Don't wait till the pressure is on to do your
contingency planning. A little time spent now could save a lot of
trouble later, says Helen Beckett
The worlds of disaster recovery and business continuity have
become part of a much broader school of thinking that might more
usefully be called business resilience.
And the smaller company would be well advised to devote some
time to the subject because it could be the biggest
beneficiary.
Noel Carey, business continuity and recovery consultant for IBM
Services, said the main part of being prepared is to do your
thinking in advance. Once you have worked out how you would react
to one unexpected situation, this response can be applied to a
range of incidents, not necessarily all "natural calamities".
A company in a niche market may have to respond to unexpected
demand for products; an epidemic of avian flu would create huge
demand for the hygiene products or face masks advertised on
specialist websites, for instance.
"Historically, smaller businesses have said 'we know how to fix
hardware'," said Carey. This would usually have involved using a
warranty or hiring the services of a specialist and would have been
a reaction - perhaps a planned one - to a particular hardware
event.
However, few businesses have asked, let alone answered, the
question: "What do we do if something happens to the people who use
the computers?"
For a long time, this was simply ignored and it was only when
major catastrophes occurred on the world stage that the concept of
business continuity developed.
Thinking around "what if" scenarios might include identifying
alternative suppliers of raw materials and where to source extra
staff. It should also include how to ramp up computer and network
capacity quickly, perhaps through a managed service.
The biggest problem is to estimate the impact a disaster would
have on an organisation and how to recover functionality and
resources. In some situations, access to a building may be
prohibited, which would hit a smaller company hard. A big company
may have alternative offices to relocate staff to and spare
capacity on the network, whereas most smaller firms will not.
When making a business continuity plan companies of all sizes
need to ask themselves:
- What are the main vulnerabilities of the business?
- What threats could harm the business?
- What would the impact of such an event be?
- Which are the critical applications?
- How long do I have to fix them before business
degrades?
These are all questions that businesses in the vicinity of the
Buncefield oil terminal will have needed to know the answer to.
There are good places to look for advice that need not cost a
fortune or could even be free for the canny SMB.
In 2004, the Civil Contingencies Act made it compulsory for
local authorities to provide free disaster recovery advice to their
business community. This was part of the government's response to
the terrorist attacks of 11 September 2001, so the council
emergency planning department is a good place to start
"Don't be afraid to talk to the professional bodies," said
Carey. "It sounds expensive, but there are ways of getting round
it. The best way is to pick brains to get a framework of the
planning that has to be done.
"Once you have this skeleton plan in place, you can fill in the
gaps yourself and perhaps get a consultant to do a final
check."
There is often a gap in contingency planning between large and
smaller companies, mainly because of the discrepancy in resources
available.
"There are always more urgent pressures that keep business
continuity in the sidelines," said Carey. And complacency sets in
remarkably quickly after a headline disaster. "It is hard to keep
up interest once any immediate crisis has passed," he added.
The most important resource is time spent thinking and planning,
and any SMB can afford that. Even half a day could make a crucial
difference to how a company copes in a crisis.
As Carey said, "It might be as simple as recognising that you
are located close to a river and therefore at risk from a flood."
Whatever the obvious risks, the critical thing is to set up a plan
that will be adaptable to any major crisis that might arise.
SMB Focus: Make sure it is business as usual