Many small businesses assume they don’t need a formal business continuity plan. With fingers crossed, they rely on broadcast emails and call-trees, and barring any great disaster, they may get by just fine.
The game changes when the small company finds themselves with a new customer, a customer that requires all vendors to have a BC plan in place. Larger companies, especially those that deal with the public trust, like financial institutions or government entities, recognize that they are only as strong as their weakest link. So every link, including the service you may provide for them, must be shored up to support the whole.
When confronted with such a scenario, what’s a small company to do? Developing a BC plan can seem daunting, but like any good plan, when you break it down into a series of steps you’ll find that creating a BC plan is not such a big deal. In fact, if you have a plan for backing up your data, you’ve already taken the first step. You just need to apply that way of thinking more broadly, considering every aspect of your business. So when you’re ready, roll up your sleeves, assemble your team, and use the tips below to get started.
- Make it a team effort. Although it only takes one person to document a BC plan, you need to take into consideration every department when developing it. Pull a team together from every functional area to make sure you’ve got everything and everyone covered. You don’t need to work in human resources to know that they will have security and continuity needs that engineering will not, and vice versa. Facilities has inside knowledge on keeping the business humming that no one outside the group has knowledge of. By including a representative from each group you’ll have a much more comprehensive plan and also you’ll find support and encouragement from all quarters.
- Communicate. Consider how you’re going to reach all your people if there is an interruption. Do you have an automated notification system that will reach mobile or remote workers wherever they are? Are the right people authorized and trained in how to effectively deliver an emergency alert? Will your staff recognize that the alert is from you, and is there a way for them to respond? Can you send an alert that allows every contact to join a conference bridge to discuss an issue?
- Collect your data. Start your plan with an open mind. Talk to all managers to find out how they and their teams would be impacted by any sort of outage. Would they have to quickly reach vendors, partners, suppliers or partners? Who would they contact if an outage impacted systems with their specific group? From this exercise, you’re going to end up with a series of lists: a vendor list, a service provider list, a company contact list, and so on. Once these lists are pulled together you’ll need to post them in a way that your team can access them even if email or your intranet is down, keeping printed and online versions of all.
- Choose your tools. A good plan will need regular updating as changes occur in your company. Changes can include new hires, a new insurance carrier, promotions, a new phone system, etc. If you’re a software developer, you likely already have a system for version control that’s applied to software—you can use that same system to keep your BC plan up to date. If you don’t already have a system, then start with what you have, the most common tool being simple word processing or spreadsheet software with careful attention to version control.
- Outline your plan. If you are creating a plan that’s strictly for internal use, you can make it as simple as a checklist with the potential hazard and the contact information for each scenario (Power out? Follow step 1,2, and 3, then call A and B, then email C. Email down? Call M, N, or O, then notify X and Y by sms). This will turn out to be a lot of information in small chunks. If you’re preparing the plan to satisfy the requirements of your customer, you’ll want to use more formal language with more explanations—you can use readily available templates for such a case. Sometimes your customer will provide a template so that your plan can be consistent with theirs.
- Break it down. Look at your plan and determine what needs to be done in the first 15 minutes after business is interrupted. Then consider the first hour, six hours, up to the initial 24-hour period. How long can you go without phones, email, or without accessing your back-up tapes? At what point do you bring in alternate equipment, and how long will that take? Can you go an hour or more without alerting your customers, vendors or partners? These form your RTOs, or recovery time objectives. When the heat is on it’s hard to think of all these details, so you want to be sure you’re prepared to take action at the right time if the interruption lasts longer than expected.
- Make good use of outside vendors. If everything related to your business is inside one building, then when the building is inaccessible, you’re in trouble. Use outside vendors that will keep your data on multiple servers and chances are, when a power outage impacts you in your local area, from some location you should be able to get on line and get to Google. That will allow you to access the latest information.
- Practice your plan. Once you have a plan in place, you must practice it. A simple way is to gather your team now and then and brainstorm emergency scenarios, practicing the steps of how each of you all react. What would you do if your phones weren’t working? It’s important that you physically walk through the steps, even testing your plan at night—that way you get to see what a real power outage is like, where you should have flashlights stashed, figuring out what you’ll do when key cards don’t work (where are the physical keys located?), how to shut things equipment down in the dark, or start it up. This is a great way to find out what you missed in your plan.
- Share the plan. You and your team have done a tremendous job in bringing all this information together. Share it with your team, put it on thumb drives so employees can carry it with them, post it to your intranet so it’s accessible to all, and most important, find a secure place to post it on the Web so it can be accessed when away from work computers.
Business continuity planning is really just thinking through all the steps that make your business run well and then deconstructing them in order to put them back in place after disruption. Learn more