planning staff, secondary datacenter and emergency duplicate worksites that can be ready in as few as 4 hours. The BC staff tries to think of every conceivable mechanism that could go wrong or problem that could arise, and a plan of action for each instance. Then they train the management and staff of the company as to what their roles will be in these various situations. Because most S2M companies are unable to afford the excessive costs normally associated with business continuity planning, traditional BC consultants have ignored this market for years. The result being, that over 2 million S2M companies in the U.S. alone lack any type of business continuity planning.

What the S2M Sector Can Do

It is said that the first step to recovery is admitting that you have a problem. Weve dealt with a vast number of S2M businesses, and the reason they called on us in the first place was that Something Bad had happened. No matter what the size, Something Bad will happen to every company at some point. The only question being, do they sit frozen and immobile, like a deer caught in the headlights, or are they prepared to act quickly and decisively? Most people would choose the second option. And its easier to get there than they think.

Step 1 Generate Your Company Specific Plan. The simplest way to do this is to create an exhaustive checklist that covers every aspect of your business. You will include, among other things:
Contact information of EVERYONE connected with your business, including employees, vendors, customers, insurance agents, etc. A complete inventory including computers, software, production equipment, etc. Insurance policies

Then you will begin planning for things that can go wrong and viable solutions. Among other items, you will consider: What to do if you are denied access to your premises because of floods, gas leaks, etc. o How will you notify your employees, suppliers, and customers? o Do you have up-to-date computer backup so that you can set up operations in temporary facilities? o How will you collect on your Receivables and service your Payables? o If you are denied access to your premises for an extended period, how will you address the issue of production? o Do you have performance contracts with any of your customers that could expose you to monetary penalties should you fail to satisfy the contractual agreement? What will you do if your premises are badly damaged or contaminated? o How do you assess the extent of the damage/contamination? o Can it be repaired? o Do you have a priority plan on repairs to allow for return to critical processing capability? o How long will the repairs take? o Will a building permit be required? o If the company that provides the repairs has a backlog of bookings, what alternatives are there? o Alternative contact information and capabilities o If the building has to be razed and rebuilt, how long will that process take? o How long can this building be out of service before it affects your ability to remain in operation? o What effect on cash flow would occur with the loss of this building? o How quickly would the effects be felt? o Is it possible to rent suitable facilities to reduce your downtime? o Which real estate agents are best suited to securing suitable rental property? Identify them and list complete contact information. o How tight is the rental market in your area? o Provide a cost estimate for the rental property. Employees o If the Plant and/or Office Building suffered catastrophic damage, were any employees killed or injured? If yes, who will be responsible for: 1. Keeping track of who has been injured 2. The extent of their injuries 3. What hospital they were taken to 4. Notifying the families 5. An up-to-date list of everyone on the premises, including temporary employees and contractors o How will everyone communicate after the incident? o Note that if there is a great deal of seasonal illness in your area, then temporary workers may be in short supply. How will you cope with this? o What will you do if public health officials start closing down schools as a preventive measure? Would you allow employees to bring their child/children into work? What are the pros and cons?

As you can see, there are a lot of elements to consider, and we have barely scratched the surface. After you have thoroughly planned for every reasonably foreseeable contingency, and developed a plan for dealing with each one, your next step will be to safeguard your computer data.

Step 2 Are your computers and servers COMPLETELY backed up? That means the operating system, registry and programs in addition to the data. A complete backup is the ONLY way to get an inoperable computer/server back up and running in a matter of hours rather than days or weeks.
Are you backing up to tape or disk? Tape backups are slow to restore, difficult to test, and have been shown to be prone to failure. A Yankee Group and Sunbelt Software survey of 362 IT executives in March 2004 found 42 percent of respondents had been unable to recover data from tape in the last year as a result of tape unreliability. Are you giving yourself the best possible chance for a successful system restore? We have experienced a surprisingly large number of S2M businesses still relying on Windows 98. The owners explain that Windows 98 and their 6-year old computer still do everything they want, so why spend money on upgrades they perceive as unnecessary? While we can certainly appreciate saving money wherever possible, these business owners are overlooking something very important. Computers really do have limited lives. Imagine that a business is running its accounting system on an older computer running Windows 98. Further imagine that perfect backups exist that will allow the entire system Windows 98, programs, settings, passwords and data to be completely restored onto a new computer. For whatever reason, the older computer suffers a major power surge, and every electrical component is burnt out. The business owners only choice is to purchase a new computer. The new computer will have the latest AMD or Intel processor, huge amounts of memory, a hard drive with a capacity of, say, 250 gigabytes, USB 2.0 ports for connecting peripherals such as printers, digital cameras or scanners, and modern audio and video systems. When Windows 98 is restored to this new computer, it will be a total disaster. It will not recognize most of the hardware, which was designed years after Windows 98 came out. It will not recognize all the new memory, it will not be able to access all of the new hard drive, and the business owner will not be able to obtain the drivers (little programs that allow hardware to work) to allow Windows 98 to function with the new audio and video card. In short, the system cannot be restored as todays average technology has outpaced the Windows 98 platform. When the business owner finally does surrender to the inevitable, and upgrades to Windows XP or Windows Server 2003, he will find that most of his software is not supported. Unfortunately, he will have to buy current versions of all of his programs, which can prove to be very costly. What should have been a 2-hour restore has turned into a 2-week trudge. Bear in mind, this computer held the accounting program.

We hope that this has illustrated the necessity of replacing older computers with reasonably up to date models. Remember that both hardware and software will need periodic updates in a viable business continuity assessment. By doing phased, scheduled replacements, costs can be spread out, stress is reduced and business can proceed without interruption.

Step 3 Not many people consider this, but are everyones cell phones backed up? While Blackberries and similar mobile devices have software that allows them to synch to a computer, cell phones require additional software and hardware. How important is this? Have you ever seen someone who lost or damaged their cell phone and lost all of their contacts? Its not pretty. Step 4 Put your mission-critical documents online. To those unfamiliar with this idea,
adopting the use of a Web Office allows authorized users to access and work with files from any computer with Internet access. Depending upon the service used, features may also include: Shared calendars Shared / private contacts Online discussion forums Web meetings Task lists

The main Business Continuity / Resilience benefit is that work can still be done when the office is inaccessible. When you consider all of the floods, heavy snowstorms and wildfires that have caused power failures and evacuations for hundreds of thousands of people over the last several years, this turns out to be a very substantial benefit.

Conclusion Business Continuity planning is well within the realm of possibility for the Small-to-Medium sized business. Its costs are so small, and the benefits are so great, that the old adage Failing to plan is planning to fail has never rung so true.