Don't wait till the pressure is on to do your contingency planning. A little time spent now could save a lot of trouble later, says Helen Beckett
The worlds of disaster recovery and business continuity have become part of a much broader school of thinking that might more usefully be called business resilience.
And the smaller company would be well advised to devote some time to the subject because it could be the biggest beneficiary.
Noel Carey, business continuity and recovery consultant for IBM Services, said the main part of being prepared is to do your thinking in advance. Once you have worked out how you would react to one unexpected situation, this response can be applied to a range of incidents, not necessarily all "natural calamities".
A company in a niche market may have to respond to unexpected demand for products; an epidemic of avian flu would create huge demand for the hygiene products or face masks advertised on specialist websites, for instance.
"Historically, smaller businesses have said 'we know how to fix hardware'," said Carey. This would usually have involved using a warranty or hiring the services of a specialist and would have been a reaction - perhaps a planned one - to a particular hardware event.
However, few businesses have asked, let alone answered, the question: "What do we do if something happens to the people who use the computers?"
For a long time, this was simply ignored and it was only when major catastrophes occurred on the world stage that the concept of business continuity developed.
Thinking around "what if" scenarios might include identifying alternative suppliers of raw materials and where to source extra staff. It should also include how to ramp up computer and network capacity quickly, perhaps through a managed service.
The biggest problem is to estimate the impact a disaster would have on an organisation and how to recover functionality and resources. In some situations, access to a building may be prohibited, which would hit a smaller company hard. A big company may have alternative offices to relocate staff to and spare capacity on the network, whereas most smaller firms will not.
When making a business continuity plan companies of all sizes need to ask themselves:
- What are the main vulnerabilities of the business?
- What threats could harm the business?
- What would the impact of such an event be?
- Which are the critical applications?
- How long do I have to fix them before business degrades?
These are all questions that businesses in the vicinity of the Buncefield oil terminal will have needed to know the answer to.
There are good places to look for advice that need not cost a fortune or could even be free for the canny SMB.
In 2004, the Civil Contingencies Act made it compulsory for local authorities to provide free disaster recovery advice to their business community. This was part of the government's response to the terrorist attacks of 11 September 2001, so the council emergency planning department is a good place to start
"Don't be afraid to talk to the professional bodies," said Carey. "It sounds expensive, but there are ways of getting round it. The best way is to pick brains to get a framework of the planning that has to be done.
"Once you have this skeleton plan in place, you can fill in the gaps yourself and perhaps get a consultant to do a final check."
There is often a gap in contingency planning between large and smaller companies, mainly because of the discrepancy in resources available.
"There are always more urgent pressures that keep business continuity in the sidelines," said Carey. And complacency sets in remarkably quickly after a headline disaster. "It is hard to keep up interest once any immediate crisis has passed," he added.
The most important resource is time spent thinking and planning, and any SMB can afford that. Even half a day could make a crucial difference to how a company copes in a crisis.
As Carey said, "It might be as simple as recognising that you are located close to a river and therefore at risk from a flood." Whatever the obvious risks, the critical thing is to set up a plan that will be adaptable to any major crisis that might arise.