Data Protection Tool

2024 Hurricane Season Could Be the Worst Ever. Is Your Disaster Recovery Plan Ready?

Picture of Tracy Rock

Tracy Rock

Director of Marketing @ Invenio IT

Published

Hurricane Disaster Recovery Plan

The 2024 hurricane season could be the worst on record, according to researchers at the University of Pennsylvania. Climate scientists predict we’ll see 33 storms between now and November 30 – the highest count ever projected.

If you haven’t updated your hurricane disaster recovery plan in a while, now’s the time.

Here’s what to expect for this year’s hurricane season and how to make sure your organization is prepared.

Will 2024 be a bad hurricane season?

If researchers’ projections are accurate, yes – the 2024 North Atlantic hurricane season could be one of the most active in modern history.

The prominent group of climate scientists led by Michael Mann at the University of Pennsylvania has predicted 27 to 39 hurricanes this season, which runs from June through November. Their “best guess” model predicts 33 storms in total. This would make it the busiest hurricane season ever, after the previous record of 30 named storms in 2020.

It’s not the only research group making this prediction.

Forecasts by Colorado State University and AccuWeather are even more aggressive, due to warm ocean waters and an expected shift from El Niño to La Niña.

Why should your organization act now?

Hurricanes continue to become more destructive, more costly, more widespread and more disruptive for the businesses that lie in their path.

Seven of the last eight hurricane seasons have had above-average storm activity, according to the Washington Post. Out of the past 4 hurricane seasons, three have had at least 20 named storms. (Tropical storms are named by the National Hurricane Center when they have sustained winds of at least 39 miles per hour.)

Disaster recovery plans are essential

For businesses without an adequate hurricane disaster recovery plan, the consequences can be catastrophic.

  • Companies of all sizes are often forced to close their doors when a hurricane’s trajectory poses a threat. This can cause major business disruptions, even when the storm doesn’t cause any damage.
  • Businesses directly hit by hurricanes can face prolonged closures. Some small businesses never reopen their doors.
  • In recent years, hurricane seasons have caused hundreds of billions of dollars in damages to businesses and property.
  • North Atlantic hurricanes can disrupt businesses anywhere along the coast, including those that are miles inland. 2023 was also the first year that the U.S. issued a tropical storm watch for California, which means the lower Pacific coast should be equally prepared.

Unlike most disasters, hurricanes are at least somewhat predictable.

You generally know they’re coming. Both the short-term forecasts and seasonal trends allow businesses to prepare ahead of time. So if your business is located along the coast, having a hurricane disaster recovery plan is essential for ensuring operational continuity (and survival).

What is a hurricane disaster recovery plan?

A hurricane disaster recovery plan is a documented set of business procedures for responding to a hurricane. Much like a traditional disaster recovery plan, a hurricane DR plan can include protocols for before, during and after a hurricane or severe weather event, including:

  • Preventative steps to anticipate and mitigate the impact of a hurricane
  • Emergency response procedures to ensure safety during the event
  • Immediate steps to restore critical business systems and operations
  • Long-term procedures for full recovery

Jump below to see some examples of the steps that should go in each of these categories.

Why do you need a DR plan for hurricanes?

Hurricanes are among the most destructive natural disasters in the United States. In addition to the danger to people, hurricanes pose a serious threat to businesses.

The Congressional Budget Office (CBO) estimates that repairing damage from hurricanes costs $28 billion a year in the United States. Nearly half of U.S. economic productivity is vulnerable to hurricane damage.

But it’s not just the costs of damage that businesses need to worry about. When hurricanes cause a big enough disruption to operations, some companies never recover.

Forced out of business

The Federal Emergency Management Agency (FEMA) has said that 40% to 60% of businesses never reopen their doors after experiencing a widespread disaster such as a hurricane.

The key factor that determines businesses’ chances of survival is how quickly they respond. If operations can’t be restored quickly enough, it could spell doom for the business in the long term.

FEMA also found that 90% of smaller companies fail within a year if they’re unable to resume operations within 5 days after a disaster. Every second counts.

That’s where a hurricane disaster recovery plan can make a huge difference. By being prepared for a disaster, and knowing exactly how to respond – rather than figuring it out on the fly – businesses are able to recover far more quickly.

How hurricanes hurt

The reason why hurricanes get the biggest headlines (vs. more frequent IT disasters, like data loss) is that they’re shocking. The destruction is eye-popping and frightening. But that physical damage is only one of several ways that a hurricane can disrupt your business.

In some ways, hurricanes encapsulate all the different disasters that can threaten your business:

  • Flooding
  • Wind damage
  • Fire
  • Staff shortages
  • Server / infrastructure damage
  • Electricity & utility outages
  • Data loss from damaged hardware
  • Transportation disruptions
  • Restricted building access

Each of these outcomes affects your operations in different ways. For example, perhaps the hurricane largely spared your business – but since everyone evacuated prior to the storm, you’re short-staffed.

Or, let’s say your office building is condemned due to damage. Your IT infrastructure is actually fine inside, if only somebody could get inside to manage it and enable remote workers to access the network. But since the building is condemned, nobody is allowed to enter.

Are there workarounds? Sure, there might be. But these examples illustrate the different ways that businesses need to prepare for the impact of a hurricane. It’s not just the physical destruction you need to worry about.

Forecasting the 2024 hurricane season

Again, one “nice” thing about hurricanes is that you know approximately what time of year they happen. And when one is on the way, you usually have a few days’ warning.

Your hurricane disaster recovery plan should acknowledge those “knowns” as part of the planning. For example, here’s what we know about the 2024 hurricane season(s):

  • Season / timing: The North Atlantic Hurricane Season is from June 1 to November 30, when ocean temperatures are at their warmest. While this is a relatively large window, it allows businesses to prepare based on the months that hurricanes are most likely to occur.
  • Predicted activity: Forecasting technology can reliably predict how bad a hurricane season will be, prior to the start of the season. In April of each year, Colorado State University’s Tropical Weather and Climate Research Division releases its annual hurricane season forecast. This year, their researchers are predicting 33 storms. 11 of those storms are expected to reach hurricane strength (with sustained winds of 74 mph or higher). This would make 2023 an “extremely active” hurricane season.

While hurricane forecasts aren’t exact, they can provide a useful “heads up” for planning purposes, based on known meteorological factors, such as ocean temperatures and climate patterns such as La Niña.

Starting with a risk assessment

Understanding the risks to your business is a vital first step in your disaster recovery planning. A thorough risk assessment will identify specific vulnerability spots that your organization needs to address. It will help to prioritize the most urgent parts of your planning and thus also guide the content of your hurricane disaster recovery plan.

In its Hurricane Toolkit for Businesses, Ready.gov provides a useful worksheet with examples of questions that can identify risks and assess your readiness, including:

  • Can your business operate without any of the following: computers, servers / data, inventory or industry-specific equipment (such as cash registers, x-ray equipment, etc.)?
  • Can your operations continue without electricity, gas, water, internet or telecommunications?
  • Can you operate if your building is damaged, flooded or otherwise inaccessible?
  • Can payroll and other expenses be met if revenue streams are interrupted? For how long?
  • Can staff work remotely from home or other locations? If so, what equipment do they need and how will they obtain it?
  • If the business is suddenly closed, will you be able to communicate status updates or emergency information with employees, vendors or customers?
  • What operations are highest priority for recovering after a disruption? Which systems come first, second, third and so on?
  • Can your business survive losses if it is closed for 3 to 7 days, or longer?

These are just a few basic examples, and it is not enough to answer a simple “Yes” or “No.” Your risk assessment must provide a deep analysis of your organization’s most critical vulnerabilities, along with thorough documentation on what’s needed to eliminate those gaps.

Building a hurricane disaster recovery plan

While each business’s hurricane disaster recovery plan will be unique to their organization and industry, the basic framework should focus on these 4 central areas:

  • Prevention
  • Emergency response
  • Restoration
  • Recovery

These 4 components help to plan for all stages of a disaster: before, during and after. They identify the steps and systems needed to prevent a major disruption from a hurricane, as well as the procedures for keeping employees safe and recovering operations.

Here’s what to include in each of these sections.

1) Preventative planning

A crucial component of any hurricane disaster recovery plan is the preventative planning. No, you can’t stop a hurricane. But you can prevent it from destroying your business.

Have you noticed how stores board up their windows before a big storm comes? That’s exactly what you need to do for your business – but not just the windows. You need to protect every aspect of your business.

For example:

  • Build in redundancy for critical business systems & operations, so that the company can continue operating even if the primary location is destroyed or inaccessible.
  • Enable employees to access company networks, data and systems remotely via the cloud or offsite datacenter.
  • Have a Plan B for quickly relocating the business or allowing operations to be decentralized.
  • Create plans that ensure employee safety – i.e. guidelines for evacuations, protocols for essential workers who cannot evacuate, guidance for shelters, etc.
  • Strengthen protection for physical assets and equipment – i.e. boarding windows, installing flood detectors, fire alarms, fire suppression systems for server rooms, etc.
  • Communication plans that ensure everyone can stay connected, especially if primary lines of communication are unavailable.

All of this planning should occur long before a storm is on its way. The more prepared you are, the less of an impact the hurricane will have on your business. Even in the case of significant physical destruction, aggressive preventative planning can ensure continuity of your operations.

2) Emergency response

When disaster strikes, the safety of your employees is paramount. Your disaster recovery plan should outline the steps that must be taken during a hurricane to reduce the risk of harm and help essential staff know what to do.

Consider a hospital emergency room in which essential medical staff must remain on site through a hurricane, caring for patients and providing shelter for others who could not evacuate. What happens if the storm destroys part of the hospital? What protocols should be followed? Where do personnel direct their resources?

Every type of coastal organization should provide employees with specific emergency procedures to follow in the event that they are caught in a hurricane. Recommendations from Ready.gov include:

  • Knowing how to protect yourself from dangerous winds and flooding
  • Identifying the safest area to take refuge, such as an interior room or designated storm shelter
  • Knowing what routes to take if trapped in a flooded building, such as going to the highest level of the building (but not in enclosed attics or spaces without exit points).
  • Understanding safe evacuation guidelines, such as the importance of not attempting to drive, walk or swim through flood waters.

All of this should be outlined in the DRP, along with the names and contact information of the recovery teams who will help to ensure these steps are properly carried out.

3) Restoring critical systems & operations

The hurricane disaster recovery plan must dictate how the business will restore its most vital systems and operations after a destructive storm.

Every possible disaster scenario should be identified, along with the steps for restoration. Ideally, your business continuity plan (BCP) will already identify these scenarios as part of the risk assessment. Create protocols that make it clear who will restore critical operations and how.

What might need to be restored first?

  • Power
  • Network access
  • Data backups
  • Servers or other damaged hardware
  • Production operations
  • Logistics
  • Customer-facing systems

Manufacturing and other production environments will also require adequate response protocols for other vital systems, such as:

  • Mechanical systems
  • Sewer and water systems
  • Fuel tanks
  • Communications equipment
  • Utility connections
  • Rooftop structures

A Business Impact Analysis (as part of your BCP or DRP) can help you to determine which of these systems are most critical for the business to survive.

Leave nothing to guesswork. Develop clear flow charts and instructions that guide recovery teams through every scenario.

4) Full recovery

Following Hurricane Harvey in 2017, nearly 20% of affected businesses took a year or longer to reopen their doors. (And unfortunately, many never did.) After Hurricane Katrina in 2005, roughly 39% of affected businesses had recovered 10 months later. And by the 2-year mark, that number increased to only 66%.

This figure illustrates the lasting impact of hurricanes. Even when a full recovery is possible, it can take months or years for businesses that are hit hardest.

Even if your business is quick to restore critical systems, the full, long-term recovery is still essential. A hurricane DRP must outline how the business can fully restore operations back to normal, as they were prior to the hurricane.

Examples of full recovery:

  • Repairs / rebuilding of physical structures
  • Replacement of IT hardware and equipment
  • Permanent relocation of the business
  • Return to full workforce levels

The role of data backup

Data backup plays a fundamental role in any disaster recovery plan. Even if a business is not completely destroyed by a hurricane, a massive loss of data would be just as disastrous.

For example, if a server room is flooded, or an electrical surge fries your file storage devices, it would likely cause a massive disruption to your operations.

This underscores the importance of using a robust data backup and disaster recovery system – even at the smallest businesses. Today’s BCDR solutions from Datto make it easy to capture all your data, every few minutes if necessary, and store those backups in multiple locations for fast, dependable recovery.

Keep in mind that data backup is just one piece of the overall disaster recovery picture. Planning for a hurricane requires a 360-degree approach that takes all aspects of your business into consideration.

The importance of hurricane drills

Hurricane drills provide an effective training tool to ensure your teams know what to do during a storm. Drills can be focused not only on employee safety, but also on IT infrastructure and other critical systems.

FEMA provides an excellent guide for conducting these drills via discussions and tabletop exercises in its Hurricane Playbook for businesses. One of the first important steps of conducting such drills is educating teams on the impact of hurricanes, from both a safety perspective and operational context. This serves as a reminder of what’s at stake and motivates employees to take the drills seriously.

Similar to the DRP itself, hurricane drills and exercises can be used to identify strengths and weaknesses in the following areas:

Facilities:
Go over planning for structural maintenance; flood prevention & mitigation; storm shutters; backup power systems; supplies for teams who may remain on-site; supplies for emergency repairs and so on.
Human Resources Policies:
Identify and test employee notification systems; review policies for early release/telework; flexible work arrangements; payroll and insurance; employee/family reunification procedures; first-aid training and functional needs.
Continuity of Operations Plans:
Review plans to operate at an alternate location; access company data; roles and responsibilities; insurance policies; supplier contingencies; customer relationship management; and processes to resume operations.
Emergency Operations Plans:
Review the organization’s readiness for providing critical information and updates during the hurricane; guidance on how to protect critical assets; protocols for communicating with first responders and critical infrastructure providers.

Using specific scenarios

FEMA’s scenario is “Hurricane Milo,” a mock Category 1 hurricane that is “projected to make landfall within 72 hours … and become an extremely powerful Category 4 hurricane.”

Does everyone know what to do during this early stage, before the hurricane arrives? Here are some sample questions to consider during the drill:

  • Who in the organization is responsible for monitoring hurricane updates? Where should they get this information?
  • What information must be shared with employees at this time, and how?
  • What decisions should be made at this time to ensure the organization is ready?

Additional scenarios should be used to test how teams will respond when the hurricane arrives.

Conclusion

The 2024 Atlantic Hurricane Season is expected to bring a record-breaking 33 storms, including 11 hurricanes, which would make it the worst season on record. All businesses located within 50 miles from the coast are strongly encouraged to review their disaster recovery plan now to ensure they are prepared for potential disruptions. Most importantly, businesses should update their disaster preparedness protocols, continuity planning and recovery systems, including data backup.

Our takeaway: As disaster recovery experts, we’ve seen first-hand how severe weather events can disrupt and destroy businesses. Companies with DR plans always fare better than those without a plan. We recommend that all coastal businesses (regardless of size or industry) review and update their planning ASAP to ensure the safety of their people and systems through the 2024 hurricane season.

Frequently Asked Questions

1. What should a disaster recovery plan include?

At a minimum, a disaster recovery plan should include procedures that help a business recover from an operational disruption. Disaster recovery plans often pertain to IT systems, but they can also apply to other business activities, units and assets. For example, a plan might also include recovery contingencies for office space, equipment, remote work systems and so on.

2. What is the emergency plan for a hurricane?

For businesses, a hurricane emergency plan should outline the steps to be taken before, during and after a hurricane. This includes plans for employee evacuations, communication and sheltering, as well as protocols for business-critical systems, contingencies and recovery.

3. What is a business continuity plan for a hurricane?

A business continuity plan for a hurricane outlines the steps and systems that help a business continue operating through a hurricane. The plan typically includes a risk assessment and business impact analysis, as well as protocols for disaster mitigation, response and recovery.

Learn more and make sure your business has a hurricane disaster recovery plan.

Take a closer look at Datto’s disaster recovery solutions for protection against hurricanes, ransomware and other disasters. Request a free demo or contact our business continuity experts at Invenio IT. Call (646) 395-1170 or email success@invenioIT.com.

 

Get The Ultimate Business Continuity Resource for IT Leaders
Invenio it logo

Join 23,000+ readers in the Data Protection Forum

Related Articles