How does this relate to recovery planning? Obviously, a plan must be organized. In this way it provides the orderly "open book" you may need to be able to research rapidly if a disaster occurs. During such an occurrence having a well-organized book will be a great help. However, there is a greater need than simple organization in preparing a recovery plan. Often stating the obvious, General and President Dwight D. Eisenhower was known for saying:
"In preparing for battle I have always found that plans are useless, but planning is indispensable."
His observation is certainly more than a catchy turn of a phrase or a 30-second political sound bite. Rather, it is wise advice, especially for the recovery planner.
Planning is essential. But, the reality is, every emergency situation is different and no plan will cover each and every variable. More important than the complexity or simplicity of any plan is how it is constructed, in other words, the planning process. This should be looked at as a way to teach people about the various needs of their business, thus enabling them to more effectively deal with any emergency, not simply those that can be easily described by the planners. The complete job, then, should be to build an emergency response that works under any condition—not just gather paperwork.
What are some of the recovery preparation traps that planners often fall into? One of the most important but often overlooked concepts in emergency management and recovery planning is the assumption that necessary people will be there when needed, and will be able to perform their specific tasks. Such an assumption is rarely valid.
Place yourself in the position of someone who may be called upon to assist in a recovery effort. Ask yourself this very real question—if there is a major regional disaster, what will be your highest priorities? Will they include getting your office PC back up and running? Perhaps, restoring the company e-mail or PBX? Probably not. Instead, most likely the first thing you will think about is making sure your family is safe and cared for, no matter how long it takes. Then and only then will you possibly feel free to turn your attention to your work.
Translating this to the recovery planning effort leads to the conclusion that constructing a successful recovery plan means building it around people, not simply vendor supply lines or emergency generators. While the equipment and hard resources are important, they do not put themselves in place or turn themselves on. People are the key to this effort.
During the 1994 Northridge, California earthquake one company immediately mandated that all personnel go home, see to their families’ needs and return when they were comfortable that their loved ones were out of danger. This company believed that the employees on-site when the earthquake occurred would be able to recover their business systems more effectively and be more clear-minded knowing their families were out of harm’s way. Their decision proved to be wise since the company’s systems were recovered and functional almost a full day ahead of the most optimistic predictions.
Management believes that several factors contributed to their success.
- Most employees with critical skills were back at work within a day of the event. They were better able to function, perform complex tasks and problem solve because they were not preoccupied with family concerns.
- There was no reason to deal with the confusion and clutter of non-critical personnel. Employees who had recovery functions to perform returned, those who did not directly contribute to critical systems’ recovery were not on-site, thus were out of the way. No extra energy was spent on directing or caring for non-essential personnel.
- Employees were motivated by the company’s concern for their families’ welfare and clearly demonstrated their appreciation with renewed enthusiasm and dedication to the recovery effort.
Including the "human factor" in planning is not difficult or expensive—it produces dividends that are incalculable. How can you incorporate such concepts into your planning process? You can:
- Design your recovery plan to be employee independent. Plan for people to be absent. Identify skills—not individuals—needed and maintain a separate list of personnel who have those skills. Do not depend on any single individual to be available when s/he is needed. If they are present during a real emergency, consider it a bonus. Always keep in mind, real emergencies are not selective about damage inflicted, bodily injury, hazards created, etc.
- Throw away the organizational chart. The best people to lead teams, organize emergency actions and get things moving may not have their own box on the organizational chart. Often the best people that are there are the ones who know the situation and know the facility or systems. Some Managers and Directors may be the best at strategic planning and administration functions. But, it is the people closest to the page number on the organizational chart who knows how to reconnect the communications links. Think about who really knows how to bring back functions. Real emergencies do not respect titles.
- Expect and plan for a period of time when nothing happens. Knowing there is some lag time between the actual event and when people finally get over the shock, assemble, communicate, and organize will reduce the panic of not seeing immediate, coordinated activity. It also allows time for the emergency to run its course. Taking action too soon after an event can waste more time (and lives). Take time to assess the situation. Real emergencies usually unfold over time.
- Plan for the smaller emergencies. Many emergency management plans focus on regional or cataclysmic disasters, and are useless for smaller events such as an isolated fire. Many larger events are comprised of a series of smaller emergencies. Earthquakes cause fires, ruptured pipes and fractured buildings—each an emergency situation. Breaking the larger event into smaller pieces makes the situation more manageable and less mentally challenging. Real emergencies rarely need to become a cataclysmic event.
- Extend your training to include a portion for the employee’s family: e.g., home safety and preparedness. This will establish a total mindset for your employees and provide them with a means to always be prepared, at home and at work—you might even consider possibly sponsoring training for employee’s families. This can pay off in terms of employee goodwill and the assurance that the employee will return to work, as quickly as possible. Real emergencies do not care if they hit companies or homes.
- Make all live tests as realistic as possible. Plan scenarios to include realistic variables—and do not forget to change the rules in mid-test. You must teach people to prepare for the unexpected. Real emergencies do not follow rules.
- Keep the actual time, location and test scenario highly confidential. Only let those people who absolutely have to know what is going to happen, know. Reveal the scenario in pieces throughout the test. Real emergencies do not publish schedules or scripts.
- Develop more inventive methods of training staff. During live testing, tap out key personnel. Randomly select personnel during the test (possibly as they arrive at the scene) to be observers. They are not to participate nor advise, only observe. They will be more valuable in the post analysis if they are not up to their eyes in the events. Real emergencies do not wait until everyone is present to happen.
Remember, real emergencies are not only unexpected, they are unusual. No matter how you prepare, you will encounter problems, difficulties, and hurdles. Your plan must be prepared in a way that fosters analytical thought, not simple search and retrieve actions. They require careful planning and innovative thought processes. Remember, real emergencies are not an open book exam.
David Osburn is Director of Consulting for JANUS Associates, Inc. a Disaster Recovery and Information Security consulting firm. Dave specializes in the People-Process-Technology integration of recovery and information systems security.