by Ted Saul 

There is an old saying “the show must go on.”  When it comes to running a business and the occurrence of a catastrophic event, it too must go on in order to keep the revenue stream alive.  This is where the business continuity plan (BCP) comes into play.  This in-depth document is an all encompassing plan to determine length of time it will take to get a business functional again and how it will be accomplished.  Driving the continuity plan will be the cost of maintaining and execution, but the bottom line question is how long the company can afford to be shutdown.  Note that it is important not to confuse the BCP with a computer systems disaster recovery plan (DRP).  While certainly extremely important, the network and computers of a company are only one aspect of continuity planning.

A first step for a business is to examine the risks that may exist because of their physical location. For example, here in Southern California ranking high will be the potential of a major earthquake or wildfire while hurricanes and severe tornados are likely considered a low threat.   Also to be considered is the category of risks that may exist regardless of location such a terrorism, disease or cyber attack.  Once an accurate list of threats is complete, analyze how each one may affect internal structure such as utility access and facilities.  Consider questions such as, what will it take and how quickly can alternatives be put into place to allow the business to continue operating? 

What is the contingency plan in case one of these risks is realized?  Consider your suppliers and vendors, especially those in close proximity of your site and how they may be affected by the same event.  You should be aware of their BCP and how long they expect to get back into production in the worst case scenario.  And should the unthinkable take place, how about the availability of key personnel.  Has critical responsibility been documented with backups in place to be able to carry out required duties to make your business available?  Make sure access codes, keys and vault combinations can be readily accessed by appropriate contacts.

A last step for the BCP will be to develop the testing, review and change management processes.  You want to make that what has been designed will really work and not wait for an actual event to take place.  Scenario test as much of the plan as possible and make changes as necessary.  Schedule regular meetings to go back to through the plan to make sure all assets and resources are covered as well as a process to thoroughly review any required modifications to the plan as they come up.

Ted Saul is a small business consultant specializing in startups and business security.  He can be read at This e-mail address is being protected from spambots. You need JavaScript enabled to view it and TWS777 on Twitter.