Whether you’re running a large or small company or even a private household, having a plan in case of unexpected situations can mean the difference between speedy recovery and immobilization. When that situation is damaging or even catastrophic, you’ll be glad you can get “back to normal” quickly by following your plan. Companies refer to this as Business Continuity Planning (where IT-related content is typically called Disaster Recovery Planning). You can imagine how important it is for hospitals, financial institutions, and any business to be able to get back to delivering their services as quickly as possible. And having a plan is no less important in the contract lab business.
Various resources are available to help a facility plan for the unexpected. The United States government provides some handy disaster recovery content online to help anyone get started with this planning. A general guideline is provided by the International Organization for Standardization [1]. For an IT-specific framework within the United States, the National Institute of Standards and Technology (NIST) offers a comprehensive library of resources. The financial industry is required to have a plan under the Financial Industry Regulatory Authority’s Rule 4370 (and anyone of us who uses a bank benefits, even if we don’t realize it).
Developing a Business Continuity Plan
Make it flexible
The overall effort should be mindfully done, but also be appropriate to the scope of the business in question. To get started, you’ll want to gather some information, like a list of assets, emergency response contact information, and vital references like Organization Charts and vendor lists. Trust me, gathering a cross-departmental team to think of all the key parts of the business will make this process much easier (and possibly even a little fun). The compilation forms the master reference file to access in times of need.
Conduct a risk assessment
Next, put that team’s brainpower to work: what are the threats that can disrupt the everyday flow of the business? Think of nature-related threats like storms or pandemics, as well as human intervention like theft or a cybersecurity breach. Keep in mind: the business’s reputation is vulnerable just like its physical assets. Any of these could exploit the business’s vulnerabilities and leave some or all of it disabled for an hour, a day, a month…your boss does not want to think about the possibilities. Get that plan going!
Conduct a risk assessment, assigning scores to —
● the probability of each threat coming to pass, and
● the impact it could have on the business.
You may also consider the effectiveness of risk mitigation tools a business may implement. Plenty of records are publicly available describing the history of crime or destructive weather events in the area of interest. The risk assessment will provide a hierarchy of sorts, where the highest “score” (i.e., most probable and least controllable threat paired with the most devastating impact) is where the business should focus its first planning.
Get everyone involved
From there, ideally, the entire company needs to get involved. Your team could provide a detailed checklist or a generalized guide, but in any case, all staff need to know how they will be included in case of an emergency. They should have emergency response training so that first aid flows naturally. Remote workers should understand how they will be contacted if needed, and on-site workers should know how the notifications are rolled out. A shortlist of individuals can be assigned, including a leader, to assess damages and report back so the leader can keep key stakeholders, including affected clients, corporate leadership, and vendors, informed. The recovery efforts should be clearly prioritized. Imagine: your call center can’t get very far if the communications utilities haven’t been restored first!
Keep your plan updated
Be aware that these plans do not age well. Hopefully, your business keeps evolving, meaning the plans need to do the same. Bring that team back together periodically and update the lists of vulnerabilities, risk scores, contact information, and prioritized responses. Create simulation exercises to keep the rest of the staff limber and to solicit their feedback on revisions—they might have a great idea that was missed.
Trust the Particle Expert
In the case of Particle Technology Labs, we focus on exemplary customer service, so we do our utmost to maintain constant uptime as a business. As such, our Business Continuity Plan is thorough and routinely refreshed, so you, Dear Client, don’t have to worry. Particle Technology Labs has your back. Contact us today to find out why PTL is trusted by so many industry leaders!
[1] ISO 22301:2019 Security and resilience – Business continuity management systems – requirements. International Organization for Standardization, Geneva, 2019.
By Rebecca Wolfrom, Methods Compliance Project Manager.
