Disaster Planning for Your Business presented to USSA by Tom Serio

Disaster Planning For Your Business Presented to

U.S. Superyacht Association July 30, 2019

Tom Serio MTS & Associates, LLC

Introduction/Background • New York: • • • •

King Kullen Grocery - IT PCH – IT, DR Cendant – International DR, BCP Cablevision – DR, BCP

• Florida: • Office Depot – Global BCM Director • Verizon Wireless – BC/DR Outreach • MTS & Associates - Consulting

Objective of Today’s Presentation • I’m not trying to sell you anything • But I have a lot of advice to give

• Thoughts…

• • • •

Get through career without a disaster Great planner Disasters go exactly as planned Life is what happens as you make plans

2019 Hurricane Forecast • Forecasts from Colorado State University and NOAA closely aligned: • 13 Named Storms (average is 10) • 6 Hurricanes (average is 6) • 2 Major Hurricanes (average is 2) • • • •

54% chance of major hurricane hitting US coast (avg. 52%) 32 % chance of hit on US east coast incl. FL Panhandle (avg. 31%) 31% chance of hit in Gulf Coast from FL to Brownsville (avg. 30%) 44% - About average risk of landfall in Caribbean

Risks • • • • • •

Build a Risk Matrix – Probability vs Risk Local – Hurricanes, severe weather, flooding, fire, social violence, etc.

National – Hurricanes, fires, earthquakes, flooding, social violence, etc.

Infrastructure – Power, water, roads, telecomm Cyber/Hacking – phishing, extortion, ransom, etc.

Family/Personal issues – disgruntled, divorce, kids

BCP vs. DRP • A Disaster Recovery Plan is a plan used to recover the centralized information technology (IT) infrastructure that supports the business. • A Business Continuity Plan is designed to facilitate timely recovery of critical business operations in the event of an interruption.

Team Profiles • Executive Committee Team - CEO, Presidents and EVP’s. Any member of this team can be asked to sit in on any other team, depending on crisis event.

• Core Business Team – Executive Committee Team and their alternates, for relocation purposes, to ensure the continuity of business.

• Crisis Management Team – Members from various teams. Someone has to be in charge.

• Incident Response Team – Members from Legal, IT, Public Relations, Information Security and HR who manage any event.

• Disaster Recovery Team/Business Continuity Team – Information Technology and business personnel responsible for the execution of the plans.

Plans

• Crisis Management Team Plan – Includes processes and information for the CMT to follow in preparation of or response to, an event. Includes information on team contacts, communications, construction, remote command center and the Hurricane Checklist.

• Core Business Team Plan – Details the process to evacuate the Core Business Team (executives or their alternates) in the event of an impending disaster event, specifically a hurricane.

• Home Security Program – This initiative allows for contractor install/removal of shutters on the homes of those members of the Core Business Team who are asked to evacuate.

• IT Hurricane BCP – Detailed plan for executing the IT drive-away team.

• Disaster Recovery Plans – Disaster Recovery Plans focus on recovering the IT infrastructure.

• Business Continuity Plans – Business Continuity Plans focus on recovering the critical business functions.

Plans • Corporate Communications Crisis Book – Used to proactively and reactively manage media inquiries. It contains key contact information, media lists, and templates for a variety of press materials, including news releases, media alerts and Q&As. • Store/Facilities Hurricane DR Plan – Includes pre and post strike checklists and procedures for vendors to follow. Also detailed is the strike zone map, store listing, and contact lists.

• Corporate Facility Hurricane Plan – Procedures and checklists to prepare the corporate campus for a hurricane.

• Distribution Centers – Plans for recovery of distribution, dock and processing centers.

Getting Started • Perform a BIA – Business Impact Analysis • Create a Gap Analysis – Understand the differences of the business needs and what IT or other services can deliver • Know who is needed when, and for what • Create comprehensive contact list • Develop recovery procedures – executable components of BCP and DRP

Communication Program • Setup 800# hotline for internal communications • Use daily email updates, video messaging, notification tools • Who can speak externally to media, and when, how, what, etc

***SAMPLE Channel

Target Audience

Communications Strategy Owner

SAMPLE*** Frequency

Content

Weekly Status Update

NA Associates

Internal Communications

Weekly (Wednesday COB)

General relief efforts, HR strategies, donations, etc.

FAQs

HR, Field HR, Store Managers, Managers

Internal Communications/HR

Updated as needed

Specific information on how to receive assistance and how to help relief efforts

Telephone Lines •Critical Information Hotline •HR Hotline

All impacted associates needing information

Business Continuity (Hotline #) HR Hotline (HR #)

Critical Information Hotline updated as needed. Directs associates to HR Numbers, payroll, etc.

Critical Information Hotline – general info, directs callers to HR HR – Answers live, payroll, etc.

Newspaper Ads

Displaced Associates

HR/Advertising

3x/week

Directs displaced associates in impacted markets to call 800#

Internal Video Releases

Corporate Campus TV/Streaming Video to NA Associates

Internal Communications

As needed

General relief effort update and information

External Press Releases

Media

Public Relations

As needed

Company’s Relief Efforts

Daily Operations Update

Expanded Crisis Management Team

Business Continuity

Daily

Specific operations information, facilities updates, etc.

Communication Program – Telecomm – Wireless and Wireline • • • • • •

Know who your carriers are Know what your carriers will do for you Know what assets the carriers have Know how your carrier will keep you on the air Know what devices your key employees use Know your link to the inter-web

What about employees?

• Initiate a personal preparedness program • Prepare home, disaster kit, personal information kit, other critical needs

• What about Fluffy?

• Educate through Lunch-n-Learns, expos • Family issues

Department Functions under BCP’s • • • •

Not BAU! Departments have to change procedures Plans and knowledge base stressed at times Goal to keep disaster transparent to customers

Other issues • • • • • •

Locating employees Resource availability Area impacted; many businesses have same issues, concerns Need a pre-disaster plan (awareness program, preparation procedures) Need facility closing plan (i.e. triggers) Need evacuation plan

Public-Private/Private-Private Partnerships • What is a PPP? • Relationship between the public sector and private entities or private and private, to the benefit of both sides • Who should be included in a PPP? • Consortium of local businesses and government agencies (i.e. local, city, county, state) • Why should we have a PPP? • To share information and resources, improve planning and recovery, and garner leverage through partnerships • When should a PPP be set up?

• Before the need arises, and since you don’t know when the need will arise, do it now • How can this be established?

• Approaches will vary, but need to reach out and make the connections w/public agencies and other businesses

Bottom Line • • • • •

Bottom line not impacted Check insurance policies Return to BAU as soon as possible Be flexible with plans and execution; disasters have too many variables Keep company off front page of Wall Street Journal

Questions/Answers Thank You!

Tom Serio MTS & Associates, LLC mtsbiz@earthlink.net 561-758-6306