How to write a Contingency Plan

You know that you should have written the contingency plan years ago. You have had it on your 'to do' list for the last three years, but 9/11 has pushed the priority up a few notches. Now your boss is asking about a contingency plan and all you can do is stammer about how you've wanted to do this for a long time, but just never had the time, manpower or money. But now the auditor is telling your boss to get one, and he is telling you to get one, and you look around and you still don't have the time, manpower or money. But nobody cares...and you have to do it!!

You've read the articles and you know how to do it, but you just don't know how to start. The secret is you write a contingency plan the same way that you eat an elephant. You do it one bite at a time. You just have to get a pen and paper, or keyboard and computer and start listing the things that can effect your area of responsibility. Live in California, Washington or Missouri ? Better put down earthquakes. Live in Florida, Texas or South Carolina ? Better figure on Hurricanes (or Typhoons if you live in Hawaii). And depending on your industry you may have to worry about terrorism. We all have to worry about fires, hazardous cargo spills, strikes and freak weather. We also have to worry about hardware and software failures. Hardware is not as bad now as it used to be. Heard of anyone being down for a week for a disk drive lately?

Once you have a list of the potential problems, pick one. I know that everyone wants you to do them all, and right now. But we are going to pick the most likely, wide ranging one on your list. We plan for this one and all of the others are modifications of this plan. Being from Washington State, I like to use Earthquakes. Others may want to use floods, or Volcanoes, but I prefer a simple, plain vanilla earthquake.

OK, take out your plan and write 'Earthquake' on the top. This is what we are planning for. Let's think about what this is going to do to the area. Is it a small isolated earthquake that knocks down a couple of walls and puts your data center out of business for a day or two? If it is a small earthquake, you can probably bring up a couple of applications on PC's and people can work manually until the computer room is squared away and you can return to full processing.

If it is the big one, what functions are you really going to do? Payroll surely. Are you going to worry about who your top customers are or is anyone going to be making sales calls to drum up new business? Probably not. Concentrate on the payroll system and any other 'business critical' systems. What is a 'business critical' system? Something that you have to do. Work in a hospital? Then it is taking care of patients. Work for an Electric Utility? Then it is getting the power flowing. Only you can decide what is 'business critical'. (And in spite of what the sales department says, getting their bonus checks out is not business critical). Can you do it manually? Can you put together a system on a PC that can get you by? Can you have everyone take a draw on their salary until you can get the payroll system back up and running? These are the answers you are going to have to come up with while you have the luxury of giving it some serious thought while it is still quiet. You don't want to make these decisions when thirty people are all clamoring for your attention in the pouring rain while you look at the remains of your computer center.

Make a list of these questions and put them any random order. Just write them down as they occur to you.

Now comes the fun part. Lock yourself in a room, forward the phone and announce that your unavailable for...an hour. What, you can't write a contingency plan in an hour! I know that! But we are not going to write a contingency plan. We are going to put together the start of an outline. Remember, you eat an elephant a bite at a time.

Start thinking (and writing) about your disaster. You are in the computer center and the ground starts shaking. Or flames erupt. Or water starts shooting under the door. What is the first thing you are going to do? Right, protect yourself! You are not going to throw yourself on the computer to protect it from falling debris, get real. OK, after you are safe, what about the other people in the computer room? I guess we have to take care of them, too. NOW we look at the computer, after everyone is safe. Do we need to evacuate the building? Do we have time to grab the contingency plan or throw a tarp over the computer? (You should be writing this down, now). Make a list of things that you would do. An outline that looks something like this (but that covers your work, not mine):

1. Initiate response to protect life and minimize property damage
2. Assess the damage
3. Determine level of response needed
4. Implement plan at the appropriate level
5. Establish a control center for disaster response
6. Notify management
7. Start disaster recovery logs
8. Notify teams and start plan
9. Assess damage and list replacement equipment and supplies
10. Arrange for repair, rental, or purchase of equipment
11. Designate and secure backup site

OK, that is enough to give you the idea. Just continue on in that vein. Then go back and put notes under these headings like so:

1. Initiate response to protect life and minimize property damage ¨

• Get new fire extinguishers
• Grab the disaster recovery book on your way out (whoops, we had better put a copy by the door so we can grab it on the way out).
• Put the emergency numbers by the phone (do we have a list of the emergency numbers?)
• Check on insurance
• Cover computers and racks with tarp if the machine is getting wet (tarp in blue box by computer)

2. Assess the damage

• Is it minor or major?
• Can we run and do any work
• Can we salvage printers , scanners, etc.

You get the idea. Keep this up for four or five more passes at the information and soon you will have a Contingency plan for your company. Relatively painlessly, too.

Now, let's call someone from every section of the company together and walk through it. What did you forget? Whoops, don't have a list of all the equipment in use? Better make that a priority assignment for someone. Can you get a replacement for that old piece of computing equipment or scanner that John in shipping uses? Maybe you need to find a replacement or maybe it is time to replace the application now. You don't want to hold the process of recovery up because of a $100 part or have to teach John a new application when the whole company is waiting. Walk through it couple of times with everyone and see if they think they can get back to work without the computers or can they do their work until you can get the computers back. Better do this now and have a frank discussion with them about it. The time to fight over priorities is now. What application is first? Is it payroll or billing? And the answer can't be 'both'. But make provisions for your absolute, gotta run programs that are a concern. Is there someone nearby who will let you run your payroll on their machine in the middle of the night, if you pay their operator to stay? Try and make a deal with someone with extra capacity who is nearby that you can be a backup site for each other. But realize that you will need to keep extra capacity on your machine for them. And watch the disks as you grow, be sure you keep room on your machine for them. And be sure that they keep room on their machine for you. If that is not an option, do you have a manual backup system that you can put in place in moments. Can you put the skeleton of the payroll system on a spreadsheet. I think people will understand if their check is off by a buck or two until the system is back up and running. Can you buy and run a system from another branch in another state? Mirror sites or backup on the web? Start to take a look at what can be done and how to do it.

The main thing is to start today. Jot down a couple of thoughts. Get a notebook and label it 'Contingency Plan'. Then when the boss comes in you can honestly say you have started on it. Remember, take a bite every day or two and pretty soon that elephant will be gone.