Be Informed

It is important to look realistically at the types of disasters that might affect a business internally and externally and prepare a risk assessment. Consider the natural disasters that are most common in the areas where the business operates and think about the business’s vulnerability to man-made disasters. Fires are the most common disasters in the United States, and they are extremely destructive to businesses,“Fires,” American Red Cross, accessed February 6, 2012, www.sdarc.org/HowWeHelp/DisasterPreparedness/Fire/tabid/81/Default.aspx. but an owner may not be aware that a community is very vulnerable to flooding from snow melt or that the proximity to a chemical plant makes a business vulnerable to the results of explosions. This is why it is important to prepare a risk assessment so that the business can plan accordingly.

Make a Continuity Plan

It is said that a business continuity plan is the least expensive insurance any business can have—especially a small business—because it costs virtually nothing to produce.“How to Create a Business Continuity Plan,” wikiHow, accessed February 6, 2012, www.wikihow.com/Create-a-Business-Continuity-Plan. The better the continuity planning is before a disaster, the greater the chances that a business will survive and recover. There are many things that can be done.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business; “How to Create a Business Continuity Plan,” wikiHow, accessed February 6, 2012, www.wikihow.com/Create-a-Business-Continuity-Plan. The following is not an exhaustive list:

1. Carefully assess how the business functions. Document internal key personnel and backups (i.e., the personnel without whom a business absolutely cannot function). The list should be as large as necessary but as small as possible.
2. Identify suppliers, shippers, resources, and other businesses that are interacted with on a daily basis. Document these and other external contacts, such as bankers, attorneys, information technology (IT) consultants, utilities, and municipal and community offices (police, fire, etc.) that may be needed for assistance.
3. Identify people who can telecommute. Take steps to ensure that critical staff can telecommute if necessary.
4. Plan for payroll continuity.
5. Document critical equipment. Personal computers, fax machines, special printers and scanners, and software are critical to most businesses. An accurate inventory will help a business restore critical equipment.
6. Make sure that all data and critical documents are protected. Critical documents include articles of incorporation and other legal papers, utility bills, banking information, and human resources documents; all these will be required to start over again. The Small Business Administration (SBA) recommends that vital business records—information stored on paper and computer—should be copied and saved at an offsite location at least fifty miles away from the main business site.“Disaster Preparedness: FAQs,” US Small Business Administration, accessed June 1, 2012, http://archive.sba.gov/services/disasterassistance/disasterpreparedness/serv _da_dprep_howcaniprep.html. Companies such as Carbonite can store records “on the cloud.”
7. Identify a contingency location where business can be conducted while the primary office is unavailable. Many hotels have well-equipped business facilities that can be used, but remember that other businesses may need to do the same thing. It is good to have a contingency plan for a contingency location.
8. Put all the information together. The continuity plan is an important document, a copy of which should be given to all key personnel. Do not distribute the plan to people who do not need to have it. The plan will contain sensitive and secure information that could be used by a disgruntled employee for inappropriate purposes.
9. Plan to change the plan. There will always be events that could not have been factored into the plan. For example, the contingency site is damaged beyond use or the business’s bank is in an area that will be without power for days. Situations such as these will require immediate changes to the plan.
10. Review and revise the plan.

Involve Coworkers

Providing for the well-being of all employees is one of the best ways to ensure that a business will recover from a disaster. A business must be able to communicate with them before, during, and after a disaster. There are several recommendations for doing this, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

• Employees from all levels in the organization should be involved.
• Internal communications tools, such as newsletters and intranets, should be used to communicate emergency plans and procedures.
• Set up procedures to warn people, being sure to plan how to warn employees who are hearing impaired, are otherwise disabled, or do not speak English.
• Encourage employees to find an alternate way of getting to and from work in case their usual way of transportation is interrupted.
• Keep a record of employee emergency contact information with other important documents.

Write a Crisis Communication Plan

The owner must decide how the business will contact suppliers, creditors, other employees, local authorities, customers, media, and utility companies during and after the disaster. One easy way to do this is to assign key employees to make designated contacts. Provide a list of these key employees and contacts to each affected employee and keep a copy with other protected contacts. Each key employee should also keep a copy of the list at home. In addition,“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. do the following:

• Make sure that top executives have all the relevant information needed to protect employees, customers, vendors, and nearby facilities.
• Update customers on whether and when products will be received and services rendered.
• Let public officials know what the business is prepared to do to help in the recovery effort.
• Let public officials know whether the business will need emergency assistance to conduct essential business activity.

Support Employee Health—and the Owner’s Health

Disasters often result in business disorientation and environmental detachment, with the psychological trauma of key decision makers leading to company inflexibility (perhaps inability) to deal with the change required to move forward.Darrell Zahorsky, “Disaster Recovery Decision Making for Small Business,” About.com, accessed February 6, 2012, sbinformation.about.com/od/disastermanagement/a/disasterrecover.htm. If the owner or other key personnel experience posttraumatic stress disorder, it can cripple a business’s decision-making ability.

No matter the disaster, there will be psychological effects (e.g., fear, stress, depression, anxiety, and difficulty in making decisions) as well as—depending on the nature of the disaster—physical effects such as injuries, burns, exposure to toxins, and prolonged pain.John H. Ehrenreich, “Coping with Disasters: A Guidebook to Psychosocial Intervention,” Toolkit Sport for Development, October 2001, accessed February 6, 2012, www.toolkitsportdevelopment.org/html/resources/7B/7BB3B250-3EB8-44C6-AA8E -CC6592C53550/CopingWithDisaster.pdf. As a result, the owner and the employees may have special recovery needs. To support those needs, do the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

• Provide for time at home to care for family needs, if necessary.
• Have an open-door policy that facilitates seeking care when needed.
• Reestablish routines as best as possible.
• Offer special counselors to help people address their fears and anxieties.
• Take care of yourself. Leaders tend to experience increased stress after a disaster. The leader’s own health and recovery are also important to both family and the business as a whole.

Insurance Coverage

Having inadequate insurance coverage can leave a business vulnerable to a major financial loss if it is damaged, destroyed, or simply interrupted for a period of time. Because insurance policies vary, meet with an insurance agent who understands the needs of a particular business.“Insurance Coverage Review Worksheet,” Ready.gov, accessed February 6, 2012, www.ready.gov/sites/default/files/documents/files/InsuranceReview_Worksheet.pdf.

• Review coverage for things such as physical losses, flood coverage, and business interruption. Normal hazard insurance does not cover floods, so make sure the business has the right insurance.“Disaster Preparedness: FAQs,” US Small Business Administration, accessed June 1, 2012, http://archive.sba.gov/services/disasterassistance/disasterpreparedness/serv _da_dprep_howcaniprep.html. Business interruption insuranceProtects a business in the event of a natural disaster, a fire, or other extenuating circumstances that affects the ability of a company to conduct business. protects a business in the event of a natural disaster, a fire, or other extenuating circumstances that affect the ability of a company to conduct business.“Business Interruption Insurance,” Entrepreneur, accessed February 6, 2012, www.entrepreneur.com/encyclopedia/term/82282.html. Small business owners should seriously consider this type of insurance because it can provide enough money to meet overhead and other expenses while out of commission. The premiums for these policies are based on a company’s income.“Business Interruption Insurance,” Entrepreneur, accessed February 6, 2012, www.entrepreneur.com/encyclopedia/term/82282.html.
• Understand what the insurance policy covers and what it does not cover.
• Add coverage as necessary.
• Understand the deductible and make adjustments as appropriate.
• Think about how creditors and employees will be paid.
• Plan how to pay yourself if the business is interrupted.
• Find out what records the insurance provider will require after an emergency and store them in a safe place. It would be a good idea to take pictures of your physical facilities, equipment, buildings, and plant so that insurance claims can be processed quickly. These pictures will also provide a good basis for putting the operation back into working order.

Secure Facilities, Buildings, and Plants

One cannot predict what will happen in the case of a disaster, but there are steps that can be taken in advance to help protect a business’s physical assets, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

• Fire extinguishers and smoke detectors should be installed in appropriate places.
• Building and site maps with critical utility and emergency routes clearly marked should be available in multiple locations—and they should be protected with other important documents.
• Think about whether automatic fire sprinklers, alarm systems, closed circuit television, access control, security guards, or other security measures would make sense.
• Secure the entrance and the exit for people, products, supplies, and anything else that comes into and leaves the business.
• Teach employees to quickly identify suspect packages and letters, for example, packages and letters with misspelled words, no return address, the excessive use of tape, and strange coloration or odor. Have a plan for how such packages and letters are to be handled.

Improve Cybersecurity

Many, perhaps most, small businesses will have data and IT systems that may require specialized expertise. They need to be protected. The industry, size, and scope of a business will determine the complexity of cybersecurity, but even the smallest business can be better prepared.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. Small businesses are the most vulnerable to cybersecurity breaches because they have the weakest security systems, thereby making them easier online targets.“CyberSecurity by Chubb,” Chubb Group of Insurance Companies, accessed February 6, 2012, www.chubb.com/businesses/csi/chubb822.html.

Every computer can be vulnerable to attack. The consequences can range from simple inconvenience to financial catastrophe.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. There are several things that can be done to protect a business, its customers, and its vendors, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business; “Cyber Security Liability Insurance,” Wall Street Journal, March 18, 2010, as cited in Robert Hess and Company Insurance Brokers, May 6, 2010, accessed February 6, 2012, robhessco.com/183/cyber-security-liability-insurance/; Eric Schwartzel, “Cybersecurity Insurance: Many Companies Continue to Ignore the Issue,” Pittsburg Post-Gazette, June 22, 2010, accessed February 6, 2012, www.post-gazette.com/pg/10173/1067262-96.stm.

• Explore cybersecurity liability insurance. This coverage is available at reasonable rates to protect against credit card identity theft, with limits up to $5 million. This insurance will cover the loss of digital assets plus expenses for public relations, damages, and service interruption. It will also protect customers. The notification of customers whose credit was compromised is included plus any legal costs and a year of credit monitoring for each individual affected. Although other cybersecurity insurance policies can cover data loss, applicants must break down loss estimates on an hourly basis because most breaches are resolved in hours, not days. This is not an easy thing to do.
• Use antivirus software and keep it up to date. If an owner is not already doing this, he or she should probably have a mental examination.
• Do not open e-mail from unknown sources. Always be suspicious of unexpected e-mails that include attachments, whether or not they are from a known source. When in doubt, delete the file and the attachment—and then empty the computer’s deleted items file. This should be a procedure that all employees know about and follow. The owner must do it as well.
• Use hard-to-guess passwords. An application for cyberinsurance requires, among other things, answering the following question: “Are passwords required to be at least seven characters in length, alphanumeric, and free of consecutive characters?” (Check yes or no.) Whether or not a business plans to apply for cyberinsurance, instituting this kind of password policy is well worth consideration.