Hurricane Sandy: Now is NOT the Time to Experiment

"Wonder Weapons"

As I type these words, the winds from Hurricane Sandy are whipping through the trees just outside my window here in Maryland. At the same time, I have also noticed a rapid change in direction of people's attitude toward technology.


In a disaster, companies sometimes try to deploy a new technology to get themselves out of trouble. They don't realize the threat of the disaster, and so they hope a gadget or software platform will do the job for them.

It won't.

We would never deploy a new technology on the sales floor if we hadn't mastered it and tested it. Follow this same philosophy during a disaster. Basically, it is too late to start a Business Continuity Plan or Disaster Plan if you are in Hurricane Sandy's path, so just rely on what you know. 

We all procrastinate before disaster strikes (yes, even I do). But I never let a technology that promises to get me out of trouble be deployed before I know what I am getting into. I like to call these "Wonder Weapons" because they promise to solve problems in wonderous, amazing fashion.

They won't.

Rely on the technology that you have already mastered and deployed, especially during a storm like Sandy. It's tried and true, and won't let you down. Don't let the speed and direction of the wind blow you away from your core instincts as a small business owner.

Use what you know, and your business will be on track to Reverse Disaster.


Patrick Hardy

Is Hurricane Sandy "The Perfect Storm"?

Hurricane Sandy is making national headlines in the United States because of its proximity to the East Coast, and the possibility of a strong landfall. But that isn't the only reason it remains in the news.
Meterologists have identified a number of similar characteristics between Hurricane Sandy and The Halloween Nor'easter of 1991, known in popular parlance as "The Perfect Storm".

Courtesy of NOAA

Nor'easters are very similar in characteristic to Hurricanes. It usually describes a low-pressure area where the rotating center is off the East Coast, providing hurricane-force high winds, rain or snow, coastal erosion, and possibly even blizzard conditions.  


Is Hurricane Sandy "The Perfect Storm"?

The simple answer is: no one knows.

As of today (roughly 5 days out), there is no certainty that this storm will even make landfall. By Saturday and Sunday, we should have a pretty good idea what is next.

The National Weather Service put out a three page statement with a lot of jargon that you and I are unlikely to understand without an advanced degree in meterology. However, as a business owner, this is perhaps the only relevant passage [caps are in original]:

"IT IS LIKELY THAT SIGNIFICANT IMPACTS WILL BE FELT OVER PORTIONS OF THE U.S. EAST COAST THROUGH THE WEEKEND AND INTO EARLY NEXT WEEK."

So how do you prepare for "The Perfect Storm"?

Don't let the verbiage of it being a supposed "Perfect Storm" scare you into thinking this is the disaster to end all disasters.

Keep a few things in mind:

1. Only the National Weather Service can declare Hurricane and Tropical Storm Watches and Warnings. Here is where to find those:

http://www.nhc.noaa.gov/text/refresh/MIATCVAT3+shtml/251446.shtml

2. Storms change their track quickly. The computers and satellites are constantly updating it. This is the current picture:

http://www.nhc.noaa.gov/refresh/graphics_at3+shtml/115907.shtml?5-daynl#contents
 
3. Storms change their power rankings daily. It may be predicted to be a stronger or weaker storm based upon modifications in temperature or cloud drift.

As a business owner, don't wait to the last minute! Start gearing up your facility for Sandy. Even if she doesn't make landfall, you can chalk it up to a realistic exercise where you can test your disaster plan.




If you want day-by-day (and hour-by-hour) tips on what to do leading up to the storm, follow us on Twitter: www.twitter.com/hytropy

Patrick Hardy

The Most Dangerous Thing a Small Business Can Say “No” To

There is an 80% chance you will be struck by a disaster or a major interruption at some point during your company’s lifetime. That is a sobering reality, especially since statistics show that small businesses without a disaster plan are playing a dangerous game.

It doesn’t matter if it is a brick and mortar business or an online company with a single owner and no employees. If you are interrupted by a disaster, and are not back in business within a month, your chances of survival are less than 1 in 10.

Unfortunately, I see this a lot in the disaster business.  Small businesses who still think they can just wing it and get through a major disruption. Why would you do that when every single Fortune 500 company has a robust disaster program? Not a single one of those companies would wing it. The reason is because they recognize that a disaster program is the company’s chance to make money, and not lose valuable customer relationships. 



So do you still need a disaster plan? Yes you do, for one reason: you have the most to lose.

When Wal-Mart has a store closed for a couple of days, it loses ten to twenty thousand dollars. For them, that’s nothing. They can easily make that back in just a few days, especially since their marketing position is such that they have broad appeal almost anywhere they are situated, and they know it.

Want to know a secret? 

Wal-Mart probably has the best disaster and business continuity plan of any brick and mortar company in the world.

They don’t care if they can make lost money back. They want to be open to show their customers, the community, and their competitors that they mean business. Wal-Mart won’t give an inch away that it doesn’t have to, because they take disasters seriously. Companies without disaster plans that do survive needlessly spend a lot of money to do so. 

I spoke a couple years in a row at a state restaurant association in an area known for massive disasters. After one of my presentations, a guy came up to me and told me that he was recommending to the association that they no longer have disaster management educational sessions.

When I asked why, he said it was because his restaurant had been struck by a disaster twice and he had survived both times without a disaster plan. After asking a few more questions, he said had spent about $18,000 on each one to completely return to normal.

I absolutely couldn’t believe it. There is no rhyme or reason why a small business restaurant should spend nearly $40,000 to be continuous after a couple disasters. What he doesn’t realize (or refuses to) is those losses will eventually catch back up to him.

Do you have $40,000 to spend on a disaster response? Do you want to spend that on a disaster response? Or would you rather have that to renovate your store, or buy more advertising time or invest in your employees?

What he also doesn’t realize is a disaster can cost you more than just money spent on responding. There are a host of intangibles that can’t really be quantified by money, such as public relations, brand perception, loss of future customers, and even the loss of qualified employees. I knew companies that lost great managers to other businesses because they weren’t open in time, while their competitors were ready to take their valuable skills.

The original company couldn’t pay them during the 8 weeks they were closed, and the employees still had bills to pay and mouths to feed. That compounds the problem because now your competitors have an edge on you, and you now have to either: hire and train new employees or make significant sacrifice to get the ones you lost back.


A good disaster program will make sure that you have a disaster plan that is tailored to your business, with training of your employees and periodic exercising of the program with realistic scenarios.

Your small business has the most to lose, so do what your Fortune 500 counterparts do: get a disaster program. It's not worth saying "No" to.



Patrick Hardy LL.M, CEM, ALEM, LEM-Pro

4 Signs Your Employees Aren't Ready for Disaster

During a disaster, you have a choice: either you can make money or lose money. There is no “breaking even” when a disaster strikes. But you have to have your disaster program ready, and employees are the critical element that makes or breaks a company’s response.
 

They are the ones who will get your processes back up, expand your client base, and get you back in business. But that means they have to be ready for the disaster. But how do you know if they are ready? Your employees aren’t going to tell you outright that they aren’t ready for a disaster.

Wondering if your workforce is prepared for a disaster?  There are 4 signs that you should look for that will help you answer this question:


Lack of Knowledge of Disaster Plan

This is an instant give away. When employees don’t have even a basic understanding of how the plan works, there is a 0% that the plan will function the way that it was designed. Disaster plans are technical documents that require constant training and employee readiness about them.

They should know how the company will communicate in a disaster, where the alternate site locations are, how to reestablish basic company functions, etc.  A couple years ago I was talking to a colleague once in the recreation industry, and she had no idea where the business would go in a disaster, even though the company had spent tens of thousands of dollars to set up an alternate location!


Indifference to the Disaster Program

In other words…no one cares. I can tell instantly when employees are indifferent to a disaster program: as soon as the disaster program is brought up in a meeting, people start to yawn, or open their smartphone, or show renewed excitement for that upcoming dental appointment.

When the leadership isn't actively engaging with employees, the disaster program is at risk of becoming obsolete. An adaquately trained workforce will keep an eye out for changes in the company that will affect disaster operations.

They also hold regular discussions with the employees in meetings specifically devoted to the disaster program. These are programs that will last in the long term.

Lack of Questions

When employees aren't asking questions about the plan that means they have never been engaged in the disaster program. No disaster program, regardless of its mechanisms and the expense that went into its creation, is perfect.

Employees that are ready for disaster ask questions about the program and the implications for themselves and their families.


Empty Exercises

Employees who are ready for a disaster understand how critical it is to participate in disaster exercises. I have seen companies that hold an exercise from 8AM to Noon, and half the employees don’t bother to show up because they think it’s an optional vacation day!

The leadership and the employees need to understand that exercises are critical to the disaster program, and that management means business. And they don’t have to be boring!

If management takes the time to create a fun exercise, everyone will want to participate.

 
If you are worried that your employees aren’t prepared, make sure you engage a disaster manager who can help develop a customized program unique to your workforce! This is the most effective way to Reverse Disaster.

Prepare for Technology Crashes

Yesterday, a hacker from the group Anonymous took credit for a coordinated cyber attack against Internet domain registrar and web hosting company Godaddy.com. The denial-of-service attack caused a complete company-wide outage for several hours, and was the largest in the company's history.

The result was chaos. Millions of small business websites were down, including shopping carts and e-mail accounts. 

Regardless of your position on Godaddy or Anonymous,  September 10th cyber attack should be a wake up call for your business to prepare for these types of major outages, or one of the casualties is going to be your business. Outside of non-state groups like Anonymous, there are a number of nations that are known to recruit and train hackers with state complicity or encouragement: North Korea, China, Russia, among others.

Godaddy is unlikely to lose its company because of the outage. However, as a small company, you probably do not have the substantial financial resources to ressurect lost business. And if you do have the money, why not spend it in a way that ensures you can take advantage of your competitors' lost business?


Website/Shopping Cart

Simply put: If your site is down for hours, your competition is going to be cheering! Even if it is for a short time, your reputation can be damaged, and potential clients will go elsewhere. However, if your competitors are not prepared and yours is, this is a chance for you to increase your business and gain ground on them! But you have to have the adaquate preparation first.

If you aren't ready for a cyber attack, you risk wasting a lot of money, particularly if you have an online advertising presence. You will still be paying for the clicks and online time, but you will get ZERO conversions. That is money thrown away. Even if you do turn the advertising off in time, you will be losing valuable face time with potential clients.


E-mail

Using a personal e-mail address to send professional correspondence looks amateur and rookie. Not only is the e-mail address going to be foreign to clients, vendors and others, it might be placed automatically in the spam folder by a message server. This is the case with Hotmail addresses, because the server will associate the word "hot" with pornographic material.

One of the other issues is the content of personal e-mails are not appropriate to the professional setting, and are rarely corrected in time. More than once I have seen disaster-striken companies who (inadvertently) send out a client e-mail with something like this in the signature line:



Jon "Bubba" Smith
"As always, EAT the MEAT, TOSS out the BONES"




Is that the impression you want to make with a new client? In business we talk a lot about first impressions, and a signature line with "eating meat" and "tossing out the bones" is not a way to foster a professional, long-term relationship under any metric. This is a reason we create a clear differentiation between professional and personal e-mail addresses. During a disaster, this line does not need to be blurred.

This also does not account for the fact that you will now have to forward all the e-mails from the personal box to the professional box, will have to delete the message in the personal box, make sure you have not violated your privacy or terms of service, and then hope that your clients aren't e-mailing your people on their personal address.

However, this can all be avoided with some simple preparation.


Reversing Disaster - Basic Tips


1. When your company is facing a disaster, your company should seek to look even MORE professional, not less. Every e-mail, every message, every client interaction should be given the highest professional feel possible.


2. Don't put all your technology eggs in one basket. If you use one vendor for all your IT needs, this is an invitation for trouble. Spread out your platforms (hosting, cart, e-mail etc.) between multiple vendors. This will ensure you have a resiliency for your business.


3. Purchase a disaster plan from a reputable source. Don't waste your time buying templates or getting disaster plans from some fly-by-night business you find online. Get their credentials, make sure they understand your long-term needs, and stick with them. They will keep your business resilient.

Commit to a little preparation, and your company can easily Reverse Disaster.


Patrick Hardy, LL.M., CEM, ALEM

Plan for Rain on Your Parade

Tropical Storm Isaac (which is not yet at hurricane strength at the time of this writing) has threatened to rain on the Republican parade at the National Convention in Tampa, Florida. The Convention organizers have already announced a shortened schedule, and a general interruption of the proceedings.
 While the Convention most likely won't be cancelled, for businesses that attend, host, sponsor, or organize conventions, expositions and large events, it's a good lesson. When your company commits valuable resources in time, effort and money into an event, ensure it also has an appropriate disaster and continuity plan. Many events around the US are interrupted or cancelled every year by natural or man-made disasters.

First, I would like to make a quick note on their relationship between event disaster plans, and comprehensive disaster plans for your business: they are not the same. The plan you have already codified for your business covers your employees, facilities and processes. Any large event should be considered a separate process from your company, and should be planned in juxtaposition to your current disaster program, whether you are an event attendee, or the event host/sponsor/organizer.

 

Event Attendee

 

Your business needs to consider its continuity in light of being an event attendee, as your loss can be significant. I knew a company that attended an annual conference in the midwest of the United States as an exhibitor. They brought large amounts of marketing materials, half their workforce, their largest truck, and samples of the product to be sold. As happens periodically, one year, a thunderstorm touched off a tornado that destroyed the truck, along with everything inside.

This became a serious problem. The company sold specialized metal beveling machines, which were purchased from one vendor overseas. That vendor was backlogged with orders, so it was over a month before the company could fulfill their existing orders, which meant those customers went to their competitors.

Furthermore, with half the workforce displaced, the company had a very difficult time rebounding. Insurance money did not cover overtime costs for their employees, and the loss of revenue stream was significant for a company like this in a niche market.

Event Sponsor/Host/Organizer

 

If you are the sponsor of the event, or host a recurring large gathering, your event preparedness should be a permanent addendum to your current plan. This is particularly true if your company is a non-profit or a trade association, because confidence in your ability to host the event is the critical factor in the draw for companies to attend. Questions your company should be asking include:

• What happens if your event has half the number of participants because of a disaster?
• What if they ask for refunds?
• What if they withdraw from the vendor exposition contract because of a storm, flood, earthquake or some other interruption?

 

And it isn’t just these natural risks that can affect your event. If your organization is tainted by a scandal, or some act of corruption, you can expect that your lead sponsors will pull out of your event.

Your disaster plan needs to have a contingency for your event so that it doesn’t sink your entire organization. Insurance may cover certain perils, but it will not cover loss of reputation, or the damage of future loss of revenue, or loss of potential clients.

 

Event Disaster Plan Considerations


Your event disaster plan needs to consider a number of elements. However, that plan should not be constructed in isolation. Your company’s overall disaster plan should be tied in closely to your event plan, discussing:

• Alternate Sites
• Crisis Communication
• Insurance (especially any covered and uncovered perils)
• Information Technology Contingencies
• Site Vendor Coordination

Your company should adopt a rule: if one is disaster plan is activated, the other should be activated.  This is because they will affect one another as you shift resources, personnel and money to one or the other as you reverse the disaster.

There is one other consideration for any event disaster plan. If your event takes place outside the jurisdiction of where your company is physically located, that means you will need to establish new relationships with the local government, first responders, etc.

These are not tertiary or unimportant relationships!

If there is a disaster at your event, and you have not consult the authorities, you are asking for trouble. Jurisdictions do not take kindly to event planners that ignore them because they will take the heat from the media and the public for any problems that arise. I remember when I was an EMT for an event at a large convention center some years ago. There were just two of us, with one ambulance, and a second backup crew. As the event progressed, we became overwhelmed and couldn’t handle the flow of participants coming out of the facility needing assistance.

The reason? Many of those at the event had checked out of cancer wards and hospices to receive some type of religious healing. When that did not work, we EMTs were stuck trying to get these people back home. The City was very unhappy that the organizers had not informed us of the demographic attending, which drew away resources from other 911 calls and emergency medical responsibilities.

Conclusion

Your company may have a terrific disaster plan, but if it is not also including those events you attend, sponsor, host, or organize, you are inviting a greater potential for business interruption. Make sure your business continuity company is planning accordingly. This is the only way to Reverse Disaster.

Patrick Hardy, CEM, ALEM, LL.M.

How does FEMA fit in?

I have no regrets saying that as an undergraduate I was a strongly-leaning libertarian. And I was vocal, too. As a political scientist, I had a lot of opportunities to inject myself into our Socratic Dialogues and make my opinions known about the postal service, social programs and NATO. I don’t know how my professors and colleagues put up with me, but they all showed remarkable restraint in not taking the bait (most of the time).

What makes that all the more ironic is that this year I officially became a federal bureaucrat. I accepted a rotation as the first business owner as the Private Sector Representative to the Federal Emergency Management Agency (FEMA). That role was originally set up by the Private Sector Division of FEMA to establish constructive relationships between the government and private industry in a disaster.

I accepted the rotation because I felt as though FEMA has a role to play in how companies respond to a disaster. This is the first part of an occasional series on FEMA and how they can assist you and your business in Reversing Disaster.

1. Money

This is the one people love to talk about, because the concept of “free money” is such a temptation, but it is also the one most subject to mismanagement and abuse. Remember the debit card-debacle in New Orleans? That was not an aberration. FEMA misallocates millions of dollars every year, and creates perverse incentives for people to do unsafe and reckless things. 

However, as a business owner, FEMA assistance can go a long way to help your employees and their families, so you can get back into business faster. FEMA offers a lot of different types of assistance for them which can supplement income, and provide temporary housing assistance.

2. Information


In my personal experience, this is something that FEMA does well…assuming you can find it. While I feel like FEMA information is mostly helpful, they have had a lot of trouble in the past with dissemination. Very rarely does FEMA provide a single-bottom line and communicate it well. This is the reason why the national press quickly catches on that the national office representatives and the field personnel are not singing from the same sheet of music.

For business, though, FEMA can provide information on mitigation measures, response activities, and provide safety information for you and your employees. They liaise with all the local and state agencies and responders, so you can minimize the risks to your employees and clients. They can also act as a conduit, in the sense that they can usually help you find the information you need on road closures, assistance updates, sheltering activities, etc. 


3. Crisis Counseling


Counseling after a disaster is not a new iteration. The Red Cross and other agencies were doing some kind of spiritual or psychological counseling for victims of disasters and wars since the First World War. FEMA now provides crisis counseling alongside these agencies, as they are able to mobilize mental health professionals quickly and efficiently to a disaster area.

In your company, your people are your most important asset. If you are a single-person business, the most important asset is you. And, of course, you need to be in a rational, steady-state of mind if you hope to keep your business continuous. You should know your limits and those of your employees so that they are not placed with undue stress

FEMA and other disaster counseling can help. The counseling is free, and could go a long way for your employees who are concerned about their family and friends. For example, disasters are very distressing events for children under almost any circumstances. Parents, guardians and other relatives can also be placed under additional stress from a disaster, and the counseling can provide a relief for them.

Conclusion


What is critical to remember is that FEMA cannot be all things to all people. Don’t expect it to be your Mommy or Daddy after a disaster strikes. They can only do so much.  By recognizing their strengths, and their limitations, you will find that FEMA does have a place in your disaster response. Utilize some of these resources available as they can be of great benefit to you and to your employees as you Reverse Disaster.

Patrick Hardy