What should your company be doing to protect itself?
By Jenny C. McCune • Bankrate.com

Your small company may not be a terrorist target, but the attacks on the World Trade Center and the Pentagon awoke many business owners to the need to protect themselves.

No matter where your company is located, there's a chance that some disaster, whether natural or man-made, will befall it. And being small generally makes you more vulnerable.

"If a small business has one location, in effect, it has all its eggs in one basket and a disaster can have much greater impact than on a big company with many locations," says Jason Taule, global director of information and systems security for Ajilon LLC of Baltimore.

Measuring your risks
Start by figuring out the odds.

You can't protect your company from everything, so concentrate on the most likely disasters that may strike your area. If your company is based in California, an earthquake may top the list. A consulting firm situated in idyllic mountain offices in the West may need to worry about forest fires. Crime may be your greatest concern if your company is located in an economically deprived urban area.

"What are the threats and vulnerabilities of your business?" asks Philip Jan Rothstein, president of Rothstein Associates, a Brookfield, Conn.-based publisher of information on crisis management and disaster recovery.

"If they are obvious to you," says Rothstein, "then they are obvious to anybody else who could mean your company harm."

Make pre-emptive moves
Once you've identified the top risks, look for ways to minimize potential damage.

The owner of a company located in an earthquake zone may wish to hire a structural engineer to examine corporate offices. Additionally, the company itself may want to bolt down bookshelves, computers and other equipment to "earthquake proof" its operations.

If your company does the majority of its work online, you must make sure your computer security is up to snuff.

It also makes sense to meet with local disaster officials from organizations such as the Red Cross. Get input on the groups' plans for a regional disaster and advice on what your company should do.

"You may want to become involved at the community level with the Chamber of Commerce or another business group to do emergency planning," says Diana McClure, who works with the Institute for Business & Home Safety.

Plan for disaster
You'll also need to develop a specific operational plan based on what pops up on your disaster radar. The plan should answer the key question of how your company will continue to run if normal business is disrupted.

"Look at what are the most important functions for your business to continue and how you can carry out these functions if work is disrupted due to a disaster," McClure says.

Such disaster plans cover:

• Your workplace and employees. If a disaster strikes during work hours, have evacuation procedures posted, so, if necessary, everyone can quickly and safely leave the offices.
  
  If your employees can't reach your offices or your offices are closed due to flooding, fire or some other disaster, have an alternative work site in place. Some small businesses arrange reciprocal agreements with other companies. If disaster strikes at your locale, your employees can work from Acme Professional Services across town. If a flood temporarily closes Acme's buildings, you agree to let its workers set up shop at your workplace.
  
  Another solution is to allow some or all of your employees to work from home. Just be sure to iron out emergency work-at-home procedures before disaster strikes.



• Crisis communications. Figure out how you will communicate with your employees if your offices are shut down on short or no notice. That could mean distributing phone lists to key employees in advance of an emergency so a "daisy chain" can be set up (employee A calls employees B through D while employee E calls F through Z).
  
  Some companies will keep a special phone number in reserve, which is used in the event of an emergency, McClure says. Or use your local radio stations to get the word out.

And don't forget your suppliers and customers. Have systems in place to contact them so they know what's happening with the company.

Protect vital people and data
Any disaster preparation should include a safe haven for important documents and computer-stored information. You may want to store duplicates of insurance policies and other business documents in a safe-deposit box.

Backing up computer data is also important. One easy way to keep copies of information stored on computers is to hire an online firm to handle your backup. Your company's information can be backed up daily and then stored far away.

To assist your staff after disaster strikes, put together an office emergency kit. It can include water and food supplies, petty cash for crisis purchases, and flashlights so that employees can find the way out if electricity fails. Don't forget to post emergency phone numbers for fire, police and the Red Cross.

And if much of your corporate knowledge is possessed by a chosen few, consider writing down how-to procedures or cross-training employees so that your company can carry on even in the absence of key workers, Rothstein says.

Inspect your insurance
Pre-disaster is also the time to examine your company's insurance coverage.

Most business policies will cover replacement of hard assets like computers, filing cabinets and phone systems, but your company may also want to invest in "business interruption" insurance. This policy, which is usually based on a company's revenues, will give your firm financial aid during any down time associated with a disaster like a flood or a fire.

Although such insurance can be expensive, it could be the difference between a temporary business disruption and a total cessation of operations.

Various doom-and-gloom statistics are offered by associations involved with disaster planning about how hard it is for a company to come back after its offices close due to a disaster. IBHS says that of all businesses that close following a disaster, 43 percent never reopen, and an additional 29 percent close for good within two years.

Practice, practice, practice
Finally, don't overlook testing your emergency procedures. Companies need to make sure that theoretical plans will work when the real-life disaster strikes.

"You need to exercise and maintain your disaster recovery plan and business contingency plan, otherwise you won't know if it will work when you need it," Rothstein says. For example, if you backup computer data, then attempt to restore the information before you are completely dependent on it.

Educate your employees on security and emergency procedures. Hold evacuation drills so employees know how to leave your building quickly and safely. IBHS recommends reviewing emergency plans twice a year with your employees. Get their feedback on what works and what doesn't.

Most disaster recovery specialists say that it's impossible to plan for every contingency. But the company that attempts to do so will be in better shape if and when disaster strikes.

"What you need to do is plan for every conceivable disruption, and then assume that what's really going to happen is the one thing that you didn't plan for," Rothstein says.

Jenny C. McCune is a contributing editor based in Montana.

-- Posted: Sept. 21, 2001