Your small business can go from thriving to surviving in the time it takes for an earthquake, an intruder, or some other disaster to wreak havoc on your property. Leo Wrobel explores some steps that even very small businesses can take to prevent or handle a disaster and get back to normal.

Size Does Matter

People tend to think of business resumption planning in terms of the Fortune 1000, but probably 90% of the businesses that could really use a plan are small or medium-sized. The sheer number of businesses that may fall into the "small to medium-sized" category boggles the mind: professional services providers such as law firms or doctors' offices, manufacturers such as machine shops or "job shops" that do custom manufacturing or build and sell PCs; car dealerships; local banks; even municipal works such as city, county, or taxing authorities. The list goes on and on.

Due to physical size, location, or financial resources, small and medium-sized firms often have to do things a little differently than large companies. Whether big or small, however, any company can end up broke if it can't recover from a disaster in time. So every organization, regardless of size, needs to have a plan. In this article, we'll explore what works for large companies, small ones, or both. On the way, I'll provide a few hints on how you can get something in place quickly for your small or medium-sized business.

Decide What You're Protecting

This step involves a preliminary identification of mission-critical business systems, without which the organization could not survive for an extended period. For example, what would your business lose if the physical facility, LAN, or telephone services were unavailable? The best way to measure the impact of such a potential loss is to look at it the same way big companies do. Historically, potential loss is measured in six ways:

• Lost employee productivity
• Lost revenue
• Lost market share
• Lost customer confidence
• Potential legal liability
• Cleanup costs

Let's consider each of these areas in a bit more detail.

Lost Employee Productivity

Loss of employee productivity is less in smaller companies than larger ones because smaller companies generally just lay people off until they have a place to work again. If you work for such a company, potential layoffs ought to be an inducement for having a plan in place.

Lost Revenue

Every business should know its "pain threshold"--the point where the inability to do business sets the enterprise on a slippery slope to bankruptcy filing. This category of loss also relates directly to how quickly your company can set up shop elsewhere.

Lost Market Share

Lost market share is a big deal for any company, large or small. For example, suppose you own an air conditioning and heating repair company with 75 employees. If a disaster puts you temporarily out of business, there are a lot of other, similar companies in the Yellow Pages for your customers to call. Your customers might decide they like your competitors better.

On the other hand, many or even most of your 75 employees are probably field service personnel who work out of trucks and vans, rather than your corporate location. In this type of business, if you take even the most rudimentary precautions beforehand, your business could still go on. For example:

• Setting up a meeting place in advance in case your main place of business is inaccessible.
• Assure employees that they're still going to be paid. Don't underestimate the importance of this step when 75 people see your building burned to the ground.
• Make sure that your inbound telephone numbers still work and are answered at a new location so your customers can reach your business. This is probably the most important issue, and we'll address it again shortly.

Lost Customer Confidence

When customers can't reach you, that problem eventually equals lost customer confidence. Suppose you went to an ATM for cash three days in a row and found it out of service each time. On the fourth day, you'd find another machine or make alternate financial arrangements; you would no longer have any confidence in that provider. If your business is unreachable or you can't resume service within a reasonable amount of time, your customers may look to your competitors.

Potential Legal Liability

You may not even have considered that loss of business capabilities could put your business at risk for legal liability. What if your business is a law office or doctors' office and you can't serve your clients? What if a client is injured (financially, physically, emotionally, etc.) as a result? What if an employee is injured or killed when a disaster occurs on the job? Are you prepared for lawsuits?

Cleanup Costs

Any disaster has the inevitable cleanup costs. Companies such as SERVPRO and BMS Catastrophe specialize in helping businesses to deal with fire and water damage to facilities, documents, electronic equipment, and so on. These firms can be called in immediately after a disaster--assuming that the damage is not too widespread and that the provider is available and not occupied elsewhere.

NOTE: Such efforts can be expensive. Make sure that your business insurance policies include these types of recovery expenses.

Don't forget the virtual side of your business! Computer viruses, hacking, and so on can damage your data, your web presence, and even your reputation. Your disaster plan needs to prepare for protecting and recovering your electronic information as well as restoring your physical properties. Remember that offsite backups are a crucial part of protecting your electronic info.

Build Awareness of the Need To Plan for Disaster

Do what you can to build awareness and to bring your people up to speed in recovery planning methodologies. For example, attend classes and seminars. The Internet also offers some pretty good public-domain planning guides these days that are very affordable. For example, I downloaded a Data Security Document and Disaster Recovery Plan template for under $50 from the IT Infrastructure Library's Survival section. It's not the be-all and end-all, but for a small business it's much better than nothing, and a great value for the money!

At a minimum, your disaster recovery plan must establish a meeting place where workers can assemble if a disaster renders your primary business location unusable. This backup location might be another branch location, a residence, a hotel--even the CEO's house. The key is determining the location in advance and then making sure that it has adequate telephone service, computer and fax equipment, and administrative support for coordination of the recovery process. This alternate location will be your emergency command center for recovery operations. The emergency plan for one of my clients, a bank, had everyone meeting in a parking lot. I can think of better locations, but at least they had defined a place. You should, too.

Prepare for Maintaining Contact with Employees and Customers

There are a number of steps you should take immediately to protect communications for your business. A major step is to assign emergency phone numbers and publish them internally to avoid breakdowns in communication in a disaster. (Make sure that at least your key employees have these numbers available offsite.)

PBX Versus Centrex Phone Lines: If your business has more than a few employees, you probably have a private branch exchange (PBX) phone system, in which employees share outside lines for direct dialing and have extension numbers for internal calls. In this type of setup, the switching equipment is physically located in your building. A central office exchange service (Centrex) is a type of PBX service in which switching occurs at the local telephone company, not at your location. Because you don't have the switching equipment onsite, your company is protected against everything from power failures to total loss of a PBX. Some companies give supervisors Centrex (direct) lines and other workers PBX lines. This way, they're protected if they lose either one.

When you think about it, phone companies and providers of enhanced Internet services have already paid much of the capital-intensive part of disaster recovery. Using vendor-provided services such as the following can be a quick and inexpensive way to improve your disaster plan:

• Remote Access to Call Forwarding (RACF)
• Voice over IP (VOIP)
• Wireless phone and Internet access

The following sections provide some details on these possibilities.

Remote Access to Call Forwarding (RACF)

One really useful feature that may be available from your phone company is remote access to call forwarding (RACF). Many phone systems can forward calls from the original phone number to a second number simply by using a phone at the original number and dialing *72 or 72#. With RACF, however, you can forward calls without having to be at the original location. Even if your building burns down, taking your phone system with it, the phone company very likely is still working. With RACF, you can automatically redirect all your incoming calls to any number where service is working--perhaps even to your wireless phone--without even contacting the phone company. (Why is this important? Think how difficult it would have been to get through to your Bell South agent immediately after Hurricane Katrina struck.)

Consider the following true story: A medium-sized municipality in North Texas (population 7,500) added the RACF feature on their main lines. About a year later, City Hall burned to the ground. Can you imagine the number of calls that came in when people saw or heard the news? Virtually all of those calls were received seven miles away, at backup facilities in the county offices, simply by activating the RACF feature.

Just a few steps are involved:

1. Call the special RACF telephone number.
2. Enter your personal identification number (PIN).
3. Enter the phone number from which you want to forward calls.
4. Enter the *72 code.
5. Enter the number where you want the calls to ring.

RACF runs about $1.50 per month per line. Where else can you get this kind of insurance so inexpensively? Get this feature installed on your phone lines today.

Voice over IP (VoIP)

Another essential consideration is Voice over IP (VoIP), sometimes known simply as Internet phone service. It's available from a variety of suppliers and reasonably priced. Vonage, for example, provides VoIP service for about $25 a month. The great thing about a VoIP service is that you can get back in business almost immediately by relocating anywhere high-speed Internet service exists. It's cheap, easy, and efficient, yet very few small businesses actually use it--and most should.

TIP: If you have VoIP service, ask your service provider how quickly they can drop ship an integrated access device (IAD) to you in the event the old one is damaged or destroyed in the disaster. Better yet, keep an extra IAD at an offsite location just in case.

Many medium-sized businesses use high-capacity Internet access services such as T1 or primary rate interface (PRI) for trunk lines. VoIP-based services are available for them as well; for example, WorldCall Internet offers a platform that provides a PRI interface to your PBX, but sends the calls out over a high-speed Internet connection.

It makes for some interesting possibilities. Suppose your business is a medium-sized university, office park, hospital, or multi-tenant building, served by four PRI circuits. It might be advisable for you to cancel one of your telephone company services and replace it with a VoIP service. Use the new VoIP PRI for outgoing calls or long-distance access in "normal" times. In a disaster, however, you can transfer your inbound calls via RACF, command routing, or porting to your temporary location where a high-speed Internet connection exists. Ask potential service providers about each option and how you should prepare.

Wireless Services

Using a wireless Internet service provider (WISP) is a great option for small to medium-sized offices, not only for emergency communications but for protecting against telephone cable cuts. For example, my consulting service uses a regional provider called AirCanopy, which uses the Motorola Canopy product for providing wireless Internet in the unlicensed frequency spectrum recently released by the FCC.

Wireless phones can be indispensable as a means of command-and-control after a disaster. Be aware that there might be blockages after a widespread event such as a hurricane. But in that situation, voice mail would still work for inbound calls.

Perform Physical Security Inspections

It's far easier to prevent a disaster than respond to one, and it doesn't cost anything to just look around your facilities for potential problems. Take a walk-through at your location and look for obvious safety issues. The following list will get you started:

• Are equipment closets locked and accessible only to authorized personnel? (If janitors store their equipment in the same closet with the telephone or server equipment, that's a disaster waiting to happen.)
• Does your equipment room use a backup power supply?
• Does the equipment room get too hot or cold for the equipment, especially during non-business hours? Is air conditioning or heating shut off for extended periods?
• Are combustibles--paper, cardboard boxes, flammable liquids, etc. stored safely, and away from the equipment room?
• Does your PBX have a power failure feature, so phones still work in case of a blackout?
• Is your server or PBX equipment located under or near a water source such as sprinklers or plumbing pipes?
• Are water pipes clearly labeled for shutoff in case of a leak? Are they located where they could freeze and break in cold weather? Is the number for building maintenance posted in case water has to be shut off quickly, even after hours?
• Are fire extinguishers available and properly charged? Are your personnel trained in using an extinguisher?
• Are emergency numbers posted prominently?
• Are smoke alarms present and working?
• Do waste containers have fireproof lids?

Summary: Start Planning Now

Planning for disasters need not be complex or prohibitively expensive for small and medium-sized organizations. There are many concrete steps your company can and should be taking immediately. Be aware that a disaster recovery plan doesn't just happen overnight, though. It evolves over time, through the collective impact of even the most minimal efforts, like those described here. Any steps that can be taken, however small, equate to an incrementally higher level of service to your customers and greater peace of mind to your business.