Need this by 9/30/2022 APA Style

Pinkdiva

CoopforSmallerCBOsFINAL-1.pdf

Home >Biology homework help >Need this by 9/30/2022 APA Style

COOP for Smaller CBOs Continuity of Operations

COOP for Smaller CBOs

Toolkit Continuity of Operations for Smaller Community-based Organizations

Recognize the difference between what is urgent today

and what is important for tomorrow.

Don’t be tempted to underestimate the risk by thinking

“It probably won’t happen to me.”

The purpose of this Toolkit is to introduce community-based organizations to a planning

process that will help them to survive disasters and quickly resume their services to the

community.

This material was assembled by Volunteer Florida and is available upon request

in Braille, audiotape, large print, and on computer disk. Please call 850-921-

9172 voice/tty for alternative formats.

Table of Contents

COOP for Smaller Community-Based Organizations 5

Community-based Organizations………………………………………… 5

The COOP for CBOs Toolkit 5

What, exactly, is a COOP?………………………………………………... 6

Tips for Developing a COOP 6

Basic Terminology………………………………………………………... 7

Four Phases of Emergency Management 7

The Planning Process……………………………………………………… 8

The Continuity of Operations Plan 9

Essential Elements of a COOP……………………………………………………. 9

1. Mission Essential Functions 10

2. Current Resources and Capabilities…………………………………... 10

3. Hazards, Risk and Vulnerability 11

4. Direction and Control…………………………………………………... 12

5. Authority and Succession 12

6. Logistics and Administration…………………………………………... 12

7. Security 13

8. Communications………………………………………………………… 13

9. Facilities and Equipment 13

10. Vital Records and Databases…………………………………………. 14

11. People 14

12. Supplies, Products and Services……………………………………… 16

13. Insurance 16

14. Community Relations…………………………………………………. 16

Implementing your COOP 17

Training and Exercise……………………………………………………... 17

Response and Recovery: Activating Your COOP 17

Emergency Protective Actions…………………………………………….. 17

Implement the Recovery Plan 18

Mitigation…………………………………………………………………… 18

Additional Resources 19

Table of Forms, Checklists and Charts……………………………………………... 23

COOP for Smaller Community-based Organizations

Community-based Organizations

Community-based, nonprofit organizations (CBOs) are a vital part of any community. They

provide services that enhance the quality of life and contribute to the economic vitality of the

community. When a CBO loses its capacity to serve due to a major disaster or even an

unforeseen internal event, the loss is felt not only by the clients it once helped but also by the

community as a whole.

Since 1998 federal government agencies have been required to maintain Continuity of

Operations Plans (COOP) to ensure their continued viability in the event of a natural or

human caused event threatening our safety and security. Federal and state COOP

requirements, however, do not extend to large nonprofits and CBOs, which make up more

than half of all the organizations that provide services in disasters.

In the aftermath of each storm of the 2004 and 2005 hurricane seasons, CBOs vital to the

recovery process were among the casualties. Some never re-opened.

Because we are just as dependent on CBOs as on government agencies in a post-disaster

environment, it is critical to make Continuity of Operations planning a routine part of doing

business. Every organization, regardless of its size, is vulnerable to a variety of hazards. The

survival of each organization and its capacity to serve is the responsibility of the organization

itself.

The COOP for CBOs Toolkit

This Toolkit is designed to help COOP planners to:

• Know the difference between hazards, risk and vulnerability

• Understand the purpose and content of the Continuity of Operations planning process

• Know the essential elements of a COOP

• Be able to apply COOP principles to their own unique organizations

The narrative portion of this Toolkit is intended to explain the planning process and the

essential elements of a COOP and to instill a sense of urgency in organizations whose services

are critical to recovery from disasters. The worksheets, charts and checklists, many

referenced in the text, will help planners to easily gather and record information and identify

specific areas where additional planning is needed.

This Toolkit is a condensed version of COOP for CBOs. If your organization has more than

30 employees, manages multiple sites or operates several programs for different clients or

consumers, you might find yourself asking, “Well, what about…?” If this version seems to be

insufficient for your needs, please refer to the original COOP for CBOs available at

www.volunteerflorida.org.

What, exactly, is a COOP?

A Continuity of Operations Plan is a tool that will help you persevere in the face of disaster.

It is both a process and a document that will enable you to strengthen your organization.

The COOP process requires careful consideration of these questions:

• What/who are we?

• What could constitute a disaster or emergency for our organization?

• What are our vulnerabilities?

• What can we do to survive?

• Are we flexible enough to redefine our organization’s purposes and processes?

Your COOP document will become:

• A record of your responses to these questions; and

• A set of actions to take before, during and after a disaster to ensure that your

organization can accomplish its essential functions.

Tips for Developing a COOP

A University of Wisconsin 1 study has shown that attitude, adaptability and flexibility are

fundamental requirements for organizational survival. Your COOP will help your

organization survive if you keep in mind that:

• The plan is for the continuance of your operation, not merely a plan for physical

facilities. Traditional structural precautions are necessary to reduce losses to life and

property, but are not sufficient to insure organizational survival.

• Most losses do not occur during or immediately after an event. Agency losses go

beyond initial damage to include business interruption and lost funding, which leads to

loss of employees and other organizational assets.

• Meeting client and consumer needs is the purpose of your organization. Those needs

often drastically change in the wake of a disaster.

• Survivors are flexible, innovative entrepreneurs. Returning to business as usual might

not be the best goal. Survivors often come up with an alternate strategy, such as

moving to a new location, changing their business processes or even changing their

products or services.

The process of developing a COOP will be a satisfying experience, as your organization

systematically plans to ensure that you’ll be there to help when the community needs you

most.

1 Organizations At Risk: What Happens When Small Businesses and Not-For-Profits Encounter Natural

Disasters, University of Wisconsin-Green Bay Center for Organizational Studies, 2001

Basic Terminology

What is an incident or emergency?

An emergency is any unplanned occurrence that can cause deaths or significant injuries to

employees, customers or the public; or that can shut down your organization, disrupt

operations, cause physical or environmental damage, or threaten the organization’s public

image or financial standing.

What is a disaster?

An emergency is generally considered a disaster if its impacts are so devastating that they are

beyond the capacity of the local community to manage them and additional resources are

needed from outside the impacted area. However, to a small community-based organization,

a structure fire, damaged computer network or the loss of a key manager can have disastrous

effects.

What is emergency management?

Emergency management is the combined actions taken before, during and after an incident to

save lives, protect property and preserve or resume the normal life of a community.

Who is an emergency manager?

You! Every individual has a responsibility to take actions that will minimize the impacts of

disasters on themselves, their families and their places of work. It is individuals, in concert

with local, state and federal government and non-governmental organizations, who will create

the “Culture of Preparedness” 2 that will make this nation and its communities more disaster

resistant and resilient. Developing your Continuity of Operations Plan is an important step

toward that goal.

Four Phases of Emergency Management

The work of managing disasters is done in phases. Every disaster has four phases –

preparedness, mitigation, response and recovery. It is common for an organization or a

community to be in the recovery phase of one disaster and the preparedness phase of another.

• Preparedness – The process of getting ready to withstand the impacts of a disaster and

to implement the other three phases of emergency management

• Mitigation – Preventive measures taken to reduce the risk of experiencing an

emergency, and to reduce vulnerability and minimize damage.

• Response – That part of the emergency management cycle that occurs immediately

before, during, and immediately after an emergency incident. Response is not merely

2 The Federal Response to Hurricane Katrina: Lessons Learned. http://www.whitehouse.gov/reports/katrina-

lessons-learned/chapter6.html

a reaction; it is a planned set of operations designed to manage and control, to the

extent possible, the event and its consequences.

• Recovery – Consists of restoring the physical and operational elements of an

organization to their pre-disaster state. It may include modified, improved or

alternative solutions.

Continuity of Operations Plans focus on preparedness and mitigation strategies to reduce the

need for response and recovery measures.

The Planning Process

The broadest possible participation in the planning process will help to ensure the buy-in of

employees at all levels and in all departments of your organization. Assemble a COOP

planning team that includes someone from each level and each department, and assign one

person to lead the team. Make sure the team knows it has the support of top management. If

your organization is a two or three-person operation, you are not “excused” from developing a

COOP for lack of a team. It simply means that your “team” has already been assembled and

that a few of the planning steps described in this Toolkit might not apply to your organization.

Prior to writing the plan, baseline information from all operational areas of the organization

should be assembled. Gather current emergency plans and policies, building plans and site

maps. Other baseline information could include: resource lists (equipment, supplies,

services), hazardous materials (including cleaning supplies and chemicals), mutual aid

agreements, security procedures, evacuation plans, information technology inventories and

procedures, employee and volunteer manuals, record retention procedures, organization charts

and delegations of authority.

Codes and regulations affecting the organization’s operations must also be identified. A

general example is the Occupational Safety and Health Administration (OSHA) regulations

that apply to all. Specific examples are the safe food-handling regulations that apply to CBOs

such as soup kitchens and Meals on Wheels, and the confidentiality requirements of agencies

making and receiving client referrals.

The steps in writing the plan are similar to most general planning processes and include the

following:

• Establish goals

• Collect data

• Determine hazards, risks and vulnerabilities of your organization

• Analyze current capabilities

• Prepare first draft

• Review by staff, board of directors and external stakeholders

• Incorporate changes, prepare final draft

• Final review by organization’s board of directors

• Officially accept and adopt as company policy

• Print and distribute

• Train, exercise and regularly update

The Continuity of Operations Plan

The Continuity of Operations Plan should contain:

• The purpose of the plan

• Key staff names and contact information

• The organization’s mission essential functions

• Methods of alert and notification of staff

• Description of alternate operations

• Standard Operating Procedures, such as, but not limited to:

o Activation procedures

o Management and staff notification procedures and lists

o Building evacuation plan

o Customer and supplier notification plans

o Alternate facilities plans

o Site support procedures

o Resource acquisition plans

o Plans for protection of vital records and databases

o Alternate communications plans

o Facility disaster supply kit and Go Box checklists

o Family preparedness guidance

Essential Elements of a COOP

A Continuity of Operations Plan follows a generally accepted planning process, but contains

certain components and elements that are essential for the plan to be a useful disaster planning

tool. The essential elements that will be found in a comprehensive Continuity of Operations

Plan include:

1. Mission Essential Functions

2. Current Resources and Capabilities

3. Hazard Identification, Risk Assessment and Vulnerability

4. Direction and Control

5. Authority and Succession

6. Logistics and Administration

7. Security

8. Communication

9. Facilities and Equipment

10. Vital Records / Information Technology

11. People

12. Supplies, Products and Services

13. Insurance

14. Community Interface

1. Mission Essential Functions

Development of the COOP begins with identification of your organization’s mission essential

functions. Mission essential functions are critical activities that are vital to the survival of the

organization and the accomplishment of its mission. These functions must be performed or

the organization ceases to operate. In identifying mission essential functions, consider both

normal day-to-day operations and the organization’s responsibilities during a disaster. 3

To determine how critical a function is, consider the following points.

• Would the function increase, decrease, remain the same or terminate during an

emergency?

• Would elimination or curtailment restrict the organization’s ability to deliver its

product or services?

• Be especially cautious with functions for which performance depends on a single

resource or activity.

• Determine the organizational unit responsible for each function.

• Identify organizational, product and service linkages to each essential function.

• Identify the human and other resources necessary to keep the function operational.

The next step is to prioritize the functions you have determined to be essential to your

organization. Those dealing with life or safety issues must be addressed first, followed by

other functions without which the organization will cease to operate.

2. Current Resources and Capabilities

This essential element enables an organization to understand where it is now, and, in the event

of an emergency, what capabilities and resources need to be developed in order to accomplish

its essential missions.

• Analyze capabilities

• Inventory resources

• Examine organization charts and personnel assignments

• Evaluate lines of authority

• Review internal plans and policies

• Analyze lines of communication

• Determine weaknesses

3 See Chart p. 100

3. Hazards, Risk and Vulnerability

The terms hazard, risk and vulnerability are similar but the distinctions between them are

important to the Continuity of Operations planning process.

Hazards are the potential incidents that could have a negative impact on you, your

organization or your community.

Risk is the probability or likelihood that a particular hazard will impact your organization,

either directly or indirectly.

Vulnerability is the potential impact of an incident on your organization.

Hazards can be categorized as:

• Natural – including severe weather, flooding, heat and drought, wildfire, sinkholes and

seismic events, agricultural diseases and pests, and human disease epidemic

• Human caused – including structure fire and hazardous materials spills

• Technological – including disruption of utility, information and communications

systems, and environmental health threats

• Criminal and terrorism – including bomb threats, building explosion, suspicious letters

and parcels, chemical and biological weapons, cyber attacks, civil unrest, robbery and

theft

• Other hazards – such as violence in the workplace

This is not a comprehensive list and there might be hazards unique to your agency or location

that will require special planning.

Vulnerability is frequently divided into three principal categories:

• Impact on humans: your employees, customers and clients. Liability and damage to

your reputation are also related to impact on humans.

• Impact on property: facilities and equipment, supplies, stock and product, and such

intangibles as your client lists, databases and other vital proprietary information.

• Impact on your operations: How vulnerable are you if your employees are unable to

report to work, there is an interruption in critical supplies, the transportation system is

disrupted, or utilities are unavailable?

After assessing risks and vulnerabilities 4 , it is important to assess your resources and ability to

respond to each threat. Do you have the internal resources and capabilities to respond? Are

there external resources are available to help you? Can you establish mutual aid agreements?

If the answers to these questions are ‘No,’ you must then determine what can be done to

prepare your organization to respond.

Once the hazards and your organization’s risk and vulnerability are determined, consider who

has the expertise to help with your planning. If there are hazards for which you do not know

how to prepare, contact your local emergency management agency, which can refer you to a

person, agency or department with the needed expertise.

4 See Chart, p. 25

4. Direction and Control

This element of the COOP addresses the question of who will direct the operations outlined in

your Continuity of Operations Plan. Someone must be in charge during an emergency. In

very small organizations the day-to-day leadership will probably remain in charge. However,

because emergency procedures may differ dramatically from normal day-to-day operations,

the person with primary responsibility for COOP planning or an individual with personal

experience in emergencies may be designated to take charge.

5. Authority and Succession

After an incident has occurred, it is too late to determine who has the authority to do what.

Authority, delegation of authority and lines of succession should be part of a normal course of

business and are essential elements of a Continuity of Operations Plan since roles and

responsibilities will often differ during an emergency.

At a minimum, delegations of authority and orders of succession should:

• Describe which authorities should be delegated and to whom (e.g., the authority to

dismiss staff)

• Describe the circumstances under which the temporary authorities would be exercised

(e.g., worksite is unsafe)

• Describe the circumstances under which normal authority would be resumed

• Identify limitations of the temporary authorities (i.e., maximum spending limit,

doesn’t permit permanent changes to organizational structure or staffing)

• Specify additional levels of succession for key staff

• Ensure the recipient of authority has the knowledge, experience and tools to manage it

6. Logistics and Administration

A plan must also be developed for the continuation of logistical and administrative functions.

Logistical:

• Identify, pre-position and maintain equipment, supplies, services and other resources

on-site and/or at off-site locations.

• Identify and arrange for the acquisition of additional equipment, supplies, services and

other resources as needed from outside sources

• Prepare and pre-position Go-Boxes

• Provide for telecommunication and information technology support on-site and at any

alternate facilities

• Provide for personnel support, including food, lodging and transportation at all

probable locations (Remember, employees may not be able to leave the work site.)

• Provide for backup electrical power

Administrative:

• Ensure continuation of critical personnel functions

• Pre-arrange alternate procedures and/or supplier of financial services, especially

purchasing and payroll

• Prepare generic messaging to suppliers and partner organizations for use until specific

information about the organization’s status is available for dissemination.

• Ensure continued complete and accurate record keeping to meet legal, insurance and

other requirements.

7. Security

The security needs of community-based organizations will vary with the size and mission of

the organization. All will need to address the security of and access to their regular and

alternate facilities. Cyber security is a concern for even the smallest of CBOs. An

organization whose mission involves the protection of clients, such as a refuge for battered

women, must also plan for operational security, including measures to deny access to

information that might jeopardize client or staff safety.

8. Communications

The communications element of the plan should examine what methods and equipment will

be needed to report emergencies, warn personnel and customers of danger, keep in contact

with customers and suppliers, keep employees and families informed and coordinate response

and recovery actions, keeping in mind that normal communications could be disrupted in

many ways. The ability to communicate at both existing and alternate facilities must be

developed. Redundancy of communication methods is vital. The COOP should identify the

data and communications systems needed to support mission essential functions, including the

functions of additional, emergency-only missions. Systems could include:

• Voice and fax

• Cellular

• Satellite

• Internet and email

• Data systems

• Secure communications, if necessary

9. Facilities and Equipment

Procedures for protecting facilities and equipment are essential to timely restoration of

operations. The first step in this process is a physical inventory of all property. For planning

purposes many items can be grouped if they warrant similar protective action, e.g., moving

vehicles to a safe location. Examples of other procedures include:

• Fighting a structure fire

• Containing a hazardous material spill

• Shutting down utilities

• Shutting down equipment

• Closing and/or covering doors and windows

• Covering and/or securing equipment and supplies

• Moving equipment to a safe location

The plan should also determine the need for pre-installed protective systems such as:

• Fire protection systems, including monitoring, warning and extinguishing

• Lightning protection

• Emergency power

• Security systems

The COOP should identify an alternate site in case your facility becomes unusable or

inaccessible for an extended period of time.

10. Vital Records and Databases

The COOP should provide for the protection and availability of electronic and hardcopy (as

applicable) mission essential records, documents, references, information systems and

databases. These records might include financial, personnel, project and client records,

corporate and legal records, service contracts and mutual aid agreements. 5

11. People

One element of the plan should specifically address the needs of people. The safety of all

persons occupying a facility at the onset of an incident is paramount. The plan should provide

for:

• A warning system that is viewable/audible by all people in the facility, has a backup

power supply and is tested regularly.

• Evacuation plans that include routing and assembly, operational shutdown and re-

entry procedures. 6

• Shelter-in-place procedures that include identification of secure space and necessary

supplies, equipment, food and water.

Survival of an organization during and after an emergency will depend as much as anything

on the survival and well-being of its personnel. The plan should provide a way for an agency

leader to contact employees and vice versa:

• Establish call down lists or telephone trees 7

• Inform employees how and when to check in or retrieve instructions via outgoing

phone message, private webpage access, or other

Equally important, employees who remain at the facility will need to know if their families

are safe (or they will probably leave). All employees should be encouraged to consider how

they would communicate with their families if they were separated from one another. In

addition to direct contact, they can arrange to communicate through a third party who lives

out of the area.

5 See Worksheets and checklists pp. 37-54

6 See Checklists pp. 55-56

7 See Example p. 34

Payroll is an extremely important issue to employees. Plans and backup plans need to be

developed to ensure that employees can be paid. If the emergency is widespread, employees

may need flexibility and support from management in order to take care of added personal

responsibilities. Could work-at-home, reduced hours or flexible hours be made available?

Would it be possible to help employees make repairs to personal property by maintaining

their normal pay for any length of time?

An emergency can create enormous amounts of stress as a result of conditions at the

organization and because of conditions at home. Training your organization’s managers to

recognize and deal with stress is a valuable investment. The return to normal operations will

be enhanced if stress is acknowledged as one of the impediments to recovery.

Employee Family Preparedness

Employees will be extremely concerned about their own personal safety, that of their families

and their homes during an emergency. If they have no plan to deal with the personal impacts

of the emergency, it is unlikely they will be able to be of much assistance in the

organization’s response to events.

Employees should be encouraged to create their own emergency preparedness plans. At a

minimum the plan should address the following issues:

• Advance arrangements for property and contents protection

• Food, water, supply and medicine cache

• Alternate shelter options in the event of evacuation

• Evacuation plans and checklists

• Family communication procedures

• Knowledge of flood zones, evacuation zones, geographic conditions

• Dependent care

• Medical/dental: Medical records, prescriptions and supplies, location of

emergency service providers

• Cash and other resources

• Pet care

• Transportation and fuel

There are numerous sources of guidance for the preparation of a family preparedness plan 8 ,

particularly the American Red Cross, Florida Division of Emergency Management and the

Federal Emergency Management Agency.

8 See Template p. 57

12. Supplies, Products and Services

The core of your operation is the delivery of a product or a service. To produce a product or

service you must obtain supplies and services. If this chain of activity is interrupted, your

operation is also interrupted, or even shut down. This essential element of your plan should

address how to maintain your supply of goods and services, how to protect your existing

inventory of supplies and products and how to continue to deliver your service to your

customers.

13. Insurance

Insurance provides the financial means to recover from disasters. Your best source for

information will be your insurance agent. The Insurance Coverage Discussion Form 9 is a

useful tool to help you get started. Your board of directors should review current insurance

policies and consider the following types of insurance as you develop your Continuity of

Operations Plan.

• Property

• Liability

• Flood

• Commercial Automobile

• Worker’s Compensation

• Errors & Omissions

• Umbrella

14. Community Relations

Your organization is part of a broader community. Your relationship with the community will

influence the success of your current operation as well as your ability to protect personnel and

property and return to normal operations after an emergency.

• Maintain a dialogue with community leaders, first responders, government agencies,

community organizations and utilities.

• Establish mutual aid agreements with local response agencies.

• Look for opportunities to provide community service: sheltering, personnel,

equipment, transportation, and product.

• Have a public information plan in place to keep suppliers, customers, shareholders,

neighbors, emergency organizations, regulatory agencies, the media and the general

public apprised of your operations.

9 See Form p. 27

Implementing your COOP

Training and Exercise

A written COOP is just a starting point. In order to implement the Continuity of Operations

Plan, you must train your personnel on any new procedures and integrate the procedures into

everyday operations. Your newly developed procedures for backing up your client database,

for example, and making it accessible from your alternate site are worthless unless your

system administrator is trained on and follows the new procedures regularly.

Testing and exercising employees’ skills, especially on new procedures, is vital to a smooth

activation in the event of a disaster. 10

Testing helps to develop expertise and exercises allow

you to test staff skills and evaluate the plan itself. One simple but effective example is called

a Tabletop Exercise. Simply write a short scenario based on one of the hazards on your list.

Staff members seated around a table will review the likely impacts of the disaster and “talk

through” an activation of your COOP, discussing the protective actions they will take. If any

elements of your COOP need to be revised, it will usually become evident through this

process.

Response and Recovery: Activating Your COOP

When your organization receives notification of a pending event, such as a hurricane or

expected flooding, organization leaders will have time to assess the situation. They will

consider the need to launch the plan, develop a schedule and notify staff and other

stakeholders as needed, using the notification procedures established in the COOP. When an

unexpected, sudden event occurs, such as a fire or explosion, some elements of the planned

response (e.g., evacuation) will be carried out automatically.

Emergency Protective Actions

The protection of employees and visitors becomes the first priority. Depending on the nature

of the incident, the decision whether to shelter in place or to evacuate must be made as rapidly

as possible, in some cases immediately. Immediately account for all occupants of the facility

and assess their status. Call 9-1-1, if needed.

The shutdown of normal operations should be quickly decided and initiated if necessary.

Building and equipment protective measures should be started, such as:

• Securing/covering/evacuating equipment

• Utility cutoffs

• Covering windows and doors

• Sandbagging

See Chart p. 26

In accordance with the plan and as appropriate to the specific emergency, the other functional

elements of the plan should be initiated using checklists, procedures and guidelines plan.

Implement the Recovery Plan

The emergency has passed. The Continuity of Operations Plan has been activated. Your

people have been taken care of and the facility has been secured against further damage. It is

now time to take the steps necessary to minimize any interruption in business and restore the

organization to full operational capability.

Recovery activities are defined in the Continuity of Operations Plan and should be initiated

using the checklists, procedures and guidelines in the plan. Initial recovery activities include:

• Temporary repairs to facilities and equipment

• Clean up

• Taking measures necessary to assure the safety of building occupants

• Restoring utility service

• Implementing new security procedures

• Quantitative physical damage assessment

• Photographing and/or videotaping facility for documentation of damage

• Determining need to move to an alternate location

• Considering need to contract for post-emergency services, supplies or equipment

• Meeting with insurance agent and claims adjusters

• Analyzing damage to agency operations

• Restoring essential agency functions

• Contacting suppliers and customers

• Keeping accurate records of emergency activities and expenditures

Mitigation

While the other three phases of emergency management address how to prepare for, respond

to or recover from an emergency or disaster, mitigation is concerned with minimizing or

avoiding hazards and their consequences in the first place. Mitigation is a prevention

strategy. It consists of preventive measures taken to eliminate or reduce the risk of

experiencing an emergency, decrease vulnerability and minimize potential damage and other

adverse consequences. Mitigation actions are those steps that you can take now to short-

circuit an emergency before it occurs.

To find proven strategies and practical ideas for disaster mitigation, please visit the Federal

Emergency Management Agency (FEMA) website at http://www.fema.gov/hazards/.

Additional Resources

Literature / Source material for this Guide

Continuity of Operations: Elements of Viability, Introduction to Continuity of Operations

(COOP) and Continuity of Government (COG), Course Participant Workbook

Karen C. Delimater

Florida Division of Emergency Management

Emergency Management Guide for Business & Industry: A Step-By-Step Approach to

Emergency Planning, Response and Recovery for Companies of All Sizes

Federal Emergency Management Agency, 1993

Emergency Preparedness Information (CD)

Ocala-Marion County Economic Development Corporation and the Institute for

Business and Home Safety, 2001

Florida Business Disaster Survival Kit, Business Continuity Planning in Today’s World

Tampa Bay Regional Planning Council and the Business Continuity Planning Alliance

in association with the State of Florida Division of Emergency Management and the

Florida Regional Planning Councils, 2003

Florida Business Disaster Survival Kit, Business Continuity Planning in Today’s World (CD)

Tampa Bay Regional Planning Council and the Business Continuity Planning Alliance

in association with the State of Florida Division of Emergency Management and the

Florida Regional Planning Councils, 2003

Open for Business, A Disaster Toolkit for the Small Business Owner

Institute for Business & Home Safety, 1999

Organizations At Risk: What Happens When Small Businesses and Not-For-Profits Encounter

Natural Disasters

David J. Alesch, James N. Holly, Elliott Mittler and Robert Nagy

University of Wisconsin-Green Bay Center for Organizational Studies, 2001

Additional Literature

Business Emergency Action Plan, Edmond D. Jones, MBCP,

Rothstein Associates, Inc., 2001

Business Threat and Risk Assessment Checklist, Edmond D. Jones, MBCP,

Rothstein Associates, Inc., 2001

Continuity Planning and Disaster Recovery: A Small Business Guide

Donna R. Childs & Stefan Dietrich, 2002

Disaster Mitigation Guide for Business and Industry (FEMA 190)

Federal Emergency Management Agency

Emergency and Disaster Planning Manual, Laura G. Kaplan, 1996

NFPA 232: Standard for the Protection of Records, National Fire Protection

Association, 2000

NFPA 1600: Standard Disaster Emergency Management And Business

Continuity Programs, National Fire Protection Association, 2000

Unforeseen Circumstances: Strategies & Technologies for Protecting

Your Business & Your People in a Less Secure World, Alexis D. Gutzman, 2002

Organizations

Association of Contingency Planners International

7044 South 13 th

Street

Oak Creek, WI 53154

1-800-445-4227

http://acp-international.com/

Department of Commerce

Economic Development Administration

Herbert C. Hoover Building

Washington, DC 20230

202-482-2659

http://12.39.209.165/xp/EDAPublic/Home/EDAHomePage.xml

Federal Emergency Management Agency

500 C Street, S.W.

Washington, D.C. 20472

1-800-480-2520

www.fema.gov

Florida Division of Emergency Management

2555 Shumard Oak Boulevard

Tallahassee, Florida 32399-2100

850-413-9900

http://www.dca.state.fl.us/fdem/

http://floridadisaster.org/

Florida Insurance Council

Post Office Box 13686

Tallahassee, Florida 32317

850-386-6668

http://www.flains.org/

Institute for Business & Home Safety

1408 North Westshore Boulevard, Suite 208

Tampa, Florida 33607

1-800-657-4247

www.ibhs.org

Insurance Information Institute

110 Williams Street

New York, New York 10038

212-346-550

http://www.iii.org

National Fire Protection Association

1 Batterymarch Park

Quincy, Massachusetts 02169-7471

617-770-3000

http://www.nfpa.org/catalog/home/index.asp

http://nfpa.gcnpublishing.com/

Ocala-Marion County Economic Development Corporation

Post Office Box 459

Ocala, Florida 34478-0459

352-629-2757

www.ocalaedc.org

Tampa Bay Regional Planning Council

9455 Koger Boulevard, Suite 219

St. Petersburg, Florida 33702

727-570-5151

US Department of Agriculture

Farm Service Agency

1400 Independence Ave., S.W.

Washington, DC 20250-0506

Telephone: (202) 720-1632

http://www.fsa.usda.gov/

US Small Business Administration

409 Third Street, SW

Washington, D.C. 20416

202-205-6734

www.sba.gov

Web Sites

Institute for Business & Home Safety www.ibhs.org

Federal Alliance for Safe Homes (FLASH) www.flash.org

Florida Emergency Preparedness Association www.fepa.org

Florida Small Business Development Center http://www.floridasbdc.com/

Florida Insurance Council http://www.flains.org/

Department of Homeland Security www.dhs.gov/dhspublic/

Federal Emergency Management Agency www.fema.gov

US Fire Administration www.usfa.fema.gov

Small Business Administration www.sba.gov

Florida Division of Emergency Management http://www.floridadisaster.org/

American Red Cross www.redcross.org

Salvation Army www.salvationarmy.org

National Hurricane Center www.nhc.noaa.gov

National Oceanic and Atmospheric Administration www.noaa.gov

National Weather Service www.nws.noaa.gov

Table of Forms, Checklists and Charts

Page

Vulnerability Analysis Chart 25

Training, Drills and Exercise Chart…………………………………………………….. 26

Insurance Coverage Discussion Form 27

Creditor Contact Information……………………………………………………………. 28

Supplier Contact Information 29

Key Customer Information……………………………………………………………….. 31

Emergency Contact List 33

Emergency Call Down Procedures……………………………………………………… 34

Facility Disaster Supplies Kit 35

The Evacuation “Go Box”……………………………………………………………… 36

Computer Hardware Inventory 37

Computer Software Inventory……………………………………………………………. 39

Computer Peripheral Inventory 41

Cyber Security Checklist………………………………………………………………….. 43

Cyber Security Threat Assessment 44

Vital Information Management………………………………………………………….. 49

Protection of Data – Backups, Software and Policies 52

Emergency Evacuation Procedures…………………………………………………….. 55

Shelter In Place Procedures 56

Employee Family Disaster Plan…………………………………………………………. 57

What to Do Before, During and after a Hurricane 61

Flood Safety Checklist……………………………………………………………………. 68

Tornado Safety Checklist 69

Lightning Safety Checklist……………………………………………………………….. 70

Wildfire Safety Checklist 71

Sinkhole Action Checklist………………………………………………………………… 72

Extreme Heat Safety Checklist 74

Water Conservation Checklist…………………………………………………………… 76

Winter Storm Safety Checklist 79

Steps to Protect Your Farm From Terrorism………………………………………….. 80

What to Do During and After a Hazardous Material Incident 82

Fire Safety Checklist………………………………………………………………………. 84

Tips for Fire Prevention for Small Business 87

Power Service Disruption Checklist…………………………………………………… 89

Bomb Threat Procedures 91

Checklist to Prepare and Respond to a Chemical/ Biological Attack………………. 94

Handling Suspicious Parcels and Letters 96

Radiological Emergency Safety Checklist…………………………………………….. 97

Radiological Emergency: Immediate Precautions In Case of a Terrorist Attack 98

Prevention and Response to Workplace Violence…………………………………… 99

Mission Essential Function Survey 100

Critical Incident Stress Information Sheets…………………………………………… 101

Florida Statutes Regarding Volunteers 103

Checklist for a Memorandum of Understanding……………………………………… 105

Source: Federal Emergency Management

Vulnerability Analysis Chart

Hazard Probability Human Impact

Property Impact

Business Impact

Internal Resources

External Resources Total

High – Low 5  1

High Impact 5   1 Low Impact Week 5  1 Strong Resources Resources

• When rating the Human, Property and Business Impacts, keep in mind your Mission Essential Functions. • Hazards with higher scores require priority planning.

Training, Drills and Exercises Chart

J a

n u

a ry

F e

b ru

a ry

M a

rc h

A p

ri l

M a

J u

n e

J u

A u

g u

s t

S e

p te

m b

e r

O c

to b

e r

N o

v e

m b

e r

D e

c e

m b

e r

MANAGEMENT

ORIENTATION/REVIEW

EMPLOYEE

ORIENTATION /REVIEW

CONTRACTOR

ORIENTATION /REVIEW

COMMUNITY/MEDIA

ORIENTATION /REVIEW

MANAGEMENT

TABLETOP EXERCISE

RESPONSE TEAM

TABLETOP EXERCISE

WALK-THROUGH

DRILL

FUNCTIONAL

DRILL

EVACUATION

DRILL

FULL-SCALE

EXERCISE

Open for Business Worksheet Insurance Coverage Discussion Form

Use this form to discuss your insurance coverage with your agent. Having adequate coverage now will help you recover more rapidly from a catastrophe.

Insurance Agent:

Address:

Phone: Fax: Email:

INSURANCE POLICY INFORMATION

Type of Insurance Policy No. Deductibles Policy limits Coverage (General Description)

Do you need Flood Insurance? Yes No

Do you need Earthquake Insurance? Yes No

Do you need Business Income and Extra Expense Insurance? Yes No

Other disaster-related insurance questions.

Source: Institute for Business & Home Safety

Open for Business Worksheet

Creditor Contact Information

Use this form to keep a list of the major creditors you need to contact in the event of a disaster. Make additional copies as needed.

Keep one copy of this list in a secure place on your premises and another in an off site location,

CREDITORS

Bank Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Bank Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Source: Institute for Business & Home Safety

29Source: Institute for Business and Home Safety 29

Open for Business Worksheet Supplier Contact Information

Use this form to: 1, Keep a list of the major suppliers you need to contact in the event of a disaster, and 2. Know what their disaster plans are in the event that they experience a disaster.

Make additional copies as needed. Keep one copy of this list in a secure place on your premises and another in an off-site location.

SUPPLIERS

1.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If this company experiences a disaster, we will obtain supplies/materials from the following:

1a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

2.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If this company experiences a disaster, we will obtain supplies/materials from the following:

2a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

30Source: Institute for Business and Home Safety 30

3.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If this company experiences a disaster, we will obtain supplies/materials from the following:

3a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

4.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If this company experiences a disaster, we will obtain supplies/materials from the following:

4a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Source: Institute for Business and Home Safety 31

Open for Business Worksheet Key Customer Information

Use this form to: 1, Keep a list of key customers you need to contact in the event of a disaster, and 2. Know where these customers can obtain alternative resources until you reopen.

Make additional copies as needed. Keep one copy of this list in a secure place on your premises and another in an off-site location.

Customers

1.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If my company experiences a disaster, my customers will obtain supplies/materials from the following:

1a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

2.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If my company experiences a disaster, my customers will obtain supplies/materials from the following:

2a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Source: Institute for Business and Home Safety 32

3.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If my company experiences a disaster, my customers will obtain supplies/materials from the following:

3a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

4.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Materials/Service Provided:

If my company experiences a disaster, my customers will obtain supplies/materials from the following:

4a.Company Name:

Street Address:

City State Zip Code

Phone: Fax: E-mail:

Contact Name: Account Number:

Source: Institute for Business and Home Safety 33

Open for Business Worksheet Emergency Contact List

Keep this emergency contract list available for you and your employees in the event of an emergency.

Attach a list of employee emergency contact numbers to this list.

Local Police Department:

Local Fire Department:

Ambulance Service:

Hospital:

Insurance Company:

Agent:

Policy Number:

Telephone Company:

Gas/Heat Company:

Electric Company:

Building Manager:

Building Security:

Local Small Business Administration Office:

Federal Emergency Management Agency Regional Office:

Local Newspaper:

Local Radio station:

Local Televisions Stations:

Source: Institute for Business & Home Safety:

Source: Tampa Bay Regional Planning Council 34

Emergency Call-Down Procedures (Cascade System)

CEO XXX-XXXX

Supervisor XXX-XXXX

Field Foreman XXX-XXXX

Technician XXX-XXXX

Field Foreman XXX-XXXX

Facility Disaster Supplies Kit

One of the most important tools for emergency preparedness is the Disaster Supplies Kit. Below are the most important items for your kit at home. At the office, the amount of food and water should reflect what is necessary for a minimum of three days. Stock up today and store in a water-resistant container. Replenish as necessary, especially at the beginning of hurricane season June 1.

 Two weeks supply of prescription medicines

 Two weeks supply of non-perishable/special dietary foods

 Drinking Water/containers -1 gallon per person/per day (minimum 3 days)

 Flashlights and batteries for each employee

 Portable radio and batteries

 First aid book and kit including bandages, antiseptic, tape/ compresses, aspirin and aspirin pain reliever, anti-diarrhea medication, antacid, Syrup of Ipecac (used to promote vomiting if advised by the Poison Control Center)

 Mosquito repellant & citronella candles

 Fire extinguisher (small canister, ABC type)

 Instant tire sealer

 Whistle and/or distress flag

 Two coolers (one to keep food; one to go get ice)

 Plastic tarp, screening, tools and nails, etc.

 Water purification kit (tablets, chlorine (plain) and iodine)

 Infant necessities (medicine/ sterile water, diapers, ready formula, bottles), if needed

 Clean-up supplies (mop, buckets, towels, disinfectant)

 Camera and film

 Non-electric can opener

 Extra batteries for cameral flashlights, radio, portable TV & lamps/ etc.

 Garbage Can or bucket with tight-fitting lid (for emergency toilet)

 Plastic trash bags

 Toilet paper, paper towels and pre-moistened towelettes

If there is a chance employees would remain at the facility, also consider:  Pillows/ blankets, sleeping bags or air mattresses

 Extra clothing, shoes/ eyeglasses, etc.

 Folding chairs/ lawn chairs or cots

 Personal hygiene items (toothbrush, toothpaste, deodorant, etc.)

 Quiet games/ books, playing cards, etc.

Precious commodities before and after a disaster  Cash (With no power, banks may be closed, checks and credit cards unaccepted/ and ATMs may not be operational).

 Charcoa1, Wooden Matches and Grill

 Ice

Source: Tampa Bay Regional Planning Council

The Evacuation "Go Box"

The "Go Box" contains copies of important documents, equipment and supplies essential for the business to continue to operate. It should be stored in a fire-proof secure container in an alternate location. Below are recommended items; however each business unit should discuss and specifically designate the contents of their "Go Box".

Recommended "Go Box" contents:  Copy of emergency contact list of employees and key customers/clients  Copy of insurance policies, agent contact information  Copy of listing of emergency vendors (contractors plumbers electricians, restoration contractors

mold remediation, etc.)  Copy of Listing of vendors & suppliers (and alternates) essential for mission critical activities  Back up files! tapes or server(s) of electronic data

 Copy of essential policies, emergency procedures, Business Continuity Plans

 General Office supplies plus any special formal etc. used in your business

 Other________________________________________________________________________

 Other________________________________________________________________________  Other________________________________________________________________________  Other________________________________________________________________________  Other________________________________________________________________________  Other________________________________________________________________________

Documentation Requirements for a SBA disaster Loan:  Corporations/ Partnerships: Copy of 3 years tax returns / 1 year personal tax returns on principles

(affiliates with greater than 20% interest) / One year tax returns on affiliated business entity  Sole Proprietorships: Copy of 3 years tax returns with Schedule C

 Copy of Current Profit & Loss Statement (within 90 days)

 Copy of Listing of aged accounts receivables/ payables

 Copy of Listing of inventory

 Copy of Schedule of Liability  Copy of Balance sheet (as recent as possible)

Source: Tampa Bay Regional Planning Council

Source: Institute for Business and Home Safety 37

HARDWARE INVENTORY LIST

Source: Institute for Business and Home Safety 38

Source: Institute For Business and Home Safety 39

SOFTWARE INVENTORY LIST

Source: Institute For Business and Home Safety 40

Source: Institute for Business and Home Safety 41

Source: Institute for Business and Home Safety 42

Source: Tampa Bay Regional Planning Council 43

Source: Tampa Bay Regional Planning Council 44

IMPACT SCALE LIKELIHOOD SCALE

Source: Tampa Bay Regional Planning Council 45

Hijacked sessions and authentication session/transaction replay; data is changed or copied during transmission.

IDENTIFICATION AUTHORIZATION THREATS

Source: Tampa Bay Regional Planning Council 46

4. customers.

personnel.

cuts, etc.

little damage.

o cables.

o EMP/T

Gun).

o Theft.

Source: Tampa Bay Regional Planning Council 47

o t

Source: Tampa Bay Regional Planning Council 48

Liability for damages if an internal user attacks other sites.

Source: Ocala/Marion county Economic Development Council

The vital information that allows the office to function must have "back-ups" off-site and is divided into sections:

Financial  Copy of all bank account numbers and their balances

 Copy of all CD account numbers and balances

 Accounts Receivable information

 Employee insurance information

 Business insurance information

 All leased and company vehicles

 All equipment insurance

 Extended warranties and/or policies

 401-K Information

 Business account information

 Account numbers & company contact telephone numbers

 Telephone

 Electric (any utility your office receives service from)

 Company credit cards

 All customers

 All vendors

Contractual  Copy of any contracts between your company and another entity

 Copy of building lease

 Copy of any equipment leases

 All leased and company vehicles

 Copier

 Postage machine

 Telephones or other leased items

 Copy of City, County & any State business licenses

 Copy of original charter

 Copy of company By-laws

 Copy of Employee Handbook

 Copy of Volunteer Handbook

 Copy of any current company Strategic or Business Plan

Source: Ocala/Marion county Economic Development Council

Inventory Lists  Furniture

 Equipment

 Calculators

 Cameras

 TVs

 Video screen

 Binders

 Consumable materials

 Brochures

 Any materials purchased in large amounts

 List of personal items from each employee's office

 Computer Equipment (include serial numbers)

 Monitors

 Keyboards

 Towers

 Lap top computer

 Scanner/Copier

 Printers

For Medically Related Businesses  In addition to items listed in this outline, all necessary patient information (pertinent history, etc.)

 All pertinent information related to medical equipment

 Copies of all medical degrees earned by doctors and staff

Membership Information (This section is mostly used in "not for" and "non" profit organizations)

 Copy of current membership list

 Include all pertinent information including email address

 Copy of membership dues

 When paid, how much, any outstanding amounts, etc...

 Copies of the most recent year's information

 Progress reports, Guides, most recent brochures and printed materials.

 Most recent Quarterly Report information

 Copy of minutes from last four to six Board Meetings for history & continuity

 Minutes from any critical committees the company either hosts or attends

Source: Ocala/Marion county Economic Development Council

Community & Business Contacts Copy of names & telephone numbers of contacts from:

 Utility companies

 Telephone

 City government

 County government

 Fire Department

 Police & Sheriff Departments

 Hospitals

 Current company projects

Most items should be copied to disk or CDROM. There will be many documents not found in the computer system and standard "hard" copies should be made of them. Scanned documents are easier to store. It is also worth consideration to keep the "originals" in the bank deposit drawer and work from a copy of the document.

LOCATIONS FOR COMPANY INFORMATION SAFE-KEEPING:  Each staff member will keep a set of diskettes at their residence that pertains to their section of the

business.

 The owner or President/CEO will be the only person to have an entire set of disks, which will also be kept at his/her residence.

 One set of the disks will be sealed in an envelope and sent to an entity that the head of the company deems trustworthy, in another state, (in case of a disaster affecting the entire state).

Should there be a state disaster, the disks kept "out-of-state" could end up being the only intact set to operate the business from.

 The set sent out of state will be updated annually or semi-annually, whichever is deemed most efficient.

 The out-of-state entity holding this set will merely Fed Ex them to business at a pre-designated time, to be updated and returned back to them.

 The disks each staff member is responsible for will be updated quarterly, or as necessary.

 "Paper" copies of documents should be kept in two places

 A fireproof safe (preferably with minimum 4 hour protection) on site

 A safe deposit drawer in a local banking institution

 A separate computer tower, screen, keyboard and mouse could possibly be placed at another designated site, for use by the company if the office was rendered un-usable. The second (and probably best) option would be to keep a laptop computer at the residence of the owner, CEO, President or Office Manager for such emergencies. This enables your business to be up and running immediately, with reduced interruption.

Source: Tampa Bay Regional Planning Council per Strategic Research Corporation 52

Backups: Creating a mirror image of the intangible data onto tangible media (disk, tape, CD, etc.) provides a backup of this information. When the original data is rendered useless the backups can then be used to re-create the data. When client-host and distributive processing becomes more popular it is important to backup all workstations since they all work in a synergistic whole.

System: System backups provide a spare copy of all the information on a computer system. The operating system (Windows, NT, etc.), application software, and volatile data are all backed-up. This should be done on individual workstations as well as on host servers.

Monthly: Even if no major hardware or software changes are made, system backups should be done on a monthly basis. Some software products can dynamically make changes to pointer files and other indexes that pertain to user data, but are actually stored elsewhere on the system.

Hardware or Software Changes: When hardware changes are made they are often saved in the CMOS. Battery failure could cause the CMOS to "forget" the hardware configuration making restoration from system backups necessary. A system backup should be done just prior to any major hardware or software changes. Another separate system backup should be done just after the changes. This provides a way to return to "square one" should any problems occur.

Operating System backup of Backup Software: Some operating systems provide basic programs for making backups. However, most systems use more efficient software in addition to the basic operating system to make backups. Before restores can be done to recover information from backups the software used to make the backups to begin with needs to be put back on the computer. By using the operating system to backup the software used to make the bulk of the backups it insures that the more efficient software can be restored using the basic operating system. Once the backup software is restored it can then be used to restore the rest of the system.

Create Bootable Disk of Operating System (Windows, NT, etc.) After a damaged computer has been repaired or replaced the operating system needs to be restored. For this restoration to take place the computer needs to be powered-up or "booted" using the operating system (OS). This typically means that a disk or CD replicating the original OS needs to be used. Some Local Area Networks (LAN's) using a Network Operating System (NOS) use a Network Operating System that can be restored using disks, CD's or tapes created from more elaborate backup software packages.

Data Only: Unlike system software, which typically doesn't change often, user data changes daily. Making backup of data is like having tangible insurance in that the hours of work a computer user has done has been protected.

Daily: System backups usually only need to be done on a monthly, or at most weekly, basis. However, most non-home PC's should have their data backed up daily.

Monday - Friday: Each day of the workweek should have its own data set backup. In other words if the workweek is Monday through Friday and it takes two tapes each day to do a data backup then a total of ten tapes should be used on a rotational basis.

Weekly: In addition to the daily backup sets a separate data backup set should be done weekly. This backup is then archived in case past information needs to be retrieved.

Fridays: Weekly data backups should be kept for a period of five weeks. This assures that past information can be retrieved on a week-by-week basis for up to a month's period back.

Source: Tampa Bay Regional Planning Council per Strategic Research Corporation 53

Monthly: Separate data backup sets should also be done on a monthly basis. These backups should be kept even after data is purged from the system for later referral. Data is typically not purged for at least one year.

Archives: Monthly data backup sets should be kept until archival backups are made. Archival backups are typically made yearly and/or just prior to purging obsolete data from the computer. This insures an audit trail is maintained in case the information needs to be retrieved after it is purged.

Storage: Correct storage of backups is a necessity. Backups that have been damaged by incorrect storage may not restore.

On-site: One set of systems backups and data backups should be kept on-site at the location of the computer systems. The latest backups are usually the ones kept on-site.

Paper Fire Safes: Fire safes for protecting papers reduce the flash point of documents. This is accomplished by a cement-like material in the walls of the safe that evaporates a vapor into the safe to dampen the paper. This allows the temperature to rise to the 300 - 400+ degree range without igniting the paper. Important papers to be stored should also include software license numbers since they are often required if a software product is to be reinstalled.

Magnetic Media Fire Safes: Fire safes for tapes, disks and CD's differ from fire safes designed to protect paper. Condensing moisture can damage magnetic media, so these safes typically do not contain vapor-inducing materials. Tapes, disks, CD's and other media should be kept in safes that insulate against fire heat to keep internal temperatures below 125 degrees. Safes should not be opened for at least 24 hours after fire exposure to allow the internal temperature to stabilize gradually. It is important to keep the original installation disks and CD's for software packages should the need arise to reinstall a given program.

Off-site: At least two system and data backup sets should be kept off-site from the location of the computer systems. If a large-scale disaster occurs at the computer system location the on-site backups may be destroyed. The geographic distance needed for off-site locations depends on the anticipated threats; across town is sufficient for a building fire, for hurricanes the distance should be 30+ miles, for earthquakes it may require locating in a different area of the country.

Paper Fire Vaults: The storage space needed for paper documents can expand quickly depending on the amount of paper generated by a system. Critical papers can be kept in fire safes, but large volumes of paper may require a vault. Fire vaults are entire rooms that are protected against fire rather than individual safes.

Magnetic Media Fire Vaults: Vaults for magnetic media are also entire rooms protected against fire rather than having to go to the expense of many individual fire safes. Magnetic media fire vaults differ from paper fire vaults in that the internal temperatures should be kept lower and fire suppression systems are usually Halon or Inergen instead of water sprinklers.

Magnetic Media: Ironically, as organizations transfer documents to magnetic media, they may actually be shortening the storage life of the information. Properly stored paper can last for decades or even centuries. However, disks have a shelf life of one to two years, tapes/drives three to five years and CD's ten plus years. For irreplaceable information it is best to have paper documents to augment the magnetic media. One example is the popularity of video wills; paper wills should still be done in the event the magnetic VMS tape is no longer readable.

Restores: Backup data sets are only of use if they can be restored properly. Financial institutions are often required to test their backups and disaster recovery procedures two times a year. Some LAN

Source: Tampa Bay Regional Planning Council per Strategic Research Corporation 54

server backup products make "images" of volumes instead of using a file-by-file method; this drastically reduces the number of steps needed to recover a system.

Boot with Copy of Operating System: Computer systems need to be started with an operating system (OS) in order to function. A copy of the OS (Windows, NT, etc.) should be kept with each backup set. Other operations, such as drive partitioning, may also have to be performed prior to restoring backup data sets.

Restore Backup Software: Before a backup set can be restored the software that was used to create the backups originally must be placed back onto the computer system. Backups are usually unreadable by the native operating system and can only be read by the dedicated backup software.

Restore System Backup: After the backup software itself is loaded onto the computer system the system backup data can be restored. Once the system backups are restored the computer should then indeed be back in an operable mode.

Restore Latest Data: Although a computer system may be once again operational after restoring system backups, the data may not be current. If data-only backups were made subsequent to the system backup then they too should be restored in order to bring the information up to the most current possible state.

Hot-site: Disasters that destroy data and software can also destroy the computer hardware that runs the software. A hot-site is an alternate location that has compatible hardware and facilities available to restore software. "Cold-sites" cost less, but don't have the equipment already installed in the facility.

 Location: The location of a potential hot-site should be considered. In a hurricane or earthquake, for instance, the disaster area could be tens of miles wide. If widespread disasters are identified in a risk assessment the hot-site location should be distant enough to be unaffected by the same disaster.

 Equipment: The computer hardware and other equipment should be compatible with the original system. Other office equipment such as phone systems, fax machines, and employee workspaces should also be examined.

 How soon to utilize: One key decision to be made, particularly during a "predictable" disaster such as a hurricane, is to decide how soon to use a hot-site.

 Too-soon operating costs: It might be thought that it is never too soon to utilize a hot-site if a potential disaster, such as a hurricane, is approaching. However, there are costs involved in moving backups, equipment and personnel to a hot-site. If the disaster doesn't occur then the costs were unnecessarily incurred.

 Too-late alternate site: In an effort to save unnecessary costs the decision could be made to wait on the declaration of a disaster. However, hot-sites generally have multiple contracts with other clients that may also be declaring disasters. For this reason it is advisable to have an alternate hot- site identified in the event that the primary site is already occupied.

Internet Backup: Many companies are investigating the virtues of online data backup, a process that involves transferring backups over the Internet and storing them in secure, offsite vaults. The system mitigates the amount of work that must be done in order to transfer data to a secure location and insures that is well protected. The system provided easy access and quick retrieval, often within minutes.

Source: Tampa Bay Regional Planning Council 55

Evacuations are more common than many people realize. Hundreds of times each year, transportation and industrial accidents release harmful substances, forcing thousands of people to leave their homes. Fires and floods cause evacuations even more frequently. And almost every year, people along the Gulf and Atlantic coasts evacuate in the face of approaching hurricanes. When community evacuations become necessary, local officials provide information to the public through the media. In some circumstances other warning methods, such as sirens or telephone calls, are also used.

The amount of time you have to evacuate will depend on the disaster. If the event can be monitored, like a hurricane, you might have a day or two to get ready (See what to do before, during and after a Hurricane). However, many disasters allow no time for people to gather even the most basic necessities.

Planning for evacuation Ask your local emergency management agency about community evacuation plans. Learn evacuation levels and routes. In your planning, consider different scales of evacuations. In a hurricane, for example, thousands of coastal residents would evacuate, while much smaller area would be affected by a chemical release.

 Talk with your employees about the possibility of evacuation. Plan where you would go if you had to leave the building or the community. Ensure all employees would have transportation in the event of an emergency evacuation,

 Plan a place to meet your key employees in case you are separated from one another in a disaster. Designate someone to be the "checkpoint" so that employees can call that person to say they are safe.

 Assemble a disaster supplies kit for each facility. Include a battery-powered radio, flashlight, extra batteries, food, water and first aid kit. See the “Disaster Supplies Kit” for a complete list.

 Keep fuel in your car(s) if an evacuation seems likely. Gas stations may be closed during emergencies and unable to pump gas during power outages.

 Know how to shut off your facility's electricity, gas and water supplies at main switches and valves. Have the tools you would need to do this (usually adjustable pipe and crescent wrenches).

 Listen to a NOAA Weather Alert or battery-powered radio and follow local instructions.

Stay inside the facility. This action will be recommended if there is a short release, a small amount of hazardous material in the air, or if time does not permit evacuation before the arrival of a cloud of toxic vapor. Take these steps to protect yourself and employees;

 Stay inside until local officials say you can leave safely. This will most likely be for no more than a few hours.

 If your business has animals, if possible bring them indoors!

 Close all doors and windows.

 Seal all gaps under doorways and windows with damp towels and duct tape.

 Turn off heating, cooling or ventilation systems.

 Listen to your local radio or TV stations for further instructions.

 Resist the impulse to go outdoors and "check things out" before given the "All Clear" by authorities.

 If you are told to protect your breathing, cover your nose and mouth with a damp handkerchief or other cloth folded over several times.

Source: Tampa Bay Regional Planning Council 57

OUR FAMILY DISASTER PLAN

We don't like to think about a disaster in our community - much less take the time (and expense) to prepare our homes, families and business to weather a storm or other disaster. Yet, if you are armed with knowledge and a little forethought, you can save yourself and your family from potential injury and financial loss. It will also be critical that, as your employer, we know what your needs are before the event and ensure we can contact you after a disaster. To get started, first read the disaster preparedness guide provided to you. Then, prepare your own Family Disaster Plan by completing the checklist below:

1. KNOW YOUR RISK. Will your family have to evacuate in a hurricane? (Y or N) ____________

If yes, what Evacuation Level __________________________________

100-year Flood Zone (Y or N) __________________________________

If yes, if your home elevated above Base Flood Elevation? (Y or N) _____

Mobile home (Y or N) _________________________________________

2. HAVE AN EVACUATION PLAN. If I do not have to evacuate, I will secure my house and stay. My employer can reach me at:

Phone ____________________________________________________

Emergency Phone No. ________________________________________

If told to evacuate, we will go to:

Friends/Name_______________________________________________

Phone No. _________________________________________________

Emergency Phone No. ________________________________________

Hotel/Motel Shelter___________________________________________

Out of the Area (Y or N) _______________________________________

Evacuation Route____________________________________________

Source: Tampa Bay Regional Planning Council 58

3. Members of Your Family 1. First name ______________________ 4. First name_________________________

Last name_________________________ Last name ___________________________

Age______________________________ Age ________________________________

Mobile phone ______________________ Mobile phone _________________________

ss# ______________________________ ss# _________________________________

Employed by_______________________ Employed by _________________________

Work phone _______________________ Work phone __________________________

Blood type ________________________ Blood type ___________________________

Allergies __________________________ Allergies _____________________________

Special needs______________________ Special needs ________________________

_________________________________ ____________________________________

2. First name ______________________ 5. First name_________________________

Last name_________________________ Last name ___________________________

Age______________________________ Age_________________________________

Mobile phone ______________________ Mobile phone _________________________

ss#_________ _____________________ ss# _________________________________

Employed by_______________________ Employed by _________________________

Work phone _______________________ Work phone __________________________

Blood type ________________________ Blood type ___________________________

Allergies __________________________ Allergies _____________________________

Special needs______________________ Special needs ________________________

_________________________________ ____________________________________

3. First name ______________________ 6. First name_________________________