Now what do we do?? Lessons learned from Sandy

The images on the news following Hurricane Sandy of the suffering and living struggles people are going through in the New York/New Jersey area have been horrific to watch.  It brings back many memories of the aftermath of Katrina, but on a different scale.  I still have family in the area and many were without electric and heat for 9+ days.

What you will not hear as much about is the impact on businesses from this serious, destructive act of nature.  It has been estimated that more than 3 million businesses – large and small, schools, government agencies, and hospitals – are still affected to a point of being partially or completely shut down.  Even YP Talk was not immune as the serves that host our system are based in the northern New Jersey area and lost power for a couple of days.

Once again, it reminds all of us of the need for disaster recovery plans.  It’s easy to talk disaster recovery;  it’s a whole other thing to actually implement it.  And we’re not only talking about hurricanes, flooding, or blizzards:  recall the earthquakes of the early 1990s in California, the recent fires this summer in Colorado, record size tornados in the southeast (not the mid-west where it is expected), and the nuclear reactor issues in Japan. Sandy’s total economic damage from this super storm could be as high as $50 billion.

Back in September, 2005, post Katrina, we covered the need for every business to have a disaster recovery plan in place (link to full article).  In that article we suggested 5 general steps for implementing a plan.   What’s different now, some seven years after Katrina and that original YP Talk article (has it really been that long?), is that technology and communications are even more critical in today’s businesses and business operations. Sandy brought down a lot of the core infrastructure:  power, Internet, and even cellular communications were wiped out and in many areas, have still not been fully restored.

While we are not suggesting that we are disaster recovery experts at YP Talk, but the two key questions you should consider in your organization is:

• How long can our business remain down with no data, no computer access, no internet, or no telephone/communication operations before we will have to shut down completely?
• How much data can we afford to lose before our business will suffer irreparable damage going forward?

Obviously, the answers are different for every industry and business.  But here’s some food for thought:  according to the Insurance Information Institute, up to 40% of businesses fail after a disaster and only 43% of all businesses feel prepared to handle an emergency. Other statistics indicate that 61% of businesses that where without communication for seven days or more eventually shut down permanently within a year.   Further, a loss of more than 30 days of data is proven to be catastrophic to 78% of businesses.

As an extension to our earlier article list, here are a couple of things to consider for your disaster recovery plans:

Step back before going forward:  Have you determined your organizations vulnerabilities and capabilities?  Expect the unexpected.  And no plan is worth the paper it is printed on if you don’t test your plan often — practice does make perfect

Backup Power is Key:  Today, EVERYTHING requires power.  If you house your own systems, do you have redundancy plan that may even include being able to run on generators for up to three days without refueling?

 Location, location, location:  Is all of your key physical infrastructure in the basement or other susceptible location??  One harrowing story from an IT manager indicated that their building’s block-long basement was filled with water and it actually made it up about four feet into the lobby above.  Hence, no surprise that the damage to the building was enough that they couldn’t get into the building at all, and then didn’t have any power for five days.  But even then, all that infrastructure was lost.

Communications, Phone, and Email:  Maintaining communications with staff, with your customers is essential after a storm.  Many firms have employees in different parts of their operation that can work from anywhere as long as they have access to servers and technology. While cellular communication if often the default provider after a disaster, as Sandy showed us, it’s not totally infallible.  Have a Plan C.   Social or business networks such as Linkedin.com or Facebook can be extremely useful for group communications, news distribution to groups, and just staying in touch.

The cloud is available:  One thing that is different from the Katrina days is that a number of cloud-based services are now available to both backup data and help companies get operational again. Think about using a service that can provide needed back up and support during disaster events.

Risk Management and Insurance – Does your company carry business interruption insurance? Flood insurance is also good because most insurance policies do not cover “rising water” from floods. The government sells affordable flood insurance to many Americans, but you must buy a contract well before a storm is viable to have coverage in force. Companies such as: Met Life or Lincoln Financial as well as others provide this service.

As Sandy showed us, here in the twenty-first century, our businesses rely heavily on critical infrastructure – and it’s essential to have a workable business continuity plan and disaster recovery plan to keep your business going, because you never know what’s next…..