Disaster Recovery Journal

By Brian Zawada & Jacque Rupert, Avalution Consulting
Article originally posted on Avalution Consulting’s Blog

The introduction of ISO 22301 (Societal security – Requirements – Business continuity management system) more closely aligns business continuity to the broader risk management discipline. A major contributor to this alignment is the standard’s requirement to understand the organization’s “risk appetite” (a term not used in BS 25999). 

I wish I could tell you that my summer was spent vacationing in some exotic location without internet access; or I was deep in remote third world countries performing humanitarian work for international charities; or that I won the lottery and was out spending my new found fortunes ­ ­­- but, I can’t.  Instead, being a consultant who has to work when the work is available, I spent my summer busy with delivering client projects.

For me, that is a hopeful sign.  This bares hope of a sign that the economy is picking up and companies are now able to support projects, such as business continuity planning, that are often deemed deferrable during down-times.  This bares hope that budgets are starting to allow for monies to invest in consulting assistance for projects, such as disaster recovery planning, where the in-house expertise is lacking.  And, this bares hope that companies are starting to put more emphasis on and giving more attention to business continuity planning and related topics.

cPanel is a Linux control panel used by many web hosting companies because not only is it one of the most intuitive control panels available, but also it is relatively cheap to use.  cPanel allows you to control and manage every aspect of your website and is compatible with Linux applications like Fedora, Mandriva, CetOS, and Redhat Enterprise Linux.  In addition, there is a plethora of plug-ins available online for this leading control panel.

In 2010 following the earthquake devastation in Haiti, I became concerned about the use of tarps and similar temporary shelter materials because of the strong possibility of a hurricane later that same year. Haitians were spared the any serious hurricanes in 2010 and 2011, but in 2012, they were seriously impacted by Hurricane Isaac.

What I proposed in 2010 was to use ConEx containers for temporary shelter, feeling that they were in abundance and more durable than tarps.  I shared my thoughts at DRJ in Orlando with Hector Fulgencio and Cole Emerson.  Hector was familiar with ConEx containers from his work in the shipping industry. Cole has vast experience in disaster response.  The consensus among us was that there was indeed a surplus of containers in the U.S. and the military could offload them and place them using heavy lift helicoptors. This would not necessitate using the ports in Haiti which had been seriously damaged. Since ConEx containers are transported via the sea, there would also be no need for the damaged and overcrowded airport.

The goal of Measured programs is to develop a resiliency program that is efficiently sized to mitigate risk while monitoring critical data elements to manage risk as the business demands. Measured programs are developed and maintained by utilizing three steps.  The first step takes into account an organization’s current state of readiness and resources available to them. The second step reviews industry best practices and determines application to your organization.  The third approach requires the implementation of program monitoring and dashboarding to provide data intelligence for senior leadership to identify a change in the risk profile and its potential impact to the organization.  This data will drive actionable items to treat, transfer, terminate, or tolerate the risks at hand.

At a conference I recently attended there was a lot of conversation around PS-Prep which bled into the discussion of “Why get certified” or, the more generic question of, “Why perform business continuity planning?” An oft repeated answer to this question, echoed by business continuity planners around the world is, “Because without a plan you will not survive as a company.”

I think this is a disingenuous answer without any history to support it. Where exactly is the evidence of this fact? What historical data can you share with me, or the CEO you are trying to convince, that this is the case? I am confident that you can dig up cases of small companies that did not survive a disaster, but where is that story about the big guy who did not survive the disaster?

Since 2002, my S-Corporation carried "Errors and Omissions" or Professional Insurance coverage. As an independent BCP/DR consultant, are you adequately insured? In 2008, my insurance carrier expanded coverage (known as the Bell endorsement) to include insurance for several crisis and emergency conditions that might create a business loss and hence a claim. The items covered may be of interest to you. They were not available in all states.

According to a Wall Street Journal article (see Penn State Warned On Accreditation at http://online.wsj.com/article/SB10000872396390444318104577589174048808462.html?mod=ITP_pageone_1 ), "Pennsylvania State University's accreditation is "in jeopardy," one of the nation's primary accrediting groups warned the school, in the latest fallout from the Jerry Sandusky child-sex-abuse scandal. "

The Middle States Commission on Higher Education, the WSJ reported, "said there was 'insufficient evidence' that Penn State was complying with standards related to governance and integrity, as well as meeting financial obligations. "

California is assessing homeowners who live in vulnerable, fire-prone areas a fee to cover the cost of fire protection services, including very expensive suppression of wild fires.  It’s about time someone acted to place the cost of protecting vulnerable properties on those who own them.