What’s Your 2021 Hurricane Disaster Recovery Plan?
2020 was an eventful year, to say the least. Amid a global pandemic, coastal areas also experienced an active hurricane season that put businesses and families at risk of further upheaval.
For businesses without an adequate hurricane disaster recovery plan, the consequences were catastrophic.
Last August, Hurricane Laura hit the Gulf Coast as one of the strongest hurricanes ever recorded in the state of Louisiana. Estimates from Moody’s put the total economic cost at $20 billion, which included the impact of closed businesses and structures damaged by the storm.
And while this was the first season since 2015 that there were no Category 5 hurricanes, the 2020 Atlantic hurricane season went down as the most active and the fifth costliest on record.
Will 2021 be a bad hurricane season?
Below, we outline the latest forecasts for the 2021 hurricane season, along with strategies for preparing your business.
But regardless of how active this season turns out, the upshot is this: hurricanes aren’t going away.
In fact, they’re getting worse. Data from the last decade shows that hurricanes have been growing in intensity and becoming more destructive.
But unlike most disasters, hurricanes are more predictable. You generally know they’re coming. Both the short-term forecasts and seasonal trends allow businesses to prepare ahead of time. So if your business is located along the coast, having a hurricane disaster recovery plan is essential.
What is a hurricane disaster recovery plan?
A hurricane disaster recovery plan is a documented set of business procedures for responding to a hurricane. Much like a traditional disaster recovery plan, the plan can include protocols for both before, during and after a hurricane or severe weather event, including:
- Preventative steps to anticipate and mitigate the impact of a hurricane
- Emergency response procedures to ensure safety during the event
- Immediate steps to restore critical business systems and operations
- Long-term procedures for full recovery
Jump below to see some examples of the steps that should go in each of these categories.
Why do you need one?
More precisely: hurricanes are among the most destructive natural disasters in the United States. In addition to the danger to people, hurricanes pose a serious threat to businesses.
The Congressional Budget Office (CBO) estimates that repairing damage from hurricanes costs $28 billion a year in the United States. Nearly half of U.S. economic productivity is vulnerable to hurricane damage.
But it’s not just the costs of damage that businesses need to worry about. When hurricanes cause a big enough disruption to operations, some companies never recover.
Forced out of business
The Federal Emergency Management Agency (FEMA) says that 40% to 60% of businesses never reopen their doors after a disaster such as a hurricane.
The key factor that determines businesses’ chances of survival is how quickly they respond. If operations can’t be restored quickly enough, it could spell doom for the business in the long term.
FEMA found that 90% of smaller companies fail within a year if they’re unable to resume operations within 5 days after a disaster. Every second counts.
That’s where a hurricane disaster recovery plan can make a huge difference. By being prepared for a disaster, and knowing exactly how to respond – rather than figuring it out on the fly – businesses are able to recover far more quickly.
How hurricanes hurt
The reason why hurricanes get the biggest headlines (vs. more frequent IT disasters, like data loss) is that they’re shocking. The destruction is eye-popping and frightening. But that physical damage is just one of several ways that a hurricane can disrupt your business.
In some ways, hurricanes encapsulate all the different disasters that can threaten your business:
- Wind damage
- Staff shortages
- Server / infrastructure damage
- Electricity & utility outages
- Data loss from damaged hardware
- Transportation disruptions
- Restricted building access
Each of these outcomes affects your operations in different ways. For example, perhaps the hurricane largely spared your business – but since everyone evacuated prior to the storm, you’re short-staffed.
Or, let’s say your office building is condemned due to damage. Your IT infrastructure is actually fine inside, if only somebody could get inside to manage it and enable remote workers to access the network. But since the building is condemned, nobody is allowed to enter.
Are there workarounds? Sure, there might be. But these examples illustrate the different ways that businesses need to prepare for the impact of a hurricane. It’s not just the physical destruction you need to worry about.
Forecasting the 2021 hurricane season
Again, one “nice” thing about hurricanes is that you know approximately what time of year they happen. And when one is on the way, you usually have a few days’ warning.
Your hurricane disaster recovery plan should acknowledge those “knowns” as part of the planning. For example, here’s what we know about the 2021 hurricane season(s):
- Season / timing: The Atlantic & Central Pacific Hurricane seasons are from June 1 to November 30, when ocean temperatures are at their warmest. While this is a relatively large window, it allows businesses to prepare based on the months that hurricanes are mostly likely to occur.
- Predicted activity: Forecasting technology can somewhat reliably predict how bad a hurricane season will be, prior to the start of the season. In May, for example, the National Oceanic and Atmospheric Administration (NOAA) predicted that the 2021 hurricane season would be “above-normal,” with 13 to 20 named Atlantic storms (with winds of 39 mph or higher), of which 6 to 10 could become hurricanes (with winds of 74 mph or higher). 3 to 5 of these could become major hurricanes (category 3, 4 or 5; with winds of 111 mph or higher). While these forecasts aren’t exact, they can provide a general “heads up” for planning purposes.
Starting with a risk assessment
Understanding the risks to your business is a vital first step of your disaster recovery planning. A thorough risk assessment will identify specific vulnerability spots that your organization needs to address. It will help to prioritize the most urgent parts of your planning and thus also guide the content of your hurricane disaster recovery plan.
In its Hurricane Toolkit for Businesses, Ready.gov provides a useful worksheet with examples of questions that can identify risks and assess your readiness, including:
- Can your business operate without any of the following: computers, servers / data, inventory or industry-specific equipment (such as cash registers, x-ray equipment, etc.)?
- Can your operations continue without electricity, gas, water, internet or telecommunications?
- Can you operate if your building is damaged, flooded or otherwise inaccessible?
- Can payroll and other expenses be met if revenue streams are interrupted? For how long?
- Can staff work remotely from home or other locations? If so, what equipment do they need and how will they obtain it?
- If the business is suddenly closed, will you be able to communicate status updates or emergency information with employees, vendors or customers?
- What operations are highest priority for recovering after a disruption? Which systems come first, second, third and so on?
- Can your business survive losses if it is closed for 3 to 7 days, or longer?
These are just a few basic examples, and it is not enough to answer a simple “Yes” or “No.” Your risk assessment must provide a deep analysis of your organization’s most critical vulnerabilities, along with thorough documentation on what’s needed to eliminate those gaps.
Building a hurricane disaster recovery plan
While each business’s hurricane disaster recovery plan will be unique to their organization and industry, the basic framework should focus on these 4 central areas:
- Emergency response
These 4 components help to plan for all stages of a disaster: before, during and after. They identify the steps and systems needed to prevent a major disruption from a hurricane, as well as the procedures for keeping employees safe and recovering operations.
Here’s what to include in each of these sections.
1) Preventative planning
A crucial component of any hurricane disaster recovery plan is the preventative planning. No, you can’t stop a hurricane. But you can prevent it from destroying your business.
Have you noticed how stores board up their windows before a big storm comes? That’s exactly what you need to do for your business – but not just the windows. You need to protect every aspect of your business.
- Build in redundancy for critical business systems & operations, so that the company can continue operating even if the primary location is destroyed or inaccessible.
- Enable employees to access company networks, data and systems remotely via the cloud or offsite datacenter.
- Have a Plan B for quickly relocating the business or allowing operations to be decentralized.
- Create plans that ensure employee safety – i.e. guidelines for evacuations, protocols for essential workers who cannot evacuate, guidance for shelters, etc.
- Strengthen protection for physical assets and equipment – i.e. boarding windows, installing flood detectors, fire alarms, fire suppression systems for server rooms, etc.
- Communication plans that ensure everyone can stay connected, especially if primary lines of communication are unavailable.
All of this planning should occur long before a storm is on its way. The more prepared you are, the less of an impact the hurricane will have on your business. Even in the case of significant physical destruction, aggressive preventative planning can ensure continuity of your operations.
2) Emergency response
When disaster strikes, the safety of your employees is paramount. Your disaster recovery plan should outline the steps that must be taken during a hurricane to reduce the risk of harm and help essential staff know what to do.
Consider a hospital emergency room in which essential medical staff must remain on site through a hurricane, caring for patients and providing shelter for others who could not evacuate. What happens if the storm destroys part of the hospital? What protocols should be followed? Where do personnel direct their resources?
Every type of coastal organization should provide employees with specific emergency procedures to follow in the event that they are caught in a hurricane. Recommendations from Ready.gov include:
- Knowing how to protect yourself from dangerous winds and flooding
- Identifying the safest area to take refuge, such as an interior room or designated storm shelter
- Knowing what routes to take if trapped in a flooded building, such as going to the highest level of the building (but not in enclosed attics or spaces without exit points).
- Understanding safe evacuation guidelines, such as the importance of not attempting to drive, walk or swim through flood waters.
All of this should be outlined in the DRP, along with the names and contact information of the recovery teams who will help to ensure these steps are properly carried out.
3) Restoring critical systems & operations
The hurricane disaster recovery plan must dictate how the business will restore its most vital systems and operations after a destructive storm.
Every possible disaster scenario should be identified, along with the steps for restoration. Ideally, your business continuity plan (BCP) will already identify these scenarios as part of the risk assessment. Create protocols that make it clear who will restore critical operations and how.
What might need to be restored first?
- Network access
- Data backups
- Servers or other damaged hardware
- Production operations
- Customer-facing systems
Manufacturing and other production environments will also require adequate response protocols for other vital systems, such as:
- Mechanical systems
- Sewer and water systems
- Fuel tanks
- Communications equipment
- Utility connections
- Rooftop structures
A Business Impact Analysis (as part of your BCP or DRP) can help you to determine which of these systems are most critical for the business to survive.
Leave nothing to guesswork. Develop clear flow charts and instructions that guide recovery teams through every scenario.
4) Full recovery
Following Hurricane Harvey in 2017, nearly 20% of affected businesses took a year or longer to reopen their doors. (And unfortunately, many never did.) After Hurricane Katrina in 2005, roughly 39% of affected businesses had recovered 10 months later. And by the 2-year mark, that number increased to only 66%.
This figure illustrates the lasting impact of hurricanes. Even when a full recovery is possible, it can take months or years for businesses that are hit hardest.
Even if your business is quick to restore critical systems, the full, long-term recovery is still essential. A hurricane DRP must outline how the business can fully restore operations back to normal, as they were prior to the hurricane.
Examples of full recovery:
- Repairs / rebuilding of physical structures
- Replacement of IT hardware and equipment
- Permanent relocation of the business
- Return to full workforce levels
The role of data backup
Data backup plays a fundamental role in any disaster recovery plan. Even if a business is not completely destroyed by a hurricane, a mass loss of data would be just as disastrous.
For example, if a server room is flooded, or an electrical surge fries your file storage devices, it would likely cause a massive disruption to your operations.
This underscores the importance of using a robust data backup and disaster recovery system – even at the smallest businesses. Today’s BCDR solutions from Datto make it easy to capture all your data, every few minutes if necessary, and store those backups in multiple locations for fast, dependable recovery.
Keep in mind that data backup is just one piece of the overall disaster recovery picture. Planning for a hurricane requires a 360-degree approach that takes all aspects of your business into consideration.
The importance of hurricane drills
Hurricane drills provide an effective training tool to ensure your teams know what to do during a storm. Drills can be focused not only on employee safety, but also on IT infrastructure and other critical systems.
FEMA provides an excellent guide for conducting these drills via discussions and tabletop exercises in its Hurricane Playbook for businesses. One of the first important steps of conducting such drills is educating teams on the impact of hurricanes, from both a safety perspective and operational context. This serves as a reminder of what’s at stake and motivates employees to take the drills seriously.
Similar to the DRP itself, hurricane drills and exercises can be used to identify strengths and weaknesses in the following areas:Use specific scenarios. FEMA’s scenario is “Hurricane Milo,” a mock Category 1 hurricane that is “projected to make landfall within 72 hours … and become an extremely powerful Category 4 hurricane.”
Does everyone know what to do during this early stage, before the hurricane arrives? Here are some sample questions to consider during the drill:
- Who in the organization is responsible for monitoring hurricane updates? Where should they get this information?
- What information must be shared with employees at this time, and how?
- What decisions should be made at this time to ensure the organization is ready?
Additional scenarios should be used to test how teams will respond when the hurricane arrives.
Learn more and make sure your business has a hurricane disaster recovery plan today!
Take a closer look at Datto’s disaster recovery solutions for protection against hurricanes, ransomware and other disasters. Request a free demo or contact our business continuity experts at Invenio IT. Call (646) 395-1170 or email success@invenioIT.com.