Last month we looked at understanding the risks associated withliving through a disaster. This month, let's examine specific waysagencies can establish, maintain and implement a practical plan fordisaster preparedness and business continuity. Backupsystems
“The biggest mistake small business ownersmake is not adequately backing up their data,” said David Luft,senior vice president for product development at Computer Assocs.'SMB program office. His company's research has shown that more thanhalf of all companies in the United States don't have a businesscontinuance plan to prevent data loss. Agencies on tape backupsystems should explore digital systems or, even better, off-sitebackup options. Live Vault(www.ironmountain.com/digital/server/),AmeriVault (www.amerivault.com) and Carbonite ( www.carbonite.com)are just three of the many resources available. If you plan tocontinue with tapes, replace them annually. Tapes have a 50 percentchance of failure after 1 year. Store tapes at a reasonabledistance from the agency and not in someone's home. An ideallocation is a safety deposit box in a bank at least 5 miles fromyour agency. Technology resources
Evensmaller agencies can't afford to not include disaster preparednessand business continuity in their budgets. The following ideas willhelp you put together an effective disaster preparedness toolkit.o Laptop computers. Determine how many laptops areneeded so staff may continue doing business if your agency is notaccessible. Be sure to include extra batteries, connecting cablesand other peripherals as needed. o Cell phones.Depending on the details of the disaster, your cell phones may beunavailable. Dedicated emergency phones help ensure phone accessand eliminate nondisaster-related calls. Ask your local phonecompany if it automatically can transfer your phones to alternatenumbers if service is lost or when a disaster is declared.o Analog phones. Your phone system may beunavailable in a disaster. For backup, install one or more analogphone jacks in the agency, and possibly at home for key peoplecoordinating the disaster plan. An analog phone may provide phoneaccess during a disaster. o Wireless Internetcards. Local phone service and cell towers will beoverloaded during a disaster. Invest in a wireless card provided byAT&T, Verizon and other vendors to provide internet accessduring a disaster. o Flashlights. Flashlights andcandles should be included in every disaster preparedness toolkit.Consider flashlights that are manually “wound up” rather thanrelying on batteries. o UPS. Every agency shouldhave an uninterrupted power supply and, if warranted, a generator.Be aware that computers require specific types of power. Make surethe UPS or generator is rated to support your technology. oE-mail accounts/online chat. Set up Google e-mail (gMail)and MSN Messenger accounts that are only used during a disaster.This allows you to control the inflow of information and focus ondisaster related communication. o Emergencylights. Emergency lights in the agency are usuallydesigned to come on automatically when power is lost. oBattery maintenance. Keep batteries at room temperatureand replace as needed, even if they have not been used. Forrechargeable batteries, check manufacturer recommendations forfully discharging, then recharging.

Determine disaster specifics
Limit thenumber of people authorized to declare a disaster. When thedisaster is declared, agency resources, staff and reputation areput on alert, which means there is a monetary and human cost eachtime a disaster is declared.

Each person authorized to declare a disaster should have writteninstructions detailing what constitutes a disaster and what actionsare to be taken once the disaster is declared. For example:

1 Is this an alert or disaster? An “alert”announces that a disaster may be imminent, but not yet declared. A“disaster” means that the disaster preparedness plan has beenactivated. 2 What is the nature of your disastersituation? The most common types of disasters include: oFire o Flooding (natural disaster or fire sprinkler system) oComputer failure o Communications failure o Internet failure o Keyequipment failure o People issues, such asillness/resignations/maternity leave o Denial of access to thepremises o Product defects o Bomb/terrorism threat oLegal/regulatory action o Utilities failure. 3 What is youragency's name and address? Decide exactly how the name ofyour agency will be recognized and authorized by the news media,carriers, utilities, customer and vendors. 4 What is thename and title of the person declaring the disaster? Thisis the name and title of the person declaring the disaster. Thisshould match exactly with information provided to the news media,carriers, utilities, customers and vendors. 5 What are yourcontact numbers and e-mails? List contact information inorder of the responsibilities assigned by the disasterpreparedness/business continuity plan. Include agency and personalinformation for phone, e-mail and fax. 6 Will your agencyrequire a password to declare a disaster? Your agency maydetermine that a password will be used to ensure accurate andresponsible declaration of a disaster. This password should beavailable to each person authorized to declare a disaster, andchanged after the disaster is over. 7 What systems areinvolved? Because of the confusion that can be presentduring a disaster, it is essential to have a written detail ofevery system that is affected by the disaster. This can include: oNetwork and servers (including manufacturer contacts, configurationinformation, serial numbers, IP addresses and passwords) o Phonesystems (including technical information and contacts as well asconfiguration information and passwords) o Utilities (includingcontact information, required information by the provider,alternate contact information). Test your plan –repeatedly
Even if you have never declared a disaster, it is essential thatyou test your systems and plan to ensure viability andrecoverability. If you have not verified that your back-up systemis viable, your agency and customers are at risk. The followingitems should be tested on a regular basis:oBatteries. Follow manufacturer's instructions fortesting and replacement. Note: Testing a battery with a tester isnot always reliable because it is not testing the battery with aload. I personally have experienced battery failure even afterindicating they were sufficiently charged. oBackup. Any type of backup (tapes, digital oroff-site) should be tested twice a year. It is not necessary totest all files, but you should confirm that you are able tosuccessfully restore and access different types of data.oUPS/generators. Follow your manufacturer'srecommendations for testing. Generally, UPS and generator systemsshould be tested at least once a year. Be sure to test them under astandard load that represents realistic energy demands during adeclared disaster. oLaptops/wireless cards. Iwould recommend testing your laptops at least twice a year. Part ofthis testing also may include data recovery during that part oftesting.

Test your wireless cards and any other peripherals orthird-party service providers you would rely on during a declareddisaster.

Utilities
Work with local utilities andtelecommunication providers to determine their testing proceduresand what they provide during a disaster. oKeyed access tothe agency. If your agency is in an office building, workwith building management to test emergency access to the building.This is particularly important if access is granted by anelectronic system that might be affected by the declared disaster.Your commitment to protection can become an important part of yourcompetitive edge in your market. Don't forget to include elementsof your plan in your marketing material and written service levelagreements with your clients and prospects. You may be the onlyagency in the area that has a plan for disaster preparedness andbusiness continuity. Next month, we will look at how to create yourdisaster preparedness plan.