Disaster Recovery: Wartime Preparedness

The following suggestions were developed from a number of sources to serve as a guide for organizations in preparing, or enhancing their business recovery plan. Centurion Disaster Recovery Services is providing this information as a service to our community. This list is not intended to offer the total solution for your business. This is intended to be an aid in preparing your business. We strongly suggest that you work with your local government authorities and visit the suggested web sites listed in this memo for more accurate and up to date information.

Review the Corporate-wide Emergency Management Plans (EMP) for the following and determine how they might be enhanced:

• Computer incident response (hacking, virus, worms, etc): this should include a procedure and an escalation plan.
• Update / revise the "suspicious packages / letters" procedure and include actions for anthrax (white powder substances).
• Update / revise the plan to include symptoms of chemical contamination and how to respond if it should occur.
• Put a procedure in place that addresses emergency response requests from the local emergency agencies / government such as "sealing the building".
• Update / revise the plan to include biological threats and how to react if it should occur.
• Exercise all aspects of the EMP at least quarterly. Review results and alter plan as needed. Consider more frequent exercises if the Homeland Security increases the alert levels.
• Ensure all staff have the latest version of the EMP and know how to use it.
• Consider developing laminated cards with select emergency procedures on them and have the staff attach them to the staff identification cards they currently carry.
• Review / update medical supplies and make sure they are sufficient and accessible when needed.
• Ensure EMP includes a procedure for guiding visitors as needed in an emergency situation, not just if there is an evacuation.
• Encourage staff to bring bottled water and non-perishable snacks to the office and store them in a drawer. Rotate supply as needed.
• Create a "home disaster plan template" and provide to the staff. Encourage them to complete it and offer assistance as requested.
• Ensure Escalation Codes, such as yellow, orange, red, exist and include the following:
1. Main computer system outages.
2. Levels of alert as outlined by the Homeland Security group.
3. Corporate security activities for each level. Determine what actions should be taken with each level. For instance, if the level is red, cancel all non-essential appointments / meetings / events. This would allow for the key staff to be in the office if something should occur.
• Enhance EMP and Risk Assessment (RA) Plan if the facility is close to high target areas such as malls, utility companies, transportation hubs, dams, and tourist attractions.
• Ensure that the EMP lists Internet sites that would assist with information in a disaster, as phones may not be available. Be sure to include a site for company-wide communication, if applicable. Staff's personal emails should be part of the plan as a secondary contact method.
• Develop / follow travel policy to reduce the risk of key personnel being affected at the same time, especially during a high alert situation.
• Encourage each facility to know where their local emergency shelters and outdoor pay telephones are located and include that information in their EMP. Pay phones in buildings generally don't work when local phones won't work, but pay phones on the street are generally setup as emergency phones and will work in an emergency situation. Make sure every employee has a copy of the EMP. Many cities have established a place where they will treat people in the event of bio terrorism. This site would be announced by radio at time of disaster / need.
• Encourage each facility to review and expand their emergency supply kit. Be sure the kit includes basic medical supplies, tools, emergency radios, batteries, and a list of staff that have first aid / CPR / EMT training. Become familiar with the "Good Samaritan Act" so that these individuals are comfortable with helping out in an emergency situation and are not afraid to get involved when needed.
• Review the Risk Assessment and ensure that there are procedures and resources to support an emergency response for situations such as earthquake, tornado, hurricane, etc.
• Be sure to have the contact information for critical emergency groups like: Federal Emergency Management Agency (FEMA), SEMA (State Emergency Management Agency), LEMA (Local Emergency Management Agency), Red Cross, Crisis Counseling services, fire department, local police, and utility companies.
• Adopt / Enforce the following security rules:
1. Sign in all visitors.
2. Ensure all staff wear employee id badges.
3. Give badges to all visitors.
4. Escort visitors through the building.
5. Assign a staff member to be responsible to assist visitors in an emergency.
• If there is no security officer at the facility, consider assigning one.
• Add weather / citizen band radios to the emergency kit along with the list of stations that would be used to monitor an emergency situation.

Plan should contain the radio / television station information that will be used by the company for communication to staff, customers and community members.

• Test all procedures in the emergency plan including how to shut off the utilities.
• Ensure that the needs of impaired persons (hearing loss, mobility issues, etc.) have been addressed. This could apply to visitors or staff.
• Contact the Local Emergency Management Agency and arrange a meeting to discuss their approach and how it will affect your facility.
• Establish a corporate-wide policy for exercising the procedures in the EMP plan on a quarterly basis.
• Be aware of the location of maps of the evacuation routes for each area and place copies of the maps into the EMP.
• Provide laminated cards to all staff that outline their emergency evacuation procedures and indicates emergencies that would not require them to evacuate, such as a tornado warning.
• Review the FEMA.gov website thoroughly and become familiar with it so that it can be used as a resource in a disaster.
• If the facility is in a leased building that is shared with other tenants, contact the facility management company and determine what emergency management plan they might have in place.

Enhance recovery plan to ensure it has:

• Succession procedures. Review plans and determine what key personnel might be called upon to assist the community in a disaster versus helping the company. Staff such as military, fire department volunteers, EMT volunteers, etc. would be included in this list. Make sure a trained backup is in place for these people.
• Review and update the Risk Assessment to include terrorist acts.
• Ensure all team members have a copy of the plan, it is current and it is kept at home as well as at the office. A list of who has the plan and how current the data is should be readily available.
• Add "disaster operation procedures" to the plan. This is a list of alternate rules that guide operations when they cannot be done in the usual manner, such as a bank setting dollar limits on ATM transactions when the ATM is not on-line.
• Add "react procedures" to the plans that provide guidelines for one facility helping one that is affected by a disaster.
• Review all insurance plans for coverage for acts of terror. Make sure all insurance coverage documentation is included in the recovery plan.
• Determine a procedure to rapidly allow telecommuting operations in a disaster so the company can continue business as much as possible if the staff cannot get to the physical building.
• Expand media scripts to include loss of life and building access issues.
• Establish employee emergency call-in telephone numbers per facility for employees to call to get status updates.
• Ensure there is a toll free number for customers to call into to obtain status updates.
• Provide procedures to update JHA web site of status as required.

These suggestions are provided by Centurion Disaster Recovery to enhance your corporation's business recovery plan. It is a compilation of information gathered from various resources such as FEMA and the Red Cross, as well as from our own experience. We realize that some of these suggestions may already be incorporated in your plan, however, in light of the current heightened possibility of terror activities, now is the time to review and update your plan to prepare for any unforeseen events. We strongly encourage you to visit the following websites for further information:

Facts About Sheltering in Place. CDC, Department of Health & Human Services.
www.bt.cdc.gov

Shelter in Place at Your Office. National Institute for Chemical Studies
www.nicsinfo.org

Fact Sheet on Shelter-in-Place. American Red Cross, February 2003
www.redcross.org

Preparing Makes Senses. Get Ready Now. US Department of Homeland Security
www.ready.gov

American Red Cross Ð Homeland Security Advisory System
www.redcross.org

FEMA: Fact Sheet: Terrorism. Federal Emergency Management Agency
www.fema.gov