by David Haskin
Jeff Multz is. He started planning for disaster after seeing it strike his clients. He runs Atlanta-based Emerging Market Technologies, which provides customer relationship management services and software. “A tornado ripped through an office in the Midwest and there was nothing left. They had no backup, and they declared bankruptcy 32 days later,” he says. Greg Merideth, MIS director for Technology and Business Integrators, a Woodcliff Lake, N.J., management consulting firm, adds some perspective: “People often get caught up in the excitement of running the business, but don’t think about what they should do if something happens.”
Multz, Merideth, and other experts urge all small businesses to plan for the unexpected or face the consequences when trouble comes knocking. Here then, is their advice the SBC eight-point preparedness plan:
1. Weigh the Risks, Make a Plan
Our experts were unanimous that the first step is to create a thorough, printed contingency plan. “On a scale of 1 to 100, a written contingency plan is a 110,” says Allen Falcon, president of Horizon Information Group, a technology consulting firm based in Boston.
“Our plan covers things as small as power failures as well as what happens when a hurricane comes,” says Elise Ziv, director of internal support for Flash Creative Management, a 22-employee management consulting firm in Hackensack, N.J.
The plan also must cover non-technical contingencies. For instance, Ziv notes that some companies have “hot” backup offices with generators, phone lines, and electricity ready to move into if the main office is no longer available.
“You have to do a risk analysis,” Ziv says. “For instance, if you are a telemarketing company, you may need a hot site with phone lines.”
Even if you don’t need a hot backup site, you still should plan for the possibility that your office may not be available. “You need to know where you can go,” says Merideth. “And who can run the business if something happens to you.”
Part of creating your plan is to prioritize what information you will most need after disaster strikes. “You have to ask, ‘if there were a disaster, what information would I need to start over again?’ ” says Barbara Hemphill, CEO of Hemphill Productivity Institute in Raleigh, N.C. “How do you track your clients? What information is strategic to your products and services?” Hemphill asks. Then plan to protect that information first. “You can’t do contingency planning unless you know what to be concerned about,” she adds.
Also, be ready to replace computerized processes with non-computerized ones. “I know of a truck repair company that has a paper system in case their computers fail and they can’t use bar codes to check parts out of inventory,” Falcon says.
2. Implement Your Plan
A contingency plan isn’t useful unless employees can access it in an emergency and know how to implement it. “Every employee gets a copy of the [contingency] handbook,” says Ziv.
All our experts agreed that you must distribute the plan widely throughout the company and demand that employees become familiar with its contents. You also should appoint individuals to be in charge of implementing different parts of the plan more on this later.
When you finish your plan, print it and keep copies safely off-premises. “Don’t put the contingency plan only on a computer,” Merideth warns. “We had one case where they put their contingency information on their computer, but the computer didn’t work.”
And when things do go wrong, having a printed plan will help keep cool heads. “Typically when things go wrong, sheer panic sets in,” Merideth says. It helps calm people down when they have a plan they can actually hold in their hands.
Our experts note that one of the most important things to do is to include an up-to-date, detailed description of your technical environment in your printed contingency plan.
Also, put at least one non-technical employee in charge of implementing the plan. Have a backup employee available, and make sure that they don’t both go on vacation or on business trips at the same time. “Make sure they have phone numbers, contact and vendor information, and even model numbers of the hardware,” says Merideth. “That can make the difference between four hours of repair or half an hour.”
3. Manage Outside Vendors
Technical vendors must be an intrinsic part of contingency planning. “Make sure the vendor is reliable, plus have a second VAR built into the contingency plan,” Merideth says. “We actually give customers the name of competitors in case something happens to us. You need a provision about what to do in case the vendor can’t perform the service any more.”
Don’t just add vendors into your internal contingency plan. Build contingency plans into your contracts with outside vendors.
“You may want a two-tiered approach,” he says. “The contract can call for normal maintenance and also for contingencies. But, of course, the faster the response time, the more costly it is.” First, though, figure out just how fast your response time must be. “Many businesses can absorb a day of loss,” Falcon says. “If that’s the case, a four-hour response time, plus the time it takes to get everything back up, will get you running within that 24-hour limit.”
If systems are mission critical, demand a faster response time, such as one hour. However, remember that response time isn’t the same as the time it takes to get back to normal. “You can negotiate response time,” Falcon says. “But you can’t negotiate the time to recovery.”
4. Back Up Data
Perhaps the most obvious part of a contingency plan is backing up data. Unfortunately, backing up occurs less often than you might think. “Many people have an ‘it’s not going to happen to me’ attitude,” Merideth says.
Just as somebody should be in charge of the overall contingency plan, select employees should be in charge of backups. “Assign two people to be your backup people,” says Merideth. “They are responsible for buying tapes and getting information about how to use the system. It’s amazing how many people know how to back up, but don’t know how to restore.”
Make sure to periodically test the backup system and keep the hardware up to date. “Tapes do wear out and should be replaced every year,” Falcon says.
Backing up to Internet services such as @Backup is a good idea, but don’t rely on them, our experts caution. “Sometimes when you really need them, if there’s a major catastrophe, you may not have Internet connectivity,” notes Multz.
5. Make It Available
Say you are religious about backing up data. The tapes are placed in a secure place in the office. Then one day, the office burns down. Among the ruins are your destroyed backup tapes. The not-always-obvious solution: Periodically back up everything and store it off site.
Make backups of critical files and save them off site. The frequency depends on the company. Meredith says, “If you don’t create many documents, you can go as long as a month.”
Once a week Multz’s company creates a CD-ROM containing essential data. “My management team all has computers at home,” Multz says. “Once a week, we burn a CD and everything in our system is on it accounting, management, everything. They take it when they leave the office on Friday, and then they can operate at home or wherever they are.”
6. Stay Connected
Determine the best way to maintain phone and Internet connections. That is particularly important for companies that depend on phone sales, e-commerce, or e-mail.
Multz has extra phone systems readily available. “Every time we outgrew an old phone system, I kept it available,” he says.
You also need a plan to stay connected to the Internet, no matter what. “Work with your Internet service provider,” urges Merideth. “You should have a [fast] connection and another account that’s accessible via dial-up in case your fast connection [such as DSL] goes down.”
But what if the ISP itself goes down? “You need to ask your ISP what their contingency plans are,” says Merideth. “Have them send you a copy of their plan and watch how they behave after you ask. If it takes four days for them to get it to you, they probably didn’t have a plan to begin with.”
The ISP’s plan should keep the site running even under the direst circumstances. Make sure that the ISP or other vendors, such as companies that process e-commerce credit card transactions, can help get the site up and running again quickly.
7. Have Plenty of Backup Power
Hurricanes, earthquakes, and tornadoes are rare, but your electric power stops, or at least browns out, comparatively often. The answer: Use uninterrupted power supply (UPS) modules.
“I have a UPS for our phone system because we can’t help clients if there’s no power for the phones,” Multz says. He also has a UPS for each file server and for his desktop computers.
Make sure the UPS provides sufficient power for longer blackouts, he says. Specifically, he recommends that servers be protected for three to five hours, and phone systems be protected for twelve hours.
Multz also has lightning protection for his phone system. “Lightning is the number one reason phone systems blow up,” he adds. “If a lightning bolt hits the phone line, it blows up the protector instead of the phone system,”
And don’t forget about the other office machines. Companies should have UPS modules for fax machines and printers.
8. Be Redundant (Again)
Backing up is a form of redundancy, as is using UPS. In addition, most IT shops employ a technology called mirroring to help them recover from disaster.
Specifically, within each server, there is a second drive that is an exact digital copy of the primary drives. For even more protection, Multz has a separate server that mirrors the primary server sort of a double redundancy.
Merideth advocates having extra servers available in case primary ones go down. Then make sure that employees know how to get the backup server up and running. That brings us back to the need to have specific instructions in the contingency plan.
“We worked on a case where a company had put in place a backup server, but they didn’t know what to do with it,” Merideth said. “It was plugged into a hub that was turned off. If somebody had known that, when they had an emergency, there wouldn’t have been a problem they could have simply switched it on. But because nobody knew, they lost a couple of days work.”
When it comes to redundancy, Falcon recommends looking first at the things that fail most often. After all, few companies can afford to have redundancy for all their systems.
When it comes to running a small business, the Boy Scouts have it right: Be prepared. Disaster of some sort will strike count on it. Whether your business gets through those tough times and continues to thrive without missing a beat depends on how prepared you are.
