BUSINESS CONTINUITY PLANNING GUIDE

ACKNOWLEDGEMENTS
Disaster Ready Chippewa Valley (DRCV) Steering Committee The DRCV Steering Committee directed the development of this planning guide and the DRCV Business Continuity Plan Template. As of October 2009, the DRCV Steering Committee members were: Tom Gillett, President, Indianhead Foodservice Distributor (co-chair) Hal Swanstom, Director, Eau Claire County Emergency Management (co-chair) John Baltes, Director of Loss Prevention & Safety, UW-Eau Claire Randy Beck, Executive V.P./Risk & Facility Management, Royal Credit Union Richard Kelly, Manager, Safety & Loss Control, Eau Claire Energy Cooperative Gerald Leff, Dunn County ARES/RACES Jenny Legaspi, Emergency Services Director, American Red Cross Dan Liddell, Safety Engineer, Hutchinson Technology Derrick Longdo, President, IRIS Technology, LLC Marge McFarlane, Superior Performance, LLC Colleen Schian, Risk Manager, City of Eau Claire

Funding Support The compilation of this guide and the DRCV template were supported with grant assistance from the State of Wisconsin Office of Justice Assistance to Eau Claire County Emergency Management. This support enabled West Central Wisconsin Regional Planning Commission to develop this guide under the direction of DRCV.

Other Resources Elements of the following business continuity models and materials in particular were adapted for this planning guide and the DRCV template: Ready Your Business: 12 Point Program for Success to Business Continuity Planning. PrivatePublic Partnership of Dane County. (www.countyofdane.com/ems) Business Continuity Guideline. ASIS International. (www.asisonline.org) Sample Business Continuity and Disaster Preparedness Plan. FEMA. (www.ready.gov/business) Florida Business Continuity Plan Template (www.fldisasterkit.com). Various Partners. Various assessment and planning forms. School of Criminal Justice, Michigan State University Critical Incident Protocol Program (www.cip.msu.edu)

I. INTRODUCTION
a. What is a Business Continuity Plan?
Business continuity planning is the processes of identifying actions so that your organization can manage and survive a crisis. In order to identify actions, the organization must assess its hazard risks Business Continuity Plan and threats. Depending on the organization, these risks may be natural An ongoing process supported by senior hazards, man-made, technological, management and funded to ensure that the economic, or regulatory. necessary steps are taken to indentify the Since mitigating the impacts of crisis situation or disaster event is an important factor in your businesss survival, your business continuity plan may refer to and encompass other emergency plans for your organization. impact of potential losses, maintain viable recovery strategies and plans, and ensure the continuity of operations through personnel training, plan testing, and maintenance. ASIS International

Within this guide, the terms business and organization are used interchangeably. The approach is reasonably generalized so that the example template can be adapted for use by private sector businesses, non-profit organizations, and public sector agencies.

b.

Why Plan?

Using a formal planning process requires an organization to consider existing conditions and risks, then identify strategies to address these risks based on available resources and circumstances specific to the business. Without such a process, an organization is not fully prepared to meet changing conditions, protect its critical business functions, and secure its assets (e.g., facility, equipment, data, personnel). Consider the following statistics: 25+% of businesses do not reopen following a major disaster1 75% of companies without a business continuity plan fail within 3 years of a disaster2 43% of businesses experiencing catastrophic data loss never reopen3

Also keep in mind that you are an important part of the community and your success is important to the Chippewa Valley. And many organizations may be called upon to provide resources during or after a disaster event in the area. For example, following Hurricanes Katrina and Rita, the private sector often was far more nimble at providing manpower, materials, and logistics than many parts of the federal government.
1 2

The Institute for Business & Home Safety Crisis Management International 3 University of Texas Center for Research on Information Systems

II. DEVELOPING YOUR PLAN

a. Getting Started
1) Obtain a commitment from management (see Section III.a.) 2) Identify your planning team and team leader. 3) Review the DRCV Business Continuity Plan Template. Modify and add additional sections if necessary. Use the template as a starting point. 4) Collect copies of existing emergency plans, procedures, etc. 5) Collect copies of organizational charts, business plans, system processes, etc. 6) Collect information on past hazard risks or disaster events which have impacted your organization or business. 7) Establish a schedule for completion of the plan. Management should assign accountability. 8) Obtain planning assistance if needed. As you review the plan template and begin collecting information, it may become apparent that the assistance of a consultant is needed for portions or all of your plan. For many organizations, planning for computer data protection, storage, and recovery is sufficiently complex that specialized expertise is needed and a stand-alone plan on this topic warranted. What is most important is that you begin planning for your organization. Dont let the potential scope of the project deter you from starting. Complete those portions of the plan that time and resources allow. You can continue to amend your plan and provide greater details in the future. The following is a suggested approach to getting started on a business continuity plan for your organization:

b.

Identifying Your Planning Team

Create the planning team which best suits your organization. While one or two key persons may sufficiently plan for smaller organizations and businesses, larger organizations may require a larger planning team representing different aspects of the business such as management, finance, security, information management, human resources and safety. A planning team leader should be identified, along with who will be responsible for compiling the business continuity plan document. You may also need to contact additional resources during the development of your plan, such as those list below and in the next sub-section: your insurance agent and accountant utilities and communications providers trade associations and other area businesses property management, if applicable

key suppliers, clients, or contracted firms public sector planning or emergency personnel

c.

Helpful Resources

Local Resources Public Sector

Chippewa County Emergency Management: http://www.co.chippewa.wi.us/emergency_management/ Dunn County Emergency Management: http://dunncountywi.govoffice2.com/ Eau Claire County Emergency Management: http://www.co.eauclaire.wi.us/CountyDepartments/planning_and_development/emergency_management.htm Chippewa Valley Technical College Emergency Service Education Center: http://www.cvtc.edu/pages/556.asp Chippewa Valley Technical College Business & Industry Services: http://www.pwebcluster1.cvtc.edu/pages/366.asp UW-Eau Claire Safety Reference Guides: http://www.uwec.edu/LPS/references/index.htm City of Eau Claire Emergency Preparedness Information & Guides: http://www.eauclaire.wi.gov/government/emergency-preparedess

Local Resources Public Health

Western Region Partnership for Public Health Preparedness: http://www.wrpphp.org Chippewa County Department of Public Health: http://www.co.chippewa.wi.us/CCDPH Dunn County Public Health: http://dunncountywi.govoffice2.com/ Eau Claire City-County Health Department: http://www.ci.eau-claire.wi.us/health-departmenthome

Local Resources Nonprofit

Disaster Ready Chippewa Valley: http://www.disasterreadychippewavalley.org American Red Cross Chippewa Valley Chapter: http://www.redcrossww.org SCORE (general business counseling): http://www.score-eauclaire.org

Other Nonprofit and Professional Associations:

Institute for Business & Home Safety: http://www.ibhs.org National Emergency Management Association: http://www.nemaweb.org National Fire Protection Association: http://firewise.org Public Entity Risk Institute: http://www.riskinstitute.org U.S. Chamber of Commerce: http://www.uschamber.com

Other Government Resources:

U.S. Department of Homeland Security Emergency Preparedness: http://www.ready.gov OSHA Emergency Preparedness: http://www.osha.gov/SLTC/emergencypreparedness/index.html Small Business Administration Disaster Assistance: http://www.sba.gov/services/disasterassistance/index.html Wisconsin Emergency Management: http://emergencymanagement.wi.gov/

Business Continuity Planning Organizations:

Business Continuity Planners Association: http://www.bcpa.org Disaster Recovery Institute International: http://www.drii.org The Business Continuity Institute: http://www.thebci.org

Business Continuity Planning Publications and Materials:

Contingency Planning & Management: http://www.contingencyplanning.com Disaster Recovery Journal: http://www.drj.com Disaster Resource Guide: http://www.disaster-resource.com On-line Business Continuity Planning Course: http://nonprofitrisk.org/tools/buinsesscontinuity/intro/1-htm Glossary of Business Continuity Terms: http://en.bcmpedia.org/wiki/Main_Page Private-Public Partnership of Dane County: http://www.countyofdane.com/ems ASIS International Business Continuity Guideline. http://www.asisonline.org FEMA. Sample Business Continuity and Disaster Preparedness Plan. http://www.ready.gov/business Florida Partnership Business Continuity Plan Template http://www.fldisasterkit.com Michigan State University Critical Incident Protocol Program http://www.cip.msu.edu

Cyber Security Sites:

Department of Homeland Security National Cyber Alert System:www.us-cert.gov National Cyber Security Partnership: Small Business Cyber Security Guidebook: http://www.cyberpartnership.org/CommonSenseGuideBus.pdf National Cyber Security Alliance: Stay Safe Online: http://www.staysafeonline.info/

Pandemic/Avian Flu Preparedness:

City of Eau Claire Emergency Preparedness Information & Guides: http://www.eauclaire.wi.gov/government/emergency-preparedess Western Region Partnership for Public Health Preparedness: http://www.wrpphp.org Wisconsin Pandemic Flu Resource: http://pandemic.wisconsin.gov Centers for Disease Control: http://cdc.gov U.S. Government Pandemic Flu: http://pandemicflu.gov Critical Infrastructure: Pandemic Planning http://pandemicflu.gov/plan/pdf/CIKRpandemicInfluenzaGuide.pdf Also contact your county health department.

Emergency Evacuation Preparedness:

Guide for People with Disabilities and Other Activity Limitations: http://www.cdihp.org/training American Red Cross http://www.prepare.org/disabilities

Family Preparedness
City of Eau Claire Emergency Preparedness Information & Guides: http://www.eauclaire.wi.gov/government/emergency-preparedess

d.

Overview of Hazard Risks in the Chippewa Valley

Natural Hazards Natural hazards have a long history in the Chippewa Valley and surrounding area:

Recent area tornado history includes 1958 Colfax, 1994 Foster, 2001 Siren, and 2002 Ladysmith. Since 1983, approximately $10 million in property damage has been due to lightningcreated fires in Eau Clare County. High straight-line winds and/or hail can cause significant damage to windows, outside inventory, and storage structures. Expect 3 to 4 winter storms each year. Temperatures dipped to -45F in January 1951. Serious ice storms or freezing rain events every 2.4 years. A serious flooding event occurs every two to three years on average, with growing stormwater flooding concerns in the area. The 1993 floods caused over $10 million in damage, including damages to more than 50 businesses, in Eau Claire County alone. In 2000, about 8 of rain fell within 24 hours causing stormwater flooding damage in the area. Many structures not within a 100-year floodplain do not have flood insurance.

Eau Claire Flooding, 1905

Swine Flu (H1N1) has raised awareness of potential pandemic threats with new cases continuing to be reported. To date, Avian Flu (H5N1) has not been confirmed in the U.S., though it has a much higher death rate than the Swine Flu.

Technological Disasters Chemical spills and infrastructure failure (power outages, bridge collapse, dam failure) are types of technological disaster, which may be induced by a natural hazard event. Some example threats:

In 1996, the City of Weyauwega was evacuated for 16 days to due to a hazardous materials spill related to a train derailment; this same rail line runs through our area. In the Winter of 1998, over 4 million persons in the Montreal area were without power (some for over 3 weeks) due to an ice storm. Large portions of the cities of Chippewa Falls and Eau Claire lie within a dam shadow.

Designer Disasters Designer disasters include acts of domestic or international terrorism, including bioterrorism, cyber-terrorism, eco-terrorism, bomb threats, sabotage, and other purposely induced natural or technological hazards. Such acts have been uncommon and largely limited in the Chippewa Valley to pipe bombs, arson, or vandalism. 5

Organizational Hazards Some organizations may be drastically impacted by the loss of a key employee, a piece of critical equipment, a key supplier, or a large customer. Product recalls, certain regulatory changes, or labor relations can also impact certain businesses. Not all business continuity plans encompass such threats which are often specific to an organization, though such hazards can be as devastating to operations as a natural disaster event. Each organization should individually assess the need to encompass organizational hazards within their plans scope.

Weyauwega Train Derailment, 1996

Siren Tornado, 2001

WRR Environmental Services Fire, Eau Claire, 2007

e.

DRCV Business Continuity Plan Template

Disaster Ready Chippewa Valley developed a companion document to this guidethe DRCV Business Continuity Plan Template. The template was compiled from a review of a numerous different planning models, offering local businesses and organizations an easy to understand fill-in-the-blank style template. The DRCV template includes ten sections encompassing existing conditions (business information, key responsibilities, critical resources), assessment, and recommendations (action plan, human resources, sheltering/evacuation, vital records). The DRCV template should be considered a starting point. You may need to modify and amend the document to best address the circumstance of your organization. For some businesses, certain sections of the plan template may already be complete and can be referenced or attached (e.g., emergency contact information, data management plan).

f.

Action Plan Ideas

The action plan is an important part of your business continuity plan (see Section 6 of the DRCV Business Continuity Plan Template). The following is a list of action plan ideas taken from the Private-Public Partnership of Dane Countys Ready Your Business: 12 Point Program for Success to Business Continuity Planning. No Cost Identify two or three contractors or supply sources for emergency items. Pre-qualify with alternate suppliers/vendors for emergency accounts Calculate the cost of business interruptions for one week, one month and six months. Ask your insurance company or agent about policy coverage and costs. Write a short checklist of recovery action items for your firm. Maintain a current emergency contact list for employees and emergency services, such as police, fire and utilities. Contact your city or county building department to determine the Base Flood Elevation (BFE) and the Design in Flood Elevation (DFE) at your location and your buildings susceptibility to flooding. Keep your buildings flood vents clear of debris or other blockage. Conduct a fire drill and check with your local fire department to determine FIRE risk at your location. Talk to your people about the companys disaster plans. Two-way communication before, during and after a disaster. Set up a telephone call tree and alternate employee communication procedures. Keep some cash and an ATM card or credit card on hand. Identify an alternate location if your building becomes unusable Talk to utility service providers about potential alternatives and identify back-up options. Promote family and individual preparedness among your co-workers; include emergency preparedness information during staff meetings, in newsletters, in company intranet, in periodic employee e-mails, and other internal communications tools. Request no-cost publications from FEMA (800) 480-2520 for individual, family and workplace preparedness Under $100 Purchase a First Aid Kit. Purchase and store bottled water for emergency use (two days minimum). Stock a supply of non-perishable foods, paper plates, napkins and plastic utensils. Purchase a NOAA Weather Alert Radio with S.A.M.E. technology to program for your specific area. Buy a stock of flashlights, batteries, pens, paper, paper towels, packing tape, etc. for disaster supply kit. Keep supplies of items such as duct tape, waterproof plastic, shut-off wrench for water and gas, whistle, compass, plastic bucket with tight lid, work gloves, pliers, hammer, plastic garbage bags and ties. Purchase/maintain camera and film.

Purchase an AM/FM radio, battery operated, or hand crank radio. Restrain/secure desktop computers, compressed gas cylinders and other small items from earthquake shaking. Elevate valuable contents on shelves above base flood level. Apply asphalt cement under tabs of loose shingles. Caulk/insulate around openings in outside walls, roof and attic. Purchase fire extinguishers and smoke alarms Attend annual Ready Your Business Conferences (Utah Division of Homeland Security) $100 - $499 Provide C.E.R.T./ First Aid and CPR training for employees. Purchase all items from the workplace supply list. Purchase a small back-up generator and maintain fuel. Purchase and maintain fuel for a sump pump. Brace major appliances, such as water heaters, and furnaces to the floor or wall. More than $500 Purchase and install a multi-KV generator, pre-wired to the buildings essential electrical circuits. Purchase removable shutters/ install permanent shutters for wind-borne debris protection. Re-roof with an impact resistant roof covering. Install high wind connectors in roof systems. Re-roof with Class A fire resistant roof covering in wildfire prone areas. Hire an engineer to evaluate the buildings wind or seismic resistance. Conduct a one-hour drill simulating the occurrence of a flood, earthquake or other hazard. Send the key safety/emergency response employee to several days training or conference. Purchase additional insurance (business interruptions, loss of income, extra expense, flood, earthquake). Store duplicate records off site at a secure facility. Purchase a removable computer storage device, store data off-site. Establish a voice communications system to meet your emergency needs e.g. voicemail conference call capability, Private Branch Exchange (PBX), Automatic Call Distribution (ACD) system. Install a monitored smoke alarm system. Install lightning protection system.

Given current concerns with pandemics due to the H1N1 (Swine Flu) virus, information on small business planning for pandemics has been included as an attachment at the end of this guide.

III. PUTTING YOUR PLAN INTO ACTION

a. Management Commitment
Business continuity planning should not just be an exercise. It takes a commitment of time to fully develop a plan and a completed plan may include recommended actions which change policies or require an investment to protect critical business functions. Top down leadership is vital to ensuring accountability in plan development, implementation, and maintenance. The senior leadership of your organization should be committed to undertaking a business continuity planning effort from the start and, if possible, have an active role as part of the planning team. Once the plan is completed, management approval is also needed, as well as a commitment to periodically review and update the plan. The roles of management will vary by organization.

b.

General Implementation

The action plan section of the DRCV Business Continuity Plan Template prompts the planning team to identify needed resources and a key responsible party for each strategy. When possible, add a completion date for each strategy and ensure that the key responsible parties are aware of management expectations. Communicate your plan recommendations and emergency procedures to employees and supervisors. Go that extra step. Some business continuity models suggest detailed forms be completed for each employee, key supplier/vendor, key clients, essential equipment, and each vital record. One such source for such forms is the Institute for Business & Home Safety.4 Though the DRCV template does not include such detailed forms, we encourage you to take your plan to the next level and incorporate such documents.

c.

Testing and Training

Exercises, drills, and training are important parts of plan implementation. Sections 7 and 8 of the DRCV template prompt you to identify a training approach. It may be helpful to attach a calendar or list of key dates for testing and training.

d.

Plan Evaluation and Updates

Your business continuity plan is a living document, and should reflect the dynamic world in which we live. It is recommended that you evaluate and update your plan at least annually. As part of your evaluation, also review progress on the implementation of your action plan and other plan recommendations. Consider scheduling your plan evaluation and update to immediately following testing and training; strengthen your plan based on the lessons learned during your training exercises. Changing conditions or a new risk may require a plan update between your normally scheduled evaluation dates. Section 10 of the DRCV Business Continuity Plan Template addresses plan evaluation and updates.
Open for Business: A Disaster Planning Toolkit for the Small to Mid-Sized Business Owner. www.ibhs.org/business_protection. Also includes a property protection checklist.
4

Special Addendum: Small Business Planning for Pandemics

The following information was taken from the Private-Public Partnership of Dane Countys Ready Your Business: 12 Point Program for Success to Business Continuity Planning. The CDC checklist, www.pandemicflu.gov/plan/businesschecklist.html is a great resource for large companies, but may be difficult to read or follow for small businesses. We have collected information that may be useful for small businesses that are trying to prepare for a pandemic. This document may be changed as new information becomes available, so check back for updated versions. All businesses, even small ones, need to prepare for a pandemic. Small businesses have fewer workers and less capital, and are more likely to have difficulty operating under trying times. Spend some time planning now to save your business later.

First thing to do:

Find your important documents (such as business licenses, accounts, etc.) and be sure you have backup copies. Make paper copies of essential documents. If your power goes out for a long period, what papers would you need to continue running your business? Providing food (grocery, farmers), water (public utilities), commerce (banks), energy (electricity, gas), transportation (mass transit, repair, cargo transport), healthcare (doctors, nurses, hospitals), public safety (police, fire, EMS,), and communications (phone service) are examples of critical or essential services. Do you sell essential products or provide any essential services?

Communicate with your workers:

Talk to your workers NOW and work together to plan for an emergency. If your workers are part of a union or labor group, involve them as well. Keep a current list of phone numbers for your employees so that you can contact them during an emergency. Encourage workers to get an annual influenza vaccination (flu shot). Help your workers prepare emergency kits for themselves and their families. Educate Workers on the importance of: o Hand washing o Respiratory etiquette (cover coughs and sneezes, using disposable tissues when possible) o Healthy diet o Exercise

10

o How to recognize the difference between influenza (flu) and a cold (influenza is much more severe, it hits you very suddenly, you have fever and aches) o The difference between seasonal flu and pandemic flu (seasonal flu comes every year, pandemic flu is when the flu strain changes and people may become much sicker than usual, and some may die).

Reduced number of workers:

You may only have half of your workers during a pandemic. Some will be sick, and some may stay home to take care of sick family members or care for children. Here are some ideas on how you can keep your business open during a pandemic or other emergency. Limit some of your services. At a minimum, try to provide essential services during a pandemic or emergency situation. Reduce the hours you are open for business. Cross-train your employees. Make sure that you dont have only one or two workers that know how to do a critical part of your work. If they become ill, you would have difficulty keeping your business open. Recall and retrain retired workers. Keep home numbers and addresses of workers who have retired. You may need to ask them to help during a pandemic or other emergency. Plan on selling, servicing, and making products with fewer workers. If you are out sick, will your business continue to operate? Identify workers who can make key decisions in the absence of owners/managers.

Social distancing:
If a pandemic occurs, you may be asked to have your business participate in social distancing. This means that people should stay at least 3 feet apart from each other. Here are some ideas that can help: Encourage frequent hand washing. Limit face-to-face contact. o Try to reduce people standing in lines or crowds. o Ask customers to stand further away from workers and each other. o Install plexiglass panels between workers and customers. o Use telephones to communicate with customers or internal staff. o Stop hand shaking o Spread out seating in meetings, or meet via teleconference. o Stop sharing of workstations. o Avoid unnecessary meetings. o Limit the number of people on elevators, and encourage people to use the stairs.

11

o Have your business work additional shifts or stagger shifts, with fewer workers per shift, to increase the distance between employees. o Have your employees work from home.

Plan ahead:
Keeping your workers healthy is one of your biggest priorities. Sick workers much not come to work, or stay at work, because they can infect your other healthy workers.

Review your sick leave policies. During a public health emergency, sick workers
must not come to work, even if you are short-staffed. Do not allow sick employees to stay at work. You must not punish employees if they are sick during an emergency. Establish clear policies and guidelines not that will help employees understand options and expectations for when they are ill.

What will your business do if a worker becomes ill while at work? Provide soap and hot water or alcohol-based hand sanitizers to your employees.
Provide disposable tissues.

Mass transit (such as crowded buses) may be suspended during a pandemic.

Gasoline may become very expensive and/or difficult to get. How will your employees get to work?

Develop infection control practices, such as decontaminating office surfaces, such

as phones, keyboards, etc. daily.

Other things to consider:

Long distance travel may be temporarily stopped. Try to avoid travel (especially to affected areas) by using teleconferencing or video conferencing. See if there are local suppliers available to your business. Do you have employees with special needs, such as disabled workers or those unable to read/write, etc? How will they be cared for? If a pandemic occurs, your suppliers may be cut off. Can you increase your inventory of raw materials? How will you communicate with your customers, suppliers, and general public during an emergency? Do you have a website? Use password-protected websites to communicate sensitive information with employees. Make sure that you can access TV, radio, and/or the internet at work to follow developments as they occur. How will your business be affected by a pandemic? For example, if mass gatherings are cancelled, would your business be affected? Some businesses may be very busy during a pandemic, such as gas stations, grocery stores, etc.

12

13

14