What should your company be doing to protect itself?
Your small company may not be a terrorist target,
but the attacks on the World Trade Center and the Pentagon awoke
many business owners to the need to protect themselves.
No matter where your company is located, there's a
chance that some disaster, whether natural or man-made, will befall
it. And being small generally makes you more vulnerable.
"If a small business has one location, in effect,
it has all its eggs in one basket and a disaster can have much greater
impact than on a big company with many locations," says Jason
Taule, global director of information and systems security for Ajilon
LLC of Baltimore.
Measuring your risks
Start by figuring out the odds.
You can't protect your company from everything, so
concentrate on the most likely disasters that may strike your area.
If your company is based in California, an earthquake may top the
list. A consulting firm situated in idyllic mountain offices in
the West may need to worry about forest fires. Crime may be your
greatest concern if your company is located in an economically deprived
"What are the threats and vulnerabilities of
your business?" asks Philip Jan Rothstein, president of Rothstein
Associates, a Brookfield, Conn.-based publisher of information
on crisis management and disaster recovery.
"If they are obvious to you," says Rothstein,
"then they are obvious to anybody else who could mean your
Make pre-emptive moves
Once you've identified the top risks, look for ways to minimize
The owner of a company located in an earthquake zone
may wish to hire a structural engineer to examine corporate offices.
Additionally, the company itself may want to bolt down bookshelves,
computers and other equipment to "earthquake proof" its
If your company does the majority of its work online,
you must make sure your computer security is up to snuff.
It also makes sense to meet with local disaster officials
from organizations such as the Red
Cross. Get input on the groups' plans for a regional disaster
and advice on what your company should do.
"You may want to become involved at the community
level with the Chamber of Commerce or another business group to
do emergency planning," says Diana McClure, who works with
for Business & Home Safety.
Plan for disaster
You'll also need to develop a specific operational plan based on
what pops up on your disaster radar. The plan should answer the
key question of how your company will continue to run if normal
business is disrupted.
"Look at what are the most important functions
for your business to continue and how you can carry out these functions
if work is disrupted due to a disaster," McClure says.
Such disaster plans cover:
- Your workplace and employees.
If a disaster strikes during work hours, have evacuation
procedures posted, so, if necessary, everyone can quickly and
safely leave the offices.
If your employees can't reach your offices or your offices are
closed due to flooding, fire or some other disaster, have an alternative
work site in place. Some small businesses arrange reciprocal agreements
with other companies. If disaster strikes at your locale, your
employees can work from Acme Professional Services across town.
If a flood temporarily closes Acme's buildings, you agree to let
its workers set up shop at your workplace.
Another solution is to allow some or all of your employees to
work from home. Just be sure to iron out emergency work-at-home
procedures before disaster strikes.
- Crisis communications.
Figure out how you will communicate with your employees if your
offices are shut down on short or no notice. That could mean distributing
phone lists to key employees in advance of an emergency so a "daisy
chain" can be set up (employee A calls employees B through
D while employee E calls F through Z).
Some companies will keep a special phone number in reserve, which
is used in the event of an emergency, McClure says. Or use
your local radio stations to get the word out.
And don't forget your suppliers and customers. Have
systems in place to contact them so they know what's happening with
Protect vital people and data
Any disaster preparation should include a safe haven for important
documents and computer-stored information. You may want to store
duplicates of insurance policies and other business documents in
a safe-deposit box.
Backing up computer data is also important. One easy
way to keep copies of information stored on computers is to hire
an online firm to handle your backup. Your company's information
can be backed up daily and then stored far away.
To assist your staff after disaster strikes, put together
an office emergency kit. It can include water and food supplies,
petty cash for crisis purchases, and flashlights so that employees
can find the way out if electricity fails. Don't forget to post
emergency phone numbers for fire, police and the Red Cross.
And if much of your corporate knowledge is possessed
by a chosen few, consider writing down how-to procedures or cross-training
employees so that your company can carry on even in the absence
of key workers, Rothstein says.
Inspect your insurance
Pre-disaster is also the time to examine your company's insurance
Most business policies will cover replacement of hard
assets like computers, filing cabinets and phone systems, but your
company may also want to invest in "business interruption"
insurance. This policy, which is usually based on a company's revenues,
will give your firm financial aid during any down time associated
with a disaster like a flood or a fire.
Although such insurance can be expensive, it could
be the difference between a temporary business disruption and a
total cessation of operations.
Various doom-and-gloom statistics are offered by associations
involved with disaster planning about how hard it is for a company
to come back after its offices close due to a disaster. IBHS says
that of all businesses that close following a disaster, 43 percent
never reopen, and an additional 29 percent close for good within
Practice, practice, practice
Finally, don't overlook testing your emergency procedures. Companies
need to make sure that theoretical plans will work when the real-life
"You need to exercise and maintain your disaster
recovery plan and business contingency plan, otherwise you won't
know if it will work when you need it," Rothstein says. For
example, if you backup computer data, then attempt to restore the
information before you are completely dependent on it.
Educate your employees on security and emergency procedures.
Hold evacuation drills so employees know how to leave your building
quickly and safely. IBHS recommends reviewing emergency plans twice
a year with your employees. Get their feedback on what works and
Most disaster recovery specialists say that it's impossible
to plan for every contingency. But the company that attempts to
do so will be in better shape if and when disaster strikes.
"What you need to do is plan for every conceivable
disruption, and then assume that what's really going to happen is
the one thing that you didn't plan for," Rothstein says.
Jenny C. McCune is a contributing
editor based in Montana.
-- Posted: Sept. 21, 2001