At its most basic a business continuity plan will “outline the instructions and procedures your law firm needs to follow when faced with a disaster (flood, cyberattack, fire or coronavirus pandemic).” This proactively initiated and implemented plan gives your business its strongest chance of surviving the disaster.
It’s rare that a business or individual gets much warning that a disaster is on its way. With coronavirus, we were given warning of its potential impacts on individuals and businesses, but even the initial warnings likely didn’t prepare many law firms for the true impact of this disaster on its practice.
The benefit of your BCDR (business continuity and disaster recovery plan) is that it is a document you would have (best case scenario) drafted and tested prior to the disaster. A BCDR may be your business’s best chance at recovery. That’s not to say that a business that doesn’t have a BCDR can’t survive a disaster, it may just take longer, cost more and cause higher anxiety than if you’d had a plan in place. However, that being said, FEMA has noted there is a likelihood that between “40% and 60% of businesses will not survive this threat.” That could be because of a myriad of reasons, but we believe a BCDR would have given those organizations a fighting chance.
How To Draft A Business Continuity Plan For Your Firm
What is a business continuity (BC) plan?
This part of the BCDR refers to how you will maintain the business functions and/or how you will be able to quickly resume business operations if there is a major disaster including: fire, cybercriminal attack, weather event or COVID-19.
When you work with a BCDR expert he or she will work with you to outline the plan and procedures and instructions everyone in the organization needs to follow when faced with a disaster. This part of the plan covers:
- Business processes
- Human resources
- Business partners
- Business assets
For example, how would get in touch with your staff, the manufacturing department, your legal department, HR and others if there were a disaster or emergency? How quickly can you not only get in touch with them, but rally the resources necessary to set up off site, if necessary, to continue operations without a stoppage?
Where will your staff work? If you had planned for them to work in an off site location, is the owner of that location prepared to accommodate them? Did that off site location survive the disaster itself? If the staff cannot come into the office, are they prepared to work from home? Do they have the access to information and software and hardware necessary?
Part of the business continuity plan incorporates a business impact analysis. When we work with you we will help you identify what the potential impact of sudden and immediate loss of business functions would be and what the cost impact is. The BIA evaluates what tasks should be, or could be, outsourced, what are essential and non essential tasks and what are the risks? The business impact analysis gives you an overview of your firm’s processes and workflow and helps determine those that are vital to viability.
What is the bottom line importance of business continuity planning?
Owners of small or large practices understand the need to remain competitive. That need involves customers, increasing customer base and billable hours, correct? Don’t wait for your firm’s capabilities to be put to the test when in the middle of an emergency.
The importance of IT and infrastructure
For many businesses, keeping the IT infrastructure viable and accessible is crucial. If you have an IT department, they can certainly be called upon to implement the solutions put forth in the BCDR, but they aren’t typically the ones involved in the initiation of the plan.
The BCDR will spell out strategies for remote employees to access data and the need for firewalls, VPNs and training of remote staff. The IT department will implement those as spelled out.
How is a business continuity plan developed?
- An assessment of the business will be completed
- Areas of vulnerability will be noted
- The estimated cost of losses will be calculated if the processes go down for even a day
A plan will be developed that includes:
- The scope will be identified
- Key business areas will be identified
- Crucial functions will be identified
- Dependencies between different departments, business areas, and their functions will be identified
- “Acceptable” downtimes will be calculated
- A robust plan will be drawn up that helps your firm maintain operations throughout the emergency or disaster
You will be given a checklist that will include:
- Necessary supplies and equipment
- Location of data and offsite backups
- Where is the plan housed
- Who should have, and does have, access to the plan
- Who has the contact information for principles named in the plan
The BC is a portion of the BCDR. The DR assumes your business has a continuity plan in place. But don’t assume all aspects of the disaster recovery plan have been tested for viability. This is something that needs to be part of your ongoing business operation.
Why should you test the BCDR?
Having a fire escape plan for your home or office is great BUT what if you never tested it? What if the original escape routes had changed or the layout of the building had been changed? What then? You don’t want to wait until you’re trying to follow the fire escape route only to find the way is blocked by a building configuration the original fire escape plan never accounted for.
You may rest easier knowing you have a BCDR for your business and that is a great first step. BUT the plan needs to be tested rigorously and regularly. If there are outside vendors or sources who are part of the plan, they need to know they are expected to be involved and that they can accommodate you.
Set up a schedule within your law firm to test the plan. We recommend testing it and reviewing it at least quarterly.
How do you test a BCDR?
- Do a walk through
- Simulate a disaster and get all parties to play their roles
- Do a structured walk-through as though it were not a test
- Do a full scale disaster simulation test
It may seem like a lot of work, but you will be glad you’ve looked at all aspects of your plan in the event you need to implement it.
Ensure your BCDR works
If you want to ensure your BCDR will NOT work is to draft it then put it in a drawer and forget it. A BCDR is a living, breathing document that requires regular updating, implementation and testing. It is not a plan you create and forget. In times like these, with the #coronavirus you want to be able to breathe a sigh of relief knowing that your business is protected.
WareGeeks Solutions is a Roselle, New Jersey-based full-service IT solutions and service provider of cybersecurity, managed IT services and data backups protection. Our team specializes in Data Protection, specifically Business Continuity and Disaster Recovery (BCDR). We work with medium and large companies, with a focus on law firms and the healthcare industry.
WareGeeks Solutions help organizations transform technology, operations and service delivery to meet business challenges. We first seek to understand your business needs and then apply our in-depth knowledge of Data Protection, Business Continuity and Disaster Recovery (BCDR), Cyber Security whether in the cloud or your data backups center environments to drafting a roadmap for transformation.