Contingency planning and disaster recovery a small business guide

Donna and I havebeen friends for some time and she read to me daily the newspaper andbusiness press accounts of small business owners in Lower Manhattanwhose losses could have been mitig

John Wiley & Sons, Inc.

Planning and Disaster Recovery

John Wiley & Sons, Inc.

Copyright © 2002 by John Wiley & Sons All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108

of the 1976 United States Copyright Act, without either the prior written sion of the Publisher, or authorization through payment of the appropriate per- copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers,

permis-MA 01923, 978-750-8400, fax 978-750-4470, or on the web at www.copyright.com Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201- 748-6011, fax 201-748-6008, e-mail: permcoordinator@wiley.com.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose No warranty may be created or extended by sales representatives or written sales materials The advice and strategies contained herein may not be suitable for your situation You should consult with a profes- sional where appropriate Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services, or technical

support, please contact our Customer Care Department within the United States

at 800-762-2974, outside the United States at 317-572-3993 or fax 317-572-4002 Wiley also publishes its books in a variety of electronic formats Some content that appears in print may not be available in electronic books.

Library of Congress Cataloging-in-Publication Data:

Childs, Donna R.

Contingency planning and disaster recovery : a small business guide /

by Donna R Childs, Stefan Dietrich.

p cm.

Includes bibliographical references and index.

ISBN 0-471-23613-6 (cloth : alk paper)

1 Emergency management 2 Small business—Planning I Dietrich,

Stefan, 1963— II Title.

HV551.2.C45 2002

658.4'77—dc21 2002031115

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

Donna R Childs is the founder, president, and chief executive officer ofChilds Capital, LLC, a Wall Street firm dedicated to poverty alleviationthrough economic development She holds a B.S from Yale University,

an M.A in International Economics and Finance from Brandeis sity, and an M.B.A from Columbia Business School Prior to establish-ing Childs Capital, she had 15 years of experience in finance and riskmanagement She began her career as a research associate in the financedepartment at the Harvard Business School, was an investment banker

Univer-in the fUniver-inancial Univer-institutions group of Goldman, Sachs & Company, and,more recently, was a director and member of senior management of theSwiss Reinsurance Group in Zurich, Switzerland A recognized author-

ity on risk finance, Ms Childs was the associate editor of Risk Financier

and a frequent speaker at reinsurance industry conferences

Stefan Dietrich majored in Computer Solutions and Aerospace

Engineer-ing as an undergraduate, and received a diploma and doctorate, summa

cum laude, from the University of Stuttgart in Germany He was a lead

developer of the hypersonic aircraft program of the German NationalAerospace Establishment in Göttingen, Germany, and then served as thelead developer for one of the U.S National Science Foundation’s “GrandChallenge” supercomputer projects undertaken at Cornell University,then one of the world’s largest and most complex computer systems As

a senior executive at Deutsche Bank, Dr Dietrich contributed to thedisaster recovery and contingency planning for one of the largest trad-ing floors in Europe as a consequence of the bomb attack on Bishopsgate

in London Most recently, he served as the chief operating officer andexecutive vice president of a technology start-up company in New YorkCity He currently advises small businesses with respect to their informa-tion technology infrastructures and disaster recovery procedures

Launching my own business is the fulfillment of a life-long dream Itrepresents the opportunity to chart one’s own course, to do meaningfulwork, to fully develop one’s creative talents, to encourage the potential

in others, to leave a legacy During the course of my entrepreneurialadventure, I have had the privilege of teaching in Russia under the aus-pices of the United States Agency for International Development I havebeen so fortunate as to learn from the experts of the United NationsDevelopment Program in Latin America I have benefited from the cu-mulative experience of the faculty and my classmates at the ExecutiveM.B.A Program of Columbia Business School who have generouslyshared their knowledge to assist my enterprise and, in particular, Profes-sors Charles W Calomiris, Murray Low, Cliff Schorer, Joe Flicek, LynnRussell, Peter Garrity, and Trevor Harris I am grateful to the faculty andstaff of the Graduate School of International Economics and Finance atBrandeis University, and in particular, Dean Peter Petri, Professor RachelMcCulloch, and Professor Ben Gomes-Casseres I have been coached andadvised by some of the sharpest financiers on Wall Street at GoldmanSachs and at 85 Broads, a networking association of Goldman alumnae

I have enjoyed all of these experiences and more because I have twovery loving parents, who made numerous sacrifices for my education sothat these opportunities were available I would like to thank my mother,Dianne M Childs, and my father, Donald R Childs, Ph.D, whose hardwork and personal sacrifices gave me the education that has opened upthe world I am assigning part of my share of the authors’ royalties toendow a program in the name of my dad at the Massachusetts Institute

of Technology, so that academically gifted young men and women maybenefit from the same opportunities my dad made available to me I hopethat my dad, who is retired, will enjoy mentoring those students andsharing with them his enthusiasm for the natural sciences as he did with

me! My dad never missed a parent-teacher’s meeting, never missed ascience fair or a spelling bee, sacrificed his Saturdays to coach my soc-cer and Little League teams, and offered every possible encouragement

to me I have very fond memories of touring college campuses with myparents during my senior year of high school, as we imagined what myfuture would be I wish every young woman could have such a wonder-ful dad to instill in her confidence and optimism

I appreciate the encouragement of Rick Lipkin, Calanit Dovere, andRavi Gupta I would also like to thank my mentors: Rosalind Gilmore,former Director of Regulation of Lloyd’s of London; Robert Goodman,Managing Director and Head of the insurance investment banking prac-tice at Lazard Fréres; David M Meerschwam, Managing Director ofGoldman Sachs; Reuben Jeffery III, Managing Director of GoldmanSachs; Jay Novik, former Vice Chairman, Swiss Re New Markets; PeterHügele, the recently retired Chief Investment Officer of the Swiss Rein-surance Company; Adrian Sülzer, Rolf Hunziger, and Andreas Bachofner,all senior executives of the Swiss Reinsurance Company; and JanetTiebout Hanson, the founder of 85 Broads I am particularly grateful toJohn Whitehead, who was formerly the senior partner of Goldman Sachs.Many members of 85 Broads told me of his generosity in sharing his timeand experience to assist younger bankers who sought to launch their ownenterprises Two weeks after the attack on the World Trade Center, hespent a half-day providing his feedback for a community developmentfund of my company Not long after that meeting, John Whitehead wasappointed the chairman of the Lower Manhattan Redevelopment Cor-poration

I must thank the law firm Cadwalader, Wickersham & Taft, whichgenerously provided assistance for a community development fund mycompany proposed to make available in the poorest communities in NewYork City We began that process earlier in 2001, but it assumed a newsense of urgency given the economic losses the city sustained as a conse-quence of the terrorist attacks Marissa L Morelle, Esq., is not only anexceptionally gifted legal counsel, she is also an enthusiastic believer inthe project I owe thanks to both Marissa and to Malcolm Wattman, Esq.,

a partner of the firm I am grateful to Jeff Silow, Esq., whose support hasbeen invaluable

I would like to express my appreciation to Victor Alvarez, Alex Krutov,Brett Lacquercia, Ron Lenore, Anton Prenneis, and Joe O’Connor, my

former business school teammates Each was a source of encouragementand an absolute joy to work with Sheck F Cho has been a most patienteditor and I am indebted to him We began writing our first draft of themanuscript soon after the attack on the World Trade Center, when ourlives were still unsettled We were lucky to have Sheck to guide us throughthis process Finally, of course, I must thank Stefan Writing this book withhim has taught me a great deal about information technology that, irre-spective of contingency planning, I can immediately adapt to my ownbusiness processes.

Donna R Childs

I would like to thank my parents, Raphael and Rita Dietrich, my sisterRafaela, and my brother Michael for their support throughout the pro-cess of writing this book I come from Göttingen, a university town inGermany with a rich history, and I was scheduled to be in the World TradeCenter on September 11 I changed my plans when I heard the explo-sions that morning and could see from my home what had happened Icannot imagine my family’s anxiety and worry as they watched eventsunfold on the television from halfway around the world, until my callrelieved their fears Other parents were not so lucky I lost a former col-league, Raj Mirpuri, who perished on the top floor of the second tower

on that terrible day His remains were never recovered I think that myfamily appreciates my need to write this book to contribute something

to respond to this tragedy, perhaps as a way of dealing with the feelings

of helplessness that such an event provokes

I must thank Donna for conceiving of this project Donna and I havebeen friends for some time and she read to me daily the newspaper andbusiness press accounts of small business owners in Lower Manhattanwhose losses could have been mitigated if they had put in place bettercontingency plans and insurance coverage I didn’t think she was seri-ous, but she wrote a query letter to John Wiley & Sons, our favorite pub-lisher, and included a writing sample and an outline of chapters Oneweek to the day later, Sheck Cho called us and we were off and running

I must thank Sheck English is a second language to me, and I pose technology is a second language to many others, so I am fortunate

sup-to have an edisup-tor who was willing sup-to converse in all languages until we

could find the right one to get our points across I also want to thank JohnWiley and Sons, for the resources they committed to this book, for theirenthusiasm, and for their extraordinary responsiveness.

I must thank Arnie Herz, Esq., for his insights into legal and othermatters Arnie is unlike any attorney I have ever met in that he brings avery constructive problem-solving approach to a discipline that is other-wise known for its narrow focus on conflict and win-lose games Arnie has

a holistic approach to legal issues that is analogous to the holistic proach to information technology issues that I bring to my own clients.Our messages are similar: don’t lose sight of your overall objective andremember that technology (or legal strategy) is simply a tool in service

ap-of a greater objective

I want to thank Ian O’Sullivan of Delphos Inc Craig Goldberg, nior Consultant for Phone and Networking Solutions, and Lou Con-stable, Senior System Administrator for Large Scale Systems, were help-ful sources of information for certain of the technical sections of thebook Finally, I’d like to thank all of the friends and people I have metduring my years in the United States It has been a fantastic learningexperience for me and I echo the sentiments of the French woman whowas interviewed on CNN on September 11, 2001 when she said, “Today,

Se-we are all Americans.”

Stefan Dietrich

AUTHORS’ ROYALTIES

We are assigning a portion of our royalties to JustGive, a 501(c)3 profit organization whose mission is to connect people with the chari-ties and causes they care about and to increase overall giving As a cen-tral gateway to giving, JustGive provides people with the resources,services, and tools they need to give—whether it’s their money, their time,

not-for-or their goods We encourage you to visit JustGive at www.justgive.not-for-org.

JustGive is the only public nonprofit organization that passes through100% of donations to charities, thereby reducing fundraising costs forthe charities and increasing the impact of donations As a JustGive part-ner, we will pay the transaction costs for a particular category of chari-table donations Visitors to the site can select from categories of chari-ties that match their interests, such as “Overseas Aid” or “Environment”and will view a number of charities, grouped by theme, to which they cancontribute You may find the information about charities dealing withdisaster relief to be helpful

September 11, 2001, is a date that many Americans will treat in themanner our parents’ generation treated the assassination of PresidentKennedy Each of us will remember where we were when the attacks onthe World Trade Center and the Pentagon occurred, and since theseevents have altered the course of history, we will almost certainly tell ourchildren of our personal experiences.

We certainly will remember We were there Our personal experience

of September 11, 2001, was the genesis of this book I (Stefan) was ing home to take the train to the World Trade Center stop, but when Iheard the explosion and saw what had happened, I remained at home.Certain of my former colleagues were not as fortunate One of my formerco-workers, Raj Mirpuri, died in the World Trade Center that day I willnever forget the memorial service held for him The family and mourn-ers were all dressed in white, consistent with their religious custom Hisparents’ grief was absolutely unspeakable Raj was an only child, and hisdeath, and the manner of his death, and the fact that his remains havenot been recovered, have only compounded their sorrow

leav-I feared that leav-I would lose many more friends as leav-I watched the trophe unfold My home is an apartment near the Newport-PavoniaPATH station of Jersey City, right on the Hudson River, and affords aspectacular view of Lower Manhattan Once I realized what was happen-ing, I reached for my camera and reflexively began taking pictures Myemotions were a mix of shock and bewilderment, and fear for the safety

catas-of my friends who live and work in Lower Manhattan At the same time,

I knew that I was witnessing a historic event and felt a need to record it

in photographs

I (Donna) live in Battery Park City, the residential neighborhood inthe shadow of the World Trade Center Indeed, Battery Park City wascreated by the landfill excavated during the construction of the World

xv

Trade Center Like many of my neighbors, I chose to live in Battery ParkCity both for the beauty of this community (my apartment affords a view

of the Statue of Liberty, Ellis Island, and the Hudson River) and its imity to the financial district I am a small business owner, and mycompany’s offices are located on Wall Street, just a fifteen-minute walkfrom home Like most residents of this community, the World TradeCenter formed the “anchor” of my neighborhood

prox-On September 11, 2001, I had a 9:30 A.M appointment in my officewith a former business school classmate, Alex Krutov On my way to work,

I stopped off at a pharmacy in the shopping concourse of the WorldTrade Center After the first plane struck the World Trade Center,firefighters and police officers rushed into the towers and began theevacuation I left the building, and because it was unsafe to walk about,

I went home and immediately called the office to advise people of whathad happened and to urge everyone to leave the area I was among thethousands of residents of Battery Park City who were evacuated Togetherwith my neighbor and his dog, I boarded a New Jersey police boat andcrossed the Hudson River to safety Our community was closed for overtwo weeks by the Mayor’s Office of Emergency Management, although Iwas once permitted to re-enter my home during that time, under theescort of a National Guardsman, to retrieve some clothing and personalitems

The next two weeks were extraordinary Like most Americans, weremained glued to the television set, watching events unfold in New YorkCity and across the world At the same time, we could see in person whatmost Americans could see only on their television sets It was as if we hadtwo screens displaying different images: the television screen displayingimages broadcast from around the world and the window on the HudsonRiver through which we saw, for example, the navy hospital ship, theU.S.S Comfort, sail up the Hudson River, to make additional medicalassistance available We saw the F-16s flying overhead, securing New York’sairspace We saw the President’s helicopter, as President Bush arrived toaddress the rescue workers at the disaster site We saw, day after day, theghastly plume of smoke rise from the remains of the World Trade Cen-ter, while the rest of Lower Manhattan, which was without electricity,remained in darkness

When the Mayor reopened Wall Street, I returned to my office fromNew Jersey, commuting on a new water ferry route that had been estab-

lished following the destruction of several subway stations in the cial district Army vehicles and soldiers patrolled Wall Street, which wasstill covered in soot Few people were about the first few weeks follow-ing the disaster, giving the normally bustling financial district the appear-ance of a ghost town My own office building remained without a cen-tral electricity supply, but a large back-up generator erected on thesidewalk provided sufficient electricity for a minimal level of lighting andcomputers and office equipment (but not the building elevator) Therewas no food to be had, as no deliveries of food had been made to LowerManhattan during the time that the community was closed by the Mayor’soffice The food supplies that were in grocery stores and restaurants hadbeen discarded due to spoilage; without electricity it had not been pos-sible to refrigerate perishable foods.

finan-And so we began the task of resuming our lives, reconnecting withfriends and family throughout the world to let them know we were safe,

as telephone service became available, and rebuilding our small nesses We will never be able to calculate the human cost of the tragedy:the lives lost, the families scarred, the continuing fear and anxiety amongthose who lived through it and those who saw the disturbing images ontelevision We can calculate, in a precise way, the financial costs of thecatastrophe This is shown in the table on the following page, whichappeared in an article titled “The I.T Toll” and is reproduced with theconsent of the publisher

busi-An economic impact study1 conducted by the New York City ship estimated that the September 11 terrorist attack would result in $83billion of damage to New York City’s economy The study concluded thateven after the payment of insurance claims, federal reimbursement forrescue work, clean-up and repair of the transportation infrastructure, aswell as the ancillary effects of these damages, New York City’s economywould likely sustain a net economic loss of at least $16 billion The City’seconomic development staff and the State’s Department of Labor haveeach estimated that Lower Manhattan lost 135,000 jobs in the six monthsfollowing the terrorist attack

Partner-The economic consequences of this disaster were not confined toNew York City With the temporary closure of airports and restrictions

on travel on and following September 11, the travel industry has sufferedeconomic losses With travel volume down, tourism, throughout theUnited States and overseas, has declined There is a “multiplier” effect

$10 billion risk manage- ment and insurance brokerage firm

3,200 employees on floor 94 in 1 World T

commu-nications gear for 14 New Y

$140 million No loss of customer ser

though still standing, will not be usable for months By Oct 8, dis- placed staffers were installed in five locations in New Jersey and Connecti- cut No data loss due to backup systems, but high-speed Net access for Aon’

local offices was not fully restored until Oct 19 During the interim, satellite offices manually dialed into headquarters for e-mail and Internet ser

devastating For that, the company credits its contingency planning “W

as a result of this experience,” says spokesperson T

by and large, our plans worked successfully

standpoint, they worked without a glitch.” “W

billion investment banking firm

800 employees on floors 9-12 and 14-16 in 1 World Financial Center

Internet trades and the intranet for its brokers nationwide Also, a network control center that monitored its investor transaction systems.

More than $2 million to replace IT hardware and office equipment No data or ser

its New Jersey data center kept its websites, news wire ser

Sept 17 Estimated at $150 million No data lost Hot backup sites in Manhattan and New Jersey kept 90 percent of its systems up and running without interruption; e-mail was restored within 72 hours The company’

Jersey location is now its main data center; another site is under construc- tion in San Francisco.

Dow Jones prides itself on running one of the best data protection setups in the business Backup systems are online 24/7, and ever data center has its own power generator

millions of dollars to maintain a high level of redundancy

meet after a crisis to how data are protected It was also lucky – earlier this year it upgraded a facility in Manhattan with a state- of-the-art backup system, 400 wired workstations, and space for 1,000 employees.

mutual fund company with more than $115 billion in assets under management

598 employees, on 5 floors in 2 World T

mission-critical trading systems were ready for business within seven hours, operat- ing out of its New Jersey location.

as those who directly sustained economic losses cut back on their ing, which in turn, has economic consequences for suppliers who, in turn,cut back on their spending, and so on.

spend-The “ITT Toll” table is a particularly helpful synopsis of one category

of losses suffered by six tenants of the World Trade Center and the cent World Financial Center There are four conclusions that one candraw from this table that are of particular interest:

adja-1. The toll is substantial, and yet includes only one component ofeconomic losses: those pertaining to information technology.Morgan Stanley, for example, estimates its losses related to infor-mation technology at $150 million! Other costs, such as employeeabsenteeism or lost revenues, are not considered in this presen-tation The total losses due to this catastrophe are obviously sig-nificantly higher than simply the IT costs

2. The losses were motivated by a disaster on a scope and scale thatvastly exceeded the worst-case scenarios envisioned by those ex-ecutives responsible for risk management The chief informationofficer of AON Corporation notes, for example, that thecompany’s disaster recovery plan did not “account for the possi-bility that everything would be lost.” (For the record, in devel-oping a contingency plan for Childs Capital, the worst-case sce-narios we had contemplated included lack of access to our officebuilding for some time due to fires in the nearby subway station—nothing on the order of magnitude of the events of September11.) Yet, those companies may have been better prepared thanmany other businesses throughout the country, as the 1993bombing of the World Trade Center alerted them to the neces-sity of contingency planning

3. Five of the six companies profiled in this table are large, talized corporations with significant resources In certain indus-tries, large companies are required to have contingency and di-saster recovery plans in place and to make them available to theirregulators The contingency and disaster recovery plans of mu-tual fund companies, for example, are currently among the toppriorities for the Securities and Exchange Commission Few smallbusinesses would likely have the capital and human resources to

well-capi-“maintain a high level of redundancy,” as was done by the DowJones organization.2

4. One of the companies profiled, May Davis Group,3 is a smaller,privately held financial services firm that had no backup plan inplace at the time of the attack The losses sustained by that firmare almost certainly more painful than a comparable loss sus-tained by a larger, wealthier corporation.

In discussing the business consequences of the events of September

11, The Economist4 reported:

For the next few years, many companies will seek security andcertainty Some lessons learnt in anticipation of the millennium-bug disaster that did not happen will be revived Critical com-puter systems will be triplicated, not just duplicated, and keptphysically separate: the Bank of New York had two clearing sys-tems, with different telephone and power supplies, but both were

in Lower Manhattan and were disabled after the attacks panies will want to know where their staff are, and will think twiceabout allowing all their top teams to work in the same officebuilding Outsourcing contracts will be rewritten, to clarify pro-visions on disaster recovery Supply chains will be redesigned, tomake them less vulnerable to disruption Security checks will beincreased Many of these changes will build in redundancy Theywill therefore add costs and reduce efficiencies at a time whencompanies can ill afford either But the bigger issue for mostfirms is how best to manage through hard times

Com-As large corporations shudder at the costs that will likely be incurred

to build in additional layers of redundancy to their operational ties, imagine the response of small businesses Our research has shownthat most small businesses in Lower Manhattan did not have contingencyand backup plans in place prior to September 11, 2001 Many of themwere underinsured The consequences to small business of the Septem-ber 11 attacks are staggering: according to J.P Morgan Chase Manhat-tan Bank, before the attacks there were nearly 7,800 businesses withannual revenues of less than $10 million (the Bank’s definition of smallbusiness) at Ground Zero and about 34,800 small businesses in LowerManhattan This affects all of us: according to the Small Business Admin-istration, small businesses collectively employ more workers than all of

capaci-the companies in capaci-the Fortune 500 We all have a stake in capaci-the health andvitality of the small business sector.

Few small business owners have the financial resources to access theexpertise that we have to offer, which is why we propose to make it avail-able through this book We read daily in the press the heart-breakingstories of owners of small businesses in Lower Manhattan who had inad-equate insurance and inappropriate technology support We hear tragicstories from the vendors, suppliers, friends, and neighbors with whom

we conduct business The livelihoods of those small business owners andtheir employees are at risk Their dreams are in jeopardy According todata gathered by the American Red Cross, as many as 40% of small busi-nesses do not reopen for business after they are affected by a major natu-ral disaster such as an earthquake or flood The Red Cross believes thatthis percentage would be significantly lower if small businesses were tomake minimal investments in disaster preparation

Regrettably, we cannot prevent disasters from occurring, but we canequip small business owners with the knowledge they will need to miti-gate their risks and to recover quickly when disaster does strike That isthe goal of this book As small business owners, our resources are lim-ited and we must work our assets smarter, not harder, than the assets oflarger companies We must spend our insurance premium dollars wisely;

we must make cost-effective decisions on establishing backup tion technology support We will give you the tools to do that, to put inplace an appropriate contingency and disaster recovery plan

informa-Before we continue, we must be clear about what we mean by ter We define a disaster as an event that disrupts business operations at

disas-a given site disas-and results in disas-a tempordisas-ary or permdisas-anent dislocdisas-ation of thebusiness A factory fire is, by our definition, a disaster A product liabil-ity crisis, by the same definition, is not Consider the experience of tam-pering with the Tylenol® product manufactured by Johnson & Johnson

We consider that to be a business crisis, one that requires a business tomanage communications with its stakeholders and possibly make changes

to its manufacturing (or in this case, packaging) processes The Tylenol®

crisis, while undoubtedly painful for the company, did not disrupt ness operations or cause the employees to lose access to Johnson &Johnson facilities Work at Johnson & Johnson could continue on-site,even as the executives of the company were working to communicate withtheir customers, the investment community, the distributors of their

busi-product, and other stakeholders We cannot advise you on situations such

as the Tylenol® crisis; we are not experts in corporate communications

As such, crisis management is beyond the scope of this book and wewould refer you to other sources.5

Few small business owners have the reach to find themselves in a crisiscomparable with that experienced by Johnson & Johnson However, many

of us will, unfortunately, experience natural disasters such as fires andfloods and disruptions in power supply during the course of building oursmall businesses The consequences of such disasters can be mitigated

by carefully crafting an insurance program and ensuring adequate mation technology capacity Many of the techniques and suggestions wemake in this book are applicable to the nonprofit sector as well We weresurprised to learn that up to 20% of workers in New York City are em-ployed by nonprofit organizations that were affected by the terrorist at-tacks We hope this book will be helpful to nonprofit organizations that,like small businesses, pursue their missions with limited resources

infor-Of course, each small business (or not-for-profit organization) facesunique circumstances and constraints and we cannot reasonably antici-pate the needs of each and every single reader We advise you to consultexperts, such as commercial insurance brokers, where appropriate, andexpect that the information we impart in this book will enable you to be

a more knowledgeable consumer of such services and to use such services

in a cost-effective manner

We hope that your small business never experiences a disaster and

we hope that the world never again experiences events such as the ones

we experienced on September 11, 2001 Unfortunately, we cannot vent such tragedies from occurring We hope, however, that we can as-sist you in preparing your small business for disasters that will, unfortu-nately, occur from time to time We also believe that you will find thatcontingency and disaster recovery planning improves the efficiencies ofyour business processes and, therefore, that the planning process we

pre-recommend will immediately benefit your business—irrespective of whether

your business ever experiences a disaster.

NOTES

1 See the New York City Partnership’s website, www.nycp.org.

2 For a detailed treatment of the increased costs imposed on businesses

by the terrorist attacks, we recommend you read an article that appeared

in the February 18, 2002, issue of Fortune, entitled “The Friction

Economy: American Business Just Got the Bill for the Terrorist Attacks—

$151 billion a year” by Anna Bernasek

3 For a moving and detailed account of the recovery process of the MayDavis Group, please read “Thirty Days of Grace” in the December 2001

issue of Worth magazine This article should be required reading for

every small business owner and employee

4 October 13, 2001

5 During the course of my business career, I (Donna) participated inexcellent crisis management programs offered by the Corporate Re-sponse Group in Washington, DC, which I highly recommend

Planning and Disaster Recovery

Disasters occur with numbing frequency From simple human errors tonatural disasters, unanticipated events can have serious consequences foryour business operations This is particularly true for small businesses

In hindsight, it is remarkable that disaster contingency planning for and medium-sized businesses received such little attention from businessowners and from the business press But the tragic events of September

small-11, 2001, have pushed this issue to the forefront of concern for decisionmakers in both business and government

In the aftermath of the attacks on the World Trade Center we haveseen that the most serious losses were borne by small and medium-sizedbusinesses Large companies did relatively well and could enter into di-saster recovery mode much more rapidly This is due to the fact that manyprivate businesses and single-office companies did not actually have ad-equate disaster contingency provisions or appropriate insurance policies

in place Without having created off-site backups of legal documentationand confidential data files, many of these businesses lost all records oftheir critical information

Large businesses have spent billions of dollars on contingency plansthat help to mitigate their risk of being exposed to disasters These ex-penses are an investment for safeguarding the company and insuring thevalue of the business assets If you actually consider the potential down-side loss that any of these disasters can cause, the actual investment indisaster prevention appears relatively small However, disaster recoveryhas become an item that is synonymous with big ticket expense

It is a myth that disaster contingency is generally expensive Thedevelopment of a disaster contingency plan will require an investment

of time and money, but it may not be as expensive as you fear In fact,you may be surprised to learn that the expenses incurred fromdownscaling contingency planning solutions for large businesses are not

cost-effective or likely appropriate for your business Small businesseshave unique requirements We recommend specific solutions that aresimple to implement, cost-effective, and provide “built-in” contingencysupport.

We have found that many small business owners do not fully realizethe many benefits that come with contingency planning Many believethat since disasters are so unpredictable and since there seems to be littleone can do to protect against them it is not worthwhile to invest resources

in disaster contingency and recovery planning But you will soon realizehow often you have already faced “small” disasters, such as a mistakenlydeleted computer file, so you will find that the additional protection willalso significantly improve your day-to-day operations Soon you will won-der how you ever operated without your contingency plan

You cannot prevent disasters from happening The most you can do

to prepare is to minimize your business exposure and limit your cial risks Each disaster is unique, and the catastrophic events of Septem-ber 11 could be considered an anomaly that does not threaten typicalbusiness owners, but disasters share similarities We examine the commontypes of disaster to determine how to prepare and protect ourselves andhow to insure the financial losses that are associated with disasters.When a disaster occurs, you will not only have improved your pre-paredness to handle it appropriately, but there may be legal requirementsfor preparedness In general, all businesses must meet their contractualobligations even in times of emergencies, and have done their due dili-gence for adequate levels of disaster contingencies Your legal counselshould advise you appropriately Publicly traded companies face evenstricter regulations The Foreign Corrupt Practices Act of 1977 states thatpublicly traded companies must comply with appropriate accountingstandards and safeguard all corporate assets If you are insufficientlyprepared, any crisis could expose you to costly litigation from employ-ees, customers, and shareholders

finan-This guide is intended to educate you about contingency ning for small businesses so that you can develop a strategy that will provide protection against a variety of unpredictable disasters We will show you how any small company, regardless of its size and financial resources, can take steps to significantly improve the protection of its business in the case of a disaster It is simple,

plan-hands-on advice that does not require expensive external consulting guidance Throughout this book, we use the symbol next to this para- graph It highlights important steps, or unusual ideas for your disas- ter contingency effort.

The following summary outlines the approach of this book as weguide you through a step-by-step process to better understand the risksand preventive measures you can take to protect your business from di-sasters

The first chapter of this guide discusses the steps that should be taken

to prepare for a disaster This preparation effort will mitigate your lossesshould a disaster strike The following points are discussed:

• Determine which assets are critical for protection

• Establish general protection measurements

• Take precautions to avoid specific disasters, such as the loss ofcomputer data due to human errors

• Mitigate potential damages These precautions are designed toprotect your information technology (IT) infrastructure, such asproviding user training, creating additional contingencies by aug-menting essential equipment, avoiding concentrations of function-ality, determining policies for backing up critical data, and estab-lishing a secondary office location We also recommend that youestablish “redundant” financial capacity, analogous to redundant

IT capacity, in the form of an insurance program and a financialreserve, so that you will have resources on hand to meet unantici-pated expenses following a disaster

may require an emergency shutdown of your systems, an isolation of anysystems found to be defective, and an effort to contact third parties tobegin rebuilding your operational capacity At the same time, you mustdocument your insured losses and file timely claims with your insurancecarrier We advise you how to go about those processes.

In this chapter, we discuss how to begin moving your business forwardfollowing a disaster, how to assess damage and communicate with all ofthe stakeholders in your business, and how to begin prioritizing tasks toresume business operations We provide some information on disasterrelief services and advice on coping with the emotions that surface fol-lowing a disaster To guide you in resuming operations from your ITassets, we advise you how to recover data, replace equipment, review theperformance of the third parties that have supported your recovery ef-forts, and reestablish business operations at a new site, if necessary Sinceyour insurance program will be affected by a disaster, we provide somespecific advice on how to reconstruct your insurance policy, resolve dis-putes, and reinstate your coverage

In this chapter we present some specific disaster contingency solutionsthat you may adapt for your own needs as appropriate We present a

“small business or home office” solution that would be suitable for amodest-sized operation with up to eight employees using computers aspart of their work processes We then consider minimal and robust solu-tions (to be adapted as your resources permit) for businesses with up to

20 employees using computers and for small businesses with more than

20 employees using computers at the worksite

By definition, disasters are acts of God that cannot be prevented, butyou should be prepared for a disaster, know how to respond to a disas-ter, and be confident that you will likely recover and almost certainly learnfrom the experience Before you start preparing your disaster contin-gency plan, you need to identify the critical assets of your business, whatyou consider to be the “jewels” of your business

You will likely learn that the most valuable assets of your small ness are:

busi-• The proprietary knowledge of your company

• The people who understand and work with that knowledge

We usually find that small business managers are aware of the risk ofloss of proprietary knowledge that resides with human capital Manag-ers often think of how to respond if a key employee leaves the company.But we find that they have a much lower level of awareness of the risk ofloss of proprietary information that is exclusively stored on their IT sys-tems and rarely have in place concrete plans for responding to a majorcomputer failure Many small businesses simply feel overwhelmed by atechnology that is evolving at a frantic pace Systems become obsoleteafter two or three years During their brief life cycles, systems must befrequently upgraded and are inundated with data Computer systems insmall businesses are often assembled without any structured plans for thestorage and retrieval of data

We present the following scheme of disasters, beginning with thehigh-frequency/low-severity category of human errors to the high-sever-ity/low-frequency category of terrorism and sabotage Very often, smallbusiness owners forego contingency planning for disaster, believing di-sasters to be catastrophic in scope and beyond their control In fact, the

“disasters” your business is most likely to experience are of the mundanehuman error variety And there are procedures that you can put in place

to mitigate your business losses from such disasters Those procedures,

in turn, will help you build more resilient and robust business processes,better equipped to recover from the larger-scale disasters

1 Human errors

Definition: Human errors are triggered by actions unintentionallyundertaken by managers and employees acting in good faith that subse-quently are shown to be mistakes The most common causes of humanerrors are inadequate computer user training, fatigue, and carelessness.These errors can reduce the productivity and increase the costs to yoursmall business

Real-world example:A new employee at a small business client supportgroup wants to add new phone numbers to the contact information inthe company’s call-tracking system He thinks that instead of entering the

telephone numbers manually, he will save time by writing a script thatautomatically replaces the appropriate numbers After running the script,all phone numbers in the system are replaced with the first phone num-ber in his script It takes hours to retrieve the backup tapes and to re-build the database Needless to say, all updates made to the computersystem that day have to be manually corrected Replacing the new num-bers manually, the original task that the new employee had sought toavoid, is the least time-consuming part of the recovery process.

2 Equipment failures

Definition:These are malfunctions or complete failures of any type

of office machinery used to store or process information Office ment commonly includes fax machines, personal computers, phone sys-tems, and network components Equipment is prone to breakage andfailure, and so you should anticipate that your business will, at some time,experience equipment failure

equip-Real-world example:After five years of service, the main disk of an oldfile server no longer spins after the machine had been routinely rebooted

on the last weekend of the month Subsequent investigation reveals thatnone of the remaining computers can read data from that main disk.After comparing the costs of hiring a data recovery service to reestablishthe data and the hours required to restore the data from the backupsystem, it is determined that only about 20% of the most critical businessdata will be recovered, leading to great frustration among the employ-ees who had lost files

3 Third-party failures

Definition: These are failures of third parties to deliver services thatyou need to operate your information-storing and -processing equipment.Included here are electrical power failures, loss of phone service, or fail-ures of Internet or market data providers This category also includesfinancial disasters such as, for example, the default of your largest cus-tomer

Real-world example:A telecommunication provider defaults on its debtand seeks bankruptcy protection Your business telephone system mal-functions Your service provider informs you that it is using the services

of a repair company that also had to temporarily suspend its servicesbecause its main creditor was the telecommunications company now indefault You are assured that everything is being done to fix your phone

connection as soon as possible, but with other “big” clients on their ority list, you, as a small business owner, have to wait a couple of days.When you come home in the evening, your answering machine is full ofmessages with urgent calls from your clients.

pri-4 Environmental hazards

Definition:These are all conditions that do not permit you to enteryour regular business offices while your IT infrastructure stays opera-tional These conditions could include smoke from a nearby fire, hazard-ous substances that have been discovered in your building, irritants likefresh paints, pollutants in your building, or contamination of your officewith radioactive, biological, or chemical substances These hazards pre-vent you from entering your worksite

Real-world example:Asbestos is discovered during construction work

in your neighbor’s offices You share the same air-conditioning unit withyour neighbor, and you have to leave your offices You are not allowed

to take any computer equipment with you as the fans have collected bestos with the dust and require cleaning that will take days to complete

as-5 Fires and other disasters

Definition:Here we consider all events that are destructive to youroffice and, hence, to your IT infrastructure Although fire poses the mostcommon threat, other disasters include natural events, like earthquakes,floods, and storms, and man-made disasters, like gas leaks and subsequentexplosions All of these can be very destructive and would either renderyour office unusable or simply prevent your key employees from coming

to work

Real-world example:A water pipe in the ceiling breaks Water spraysthroughout the office Eventually, it enters some IT equipment and short-circuits the power supply Fortunately, the water is quickly shut off, theequipment is dried, and some parts, including the power supply, arereplaced Everything seems to be fine Two weeks later, severe mold de-velops A hazardous condition exists and the office can no longer be used.The IT equipment is relocated to a temporary office location, but theequipment becomes unreliable Water corrosion inside the PC has dam-aged plugs and prevents the CPU fan from running at full speed Insuf-ficient cooling of the CPU causes system crashes This is a good examplehow a single event can cause a series of related disasters—in this case,from a water leak to equipment failure

6 Terrorism and sabotage

Definition:We define a terrorist attack as an intentional, systematic,planned, and organized effort with the goal to cause maximum damagewith resulting publicity Sabotage is also motivated by calculated intent,but rarely attracts the same level of public attention Unlike the otherdisaster types, acts of terrorism and sabotage can be the most threaten-ing because they are based on malicious intent, and if the perpetratorshave access to sensitive information about your business, very concen-trated damage can be done with relatively little effort For terrorists, allmeans are considered just to reach the goal Hence, the spectrum ofattacks is unusually large, from hostage situations to large bomb explo-sions, and, as we saw on September 11, suicide missions using planes asweapons of mass destruction, causing numbers of human casualties anddestruction of large office buildings Saboteurs, on the other hand, likethe secrecy of underground activities and work with sophisticated tools.They can attack you from the outside, such as attacks by computer hack-ers, or attempt to infiltrate your organization with computer viruses Youcan also be threatened from the inside when, for example, a disgruntledsystem administrator sabotages your backup system

Real-world example:These are rare cases, and unfortunately, it is tically impossible to be fully protected Terrorist acts are usually publicand can result in the complete destruction of IT equipment assets Cases

prac-of sabotage usually do not reach the public’s attention, nor can it always

be determined if the damage was the result of a highly sophisticated act

of sabotage or simply a common equipment failure Since we do not want

to make suggestions to those with bad intentions, we refer to a real-worldexample from 20 years ago A company with approximately 40 employ-ees had a so-called mini-computer and a green bar paper printer, both

of which were located in an air-conditioned room The whole companydepended on this one computer system, and it was simply prohibitive onthe basis of cost to back it up with a second system However, the operat-ing system was very stable, so typically this was a reliable setup An em-ployee, possibly by accident, reduced the level of humidity in the air qual-ity control unit, resulting in the buildup of high electrostatic voltage inthe printer paper The voltage was discharged through the connection

of the computer with the printer, thereby destroying the whole computer.Each category of disaster we have presented requires a unique form

of preparation and emergency response In developing your businesscontingency plan to protect against these disasters, you should considerthat as you go down the list from human error towards terrorism and

sabotage, the frequency of the event decreases but the severity of theresulting damage increases Human error is by far the most commoncause of business disasters on a day-to-day basis In most cases it is rela-tively simple to protect against this risk and it is possible to recover fromsuch errors with minimal impact to your company’s business However,

an act of terrorism and sabotage would be a rare event for most nesses, but if such an event should occur, it would cause significant dam-age that could critically affect your company’s future Thus it is impor-tant for the reader to weight the likelihood of occurrence with the risksassociated with each type of disaster in order to create the type of disas-ter contingency plan that best meets your needs

busi-All managers should review with their employees basic safety

prac-tices, such as the means of exit from the worksite in the event of fire.There are various government and local agencies that can assist smallbusinesses with employee safety training Begin by contacting your localCity Hall, the Occupational Safety and Health Agency (OSHA) and theFederal Emergency Management Agency (FEMA) You should also con-tact your local emergency planning committees, fire departments, policedepartments, emergency medical services organizations, and the RedCross for guidelines to ensure workplace safety

Since employee safety is so important and fire is such a commonhazard it makes sense to begin by contacting the fire department forinformation on evacuation plans for your building and information toprevent and prepare for fire-related disasters You should identify themedical facility or hospital nearest your place of work where you can seektreatment in the event of an emergency Many hospitals provide freesafety training to members of the community, and it is well worth theeffort to complete such a course of instruction You must periodicallyreview your safety training materials to ensure that they are up to date.Employee training and drills should be practiced on a regular basis Andmeet your neighbors A good relationship with other businesses in thecommunity could be mutually beneficial You could store your backuptapes at one another’s sites, for example

In the Appendix, we include some basic information about workplacesafety to use as a starting point for employee safety training For a moredetailed approach to safety training, we refer you to your local hospital,fire department, or local chapter of the Red Cross They are the experts.Once you have developed a plan for basic workplace safety training, weare ready to begin our discussion of preparing a contingency plan foryour small business