Disasters happen but preparing for them can help you recover quickly:

What, exactly, is a disaster? One thinks immediately of natural disasters, such as earthquakes, floods, fires or hurricanes, but an electrical contractor’s business can also be destroyed by theft, computer viruses, human error and/or other uncontrollable events. Statistics show that up to 90 percent of businesses that fall prey to a disaster and lose their data fail to recover and are forced out of business within two years of the event. Rather than take a fatalistic approach, electrical contractors can develop disaster recovery and business continuity plans that increase the chances of the business surviving and prospering over the long run.

Whether you create a disaster recovery plan (DRP) or a business continuity plan (BCP), having an understanding of what constitutes a disaster will provide a solid framework from which to create specific plans for your business. According to Tom Abruzzo, president and CEO of TAMP Systems Inc., Merrick, N.Y., a disaster is any event that causes inaccessibility or inoperability of your technology, business functions or facility. “A DRP is a plan to recover from the inaccessibility or inoperability of your technology, while a BCP is the plan that allows you to recover from the inaccessibility or inoperability of your facility,” he said.

Without a DRP or BRP, a company will need a much longer time to reassemble the data, personnel and technology required to function and may very well possibly fail to recover. “Information is the backbone of any business. Without access to the data, most businesses can’t function anymore,” said Sally Cohn, MBCP, director of planning for CAPS Business Recovery Services, Shelton, Conn. Also, without a plan for communication after a disastrous event, you can’t tell employees where to gather or what jobs will take precedence during and after the emergency.

“Without a plan for acquiring additional equipment, locations or ways to continue to conduct business, your organization will be in chaos,” said Julius Neudorfer, director of network services for North American Access Technologies Inc. (NAAT), Hawthorne, N.Y. Finally, without a plan in place, recovery is more expensive, your company can lose market share as it tries to recover, and you can lose your investment in recovery strategies that don’t succeed.

“Alienating customers because you can’t complete projects or accept new business is another risk for those companies without a DRP,” said Jim Grogan, CISM, vice president of consulting product development for Sungard Availability Services, Wayne, Pa. Unplanned downtime caused by a disaster affects revenue, customer satisfaction and productivity regardless of the size of the company. Therefore, the idea that a DRP or BRP is only for large companies is completely false. The trick for smaller firms is to balance business continuity protection with the potential risk and the amount of money available to develop and maintain a plan.

Assessing risk and developing a plan

Contractors can assess their current risk of being caught unprepared in a disastrous event by first determining the probability of any event, the need to plan for it and the effect of the event if one occurs.

“Each risk and threat has a different probably of occurrence. A BCP is what allows the company to mitigate the effects of any risk or threat,” Abruzzo said.

Assessing risk, according to Robert Urion, general manager of CAPS Business Recovery Services, begins with the formation of a risk management team that determines the existing risks to the business, the requirements for the business to continue if an event occurs, and the business’ critical functions, the minimum staff required to meet those functions and the resources needed.

“Vulnerabilities that increase a contractor’s risk exposure include loss of customer records and loss of engineering and architectural drawings,” Abuzzo added. Physical risk also needs to be identified, such as whether the building is in a flood plain or vulnerable to tornadoes or earthquakes. After the risks and threats are identified, the contractor needs to figure out, as best as possible, the probability of any particular event and what the cost-effective safeguards are that will mitigate or eliminate, when possible, the risk.

“Assessing risk is basically playing the what-if game,” Neudorfer said. What if I lose access to my building or the building itself? What will it cost to replace, and how will I reacquire assets? The answers to those types of questions then have to be balanced against the company’s ability to stay in business after an event.

“That balance will help determine how complicated and sophisticated the DRP needs to be,” he said.

Contractors have resources they can tap to help them assess risk, such as their municipal emergency management agency and even their insurance carrier.

“The local agency can help determine how an emergency may affect your ability to do business, and quite often, insurance carriers have additional services available that provide environmental risk information or on-site inspections that can help determine the greatest risk or threats,” said Abby DeLotto, project director for Strohl Systems, King of Prussia, Pa.

With the business impact analysis (BIA) in hand, the contractor can begin to prioritize and develop its BRP.

“In examining the prioritized tasks, the company must decide what kind of response will be necessary, which will be dependent on the type of interruption being planned on, from a half-day outage to longer periods of time because of a large-scale event,” Grogan said.

What to include

To begin developing the disaster recovery and business continuity plan, experts advise companies to include the scope of what they are trying to recover from the disaster, from a single server to the entire facility; define the timeframe objective, that is, the target timeframe within which the company wants to recover; choose and implement the recovery strategy that will allow the company to achieve its target timeframe; and identify and document the necessary recovery resources.

“These are the important resources that will assist you in your recovery activities and allow you achieve your target timeframe,” Abruzzo said. Categories of recovery resource information include equipment, facilities, forms and stationery, personnel, software, supplies, vendors and vital records.

“Generally, the plan should include the people, processes and technology required to conduct business,” Grogan said. That includes ways to communicate with staff and customers and having physical facilities in which to operate.

“The plan should include all of the contact information that you could possibly imagine needing if you are displaced from your place of business,” DeLotto said. That includes employees and management, primary and secondary suppliers, the insurance carrier, the claims adjuster, and those key customers with which you cannot afford to be out of touch. The disaster recovery plan must be documented, logically organized and easy to reference. According to Abruzzo, it should include the following:

The scope of recovery
- Objectives, strategies and the assumptions that went into the plan
- Notification procedures
- The recovery teams’ responsibilities
- Staffing
- Procedures
- Emergency procedures and information
- Mission-critical operating specifications
- Rebuilding and restoring specifications and inventories
- A glossary of terms

The plan should then be reviewed and tested regularly, from quarterly to annually, depending on the size of the company and the scope of the plan.

“Testing is paramount,” DeLotto said. “Testing provides reinforcement and allows the company to be comfortable that it can react to a disaster before it actually occurs.” Testing also allows the company to determine whether the original assumptions used in developing the plan were correct. In addition, the plan should be reviewed and tested whenever there are substantial changes to the company’s critical mission, personnel, processes or technology.

“Significant changes to how the company operates may require alterations to the plan,” Grogan said.

Resources

One alternative for developing a disaster recovery plan is to purchase a do-it-yourself software product that contains the information and tools required. Another alternative is to secure the services of a consulting firm that specializes in business continuity planning and that can help you become self-sufficient in maintaining the plan.

Data backup and storage in today’s technological age is an integral part of any business continuity plan. Data can be stored at a hot site, warm site or cool site, depending on the needs and budget of the company. Hot sites, the most expensive, store data in both an operational location and in a mirror site that operates in real time, allowing the company to continue operating seamlessly. Warm sites have the same redundancies as hot sites, but do not operate in real time, while cool sites are data-storage facilities such as service bureaus, managed recovery facilities and mobile recovery units.

There are also commercial alternate sites available that offer a backup and recovery facility that is available to use as an office, including computers, phones, Internet connectivity and backed up data.

Regardless of the scope of the plan, when choosing a disaster recovery provider, make sure the company can offer you a number of choices for data-recovery solutions that will meet your needs, has a proven track record in creating plans and completing successful recoveries, and that invests in state-of-the-art technology. In your time of need, the preparations you make now will mean the difference between bringing your company back to life and becoming one of the many companies that fail each year.     EC

BREMER, a freelance writer based in Solomons, Md., contributes frequently to ELECTRICAL CONTRACTOR. She can be reached at 410.394.6966 or by e-mail at [email protected].