There are many resources required for the preparedness program including:

• People
• Facilities
• Communications and warning technologies
• Fire protection and life safety systems
• Pollution control systems
• Equipment
• Materials and supplies
• Funding
• Special expertise
• Information about the threats or hazards

Consider the following examples:

If there is a fire inside a building, the fire alarm system warns employees to evacuate. An evacuation team guides employees to safe exits and outside to assembly areas. The fire alarm system, evacuation team and exits are resources.

When a primary facility cannot be occupied, a suitable alternate facility (if available) may be used. The alternate facility is a resource for the business continuity plan.

Needs Assessment:

A needs assessment should be conducted to determine resources needed. Resources may come from within the business including trained employees, protection and safety systems, communications equipment and other facilities owned or leased by the business. Other resources from external sources include public emergency services, business partners, vendors and contractors.

The availability and capability of resources must be determined - some are required immediately. For example, trained people (employees or public emergency services) capable of administering first aid or cardiopulmonary resuscitation (CPR) must be available to respond at a moment’s notice. Other resources such as plywood to board up windows in anticipation of a hurricane may be stockpiled in advance or purchased when a storm is forecast. Even if plywood is stockpiled in advance, temporary labor may be needed to install the plywood over windows and doors.

The availability of resources often depends on logistics. Logistics is the management of resources to get them to where they are needed when they are needed.

Assessing resources for the preparedness program begins with reviewing program goals and performance objectives. High-level goals of the program include:

• Protect the safety of employees, visitors, contractors and others who may be at risk from hazards at the facility
• Maintain customer service by minimizing disruptions of business operations
• Protect facilities, physical assets and electronic information
• Prevent environmental pollution
• Protect the organization’s brand, image, and reputation

Examples of performance objectives include:

• The first aid team (that is trained to administer first aid and perform CPR) will be able to reach any employee within two minutes.
• The evacuation team will be able to direct all employees to safe exits and account for them outside the building within four minutes.
• Customer service staff will begin contacting customers within 8 hours of a service disruption using office space and telephone service provided by a business partner.
• The primary network server will be restored within 24 hours with replacement equipment from your primary vendor and data restored from backup media retrieved from the secure storage site.
• Production of product A will resume within 1 week by displacing production of product B at Plant B.

For each objective, an assessment of resources needed to accomplish the objective should be conducted. Simple objectives may require limited resources. Aggressive objectives will require many resources with significant capabilities available on short notice. Remember, without sufficient resources, or if resources lack required capabilities, objectives may not be attainable.

Conducting the Needs Assessment

Besides identifying specific resources for the preparedness program, the needs assessment should answer other questions:

• What quantity of a resource is required?
• When will the resource be needed?
• What capability does the resource need to have? Are there any limitations?
• What is the cost for procuring or having the resource available? Are there any liabilities associated with use of the resource?

Resources

There are many resources needed to support the preparedness program. These resources can be organized into different categories:

• People
• Facilities
• Systems
• Equipment
• Materials
• Supplies
• Funding
• Information

Resources are needed for all phases of the program including prevention/deterrence, mitigation, emergency response, business continuity, crisis communications and disaster recovery.

Human Resources

Employees are needed to staff emergency response, business continuity and crisis communications teams. The emergency response team may be limited to employees trained to direct evacuation or sheltering. Some businesses may choose to organize emergency response teams to administer first aid, perform CPR and use automated external defibrillators (AEDs). Still others may train staff to use portable fire extinguishers. Regulations define minimum requirements that include training and organizing employees. Staff is needed to develop and manage the business continuity and crisis communication plans. The teams will likely be made up of employees working in their respective departments. Some staff may be assigned to work at alternate worksites if a primary worksite cannot be occupied.

Facilities

Facilities for emergency response include defined shelter space for protection from a tornado or interior space when “shelter-in-place” from an exterior airborne hazard is required. Facilities should also include a room that can be equipped to serve as an emergency operations center for supporting response to an incident. Other facilities needed include office space or a meeting room with communications equipment to serve as a communications hub.

Facilities for business continuity may include alternate workspace equipped for continuation of business operations. Alternate facilities may be owned or contracted including office space, data center, manufacturing and distribution.

Systems

Systems for emergency response may include detection, alarm, warning, communications, suppression and pollution control systems. Protection of critical equipment within a data center may include sensors monitoring heat, humidity and attempts to penetrate computer firewalls.

Every building has exit routes so people can evacuate if there is a hazard within the building. These exit routes should be designed and maintained in accordance with applicable regulations.

Business continuity resources may include spare or redundant systems that serve as a backup in case primary systems fail. Systems for crisis communications may include existing voice and data technology for communicating with customers, employees and others.

Equipment

Equipment includes the means for teams to communicate. Radios, smartphones, wired telephone and pagers may be required to alert team members to respond, to notify public agencies or contractors and to communicate with other team members to manage an incident.

Other equipment depends on the functions of the team. Automated External Defibrillators may be required for a first aid/CPR team. Fire extinguishers would be required for a fire brigade. Spill containment and absorbent equipment would be required for a hazardous materials response team or trained employees working in their assigned workspace. Personal protective equipment including hearing, eye, face and foot protection may be required for employees as part of a safety program.

Many tools may be required to prepare a facility for a forecast event such as a hurricane, flooding or severe winter storm.

Materials and Supplies

Materials and supplies are needed to support members of emergency response, business continuity and crisis communications teams. Food and water are basic provisions.

Systems and equipment needed to support the preparedness program require fuel. Emergency generators and diesel engine driven fire pumps should have a fuel supply that meets national standards or local regulatory requirements. That means not allowing the fuel supply to run low because replenishment may not be possible during an emergency. Spare batteries for portable radios and chargers for smartphones and other communications devices should be available.

Funding

Money invested in the preparedness program can pay big dividends if an incident occurs. Consider the benefits of a fire being controlled quickly; immediate medical assistance that saves an injured employee; or a recovery strategy that enables continued customer service. Spending funds prudently on preparedness can pay back multiple times when measured against the potential for damage to equipment, facilities, loss of staff, lost customers and lost revenue.

Internal Resources

There are many resources within your business that are needed for your preparedness program. These internal resources include staff for emergency response, business continuity and crisis communications teams. Other resources include facilities, systems, equipment, materials and supplies to support response, continuity and recovery operations. Identify needed resources and determine what resources are available internally. Resources that are not available must be obtained from external resources. Consider the following internal resources for your preparedness program.

People

Employees can be assigned the following tasks.

• Monitor weather forecasts and Emergency Alert System messages, broadcast warnings if severe weather is approaching or other warnings are broadcast, and alert the emergency response team
• Direct evacuation and shelter actions
• Administer first aid, CPR and use automated external defibrillators (AEDs)
• Provide facility security and take the lead on threats including bomb threats and suspicious packages
• Operate building detection, alarm, communications, warning, protection and utility systems
• Stabilize an incident using fire extinguishers; or cleaning up /containing small spills of hazardous chemicals
• Prepare a facility for a forecast event such as severe weather
• Clean up damage following an incident
• Lead the business continuity team; provide support for the team
• Execute recovery strategies for critical or time sensitive business processes;
• Serve as a spokesperson as part of the crisis communications team; communicate with employees, stakeholders and the news media; answer requests for information

Employees should be trained so they understand the importance of their assignments and follow established procedures. Some employees may be given the opportunity to learn new skills.

Facilities

Office space and meeting rooms can be used as an emergency operations center (EOC), which is a facility for incident management. The EOC is a place to bring together personnel, gather information, facilitate communications, procure resources and support preparedness, response, continuity and recovery efforts.

Rooms or areas within the interior of a building that are structurally strong can shelter people from a tornado. Unobstructed exits that are marked with signs and equipped with emergency lighting are essential to quickly evacuating people if there is a fire or hazard inside.

Owned buildings at another site may be used as alternate workspace if a building cannot be occupied. This depends upon the location of the building and whether the building would be affected by the same hazard that prevented use of the primary building. The alternate facility may be a viable business recovery strategy if the building can be configured with the required equipment or existing equipment can be configured to need business requirements.

Systems and Equipment

Many systems and equipment are needed to detect potential hazards and threats, protect life safety and property and continue business operations. These resources include:

• Detection systems (fire detection, burglar alarm or intrusion detection, computer network security, Emergency Alert System receivers and television, radio, for news and weather)
• Alarm systems (fire alarm, intrusion alarm and process system alarms)
• Warning systems (occupant warning systems include fire alarm, public address and tornado warning)
• Communications systems (landline telephones, cellphones, smartphones, email and data, radios and pagers)
• Pollution containment systems (primary and secondary building containment and devices to stop the flow of materials from tanks and piping)
• Fire protection and suppression systems (fire sprinklers, fire extinguishers, fire pumps and water supplies, special extinguishers for computer rooms and special hazards)
• Emergency power supplies (uninterruptible power supplies and generators).
• Building utility systems (electrical, plumbing, heating, ventilation, air conditioning and sanitary)

Evaluate these systems to determine whether they meet the needs of the program. Identify and plan to overcome emergency communication system limitations such as weak radio or cellular service or areas where a warning system cannot be heard. Upgrading this critically important system may be required. Verify that these systems are in reliable working condition. If fuel, battery backup power or batteries are required, make sure the system can run for the required time and chargers are available. Document how to operate these systems and mark the locations of controls. Make sure the information is available during an emergency. Many of these systems also require periodic inspection, testing and maintenance in accordance with national codes and standards. Train staff so a knowledgeable person is able to operate systems and equipment.

Materials and Supplies

There are lots of basic materials and supplies needed for the preparedness program. These "consumable" resources include clipboards, paper forms, pens and pencils. Sufficient copies of paper forms are especially important to do automated tasks manually. Flashlights with spare batteries are needed if the power goes out. Provision of food and water for personnel engaged in preparedness, response, continuity and recovery activities should also be addressed in the plan.

EXTERNAL RESOURCES

Preparing for an emergency, responding to an emergency, executing business recovery strategies and other activities require resources that come from outside the business. If there were a fire in the building, you would call the fire department. Contractors and vendors may be needed to prepare a facility for a forecast storm or to help repair and restore a building, systems or equipment following an incident.

An understanding of the availability and capabilities of external resources is needed to make decisions about the preparedness program. How long would it take the fire department to arrive? How do you reach a contractor late at night and how long will it take them to arrive? Determination of the response time and capabilities of external resources will help you identify gaps between what you need and what is available. Strategies should be developed to fill these gaps.

The following external resources should be identified within plan documents. Include contact information to reach them during an emergency and any additional instructions within the preparedness plan.

Public Emergency Services

(Note: one agency or department may provide multiple services)

• Fire
• Emergency medical services
• Hospital or emergency health care provider
• Rescue
• Hazardous materials
• Law enforcement (local, county, state police)
• Public health
• Public works

Contractors and Vendors

• Emergency services (hazardous materials cleanup, facility repair and restoration)
• Systems and equipment (procurement, inspection, testing and maintenance)
• Information technology (equipment procurement, data backup, recovery solutions)
• Business continuity (generators, temporary equipment, leased space, office trailers)

Partnerships

(*Reciprocal or mutual aid agreements)

• Business partners (suppliers, contractors, vendors and professional services firms that could lend assistance with services, temporary workspace and other resources)
• Businesses or civic organizations in the community

* Reciprocal or other agreements should be documented in writing if possible.

Logistics

Logistics considerations are an important part of the preparedness program to ensure that resources will be available when and where they are needed.

Compile an inventory of internal and external resources to identify their location, the operating procedures and the persons who can operate these systems. Also, note the estimated delivery or response time of external resources.

A person should be assigned responsibility for logistics and to manage resources to support the preparedness program. They should work with the emergency response and business continuity teams who can identify resource needs.

Logistics procedures should define procurement requirements including the names of employees who have the authority to issue purchase orders and contract for services. Procedures should also be established to expedite obtaining resources during an emergency. Open purchase orders with potential contractors and vendors will expedite the procurement process.

 

The actions taken in the initial minutes of an emergency are critical. A prompt warning to employees to evacuate, shelter or lockdown can save lives. A call for help to public emergency services that provides full and accurate information will help the dispatcher send the right responders and equipment. An employee trained to administer first aid or perform CPR can be lifesaving. Action by employees with knowledge of building and process systems can help control a leak and minimize damage to the facility and the environment.p>

The first step when developing an emergency response plan is to conduct a risk assessment to identify potential emergency scenarios. An understanding of what can happen will enable you to determine resource requirements and to develop plans and procedures to prepare your business. The emergency plan should be consistent with your performance objectives.

At the very least, every facility should develop and implement an emergency plan for protecting employees, visitors, contractors and anyone else in the facility. This part of the emergency plan is called “protective actions for life safety” and includes building evacuation (“fire drills”), sheltering from severe weather such as tornadoes, “shelter-in-place” from an exterior airborne hazard such as a chemical release and lockdown. Lockdown is protective action when faced with an act of violence.

When an emergency occurs, the first priority is always life safety. The second priority is the stabilization of the incident. There are many actions that can be taken to stabilize an incident and minimize potential damage. First aid and CPR by trained employees can save lives. Use of fire extinguishers by trained employees can extinguish a small fire. Containment of a small chemical spill and supervision of building utilities and systems can minimize damage to a building and help prevent environmental damage.

Some severe weather events can be forecast hours before they arrive, providing valuable time to protect a facility. A plan should be established and resources should be on hand, or quickly, available to prepare a facility. The plan should also include a process for damage assessment, salvage, protection of undamaged property and cleanup following an incident. These actions to minimize further damage and business disruption are examples of property conservation.

 

When an emergency occurs, the need to communicate is immediate. If business operations are disrupted, customers will want to know how they will be impacted. Regulators may need to be notified and local government officials will want to know what is going on in their community. Employees and their families will be concerned and want information. Neighbors living near the facility may need information—especially if they are threatened by the incident. All of these “audiences” will want information before the business has a chance to begin communicating.p>

An important component of the preparedness program is the crisis communications plan. A business must be able to respond promptly, accurately and confidently during an emergency in the hours and days that follow. Many different audiences must be reached with information specific to their interests and needs. The image of the business can be positively or negatively impacted by public perceptions of the handling of the incident.

This step of Ready Business provides direction for developing a crisis communications plan. Understanding potential audiences is key, as each audience wants to know: “How does it affect me?” Guidance for scripting messages that are specific to the interests of the audience is another element of the plan.

 

When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. A business continuity plan to continue business is essential. Development of a business continuity plan includes four steps:

• Conduct a business impact analysis to identify time-sensitive or critical business functions and processes and the resources that support them.
• Identify, document, and implement to recover critical business functions and processes.
• Organize a business continuity team and compile a business continuity plan to manage a business disruption.
• Conduct training for the business continuity team and testing and exercises to evaluate recovery strategies and the plan.

Information technology (IT) includes many components such as networks, servers, desktop and laptop computers and wireless devices. The ability to run both office productivity and enterprise software is critical. Therefore, recovery strategies for information technology should be developed so technology can be restored in time to meet the needs of the business. Manual workarounds should be part of the IT plan so business can continue while computer systems are being restored.

 

Businesses use information technology to quickly and effectively process information. Employees use electronic mail and Voice Over Internet Protocol (VOIP) telephone systems to communicate. Electronic data interchange (EDI) is used to transmit data including orders and payments from one company to another. Servers process information and store large amounts of data. Desktop computers, laptops and wireless devices are used by employees to create, process, manage and communicate information. What do you when your information technology stops working??

An information technology disaster recovery plan (IT DRP) should be developed in conjunction with the business continuity plan. Priorities and recovery time objectives for information technology should be developed during the business impact analysis. Technology recovery strategies should be developed to restore hardware, applications and data in time to meet the needs of the business recovery.

Businesses large and small create and manage large volumes of electronic information or data. Much of that data is important. Some data is vital to the survival and continued operation of the business. The impact of data loss or corruption from hardware failure, human error, hacking or malware could be significant. A plan for data backup and restoration of electronic information is essential.

 

When disaster strikes a business, the impacts include more than just the property damage and business disruption. Employees may be injured or temporarily out of a job. A disaster that affects a community may also damage employees’ homes or force them to stay with family or friends. The human impact could be significant.

Providing assistance and support for employees should be part of a business’ preparedness program. It should include communicating with employees and their families and providing support as appropriate.

Communicating with Employees

Following a disaster in the community, it is in the best interest of the business to communicate with all employees. Employee information, typically compiled in a human resource information system, includes home addresses and telephone numbers. Consider asking for additional information including home email addresses and cellular telephone numbers (for text messaging/SMS). Also, request the name and contact information of a family member or friend who can be reached in an emergency. The confidentiality of this information should be protected and only be available to authorized users who are operating from their office, emergency operations center or alternate business facility.

If the business uses an electronic notification system, the additional contact information should also be added to that database. Use call lists or the electronic notification system to contact employees and identify those who need assistance or are awaiting instructions from their employer. If your business has a call center, inform employees to contact the call center following a disaster to obtain official information. The crisis communications plan should include procedures to provide official information to call center operators.

Employee Assistance

Many employers have employee assistance plans (EAP) and providers. Services include access to professionals who can assist employees to deal with the emotional impacts of a disaster. Employers can also arrange for services from professionals within the community. Reach out to public officials and mental health providers within the community to identify services that may be available to employees.

Whether an emergency or disaster affects the local community or a remote location where employees may be working or traveling, you need to account for all employees as part of the emergency response plan. After accounting for all employees, assess the potential human impacts and determine appropriate assistance.

Following a major incident, you may want to open a family assistance center or direct employees to an assistance center opened by local officials or FEMA. Locating and applying for Federal disaster relief is available online. Consider employee needs for short-term assistance, including advances on future wages. Provide assistance to employees in accessing available benefits.

 

When an emergency occurs or there is a disruption to the business, organized teams will respond in accordance with established plans. Public emergency services may be called to assist. Contractors may be engaged and other resources may be needed. Inquiries from the news media, the community, employees and their families and local officials may overwhelm telephone lines. How should a business manage all of these activities and resources? Businesses should have an incident management system (IMS). An IMS is “the combination of facilities, equipment, personnel, procedures and communications operating within a common organizational structure, designed to aid in the management of resources during incidents”.

The National Incident Management System (NIMS) was established by FEMA and includes the Incident Command System (ICS). NIMS is used as the standard for emergency management by all public agencies in the United States for both planned and emergency events. Businesses with organized emergency response teams that interface with public emergency services can benefit from using the ICS. ICS is also well suited for managing disruptions of business operations. Public information and crisis communications are an integral part of the ICS structure.

When an incident occurs, incident stabilization activities (e.g. firefighting, damage assessment, property conservation) may be underway at the scene of the incident. Others assigned to support incident stabilization, business continuity or crisis communications activities will report to an emergency operations center (EOC). The emergency operations center is a physical or virtual location from which coordination and support of incident management activities is directed.

The Incident Command System and the use of an Emergency Operations Center supports incident management.

If there is a fire in the building would employees know what to do? Are they familiar with the system that would alert them to evacuate, shelter or lockdown? Do they know who is in charge during an emergency? Do they know who is authorized to speak with the news media? Are employees familiar with their responsibilities for building and information security? Can they carry out their assigned responsibilities during an emergency or business disruption?

Training is essential to ensure that everyone knows what to do when there is an emergency, or disruption of business operations. Everyone needs training to become familiar with protective actions for life safety (e.g., evacuation, shelter, shelter-in-place and lockdown). Review protective actions for life safety and conduct evacuation drills (“fire drills”) as required by local regulations. Sheltering and lockdown drills should also be conducted. Employees should receive training to become familiar with safety, building security, information security and other loss prevention programs.

Members of emergency response, business continuity and crisis communications teams should be trained so they are familiar with their role and responsibilities as defined within the plans. Team leaders should receive a higher level of training, including incident command system training, so they can lead their teams. Review applicable regulations to determine training requirements. Records documenting the scope of training, participants, instructor and duration should be maintained.

If emergency response team members administer first aid, CPR or use AEDs, they should receive training to obtain and maintain those certifications. If employees use portable fire extinguishers, fire hoses or other firefighting equipment, they should be trained in accordance with the applicable OSHA regulation. If employees respond to hazardous materials spills, they also require training.

Pre-Loss Inspection

Disaster Planning coupled with a pre-loss inspection of your buildings and inventorying your property that is covered under your policy, is a critical and important function which may facilitate a quicker and equitable settlement of your claim as a result of a catastrophic event.