The Katrina and Rita hurricanes claimed more than a thousand lives, displaced hundreds of thousands of people, and disrupted businesses throughout the Gulf Coast area. Disasters large and small test the ability of a business to respond in a timely manner, preserve electronic data and paper records, and serve customers at a time when people need services the most. The following is a compilation of lessons that we can learn related to disaster preparation, response, business continuity, and recovery.

The Early Stages

1. You may have several days of warning about an impending disaster.
2. When warned of a disaster, the warning period must be used wisely.
3. You may be subject to mandatory evacuation.
4. Attend first to the life, health, and safety of employees, families, and the public.
5. Evacuation plans are important.
6. Evacuation without accounting for who went where, and when, can lead to great emotional stress.
7. Key employees need to have ubiquitous access to the business continuity plan in order to execute it.
8. Before evacuating, move vital records to safe areas of your facility, or take records with you.
9. Facilities may be vulnerable to looting and fires after evacuation.
10. Water flows downhill; don’t put your generator, computer systems, or vital records in the basement.

Data Backup and
Retrieval

11.    Backups are important.
12.    It is less stressful to verify in advance that backup tapes are readable.
13.    Full server recovery is more likely if you have performed test restorations.
14.    Backup tapes should be stored more than a couple miles away from the datacenter.
15.    Backup tapes stored at insecure locations are even less secure after the destruction caused by a disaster.
16.    Iron Mountain or similar service providers may be unable to access the site where backup tapes are stored.
17.    Disasters destroy paper documents.
18.    Paper documents are not remotely accessible.
19.    Electronic records are more portable than paper.
20.    Customers are negatively impacted when a business loses paper records.
21.    Services that perform remote backup over the Internet have some advantages.

Geographic Scope

22.    You need an alternate Internet connection from a second location to backup your primary connection.
23.    Both your primary site and your backup site may be lost in a disaster, or a succession of disasters.
24.    Regional disasters require command centers, alternate sites, and hot sites that are far away.
25.    Employees may be unable to get to an alternate site that is too far away.
26.    Employees at different locations may need to act independently when communications are disrupted.
27.    Disruptions to electrical power, communications, critical supplies, etc. extend far beyond the disaster area.

Disaster Conditions and Immediate Response

28.    Disasters are likely to be very confusing and frightening.
29.    Much of the word of mouth information that you initially receive can be wrong.
30.    Basic services such as electricity, cell phones, transportation, and law enforcement cannot be assumed.
31.    Cell phones don’t operate for long when electrical power is not available.
32.    Emergency response personnel should be able to recharge cell phone batteries in their car.
33.    Telephones and cell phone circuits may be too busy to be useful, even if they are available.
34.    Roads may be impassible or blocked by traffic jams.
35.    Effective crisis communications is a challenge, even for professionals who are trained and prepared.
36.    Blogs can be useful tools for ad hoc sharing of information during a crisis.
37.    Emergency notification systems need to be well defined and tested.
38.    A business should be able to update their web site home page within minutes or hours.
39.    Hosting your web site at your offices may make it unavailable for emergency communications.
40.    A disaster doesn’t eliminate people’s reliance on their paycheck; it makes timely pay more important.
41.    If a disaster affects one office, try to assure employees of a job at another office.

Recovery

42.    Recovery may require weeks or months.
43.    Employees can’t help a business recover if the disaster disrupts their own lives.
44.    Employees may be so traumatized by the disaster that they can’t work effectively.
45.    Government agencies may try to help, but it may take days for them to arrive and it may not be enough.
46.    Interim operating procedures are important.
47.    Pre-positioning of recovery supplies can be very helpful.
48.    Consider the need for basis necessities, as well as the items needed to recover the business.
49.    The recovery staff may need a place to sleep and eat.
50.    The recovery staff may not be effective unless they have nearby daycare services for their children.
51.    Hotels that offer full services, including Internet access, can be a good choice for a command center.
52.    Don’t rely entirely on company facilities for command centers or alternate sites.
53.    You may encounter an emergency while recovering from an emergency.
54.    Environmental contamination may prevent a return to facilities even after the disaster has passed.

Financial Lessons

55.    Cash comes in handy after a disaster.
56.    ATMs may run out of cash, leaving many people without a source of cash.
57.    Credit cards aren’t very useful if the disaster eliminates communications for transaction validation.
58.    It is painful to learn that insurance doesn’t cover the disaster that was just experienced.
59.    After a disaster, you may want to take pictures for the insurance company.

Bank and Bank
Customers

60.    If core processing is done onsite, consider cooperating with another bank that uses the same software.
61.    If you have a disaster recovery service, the business continuity time period needs to be long enough.
62.    Some employees may need to temporarily relocate to a distant city to restore computer systems.
63.    Demand for bank services and cash may spike prior to a disaster, if there is early warning of the disaster.
64.    Customers that normally deal with a bank in person may need to access bank services from far away.
65.    A bank’s ATM network and online banking should operate even if the bank’s main office is down.
66.    In serving disaster victims, banks have to manage the fraud risk in trying to serve urgent customer needs.
67.    A bank may want to assist customers in avoiding financial scams after a disaster.

How Assurity River Group can help

Recent disasters have reinforced the need for good business continuity planning. Assurity River Group can help you plan effectively. You shouldn’t focus so much on the last disaster that you are blindsided by a new type of emergency. Also, even though the major disasters get most of the headlines, your planning will have a higher ROI if it helps you with smaller, more common emergencies. Assurity River Group can improve your Business Continuity Plan and recovery processes. We can help you by:

• Assessing the level of risk that you face based on known threats and the status of your existing plan.
• Reviewing your technical infrastructure for areas of risk such as single points of failure.
• Prioritizing recovery through a Business Impact Analysis.
• Selecting recovery strategies that achieve your desired recovery timeframes.
• Define the organization, functions, and step-by-step actions of recovery teams.
• Providing the business continuity expertise that you can’t afford to develop internally.

Assurity River Group will work with you to prepare for recovery from a wide variety of disasters that could impact you and your customers.

Contact Jeff Olejnik (jolejnik@assurityriver.com) at 651.259.6888 for more information.