Regardless of the cause, extreme weather events are on the rise. From floods to droughts, and storms to severe weather that can cause power outages or regional disruptions, natural disasters are a growing threat. The specific risks associated with severe weather events are obviously location-dependent, but virtually every business faces some degree of exposure. From tornadic storms in the center of the country, to tropical storms on the coasts, no one is completely immune from the impact of severe weather events. Even companies that may feel somewhat insulated from the direct impacts of severe weather can feel the pain of secondary effects like spikes in gas prices or supply chain disruptions in the wake of a natural disaster.
What follows is a brief overview of what business leaders can and should be doing right now to prepare and protect their people, properties, and profits from the worst effects of weather-related natural disasters.
Plan ahead for incident response and recovery
Making a plan sounds like basic advice, but it’s remarkable and unfortunate how often this is ignored or half-stepped. If you wait until a storm is looming then it’s too late. Detailed planning should include your response during the incident and recovery measure after the event. Thoughtful and comprehensive disaster response planning involving all relevant personnel and departments who may be impacted from a business resiliency and continuity standpoint is critical. These stakeholders and subject-matter experts should contribute their own piece of the disaster planning and preparedness puzzle (e.g. IT likely knows best how to protect its assets in the event of a flood).
Security professionals see it over and over again: companies that are reactive are those who face the biggest and most damaging impacts from severe weather events. Human nature is to naturally be reactive. Preparation and planning takes work, discipline and commitment. It’s much easier to respond to something visceral—something that is happening or just happened—than to PREPARE for something theoretical that might seem remote or unlikely.
Those that can quite literally weather the storms—mitigating and minimizing damage and bouncing back quickly after a disruption—are the companies with decision-makers who take the time and invest the resources to plan.
How to build a disaster recovery plan
Business leaders who have never had a disaster preparedness and recovery plan before are likely to ask themselves the obvious question: where do I start?
Every great plan starts with an assessment. Before you can start building any plan or procedure you need to determine what your threats are, where your vulnerabilities lie, and what the impact of those vulnerabilities might be. It’s also essential to identify the right stakeholders. One common profile for planning failure is a company where one group or department is pushing a plan and no one else has bought in. Everyone needs to be onboard. Securing that buy-in starts at the top. Identify all the different entities that need to be involved (IT, HR, Facilities, Corporate Security, Operations, etc.) and engage in a collaborative planning process. The specific participants will vary from one company to the next, but the inclusive planning process should be the same. Develop at the committee level who will be involved, assigning specific roles and responsibilities accordingly.
Different people will inevitably have different perceptions of risks and threats. Being able to share across departments helps to break down personal or institutional resistance that can inhibit effective planning. Having an outside security expert determine region- and company-specific threats and articulate the potential business impact can be helpful. Third-party objectivity helps accurately assess threats and allocate resources effectively and efficiently, resulting in a better and more effective plan.
Common missteps in disaster preparedness
What do companies get wrong when building a plan? One of the most common missteps is failing to get leadership buy-in to really develop a workable plan. All too often, disaster preparedness and recovery planning becomes an exercise in box-checking. Effective planning requires decision-makers to devote time and resources to come up with a comprehensive plan, to document it appropriately, and to practice it diligently.
Companies also sometimes fail to identify the right partners. Whether it’s a security or disaster recovery expert, a remediation specialist, or simply a resource who can help secure emergency fuel supplies or generators in the wake of a disaster, these are relationships that should be established long before natural disasters strike.
Another costly and common misstep is failing to identify critical redundancies. Temporary facilities, new or temporary equipment and infrastructure, or alternative power sources should all be established ahead of time. For many companies, downtime is damaging, but the cost of an extended interruption can be catastrophic.
COVID complicates safety and security planning
Like anything else these days, the long shadow of the COVID pandemic looms over everything with regard to safety and security planning. In the case of disaster preparedness/planning, it’s reasonable to wonder if the pandemic-related emergency measures that so many brands and businesses have had to put in place over the last 18+ months have actually left them better prepared for the next crisis.
The reality is that, from a disaster preparedness and emergency planning perspective, COVID has been something of a double-edged sword. Companies are generally more aware of unexpected threats and the value of planning and preparation. Business leaders everywhere understand on a visceral level that these kinds of large-scale emergencies can and do happen. But threats change and evolve—and that holds true whether dealing with a global pandemic or a regional weather emergency. The next disaster might not even be on anyone’s radar today. The best security planning accounts for that uncertainty and recognizes that we need to expect the unexpected.
Given the high-profile impact of COVID, you might think funding for disaster preparedness and emergency planning is easier to get. In many cases, however, it’s actually harder—partly because many companies have taken a significant financial hit, and partly because recognizing the nature of threats to the disparate structure of remote workplaces is tougher for many business leaders to appreciate. Ironically, that remote or hybrid operational models that so many companies have moved to out of necessity actually complicate emergency planning. It’s easier to replace a single facility than a large number of remote work sites. While many companies have a more robust technology infrastructure than they did pre-COVID, a scattered workforce can be both and asset and a liability in an emergency—and your planning should reflect that reality.
