Did Katrina Destroy Your Disaster Plan?

Over the years, this column has urged you many times to set up an effective Disaster Recovery Plan (DRP). Well, now that hurricane season is in full swing and we've seen the widespread devastation caused by hurricane Katrina to New Orleans and the Gulf Coast, I think that it's time to revisit this important topic. The old excuse "we'll deal with it tomorrow" is no longer an option, and failing to establish a DRP could result in real legal liability for your company and you.

Even if you thought your DRP was strong enough to survive any contingency, there are still some serious questions to consider given recent events.

Suppose your company took a direct hit from a disaster the magnitude of Katrina. Would you be wiped out? Could you relocate your operations and IT systems? How long would that take? What about your employees—are you taking them with you or are you leaving them on their own?

Could you even do something as simple as putting a notice on your Web site informing your customers what has happened?

Katrina should have served as a wake-up call to every business as to the state of their DRP. While you thought your plan covered everything, could your business really survive something like Katrina?

A wide dispersal of your assets may be necessary to ensure survivability. Simply moving across town may not be an option. It's a tough question: How far away from your corporate office is far enough?

When a regional event like Katrina occurs, a hot site one hundred miles away may not be clear of the disaster zone. Depending on the nature of your business, you might consider a DRP with vendors across the country or around the world.

Don't forget--you cannot always count on having the kind of lead time to prepare that a hurricane offers. Earthquakes, tornadoes, and terrorists usually don't give you a warning time. You need a DRP in place that you can implement quickly and effectively.

Finally, Katrina has taught us we can't rely on the government to instantly bail us out. You have to take proactive steps to protect the life of your company. Depending on what you do, even being down for a few hours could put you out of business.

While most DRPs focus on moving operations and IT systems to backup facilities, the devastation of New Orleans has shown that a robust DRP needs to account for contingencies like wholesale evacuations. Your company's physical facilities may not be accessible for months and your employees scattered by a mass evacuation. How will you recover?

If your area took a hit from Katrina, you know how your plan worked (if at all). If your company was outside of the disaster zone, don't simply thank your lucky stars and move on. Use this opportunity to re-evaluate your company's DRP.

You have been presented with a tremendous opportunity here. Over the course of the next few months, the news is going to be flooded with stories on how companies handled Katrina. We will hear the horror stories about companies that were wiped out, and about companies who simply moved their operations elsewhere without missing a beat.

Looking back over the action reports, new stories, and other sources you can cheaply take advantage of your competitors and other companies. The results might surprise you: analysis of vendors offering DRP services showed that after 9/11, most of them earned good grades.

DRPs vary greatly in size and complexity. While a small company might be able to move its operations by simply unplugging a backup hard drive and physically moving it to another computer, larger operations will require more complicated backup and restore procedures. These mid-sized and larger companies need legal help in negotiating the outsourcing, leasing, and backup "hot site" contracts necessary to ensure the disaster recovery takes place seamlessly for you, and appears so to your customers.

Often, it's best to outsource your IT recovery planning to companies that specialize in providing these services. Presumably, disaster planning is not one of your core competencies. It also does not make sense to have your inexperienced employees develop a DRP from scratch. Fortunately, you are in luck: a quick Google search will result in a large number of companies that specialize in disaster recovery planning.

If you do decide to outsource your DRP planning or use a vendor to provide specific services, please be patient with them for a while. Many of them are heavily involved in helping clients hit hard by Katrina.

Your technology attorney should be part of your team when you design your DRP. While your IT guys can tell you how your company's vital data and operations can be moved, your technology attorney can help ensure things work as they are supposed to when you move offsite. An experienced technology attorney can help you negotiate a meaningful agreement that properly memorializes your understanding. After the next hurricane is not the time to find out that your DRP is a disaster too.

Having a DRP in place and ready to go is critical. You really don't want to be rushing around trying to implement and test a disaster plan on the fly with something like a hurricane bearing down on you, or in the aftermath of some other disaster. That's the time to spend protecting your family or getting out of town. You are also going to be facing time pressures from your employees since they want to go and protect their family and property too.

With a properly placed plan, you declare an emergency and a series of pre-planned and pre-tested steps go into effect. The goal - get you up and running again within a reasonable amount of time.

Take the time today to reevaluate your disaster plan. Preparedness and adaptability are key parts of any workable DRP. Be ready to move today for the disaster that may be right around the corner.