4 Steps in Creating a Small Business Disaster Recovery Plan
A disaster does not give a written warning that it is about to strike. Disasters often strike without warning. Prudent business owners recognize the threat and formulate disaster recovery plans.
A Disaster Recovery (DR) Plan is an essential tool of Management, more so for small businesses, which do not have deep pockets and the wherewithal to withstand a prolonged shut down. For a small business, even a shutdown of a few hours can lead to financial disaster. A carefully designed DR plan should be the cornerstone of any business owner’s survival strategy.
No one can predict with certainty when a fire, flood, snowstorm, theft, data loss, etc. can strike an organization. It is a hazard which is ever present on the event horizon. Therefore, a small business should be prepared to restart operations in the shortest possible time. Remember, the fixed costs of a business keep adding up, even when production has stopped.
A small business that is prepared will be able to face the disaster with confidence, leading to minimum downtime and the least possible impact on revenues and profit.
The 4 critical steps to be considered when preparing a DR plan for a small business are:
- Assessing the risks to the business
- Prioritizing business functions depending on criticality
- Developing risk prevention and mitigating strategies
- Testing and maintenance of the disaster recovery plan
Each of these steps is crucial to developing a sound DR Plan. Let us analyze each of these steps.
Assessing the risks:
A business could face risks both internal and external. The business may have some control over internal risks. Internal risks can be eliminated or at least minimized to prevent it from becoming a full-blown crisis. The business will not have control over external risks that can adversely impact business operations.
Some of the external threats faced by a business is location dependent, while others are not. For example a business based in Denver, Colorado may face the risk of shutdown due to a snow storm, while one in Miami, Florida will not. In the case of hurricanes, it is the reverse. Each external risk should be listed and analyzed as to what possible impact it could have on the business. Some of the external risks that could affect business operations are:
- Floods
- Earthquakes
- Adverse weather
- Damage to production site
- Prolonged power grid failure
Factor in the criticality of a business function and prioritize them
Every critical function of the business should be listed out in decreasing order of importance. The higher the function on the list, more attention should be paid to it, so that it can be restored in the least possible time. If necessary, businesses should take insurance coverage so that the losses are minimized.
All business functions that are not critical should be put on hold till the recovery of critical functions are completed and restored. Only then does attention have to be paid to non-critical functions.
Mitigation and prevention strategies
Once the critical functions have been determined, a strategy for mitigation and prevention should be developed, so that the critical function remains unaffected, or if affected, it can be restored in the least possible time. For example, if power is crucial to production, then backup power or an alternate power source should kick-in when the primary source is out of action. Similarly, the DR plan can have mitigation and prevention strategies for all possible risk factors.
Plan testing and maintenance
No DR Plan will be perfect when it is drawn up. There are bound to be bottle-necks and problems. Therefore, it is important that the DR Plan is tested. During testing, problems and bottlenecks have to be addressed and corrected. Repeated testing at regular intervals will ensure a robust and accurate Disaster Recovery (DR) plan.
For any DR Plan to work, training employees is a key to successful implementation. The following sequence of developing a DR plan ensures employees understand and support actions that ensure success.
- Management authorizes development of a companywide DR plan and appoints a leader
- DR planning team constituted
- Planning team develops DR plan and solicits input from all departments from a wide array of employees. Input and comments should be sought from managers and floor level employees alike
- Plan tweaked based on input
- Management approval
- Train all DR team members
- Train all employees
- Test plan
- Fine tune plan
- Test at regular intervals
Changes to the DR Plan should be done at regular intervals depending on changes in the input or other factors. The DR Plan should not be a static plan, it is a dynamic plan which has to be routinely tested and upgraded.
When a sound small business Disaster Recovery Plan has been formulated and tested, the business has put in place the first building block of resilience in the face of disaster. Well-trained staff will seamlessly shift into the roles assigned in the DR Plan. The DR Plan will help the business recover in the fastest possible time.
Categories: Disaster Recovery Planning
