Five basic steps to disaster readiness

You probably don't believe any disaster will ever happen to your business. That's called "denial", or the "it won't happen to me" syndrome. This has been proven many times to be a very poor business strategy.

If it is the cost of implementing a business continuity plan (BCP) or disaster recovery strategy that scares you, here are five steps your small and midsize business (SMB) can take that cost almost nothing, but will prove helpful in a crisis, disaster, emergency or calamity.

1. Establish a crisis management team (CMT).
It may consists of just you, a secretary and the tea lady, but that's okay. There's no firm rule on how you should do this, except to keep the CMT as small as possible.

If your company is big enough to have departments: appoint someone from operations, such as the vice president or chief operating officer; admin or finance, such as the chief finance officer or chief accountant; human resources; facilities or security; and public relations or corporate communications.

Why is the IT guy missing? Well, do you think IBM has "an IT guy" on its CMT? No, they have people who can make business decisions in a crisis. So should you. You may need someone to tell you when, or if, your computers and IT systems will be running again. But, for most SMBs, that someone won't be an executive-level decision maker.

2. Choose a place from where decisions can be made.
If you can't get into your office for longer than a few hours, you'll want to operate from somewhere. It may be your living room, it may be your accountant's office or it may even be a Starbucks outlet, which provides free wireless access if you purchase a cup of coffee.

This will provide a location where you can sit, think, and plan your next move.

If you prefer some privacy, away from the peering eyes of other customers in the café, you can also rent well-equipped, commercial recovery sites. These facilities provide "seats", consisting of a desk, chair, PC, phone and Internet connection. In Singapore, they are available at recovery sites and each seat costs about S$75 (US$55) per month--whether you get to use it or not--you have to sign a multi-year agreement.

3. Toss out your computer tapes.
Only dinosaurs still use back up tapes. I should add though, that some very large companies have huge amounts of data to archive.

It costs about S$150 (US$110) per month to back up 5 gigabytes (GB) online, and you can do that overnight using your existing office internet connection. You can retrieve the files anytime, from anywhere and all documents are password-protected.

My company threw out all our tapes a while back, cancelled our offsite storage contract and used the money to pay for the online backup service. And it's done by our office manager; no technician required.

You should also store copies of current, hard-to-replace paper records off-site, including contracts, tax returns and cheque books.

4. Use your mobile phone.
Most, if not all, mobile phones today come with an address book and some kind of "To Do" list function--just what you need for a basic BCP.

Assemble a list of employees, a second list of vendors and a third list of customers. Collect as many phone numbers and e-mail addresses that they can be contacted at, as you can.

Make a "To Do'' list called "BCP", and list the first 10 steps you want to take after a disaster has hit your company. "Check the health and safety of all employees" should be the first item.

Refine your list whenever you have time, or when you think of something else. It's a gradual process, so you don't need to finish a BCP in one sitting.

During a major disaster, keep in mind that while mobile phone services may not work, SMS (short messaging service) may. During the September 11 attacks in the United States, for instance, BlackBerries functioned when phones did not.

5. Prepare for the worst.
Answer the question: "What's the worst that could happen?" For most SMBs, I think this pretty well describes the worst-case scenario:

You're standing out in the street in the rain, and you can't get into your building. It doesn't matter why: it could be a fire, flooding, gas leak, explosion, contamination, structural failure or an accident. No one seems to know how long you'll be out of the building: it could be only hours but it could also be a couple of days. All your equipment, records, computers, data and finished goods are inside your building. You can't find one of your employees, and you wonder if she is still inside the building.

The cause of a disaster doesn't really matter; it's the potential consequences that should concern you.

One more tip for SMBs: Assume that "crisis", "emergency", "disaster" and "calamity" all mean the same thing. The subtle distinctions are important only to experts. Try to make preparations that would apply to any of them.

Also, the Institute for Business & Home Safety (IBHS) has an "Open for Business" program that includes a BCP toolkit and online training for SMBs.

The toolkit includes simple BCP templates, which can be downloaded for free

Nathaniel Forbes is the director of Forbes Calamity Prevention in Singapore, and is a member of the Business Continuity Institute (MBCI) and the International Association of Emergency Managers (IAEM).