As Category 5 Hurricane Dorian approached the Southeast in the U.S. earlier this month, thousands of businesses, including Vector Solutions, sprang into action to prepare their employees, clients, infrastructure, and operations.
While the Vector team was thankfully not impacted this time, we’ve prepared for disasters before – and know that a disaster can happen anywhere at any time.
This then begs the question for every business around the world: What will you do if a disaster strikes your business?
Disasters often strike with little to no warning, and they can come in many forms: hurricanes, earthquakes, fires, cyberattacks, accidents, and more.
To give your business the best chance of success during a disaster, you need to have a plan in place that assigns clear roles to employees and ensures timely communications with all stakeholders, both internal and external.
This type of plan is often referred to as a business continuity plan.
According to CIO.com, “Business continuity refers to maintaining business functions or quickly resuming them in the event of a disruption, whether caused by a fire, flood or malicious attack by cybercriminals. A business continuity plan outlines procedures and instructions an organization must follow in the face of such disasters; it covers business processes, assets, human resources, business partners and more.”
Simply put, a business continuity plan (BCP) puts processes and procedures in place to ensure that a company can continue to operate in the aftermath of a disaster. It is a living document and the blueprint for how to keep an organization running, addressing business and employee personal safety as well as customer service.
But how does one create a BCP? And what should be included in it?
Here, we’ll take a look at BCP best practices as outlined by emergency management officials and highlight some key parts of Vector Solutions’ BCP.
Creating a BCP can feel like a daunting task. How do you create one? What should you include in it? What disasters should you prepare for? Who should be involved?
The Department of Homeland Security offers an entire Business Continuity Planning Suite, which includes software “created for any business with the need to create, improve, or update its business continuity plan.”
In fact, Vector utilized these resources to create our company plan.
In addition to BCP template generators, the Suite also includes a 30-minute video-based training course which highlights the importance of having a BCP, as well as prepares users to create their own plans.
A good BCP should be comprehensive and address all aspects of your organization or business. It should include an overview of your plan, detailed activation guidelines involving key team members, and plan administration, maintenance, and testing guidelines.
Here are three critical elements that should serve as the backbone of your BCP:
The overview of your BCP should address the scope and objectives of your plan, as well as general information that identifies and assesses specific and/or expected risk threats and potential business impacts while identifying and defining critical teams (ex: Communications, HR, Legal, etc.).
Because Vector Solutions has multiple offices in all regions of the country, our BCPs must be specific to the office location they serve. For example, our Tampa office BCP identifies hurricanes as a likely risk threat, while our San Diego office does not.
This piece of your plan will determine when it’s time to activate your BCP team, how that activation will operate, and who will be involved in that activation. This section should include key decision points, communications, and team action plans.
As outlined in the Tampa office BCP, in the event of an approaching hurricane, Vector staff will use guidance provided from local, state, and national emergency management offices to determine when to act on our key decision points, which include when to close the office, when to power off equipment, when to relocate resources, and more.
Once we activate, our BCP team will carry out their assigned responsibilities as outlined in the team action plans.
It’s important to remember that a BCP is a living document and will require changes, updates, and testing at least once every year. This includes assigning proper training to any team members that need it, completing at least one tabletop exercise or drill, and updating the plan as needed.
In addition to performing routine BCP updates, Vector Solutions reviews and updates each office plan in the event an actual disaster occurs in order to assess the strengths and weaknesses of the plan.
As sections of the plans are updated, the revised sections are provided to BCP team members and any additional plan holders.
After personal safety, communication is perhaps the most critical piece of any plan and is required before, during, and after a disaster.
Proactive, timely and frequent internal and external communication show that you are prepared and ensure that the correct information is going out to your employees, clients, and stakeholders.
Because technology is often affected during disasters – power outages, unreliable cell service, etc. – it’s important to have multiple platforms of communication open and available to employees and clients so that they can receive the latest updates from your organization as well as ask questions.
The following is a list of helpful communications platforms for both internal and external audiences, and ones that Vector Solutions utilizes in our BCP:
There are many unknowns when it comes to disasters. While your business continuity plan might not be 100% successful at preparing your organization, one way to ensure zero success is to not take it seriously or waiting until the last minute to create one.
If you are in charge of creating or implementing your company’s BCP, start with your senior leadership and work your way down. Employees will not take their roles seriously if the BCP is approached with a casual attitude.
Test your BCP annually and make sure updates are completed in a timely manner. Additionally, make sure that the appropriate team members are trained and clearly understand their roles and responsibilities.
And last but not least, communicate with your team members. Misinformation or a lack of information during a disaster can lead to confusion, mistakes, panic or worse.