BUSINESS CONTINUITY PLANNING: While you're under the nearest desk for the 9.26am drill, spare a thought for the laptop or cellphone you've left on top of the desk. Now imagine you won't see either advice again.
"At 9.26am on Wednesday 26 September, more than one million people will participate in the New Zealand ShakeOut earthquake drill, the first ShakeOut drill held nationwide in any country!
"Whether you are at home, work or school join in and practice 'Drop, Cover and Hold' - the right action to take in an earthquake."
- New Zealand ShakeOut webpage
While you’re all under the nearest desk checking that you have your required amount of fresh water per person, spare a thought for the laptop or cellphone you’ve left on top of the desk. While you’re down there, imagine that you’re never going to see that device ever again.
Does that change how you should have prepared for that disaster?
It’s not only people who we should be considering when we think about disaster planning.
The ICT infrastructure that we rely on everyday can play an even larger role during a natural disaster.
When people evacuated after the Christchurch earthquake, many of them did exactly what we are taught, they left their handbags and backpacks behind.
The problem with that was that was where their cellphone was and it left them isolated and unable to contact their wider support network.
Many a company was having considerable difficulty accessing their customer/tax/stock data in the weeks and months following the disaster because their servers were still located in their old premises within the Red Zone.
You’ll be over the moon when you manage to escape a natural disaster with your life, but give it a few hours or weeks and you’ll wish you’d thought more about escaping with your phone or CRM backup.
Business Continuity Planning (BCP) and Disaster Recovery (DR) are two phrases which get thrown around these days. Many people think they are synonymous, many more have never given them more than a cursory glance.
I’d like to take a few moments of your time to describe each of them and give you a bit of homework for while you’re under your desk on September 26.
The first thing to realise is that they are different things.
Business continuity planning (BCP) is a proactive process to develop a set of plans ensuring that your business will be able to continue trading at an acceptable level in the face of an internal or external threat.
It is a process that happens before a disaster and looks to cater for all manner of threats be they large or small. It’s just as likely that a good BCP plan will cater for a disgruntled staff member pasting your customer data on the Internet as it would cater for a tsunami.
A disaster recovery (DR) plan is a reactive process which describes the steps required for systematic amelioration from a negative incident of any magnitude.
A DR plan assumes that something bad has already happened and seeks to guide you in what you need to do to get back on your feet.
So to recap...
Now, lets look at what we can do on an individual level during Shake Out. While you’re under your desk practicing your Drop, Cover and Hold (I prefer to think of it as Crouch, Touch, Pause and Engage but thats just me), thats the time when you’re just transitioned from BCP to DR. All those things you wish you’d done BEFORE you Dropped, well those are things for your Business Continuity Plan. All the things
you’re going to have to do AFTER you finish Holding, well those are part of your DR plan.
Here are some examples.
Individual ICT BCP plan
Make sure you:
Before I go through some DR plan suggestions, I feel I should give a sort of disclaimer.
Pilots have a little saying to remind them what they should be doing in a crisis. It goes along the lines of: Aviate, Navigate, Communicate.
It reminds them that their first priority is to fly the plane, then work out where they are going, then finally to tell people what they are doing.
Similarly, in a natural disaster, you need to take care of your physical safety and have an evacuation plan before you start thinking about communicating with the outside world. Do not start tweeting before you work out if the roof is going to fall on you. When it is safe however, here are some ideas of what you might want to do.
Individual ICT DR plan
Now it’s time to:
That little exercise should have shown you at in individual level what BCP and DR are all about and helped you communicate a little better before and after an emergency. This article is much too small to go
through this for a whole organisation, but you should be a bit better informed to start that discussion.
So remember toda: Crouch, Touch, Pause and Engage!
Dean Pemberton is a technical policy analyst for InternetNZ, the body that adminsters the .nz domain and advocates for internet users.
