The Big One's Coming, So Get Ready

"Businesses first need to look at their two key assets: Your key assets for your business are your people and your data."

• By Jerry Laws
• Jul 09, 2007

Editor's note: Office Depot recently conducted a survey that found 71 percent of businesses do not have a disaster plan in place. Federal data indicate more than 40 percent of businesses never reopen after a disaster affects them, according to the company. Because 80 percent of its customer base is small to medium-sized businesses, Office Depot considers it important to help them protect their businesses, said Tom Serio, Director of Global Business Continuity Management for the company, which has 52,000 associates and about 1,500 stores worldwide.

Office Depot formed a foundation (www.community.officedepot.com) after Hurricane Andrew to provide no-cost loans to employees who go through catastrophic events. Every business will face some kind of disaster someday, said Serio, who discussed continuity planning and preparedness in an April 13, 2007, conversation with Occupational Health & Safety's editor. Excerpts from the conversation follow.

Why don't people, in general, prepare better for disasters? How can we snap them out of it?

Tom Serio: You're right, a lot of companies don't. We know that more than one in four businesses will have a disaster. But of that, approximately 43 percent don't have a disaster plan.

Now, why don't they have a disaster plan? Complacency is one of them. "I think it's not going to happen to me": It's the "not in my backyard" syndrome. Office Depot's headquarters is in Delray Beach, Florida, on the east coast of Florida. We know how to deal with hurricanes and disasters--we've experienced them ourselves down here. . . . In the Gulf Coast area that was impacted by Katrina, we had over 100 stores, 2,000 associates in the area, and a warehouse. So we know how bad a disaster can be. We know the impact it can have on a business, be it a small or a large business. And we know that companies really need to do their due diligence to protect themselves, their employees, and their shareholders.

Absolutely right. You mentioned more than one in four are hit by disasters; we're talking about all kinds of disasters--the death of a CEO or a top officer, for example.

Serio: Let me give you our definition of a disaster. We look at a disaster as any event that can impact your regular business functions for an extended period of time. You're right, it could be a hurricane, it could be a fire, tornado. It could be a cyber attack that brings down your e-commerce. Pandemic, let's say. It could be any of those things that prevent you from performing your regular business functions for a period of time. That period of time is defined by each business.
We have an outage period that we look at. . . . If you're in the e-commerce or Internet business, if your business is solely online, an hour of outage can mean X amount of dollars being lost. Business owners have to look at that and say, "Holy mackerel! If I'm out, what am I going to do?"

CONTINUITY PLANNING ISN'T EXPENSIVE

It's pretty clear many haven't done that. You mentioned complacency; is it also fear of acknowledging the risk?

Serio: It may be a little bit of fear, but too many companies think it's an expensive proposition to do disaster planning.

Good point. What can you tell them to disabuse them of that notion?

Serio: I can tell them there are simple and affordable solutions out there. And that's what we are helping to promote to small businesses. You can take a thumb drive, a dollar's worth of media like a CD, and back your data onto that CD and get that CD off site. So right there, you've got a backup and an off-site routine going.

Businesses first need to look at their two key assets: Your key assets for your business are your people and your data. For your people, protect them first. First thing we've got to do is educate them. Get people to understand what is a disaster, what should they do before, during, and after a disaster.

Along with that, you can bring in your local Red Cross, your local fire department, maybe some local vendors. For instance, down here in Florida, we'll bring in a shutter company or a roofing company to tell people what they can do to help protect their home, their family, and their business.

The other thing, we tell companies, "Look, you need to get more information from your employees." We learned from Katrina that we didn't have enough contact information for our employees. Typically, you have a person's home phone number and his cellphone number. When Katrina hit, everybody scattered to the four corners of the country. And we lost track of them.

Now, on our contact list, we want that information, but I also want your spouse's cellphone number, I want your home e-mail address. I want to know if your cellphone is text messaging capable, because another thing learned during Katrina was that, even though cellphones were down in the area, text messaging did work.

I did not realize that.

Serio: We learned that during the event: that if your cellphone is text-message capable or SMS capable, then you can potentially do text messaging even if the cell's not working.
The other information we'd like to get from everybody is contact information--a phone number and a name--of a relative or close friend who's out of the state whom you're most likely to call.

There you go.

Serio: For example, my mom still lives up in New York. She's probably one person I would contact, "Hey, we've got a hurricane in Florida but we're fine." So if the company can't find me, at least they have another contact.

You made a very good point a moment ago: Most companies don't have that kind of information. But it's not hard to get or expensive to get. You just have to go get it.

Serio: Right. A very simple solution for companies to do right now.

Agreed. Having contact information for someone who's out of the state is a great idea, but a pandemic would not be a local event. So there are some events that might affect the country, or beyond our borders.

Serio: Typically, we look at hurricane, fire. It's a dust and rubble disaster. A pandemic is different: It's a people disaster. You still have your buildings. The phones still work. You may be at home, quarantined. So you may not need that level of contact. But you're not going to have your full staff come in to work. What do you do?

Different, yes, but a pandemic still is something you can quite capably plan for, isn't it?

DATA PROTECTION IS KEY

Serio: Absolutely. Let me jump to this next point: The data of a company is key. It's key for them operating; it's key for them to be able to have that after a disaster in order to bring the business back up and running.

One of the things we try to tell companies is, in reality, they can't afford not to prepare. Companies should identify what their critical data is. Look at your business; what are your critical business streams, your critical functions, and what data are associated with them?

Once you've identified that, which is probably the hardest part, go back and make sure that data is backed up. Take that data and copy it. We also tell companies, put an external hard drive on your computer, copy your files over, disconnect your hard drive, and get that data out of the building. Because secondary to backing up is getting that data off site.

To some secure place that can withstand whatever you can envision as a possibility, right?

Serio: For a company that has multiple locations, they can send it from one location to the other ones and safeguard it there. There are third-party vendors that will store and safeguard your data for you.

I've seen this [at] a lot of companies: First of all, too many companies don't do backups. Once we get them doing backups, I say, "Where have you stored that backup?" They say, "Well, here it is" in the drawer right next to their computer.

What good is that? If the place burns down tonight, you've lost your data and your backup. So it's key to get it off site.

Companies really need to invest in preparation. And that costs. People say, "How much is it going to cost, Tom?" Look, I can't answer that because it's going to vary, depending on the nature and size of your business and what your local hazards and risks are. Down here, we look at hurricanes. In California, you're going to think about earthquakes. Midwest, you've got severe weather season and tornadoes. Very different things, but it's all bottom-line the same: We've got to prepare and plan.

This ought to be part of just the normal business thinking that companies do anyway.

Serio: That's right. It's not a project, it's a process.

They're always trying to look to the future and think, "What are my sales going to be next quarter? What can I do to increase customer service?" This ought not to be alien to what they are already doing in terms of planning.

Serio: Similarly, Office Depot has learned from those hurricanes. We survived some major hurricanes in 2005. We have plans in place, we implemented those plans and those plans did work.

Once you get a plan together, you do want to test it.

Serio: The funny thing is, people ask me whether we test our plans and I say, "Why? We have a hurricane every year." But you're right, companies do need to test their plans, and it's very simple. First of all, I tell people, do a tabletop exercise. Get all the key players of the plan, put them in a conference room, and walk through the plan. Play out a disaster role. Make believe you're sitting in a local hotel because your building's burning down. And do the role modeling: "Who do we call first, second, and third? How do we pay our people? How do we keep accounts receivable going? What's our tangible asset that makes us money?"

THE VALUE OF ANNUAL EMPLOYEE TRAINING

Do community resources help you in fine-tuning and testing a plan?

Serio: The fire department will come in. They like to do that kind of stuff, but the fire department can't reach out to business. Businesses need to reach out to the fire department, the local Red Cross, and other associations like that.

We host something we call a hazard fair. We do it for our employees; we've got 2,200 people on our corporate campus. Our hazard fair, I bring in the fire, police, and Red Cross; I bring in local vendors, the shutter, the roofing guys; insurance companies; the state insurance department; the utility companies. The Humane Society comes in--because people always say, "What do I do about my animals during a disaster?"

We bring them all in here and we host a big fair so employees have like a one-stop-shopping opportunity to get everything they need to get ready for hurricane season, which starts June 1st.

So you do this annually?

Serio: We did it in 2004 and 2005. We didn't do it in 2006. We're going to do it again this year.
That gets people ready. Anybody who moved to Florida and hasn't been through a hurricane, it starts getting them prepped.

You make a good point: A good-sized business, on an annual basis, probably has enough newcomers that it needs to educate them in this way, because they won't know what the long-term employees know.

Serio: We have a brochure online at www.officedepot.com/getprepared. We put it out there for businesses, but people can look at it, also, and see what they need to do. Companies can use that as a starting point.

We tell business owners: You worked hard to build your business. You're an entrepreneur. You've toiled all these years. Don't risk its survival. Get prepared.

This article originally appeared in the July 2007 issue of Occupational Health & Safety.