Emergency Preparedness Planning 6: Incident Response

In the previous articles we discussed risk assessment, the importance of establishing what risks and threats your business faces and how some of them can be prevented, avoided or their impact reduced to manageable levels. But, when an emergency occurs, it is still likely to give you very little preparation time, and it is essential that everyone know what to do during the incident response phase if the impact is to be minimized.

95% of managing and recovering from a disaster is the emergency plan itself. If you have carried out your risk assessment, implemented the necessary investment or policies to avoid or mitigate against each risk, creating the emergency plan should just be a case of pulling all these critical pieces together in a single document.

Dealing with an incident then becomes almost entirely a matter of referring to the emergency plan and following instructions.

A number of important points need to be remembered.

1. Make the plan accessible.

The emergency plan needs to be available to all who may need it, regardless of what the emergency is. A hard copy in the CEO’s office is not much use if the main administration building is on fire or under 6’ of water! If possible make the disaster recovery plan available on-line and in a form that can be accessed by remote devices such as smartphones and laptops. Ensure that everyone who might need access to it knows how to find it, and is sufficiently familiar with the document to be able to find the relevant section in an emergency.

2. Make the plan complete.

Even if you have procedures or infrastructure in place to prevent a specific emergency, you need to ensure that these are addressed in the plan. If you have off-site archives or back-up facilities, staff need to know how to access them, if you have flood prevention measures, details of the water levels that they can handle need to be available, if you have an earthquake-proof building, staff need to know that is where they have to be if an earthquake strikes. All of these areas should be included in the plan. Ensure that issues such as communication and escalation are considered and fully addressed.

3. Training and testing.

Continuity plans must be regularly tested, as unforeseen emergency situations can arise at any time. Testing your plan, even if only a desk-top exercise, is really the only way of knowing whether it will be effective in a genuine emergency.

4. Review.

The emergency plan needs to be a living document that takes account of feedback from actual incidents and tests. Following each test or genuine emergency, review the document to determine whether any problems need to be addressed or whether anything could have been improved. Ensure that any updates to the plan are circulated and added to every copy.

5. Be flexible.

Emergencies never run to plan! It is inevitable that something unexpected will happen to either lessen or make the situation more serious. Those on the spot trying to manage the situation and follow the plan, must know their delegated authorities and be able to take instant decisions to address an evolving situation knowing that senior management will support them.

6. Communicate.

The importance of communication can not be overstated. The emergency services and first responders need to be informed of the situation and then kept up-to-date with any changes. Staff, students and others on site need to be advised if they should evacuate, “shelter-in-place” etc. Those not on site need to know what they need to do, whether it be coming in to work to try to rescue documents, work from home or an alternative site to maintain business continuity and inform customers etc. You not only need to consider how you will get emergency messages out, but how you keep people informed. For your customers or users, there is nothing worse than not knowing what is going on, when normal business will be resumed or who they can contact for updates. An emergency notification system that also allows you to contact ALL interested parties can be extremely useful in helping to manage any emergency and ensures business continuity is not affected any more than necessary.

To read the first article in this series, go to Emergency Preparedness Planning: Identifying the Key Stages of your Disaster Recovery Plan. To read the 2nd article in this series, go to Emergency Preparedness Planning 2: Risk Assessment. To read the 3rd article in this series, go to Emergency Preparedness Planning 3: Continuity Planning. To read the 4th article, go to Emergency Preparedness Planning 4: Disaster prevention and avoidance. To read the 5th article, go to Emergency Preparedness Planning 5: Disaster mitigation. To read the 7th and final article, go to Emergency Preparedness Planning 7: Recovery.

Register for a free online demonstration of Regroup’s powerful, secure and easy-to-use mass notification and emergency messaging system or get more information, case studies and white papers about how Regroup helps in meeting your day-to-day and emergency communications needs, by talking to a Regroup Communications Consultant today at 775-476-8710.