Incident Management

Standard BCM Procedures
The criticality of implementing standard BCM procedures well in advance of a disaster is highlighted when an event such as a hurricane, earthquake or terrorist attack occurs. This is why The Steele Foundation refers to the process as "business continuity management" rather than "business continuity planning." The word “planning” implies that this is something that can be handled as a project: done once and then forgotten until the need for it arises again. In fact, in the year following the Sept. 11 attacks, we began to see that many organizations were taking the project-based approach to business continuity. But business continuity is not a project. It is a program. And it must be managed on an ongoing basis to ensure that a full program management cycle is conducted around how your business will continue in the event of a catastrophic event.  Though this is not an exhaustive list of standard BCM practices, the following steps may help your company.

• Coordination — Advance preparation ensures that public and private organizations have business continuity and disaster recovery response plans that are in sync with the rest of their facility, utilities, suppliers and key customers, as well as with county and statewide emergency operations. This coordination, in the form of tests (tabletop through simulation), is necessary to recover business operations expeditiously.
• Emergency notification — Everyone in the organization should be trained on emergency notification procedures. These procedures include not only who to notify in case of an emergency, but where to go to seek information in case of an emergency. Every employee should also know how to direct customers, trading partners, suppliers, the press and other community members on how to get needed information or assistance.
• Centralized command center and emergency operations center — Centralizing these operations allows for better organization and coordination throughout the facility in the event of an emergency. Global Rapid Response provides redundant 24/7 incident management centers.
• Emergency management software — For larger disasters, organizations should have emergency management software in place to help coordinate recovery efforts.
• Testing — Regular testing of recovery plans is imperative to ensure the smoothest possible recovery. It is also an opportunity to train new employees and refresh the training of other staff.
• Media relations — Maintaining a good relationship with local media makes good business sense on a day-to-day basis, but it becomes critical when disaster strikes. Companies can be severely impacted by the tone the media takes in reporting on an event, and the organization’s position in the community can be either enhanced or damaged, depending on the slant. If there is a negative impression of your organization in the community today, begin working to repair it now so that you are shown in the best possible light should a disaster strike.
• Technology and service provider resources — Organizations should take the time to understand the ability of their technology and service providers to restore their own functionality after an event, so that they can understand how long it will take to recover their own business processes. It doesn’t matter how fast your organization gets itself up and running if you haven’t coordinated with the rest of your supply chain and they are still inoperable.
• Personnel training — A point that many organizations don't think about is that, during disasters, the first thing employees do is protect their homes and families (or evacuate). Therefore, actual recovery times may be greater than anticipated. This is in direct contradiction to what many organizations assume: that employees will be around to restart the business immediately. Therefore, recovery teams must be formed with primary, secondary and tertiary members, and all recovery team members must be trained in advance to handle their personal recovery needs.

Pre-Event BCM Procedures
With certain kinds of disasters such as hurricanes, organizations have advance warning that the event is going to occur. In these instances, pre-event organization and planning can greatly improve the disaster recovery scenario.  The best advice in these cases is to start early. Conducting daily conference calls with government agencies, utilities, suppliers and other businesses in advance of the event can go a long way toward reducing chaos and confusion once the event occurs. Discussions should center on how to protect and evacuate people if it becomes necessary.  The Steele Foundation is able to assist in developing these procedures.   Getting employees safely home should be a top priority.   These calls can also:

• Clarify the status of the event .
• Result in decisions concerning events such as early closures (because, for example, if all businesses close at the same time, traffic will be affected).
• Increase understanding of alternatives (for example, alternate traffic routes need to be identified should traffic flow be disrupted because of road closings).
• Determine required actions for the day.

Sometimes evacuation is not possible. This can happen in the case of unexpected events (such as earthquakes), chemical or biohazards, or if a storm hits earlier than expected or causes more damage than anticipated. In these instances, organizations must be prepared to offer food and shelter for their employees in affected facilities.   It is critical to have emergency supplies on hand. Food, water and ice are all required. An often-forgotten necessity is cash. If the power is out, automated teller machines won’t work and businesses that remain open can’t take credit cards. All organizations should have ready access to cash for a limited time period, especially to purchase small items for emergency needs. The amount of cash will vary depending on the organization, but you should plan for a three-day supply of petty cash.  Other advice to consider includes the following:

• Post-event supplies — Stage post-event services, supplies and equipment for fast departure after the event. These should include mobile business services (such as those of mobile banking facilities and critical government agencies that will immediately interface with the public), ice, water, and office supplies stored at the command center or emergency operations center.
• Emergency radio equipment — During regional disasters, such as hurricanes, the telecommunications infrastructure, the Internet and other electronic resources might not be operational. Therefore, organizations are advised to deploy emergency radio equipment (900MHz) to key personnel in advance of the event so that communications are not entirely disrupted if power and phone lines fail.
• Emergency contact information — Validate all emergency contact information for critical staff, customers, suppliers and other trading partners.

Post-Event BCM Procedures
After an event strikes, whether anticipated or not, the first thing an organization must do is account for all its critical assets, including employees. Business continuity recovery is about people first. You must know where your employees are and attend to their health and safety before doing anything else. The second thing organizations must do is assess their property damage. Having a clear understanding of the situation ensures that the proper actions will be taken next.  Organizations in the post-event phase should then proceed with the following activities:

• Daily conference calls — Until all the fallout from the event is fully understood and addressed, organizations should continue with their daily conference calls with local government officials, utilities, suppliers and other businesses to assess status, answer questions, make decisions (about reopening, for example) and outline required actions for the day.
• Emergency supply distribution — Organizations should begin dispensing emergency supplies to employees (and community members, suppliers or others, if that has been agreed on) if they are needed.
• Rebuild facilities — Once the immediate needs of employees and the community have been met, organizations should begin to recover and rebuild their physical equipment and facilities.
• Recover business services — As soon as reasonably possible, organizations should seek to restart operations and reopen for business on a full or limited basis.

Bottom Line

Recovering and restarting business services after a catastrophic event is obviously the ultimate goal for any organization. However, it cannot take place until people and facility issues have been addressed. Trying to restart business operations, even on a limited basis, before seeing to the health and safety of employees can do irreparable harm to an organization’s long-term reputation as the community recovers and tales of their activities start to circulate. Having a strong BCM program in place — with regularly tested and updated plans to manage all types of scenarios — is the best protection an organization can have against unforeseen disasters.