What kind of exercise injects should you include for a Hurricane Scenario?
- Keep it simple and think about what would really happen
- Review your Business Impact Analysis and Recovery Time Objectives, think about what could disrupt these
Feedback from BCP Builder Community on LinkedIn:
Injects
- Highway gridlock and airport closures (preventing critical personnel from evacuating)
- Explosions in chemical plant due to power loss (there were “controlled” explosions in Harvey) resulting in shelter-in-place (scorching heat in Houston)
- Damage to facilities
- Inability to access tools, not just at the affected area but also locations which are dependent on Data Center which is affected
- Reduction in resources after the hurricane has passed. How many employees would go to work after a natural disaster? This would now impact your ability to address workload and volume
- Increase in workload or volume and your plan to address it until it is back to acceptable levels of service or normal operations
- Building infrastructure damages, unable to go back to your office to work. Sometimes work from home does not work as employees do not have the habit of carrying their systems and accessories home. Or they cannot work from home as the internet is unavailable for a few days (city infrastructure impacted)
- Business(es) being a single point of failure
- A hurricane or earthquake has impact after it has taken place (can last for days), scenarios or injects based on the aftermath should be considered
- Heavy rain situations can cause City outage or partial city outage due to waterlogging, where employees are not able to reach the office or get home
- Inland flooding and employees unable to work because of flooding and power outages.
- Data center flooding due to the storm, office flooding due to damages on the facilities and employees homes being washed away or flooded
- Power outage leading to communications and data passage issues out to/from remote sites
Advance Warning
- Hurricanes are usually announced in advance. It is important to conduct a proper survey of most staff locations. especially your critical staff. Then you need to ensure your recovery site is very safe. If possible, move staff a day or two in advance to the recovery site with proper arrangements for their family. If you leave your arrangements too late you may find the contact number does not work.
- People safety should always be at the top of your priority list.
Post Hurricane Staffing
- Staffing is a problem as they will be cleaning up. How long they will be unavailable for depends on the depth of destruction. Also, the number of family members affected or living in the affected area. This must be managed with some empathy.
- Many businesses want to check in with staff – how will you contact them? Polling them with questions and seeing when they’ll be able to come back into work. Or asking if anything would prohibit normal business flows like loss of home or roof, trees down, etc. It helps the Chief Operating Officer know what strength the business will be operating at post-storm.
- Contact details of people who can bring help after the hurricane. Satellite phones are very useful but it’s important to have the phone battery charged up 100% previously.
Potential vulnerabilities
- Out of date contact information
- Paper and digital records located on ground level
- Generator located on ground level
- Buildings that cannot easily be secured in the event of extended power outages
Potential Opportunities
- Buildings built beyond the code that could withstand a Category 5
- Early relocation of critical data and assets to a secure location, as well as a skeleton crew of staff who can ride out the hurricane
If you want to increase your Organizational Resilience, start with preparing a Business Continuity Plan and check out BCP Builder’s Business Continuity Planning Templates.
