advice

At the time of this writing H5N1, known as Avian Flu, is spreading throughout Asia with one of the highest mortality rates of any flu virus of the previous century. Even the Influenza (Spanish Flu) of 1918 did not have as high a morbidity and mortality rate as H5N1 (Avian Flu). We are seeing almost daily some revelation from the World Health Organization (WHO) or Centers for Disease Control (CDC) or the popular media.

The terrorist attacks of September 11th should have been a wake call for the business community in Britain and across the world. However, nearly four years on, national surveys show nearly 49% of all UK businesses lack plans to keep the wheels turning if the unthinkable happens. Astonishingly, that number has only improved by 5% since the 9/11 attacks. Where there are plans – mostly among the larger and more regulated businesses – one fifth have never been tested.

Why has business been so slow to get its act together?

We watched as the 9/11 attacks unfurled, we watched the Madrid Bombings, we watched, as there were targeted attacks on business overseas. But an attitude of “it could never happen to us” permeated the wider business community.

While the web has reduced from days to minutes the time in which a corporate reputation can be attacked on a global scale, companies trying to protect their brands must also face the fact that the public remains cynical about the motives of organisations in both state and private sectors.

Bombs, hurricanes, power cuts. What does it take to get small and medium-sized enterprises to prepare for the worst with a business continuity plan? The London Chamber of Commerce, whose members have suffered all of the above in the last 20 years, often on multiple occasions, believes that as many as 44 per cent of SMEs in the capital have no contingency plans.

Taking Decisions about Evacuation during a Chemical Incident

From a Business Continuity or Emergency Planning perspective is it better to evacuate people in the vicinity of a serious chemical fire or should they remain where they are?

A study* comparing the health outcomes in sheltered and evacuated populations after a chemical fire suggests that there are health advantages in people sheltering rather than evacuating. The study is published in the BMJ and was based on a real incident in 1999. It involved collaboration between public health staff at a local health authority and national health experts (now at Bristol University and the Health Protection Agency).

A recent Survey by the Economist Intelligence Unit says "Most businesses are very concerned about business continuity, but two-thirds lack a reliable plan to ensure their business can survive the worst."

World Health Organisation and NHS officials have reviewed the current guidance and produced a simplified guide to the issues and the potential effects.

Updated guidance on how to cope in a heatwave has been issued by the government's health adviser as the country gears up for hot temperatures.

Early indications from the Met Office hint at a warmer than average July and August this summer.

England's Chief Medical Officer Professor Sir Liam Donaldson set out measures people can take to protect their own health.

A view on SOX and the BC Process

In a recent interesting piece by Dr Eric Schmidt of TDS Inc. he explores some of the background of the Sarbanes Oxley and looks at the implications it has for Organisations affected and specifically the impact on Business Continuity Practitioners. He argues persuasively that regulatory initiatives and world events are driving the convergence of business continuity, security and information management under the umbrella of enterprise risk management, sometimes referred to as global assurance.

Water and Flood damage management

Water damage is often believed to be a static effect of primary damage where the visual effects of contact and adsorption are a measure of damage. The reality is that water damage is dynamic, continuingly expanding it’s effects and is capable of developing far reaching secondary damage in minutes or days after the initial effects.

Bio amplification, mould, corrosion, swelling and distortion are typical effects of uncontrolled water escape or flooding. These effects can result in health risks, structural and contents damage and possible devaluation of property.

Confronting the Conundrums of Business Continuity by Jon William Toigo

In government and business, there continues to be more discussion than doing in the realm of disaster recovery and business continuity. One hears a lot of talk about "10/12" - the next 9/11 - which everyone from the familiar crepe hangers and doomsayers to the most heads-in-the-clouds pollyannas agrees is more or less inevitable.

Add to that the weather-related disaster potentials that NASA weather models predict will worsen this year, the well-documented vulnerabilities of aging power and telecommunications infrastructures, and ongoing problems in information technology that range from poor interoperability standards to improved malware and hacking techniques, and you have a confluence of threats that could best be described as the Perfect Storm.

Practical lessons from a user perspective

On August 29, 2005, Hurricane Katrina blew through New Orleans. With the hindsight of 18 months, here are some changes we implemented, and ideas we expanded based on our experience. We hope they help you develop your firm's disaster recovery/business continuity plans.

REVIEW AND UPDATE

It's critical to keep your DR/BC plan current and realistic. An outdated plan, or one that assumes the impossible, won't help you in real life. We now review our plan every six months, which helps us revise it to incorporate new technology or ideas. For example, if a new application is added to your network, someone should ensure that the data it produces is replicated, and that the application itself will be available remotely, and at your "hot site". Should this be overlooked at the time the new application is installed, the periodic review, if done properly, will catch the oversight and make the DR/BC plan accurate again.

DESIGNATE A REMOTE OFFICE

I can't say enough of the value in having a remote office ready to set up shop in after a disaster. Even if that office isn't large enough to accommodate the entire staff, it's a start and is better than nothing at all. After Katrina, our Baton Rouge branch office instantly became our main office.

Other firms that only had an office in New Orleans were still scrambling to find floor space while we were wrapping up our network restore. You can bet during a regional disaster like Katrina, available space will go very quickly. If you have multiple offices, designate one as the expected backup main office, and consider making it a hot site where you can continuously replicate your data. Be sure that the remote office is not so geographically close to your main office that it might be equally hit by calamity.

Alternatively, if your firm doesn't have a secondary office, consider a co-location arrangement with a vendor who has a data center within a few hundred miles of your main office, or close enough to drive to within a few hours. (Again, factor in possible regional events).

You might also consider a "mutual aid" partnership with another firm in a different region, obviously not a direct competitor, in the event of a major regional catastrophe. Don't forget to incorporate remote access tools into your hot site, especially if you think people will be dispersed and not all working at the hot site.

TEST, REVISE AND RE-TEST

Post-Katrina, we now schedule tests of our hot-site systems at least twice a year, tied to the beginning and end of hurricane season. Our goal is to ensure that we can duplicate network operations as closely as possible and according to our established plan.

It is important to realize that a hot site likely won't be an exact twin of your production network. It's important to have critical applications and data current and available; however, from our users' perspective there will be subtle, noncritical differences such as invalid printer names, and invalid shortcuts to programs that are not available. Document these differences well enough and incorporate back into your plan. This will ensure that when a real failover occurs, everyone involved will know what to expect.

Throughout the year, we also continuously perform data integrity tests of our replication software. While we have faith in the reliability of our replication system, and monitor its status, it's very easy to fire up the hot-site databases and perform a quick query to just be sure everything is in sync.

In fact, the software allows us to automate that process completely, all without ever stopping the real-time replication. You don't want to come to discover that your hot-site data is actually six months out of date.

PEOPLE AND COMMUNICATIONS

Do not forget about the most important component of your firm: the people.

The best technology won't be worth a dime without the human resources. After Katrina, many of our staff lost everything and were scattered throughout the region. Those who could make it to our Baton Rouge office did so as quickly as their situation allowed, while others were in other nearby cities.

In preparing your own disaster plan, most specific details regarding human resources can't be ironed out in advance. However, you can develop a protocol about what the firm will expect of employees and what employees can expect of the firm following a disaster, for example, how will the firm contact employees, and vice versa? Keep employee data updated and keep a printed hard copy offsite. Be sure your management team always has a copy. Also remember to include the contact list in any type of disaster "hotbox" you create.

Given the annual threat of hurricane evacuations, we went one step further and asked that employees also provide contact information about where they might evacuate (e.g., friends and family.) We now hold biannual meetings to remind empoyees about emergency procedures.

One specific thing we have done to help maintain communications during and immediately following a disaster is to establish service with a Web-based SMS (text-messaging) service.

Post-Katrina, Gulf Coast residents quickly discovered that though cellular service was nearly nonexistent, text messaging generally worked flawlessly. We will use this to broadcast vital information to employee cell phones via a simple Web interface.

RISKS AND PLAN

Understand your firm's specific threats and plan for those scenarios first. Although our firm is vulnerable to other disasters, being located in New Orleans (and having gone through Katrina) our disaster planning revolves around hurricane scenarios.

I would imagine folks on the West Coast would likely plan for earthquakes and wild fires. But also consider disasters that may only briefly interrupt your operations, such as a defective sprinker system, as well those that can potentially keep you out of your office for extended time, or completely destroy your main site. Each day when you leave your office, stop and think about what you would do if the next morning you discover the main office was completely destroyed.

In addition, it is your job to get a new office running by the end of the day, or sooner. Do you have servers? Do you have tapes? Do you have a disaster plan?

James Zeller is network manager at Chaffe McCall, in New Orleans, and won an honorable mention in the 2006 Law Technology News Awards' IT Director of the Year competition.

END

If you would like to know more about how your organisation can get involved and benefit from working with the Continuity Forum, please email us HERE! or call on + 44 (0) 208 993 1599. 

Better organisation planning and communication needed for employees and Business

Nearly 1 in four of working Americans say they probably would lose their job or business if forced to stay home for seven to 10 days during a severe flu pandemic, according to a study by the Harvard School of Public Health. 

The study found that most U.S. citizens would cooperate during the early stages of a pandemic or health emergency. However, after a week to 10 days, financial needs and worries about losing their jobs or businesses would force nearly 25 percent of the survey respondents back to work. More than one-third (35 percent) of the respondents reported that they would still go to work if public health officials told them to stay home but their employers wanted them to report to work. 

Category Business Continuity Management BCM - EVENT - Support - Advice

Business Continuity Basics Educational Workshop SERIES

The Continuity Forum run a special Programme of BCM Development Events aimed at those looking to develop their BC planning skills, or those at the very start of the BC Planning phase within their organisation, these events are specifically to help ensure that your planning is as efficient and effective as possible.