Business Security Information

When most companies think about disaster planning, a variety of thoughts come to mind.  Some businesses I have dealt with think about preparing for a natural disaster or a fire while others think about nothing but planning for an IT or network outage.  For the purpose of this article, I am referring to the planning for and recovery from a disaster.  This definition encompasses more than just the planning and recovery of IT services, infrastructure, data (information) and other technology resources of a company.  Disaster planning must include preparing for and recovering from the loss of human resources, such as key employees of a business, and other essential resources that allow a business to function.

An example may bring some clarity to the point I am trying to make.  Recently, I was working with a small business that had less than 10 employees.  Their first thought was to simply protect the critical information they had on their computers by using a local backup as well as a remote (off-site) backup for any critical business information.  Upon looking further into disaster planning issues for the business, it was noted that they also needed to address issues related to internet access since the business required uninterrupted internet access.  Another issue that came to light is the cross-training of employees so that if there is a loss of a key employee for any reason, the business can still function.  I feel that this issue is important for any business but especially for the small business where an employee may fill more than one critical role in the small business.  Lastly, the business realized they also needed to look at key delivery systems or shipping channels so that a loss of one would not affect the function and profitability of the business.  As you can see from this example, there are a lot of things to think about when preparing even small businesses for a disaster.

7 Key Elements of Disaster Planning

How do you get to the point of being able to prepare and recover from a disaster that may affect your business?   Here are some essential steps to take to reach that point.

1. Determine the threats or risks to your business – Some of these will be general in nature such as a natural disaster while others may be more specific to your particular industry.  Threats include tornadoes, fire, flood, virus infections, power outages, or simply the loss of a computer hard drive with critical information.  More complex threats may include a cyber attack by criminals trying to gain access to business accounts or an activist group trying to stop you from selling a certain product.  The list can be endless,  but businesses should look at events that have the highest probability of occurring as well as the types of threats that would have the greatest impact on the business.
2. Determine the essential elements and needs of your business -  These include information, hardware, software, suppliers, transportation systems, employees and other elements which are critical to the survival of your business.  Determining what elements of the business are most critical is necessary to properly prepare your business.  This should include the items or supplies that will be important to have on hand to manage and recover from a disaster.  When a disaster strikes, it is usually very hard to get essential supplies because of limited availability and competition from others who also need supplies.
3. Locate all critical business resources -  This is especially important for information or data.  Many businesses don’t know where all the critical information that they use is stored.  When planning for a disaster, you should ask these questions:  Which server or computer is used to store this information?  Is there a current backup?  Where is the backup kept?  Would it be accessible during a disaster?  All these questions and more must be answered before an event actually occurs.  As stated above, do not forget other critical business resources, especially your employees and other related resources that you need to operate your business.
4. Look at current measures being used to protect your company –  How will these measures reduce the impact of a disaster if one were to occur?  It is always more effective to prevent a disaster from occurring than to respond and recover from one.
5. Determine costs – What are the costs to the company if a disaster does occur?  Per hour?  Per day, etc.?  Also, what will be the estimated costs to adequately prepare for a disaster.  You don’t want to spend more than you should.  Cost benefit analysis is critical in any business decision.
6. Develop the plan -  If the hard work is done in steps 1 – 5, developing a plan should not be as difficult.
7. Train employees and test and maintain the disaster plan – Once the plan is developed, you have to train employees so they know what to do.  Then, the plan must be tested to see if something has been missed and to find any glitches in the plan.  This also help employees put into action what you have just trained them in.  Also, a schedule should be set up to review and update the plan.  If the plan is not updated and tested on a regular basis, all efforts up to this point will have been wasted.

By thinking through, planning and implementing a disaster plan, you and your business can be prepared to handle almost any disaster that you may face.  Remember the survival of your company is at stake.

Related posts:

1. Addressing the Most Important Business Security Issues
2. Cybercrime Small Business Survey
3. Security Issues Related to Insider Threats