What happens to a building owner’s business if the building(s) containing the owner’s office space and IT files must shut down for a day (or two or three …)?
How can you continue to take care of the tenants in your other buildings? What about the tenants who lease space in the building that has temporarily shut down? They’re in the same boat as you. Do you have any responsibility to them?
The answers to these and other related questions form the basis for a business continuity plan, which has recently become a security assignment across corporate America.
First, affected tenants will have to rely on their own business continuity planning. Depending on the lease, a building owner may have some responsibilities for helping a tenant recover, but that’s unusual, according to Don Aviv, the COO of Interfor, a New York City-based security consulting company.
Like most security planning, business continuity planning begins with a security assessment of your building. Typical security assessments catalog threats that might affect the building. “Hurricanes, floods, earthquakes, power outages, fires, hazmat accidents, terrorist attacks – what are the realistic threats that could affect your business?” Aviv asks.
Security assessments also look at vulnerabilities – the impact that a threat might have if it were fulfilled.
Suppose an explosion cripples a substation that routes power to your building and cuts off the electricity for 24 hours?
“You should ask yourself how your business would be affected if the power went off for 24 hours, two days, three days, or a week,” Aviv says.
Business Continuity Guideline, an ASIS publication, recommends conducting a business impact analysis (BIA) that assesses the impact a threat event would have on various critical business processes, such as purchasing, supply chain, accounts receivable, accounts payable, payroll, IT, leasing, and other functions important to the successful operation of your business.
It also recommends assessing the physical and psychological human costs that employees, tenants, suppliers, and other stakeholders might suffer. What is the financial cost of replacing equipment and property, covering downtime and overtime? How will the event harm your company image and reputation?
For each business and human cost, draw conclusions about how long it will take for these costs to grow to unacceptable levels.
“You might say that everyone can work from home for one or two days,” says Aviv. “After that, you might determine that the cost of not handling the tasks that must be carried out in the office is too great and it will be important to be able to move into alternative space.”
Once you figure out what bad things could happen for one to seven days, the work of business continuity planning really begins.
What resources will you need to recover and get back to normal? According to the ASIS guideline, these might include specialized services, computer hardware and software, communications, office supplies, office space, and business records. You’ll have to make arrangements to ensure that all necessary recovery resources are at your disposal when you need them.
If it’ll take three days to get into temporary office space, you’ll have to make arrangements with employees to work at home for that long.
The ASIS guide also recommends appointing a crisis management team to organize and mount the company’s response. Such a team must have clearly defined positions and detailed descriptions of duties. It should include human resources, IT, facilities, security, legal, communications/media relations, and other support functions.
The crisis management team will direct response teams that will assess damage, organize the work and supplies necessary to restoring the site, handle payroll and other financial responsibilities, bring in new IT equipment and phone systems if necessary, and supply administrative support.
In short, the crisis management team will manage response teams working on restoring all critical business functions that were knocked offline by the event.
Finally, one plan should cover each of the periods of time outlined by Aviv: 24 hours, 48 hours, 72 hours, 96 hours, and 120 hours – one to five business days.
“Anything over a week will probably be so catastrophic for your business that you should probably prepare a major strategic plan for restarting your business in new office space with new equipment and furnishings,” Aviv says. “The business continuity model for such a worst-case scenario is the aftermath of the 9/11 attacks.”
Within weeks of 9/11 a number of large financial companies had moved their offices out of Manhattan to Newark, NJ. They had laid those plans ahead of time. When the time came, they knew exactly what to do and exactly when it would become necessary to do it. That is how to maintain the continuity of a business – even in the face of disaster.
