Identify the Risks that can Shutdown Your Business.

First, catastrophic events: nature happens,

What natural disasters have happen in or close to your area? Earthquakes, hurricanes, tornadoes, flooding, snow (ice) storms, etc.

Followed by man made disasters, which are harder to predict, but can include power outages, network outages, fires, gas leaks, train derailing, etc. You can learn from history, whatever has happened will happen again.

Second, inside event risks: Sooner or later every business will experience these events,

Computer related problems:

• Hardware: Designed to last 5 years at best, yet you get a 1 year warranty. How fast can your vendor supply you with new hardware?
• Software: Virus attack, driver issues, a bug in the software, mixing different versions, etc, can cause the system to slow or shutdown.
• Network: Loss of commutation between computers and or the Internet.

Other business equipment failures:

• Phone system: What will happen when telecommunications is lost for x amount of time?
• Peripherals: Copiers, FAX, printers, monitors, etc, how long can you maintain business if any of these devices fail?
• Security: Could this result in a greater risk of exposure to theft, sabotage, even a terrorist attack?
• Human error: From accidentally deleting a file to formatting a hard drive with critical data.

Accidents happen! Murphy's law. When they happen in the work place you must be prepared.

What happens if the person in charge of handling an event risk is not at the location?

The simplest way to start evaluating your risks, is to make a chart (fig 1 & 2). List all possible events that could happen to your business and assign a risk number. Start with natural disasters, man made, then computer and equipment failures, and finally human error.

By assigning a risk number to each event you can start to prioritize the possible events. You must consider your location, age of equipment, and experience of your employees when assigning a risk number. Using a simple number system, zero through nine, where 9 is most likely to happen and 0 is next to impossible. Numbers in between represent a possible risk, the higher the number the more likely this event could happen.

Equipment (computers and other hardware) failures should also be assigned an impact number. What to do when this failure happens, using a simple number system with 1 meaning can do without, wait for repairs, to 5 highly critical to business, requires immediate recovery / replacement. There must always be a second in charge for high impact number events.

Keep your risk factors within a time frame, as a rule, they should be re-evaluated every 6 months.

Example:

What is the risk of a major snow (ice) storm in the next 6 months?

If you live is Key West Florida, assign a 0, if you live in Fargo South Dakota, it would be a 9 (in the Fall-Winter Seasons) and a 4 (Spring-Summer time).

Figure 1, set up a simple spread sheet to describe natural and man made catastrophic events that can, or have, happened at your location.

What is the risk of computer hardware failure in the next 6 months?

If the hardware is new (less than two years), maybe a 3, older (2-5 years), a higher number like 6, and over 5 years old would be a 7 or higher.

The impact number would be a

5- if it must be repaired / replaced immediately.

4- if it must be repaired / replaced current business day.

3- if it can wait 24 hours for repair / replacement.

2- if it can wait 36-72 hours for repair / replacement.

1- if it can wait for normal service.

Figure 2, set up a simple spread sheet to identify the equipment that is important to the business' operation.

Develop and Maintain a List of Inventory Items

Every business needs a complete inventory list of their equipment. Using the spread sheet above (Fig 2) and adding a few more columns Serial Number, Model Number, Purchase Date, Cost, and Vendor you will have an inventory list. To complete the list be sure to add software, and equipment other than IT. Check with your insurance company to be sure this list contains all the information they require. You should have an separate inventory list for every location.

Any risk with a number greater than zero, must be included in your disaster recovery plan, and your business continuity plan. Now that you know your risks and the impact to your business you can start to write a plan. This will be covered in part 3 of this document.

Caveat: This guide is very basic and is designed more for the IT department. We know that every business is different. Use this document as a starting point to help create your own plans for the types of disasters that could happen to your business.

We look forward to comments and suggestions.