Business Continuity and Disaster Recovery Plans: Things Overlooked

by Steven Lewis. Ph.D.

Even experienced disaster and business continuity professionals miss key areas that could leave their company even more vulnerable during crises.

Only about 50 percent of companies have implemented corporatewide business continuity and disaster recovery plans, though this is up 66 percent from five years ago, according to a 2004 Deloitte & Touche LLP and CPM Global Assurance study. Many companies still need to hear this message. Nineteen percent of companies have suffered a disaster that caused their organization to cease operations for a period of time, according to a 2004 study by AT&T and the Partnership for Public Warning. While most companies will back up their computer systems and get those backups off site, many other steps may be missed, even with a sophisticated plan. Below are a few of the things often overlooked:

Vulnerability of telephone and network terminators to falling water: Many disasters involve water getting in the building, yet most telephone and networking central controls are not shielded from the sprinklers or from water coming down the wall or the cables to the rack. When hit by water, they burn out.
Employees personal life situations that limit emergency response: Key employees are often required to locate to a computer hot site in an emergency. Single parents, employees caring for ill relatives, and those relying on public transportation may have severe limitations here. Find these out in advance and plan around them, relocating the hot site or assigning other staff to cover.
The company's priority to utility companies and vendors: Many planners mistakenly assume that because of the nature of their organization (bank, nursing home, etc.), the utility companies and vendors will assign them a high priority in recovery operations. During the 2004 hurricane devastation in Florida, many nursing home operators, among others, found out otherwise.
Back-up vendors for key support services: When a large-scale disaster strikes, vendors of commonly needed items, such as generators or services such as pumping out flooded basements, become overwhelmed. Anticipate this and locate second-source vendors outside the region.
Accessibility of checks and purchase orders: The two most important documents in any disaster are the company checks and purchase orders. A damaged customized check printer may take a week or more to replace. A supply of preprinted checks and purchase orders must be kept off-site; ready to purchase critical equipment and supplies.
Exits requiring keys: In older buildings or institutions open to the public, keys are sometimes needed to exit certain doors. For everyone's safety, every exit door needs to be operable from the inside without a key.
The needs of outside emergency organizations: Remote sites may be forgotten in emergency planning. As part of their periodic disaster plan review, planners should confirm that the fire and police departments covering these locations have up-to-date contact information, and that the fire department has a set of building plans.

A list of 20 items is available via the Edwards Information Web site. The Web site also has resources for companies that have not yet begun their planning. The Edwards Information Disaster Recovery Yellow Pages itself is a great compilation of hard-to-find resources, with more than 3000 listings in 355 categories.

About the Author
Steven Lewis, Ph.D., CISA, CCP, is founder of the Edwards Information Disaster Recovery Yellow Pages directory, and a nationally-known business continuity expert. He has spoken and written on the field for 20 years. The directory came out of his work in developing more than 120 comprehensive business continuity plans for network-based organizations.