Worst Case Scenarios
When planning for disasters, we tend to plan for “worst case” scenarios. Yet again we are surprised when the “worst case” based plan that has been developed is superseded by an actual event that occurs. Hurricane Katrina taught us this lesson. Will we be going back to school and learn the same lessons from Hurricane Harvey and Hurricane Irma? And, Hurricane Jose is coming in on the heels of Irma. Let us also consider that Mexico just had an 8.1 magnitude earthquake – the biggest one in over a century.
Disaster Recovery Planning Considerations for Resilience
On 11 September 2017, Information Management posted an article titled, “6 disaster recovery lessons organizations can learn from Harvey and Irma”. The article actually lists 7. The article starts out by highlighting hurricane-related information:
“Just one week after Hurricane Harvey flooded the Houston area, Hurricane Irma emerged as an even more powerful Category 5 storm. The system made landfall this weekend and Florida Gov. Rick Scott declared a state of emergency for the entire state, urging residents to evacuate the storm’s path. The two back-to-back powerful hurricanes have put the focus on disaster recovery strategies. Here is what organizations can do to serve their clients and their employees in the hours and days before disaster hits.”
Let’s dissect the six (or is it 7?) disaster recovery lessons to see if they can be applied effectively:
# 1: Communicate the Disaster Recovery Plan
Comments:
The communication recommendation is a good one as it covers internal and external communication. However, the communication process should not end when communicating the disaster recovery plan to the clients. It would be advisable to communicate your plan to the local, state and if applicable federal government, suppliers, vendors (“Value Chain”) in addition to clients and employees. Recognize that after an event, your business is most likely not a top priority for recovery by government responders. Your employees, regardless of how loyal they are, are going to be dealing with their own personal disasters and most probably will not be available for recovery efforts on your behalf. My final comment here is a question: “Why did you wait until a disaster was imminent to communicate the plan?”
# 2: Forward all call and e-mails to mobile phones
Comments:
Mobile phone communications will be most likely disrupted as other infrastructure. What about the battery life of your mobile device? No electricity means that you will not be able to charge the mobile phone’s battery. In addition, the federal, state and local responders will have priority on mobile communications (see Presidential Executive Orders and federal guidelines on this issue). So, with cell towers out of service or seconded to the government, your ability to access and use mobile communications may be significantly degraded or nonexistent. Lesson learned from Hurricane Charlie – mobile communications were pretty much wiped out until providers (Version, etc.) could reestablish tower infrastructure. There are usually hurricane warnings which allow the individuals’ temporary evacuation. Remember that the government has the power to commandeer all communications for national security purposes.
# 3: Form a Texting Chain
Comments:
See comments for # 2 above – as this is also applicable for this recommendation/lesson learned. It’s all about the battery life!
# 4: Backup all Client Data
Comments:
Great idea. Why wait until now? Haven’t you been doing this all along? The backup of client data should be a regular practice not, a disaster only practice. What about the other data that you own and process on daily basis? Employee data, financial data, “Value Chain” data, etc. In any event, this data should be backed up and sent to secure location/storage outside the projected impacted areas. You really need to consider the security implications too. How susceptible is the data to being hacked (if electronic), stolen (if hard copy) or otherwise compromised? Security, security, security!
# 5: Open the Office to Advisory Employees and Family Members
Comments:
Unless you have a bunker type facility, with cafeteria and plenty of stored supplies this may not be recommendable. Most modern offices are glass and steel. Regardless of how good your intentions are, glass and steel may not stand up to hurricane force winds and flying debris. Also, you may find yourself stranded and unable to evacuate after the event due to infrastructure disruption. The government may as well step in and under “eminent domain” take your supplies for the greater good of the community. Assess the risks and plan accordingly. You may be creating more of a problem than you think (what about legal considerations?).
# 6: Suggest Clients’ employees had ID information available
Comments:
What about your employees? While I wholeheartedly embrace the general consideration of having ID available; one must ask the question: “to what end?”. How will having ID available assist in recovery? Of course, having ID is highly recommended, as well as, key and critical personal information – insurance papers, bank information and other essential data. You need a secure means of storing that information so that if separated it cannot become a source of identity loss (due to identity theft). Ensuring that all people who may be impacted by the event have proper ID is critical. I would recommend a special ID for those who will be involved in recovery operations that take place after the initial response is completed. Medical information, banking information, social security and all your Human Resources department records need to be secured.
# 7: Inform Clients and Colleagues of Free Services
Comments:
Free services? Unless you are planning on providing essentials – food, water, shelter, etc. one would question the value of “free services”. While some services, such as transportation, telecommunications, waiving of bank fees, come readily to mind; in the aftermath of a disaster, people are most concerned about the basics – food, shelter, etc. Be careful what you offer too. You may become a magnet for further disruption of your enterprise. Can you imagine the amount of potential theft that may occur by opening your doors to a dislocated population? Also, if you are offering “free services” ask yourself, “for how long?”, “to whom”, etc. “Free services” may sound good on paper, but executing may be a completely different “ballgame”. Be very, very careful about what you offer.
From Materials Handling and Logistics, we get the following from David Sparkman:
Think before you act: If the work involves non-routine tasks, take the necessary time to conduct a Job Safety Analysis, determine the hazards and provide training and personal protective equipment (PPE).
Emphasize “Situational Awareness”: By stressing that supervisors and employees keep their eyes out for unforeseen, hidden and sometimes just plain weird hazards.
Anticipate that disasters never follow the rules and plans: “Expect problems. Be paranoid,” Howard Mavity (a lawyer with Fisher Phillips) advises. “In your planning, always engage in ‘what-if’ analysis. I recommend that larger companies create a ‘What-if Committee’ and periodically brainstorm. Consider it an expanded process hazard analysis applied to every aspect of your business.”
Stay alert for hazards posed by fatigue, hunger and dehydration. When exhausted, the first thing to go is your judgment. Keep hydrated and remember that skipping meals also can lower glucose levels, resulting in poor judgment and injuries.
Fall protection is non-negotiable: Most people who are scrambling onto roofs to avoid the rising water don’t know what fall protection means. “Only one error is necessary, and as in the case of trenching, excavation and confined space entry, one error often means a death,” he says.
Generators and gas tools generate carbon monoxide: Be careful about using them inside a building or any other confined space.
Follow the OSHA bloodborne pathogens standard and recognize that rising waters will contain a soup of fecal matter, fuel, rotten food, chemicals and heavy metals, and other risks.
I would add to lessons learned and the above tips, that having cash on hand is a very good idea. As we have seen with Harvey and Irma, the electronic charge and payment systems (credit cards, automated banking, etc.) was disrupted due to the loss of infrastructure (electric generation) for some time. Hurricane conditions bring the necessity of using cash, and as such suddenly cash becomes “the king” once again. Additionally, personal protection should be a consideration.
You need to think and plan on three levels as depicted in figure 1, “Resilience Framework” below:
The strategic level should look at how your organization will achieve its goals and objectives (strategic plan) now that you are operating in discontinuity. The Operational level should be focused on preventing cascade effects from the event, while the tactical level should be focused on response actions for the affected elements.
Conclusion
Traditional concepts such as Incident Command, National Incident Management System, etc. are subject to constant modifications and adjustments, as they may not be as effective in dealing with the risk realities faced today. Threat dynamics are changing, resulting in more uncertainty not less; therefore, this requires a planning approach that integrates the tactical, operational and strategic planning, combining continuity, emergency, crisis, disaster and contingency planning into an integrated process.
