In-Depth

Before the Storm

As some Microsoft partners know all too well, a solid emergency-response plan can mean the difference between surviving or sinking when disaster strikes.

• By Fred Bayles
• May 01, 2007

As vice president of Momentum, an infrastructure and training company and Gold Certified Partner, Armanini witnessed first-hand the impact a major catastrophe can have on a business community. She also saw the difference a disaster plan can make for riding out the storm.

Momentum's headquarters was across the street from the Louisiana Superdome when Hurricane Katrina hit New Orleans in August 2005. The office couldn't function after the area around it was destroyed. Power was out. Lines of communication were down. Many staffers lost their homes.

But Momentum maintained a second office 80 miles north of New Orleans in the relatively secure state capital of Baton Rouge, where backups for all the company's critical information were safely tucked away. When Momentum's New Orleans refugees straggled up to Baton Rouge, they found all systems up and running.

"We were fine and able to conduct business without missing a beat," Armanini recalls.

Unfortunately, Momentum's smaller clients weren't as lucky. Many never reopened; most of those who did had little money for consultants or trainers. Momentum survived, and even prospered, by opening an office in San Antonio. Yet today Armanini has noticed a divide between her Louisiana and Texas clients when it comes to thinking about preparing for another catastrophe.

"Disaster planning is definitely a hot topic in Louisiana," she says. "We talk about things they should have in place, like managed hosting solutions. It's all part of the conversation now." Over in Texas, however, the conversations are different. "Disaster planning is not as prevalent," Armanini notes. "There's a lot more interest in [Windows] Vista than in contingency operations."

While it seems as if business owners should be chastened by the effects of a recent string of natural catastrophes, relatively few small and midsize companies actually have viable disaster plans. By some experts' estimates,disaster-ready companies represent only about 10 percent of the business population.

That figure is underscored by a more chilling statistic provided by the U.S. Small Business Administration. According to its surveys, up to 40 percent of small and midsize companies never reopen after a catastrophic event.

There's no doubt that failing to prepare for such events can be, well, a disaster for your company. But planning shouldn't stop there. If your clients aren't prepared as well, their problems could deal a sharp, if not fatal, blow to your own business even if you survive the initial disaster.

The good news: There are plenty of resources, from disaster-plan kits to data-protection solutions and services, that can help you -- and your clients -- prepare for worst-case scenarios. The hardest part, however, is finding the resolve and the funds to carry through with the process.

"A lot of companies know they should be doing this, but they're rolling the dice," says James Crosson, chairman of the Association of Contingency Planners, a business continuity trade association. "When you're dealing with a smaller business where the owner is only talking to the IT guy, they don't get [disaster planning] until the house next door burns down."

Overcoming Resistance
When Bob Hood brings up the subject of contingency planning, he usually gets the impression that his clients would rather talk about almost anything else. "A major part of their complacency is the assumption that because things are working properly now, they will continue to work properly," says Hood, the principal of Hood Consulting Group, a Chicago-based consulting company that specializes in serving small businesses and nonprofit organizations. "[Customers are] aware that they should be thinking about contingencies, but they have their heads in the sand."

It isn't just the desire to avoid unpleasant thoughts that makes disaster planning a hard sell. A good contingency plan requires time and money, scarce resources in any growing business. Depending upon the operation's size and scope, developing a basic disaster plan can cost between $5,000 and $10,000, according to business continuity experts. That figure doesn't include the much higher expenses of backup equipment, facilities and training.

Even in the still-smarting Gulf Coast region, small and midsize companies resist the disaster-preparation process, says James Moak, president of Gulf South Technology Solutions LLC, a Baton Rouge-based IT consulting, design and implementation company. After Katrina, Moak's company, a Gold Certified Partner, set up a service center in Baton Rouge that offers both data storage and temporary workspace for companies displaced by hurricanes. Business has been slower than expected.

"We met with several companies six months after Katrina who were very interested," Moak says. Then the National Oceanic and Atmospheric Administration released predictions for a quieter hurricane season "and we never heard from them again," he says. "A lot of them were involved in rebuilding their business and couldn't commit to a plan."

So how do you go about convincing your executive team -- and your clients -- that it's important to patch the virtual hole in the roof before it rains?

Diana McClure of the Institute for Business and Home Safety, a nonprofit organization funded by the insurance industry, says that many businesses lack a big-picture view of contingency planning.

"Most people think in terms of time and geography. They say: 'It isn't going to happen here or it isn't going to happen tomorrow,'" says McClure, vice president of business protection for the Tampa, Fla.-based group. "You have to make them understand that contingency planning also accounts for a hard drive crash or a computer virus or a building fire. I'll ask them 'What would [you] do if there were a hazardous spill that would affect your ability to get to your building?'"

If those potential scenarios aren't compelling enough, consider another breath-taker: your competition gaining the advantage while you struggle to resume operations. Think about the impact on your business if incoming customer e-mails bounce and people looking for your Web site get a "404" error message suggesting that your company no longer exists.

"The small-business market once could run with a server down," says Jeff Middleton, whose contingency-planning work at his Metairie, La.-based SBSmigration.com has earned him a Microsoft Most Valuable Professional Award. "Today the society running on e-mail is unforgiving. It has changed what people's expectations are."

A final argument in favor of good disaster planning: It may be a legal obligation. Companies large and small face a growing number of record-keeping requirements established by the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act and other federal and state regulations. (For expert advice on doing the job right, see "7 Tips for Drawing up Disaster Plans.")

Developing Your Blueprint
Once you've made all your salient arguments in favor of disaster planning, your next task is delivering the goods. The first step is identifying what you want, or need, to accomplish. Should your contingency plan call for continuous data backup? How about once a day? Or once a week? Would you feel safe enough sending one person home with a batch of sales records on the 15th of every month -- or do you want to work with a Web-based service a thousand miles away that archives your data automatically every day?

Some protective measures can be undertaken even before you've completed a formal disaster plan. Hood now insists that his clients do weekly tape backups and keep a monthly archive to hedge their bets against the unexpected. He also pushes them to create a set of documents that other consultants could easily understand if called in on future problems.

Another tough planning question involves calculating how much down time your company can afford. Is your goal to be up in minutes after some catastrophic failure? Hours? Can your customers wait a few days? In disaster planning, as in the rest of your business, time is money. However, it may actually be far more expensive to set an ambitious goal of uninterrupted operations than to accept a minimal amount of down time.

"You need a structured process to identify the scope of services a contingency plan will provide," says Michael Cocanower, president of itSynergy, a Phoenix-based Gold Certified Partner that offers contingency planning along with its network infrastructure consulting business.

Cocanower says raising the cost issue helps his clients better determine what they really need. "We'll ask, 'How long can you go without e-mail?'" he says. "When a client says he needs it back in a matter of hours, we'll say, 'OK, it'll cost around $500,000.' That's when the owner will say, 'OK, let's make it a couple of days.'"

You can make planning less overwhelming by breaking the process into pieces. Analyze what it would take to restore the IT department. Then look at the billing department. Make the plan modular so you can develop it in stages.

At the same time, realize that you can't account for every possible event. One old saw in risk management is that the auto industry could make a completely safe car. The only downside is it would weigh more than an M1-A1 Abrams tank and cost nearly as much.

Thinking along those lines, you can cut some costs by incorporating the plan into the company's larger strategic blueprint.

"There are a lot of good arguments for multi-objective planning," says McClure, of the Institute for Business and Home Safety. "If you're thinking about opening another branch 50 miles away, you can incorporate [the new location] into your contingency plan. It helps justify the time you spend preparing for the event that may not happen for a long time."

The Human Factor
After establishing goals, you have to designate people to implement them. Will your first-responder team be your own people working at a nearby data center? Or would you outsource the work to another company, perhaps at a more distant site, until you can marshal your troops?

Whichever way you go, your team members must do more than just read the plan: They'll need training and practice. "Any [real] problem that surfaces has to be retested," says Crosson, of the Association of Contingency Planners, who acknowledges that it's often tough to run such exercises without disrupting operations and affecting customers. "But a plan isn't complete until you can document how it performs."

Disaster preparation is always a work in progress. Experts say that you must revisit your plan at least once a year, updating it as needed to account for recent changes at your company.

Finally, McClure recommends encouraging your employees to develop their own family disaster plans, including an evacuation strategy and a store of supplies. The underlying reason goes beyond being a benevolent employer: "The better prepared they are at home, the safer they are in their lives, the more easily they're going to be able to get to work" if needed there, she says.

Crosson agrees that it's particularly important to consider the personal lives of those charged with implementing your company's disaster plan.

"A lot of companies send people rushing in and forget about the impact on them," he says. "Your plan should have provisions for rotating your first responders in and out of the area. You have to consider their well-being. When your responders become victims, then you're really in trouble."