by Joy Dike, PhD

As consultants, we have the privilege to present our risk assessment findings and recommendations to the decision makers in an organization - CEOs, CFOs, Executive Directors, heads of security, general managers, engineers, IT directors, school Headmasters, and more. More often than not, these are the people who have actively sought out having a risk assessment performed for their institution and are keen on improving security.

With that said, there are times when our findings and recommendations fall on deaf ears. Sometimes the decision makers are offended by our findings or don't believe us. ("We do TOO have radio communication between the lobby and 10th floor!") Sometimes they don't understand the terminology. ("Each of the locations surveyed that have visitor traffic should employ visitor management systems managed by the same SMS systems database allowing for universal reporting.") Sometimes they're frightened by the findings. ("You mean anyone can just hop over that broken fence and have access to the school campus?!") And sometimes they're overwhelmed by how detailed the assessment it. ("You mean that we have 531 active users in the access control database? But we only have 75 employees!")

While our risk assessments are always done in an unbiased and objective manner, we understand that hearing about your organization's or institution's risks and threats is sometimes hard to acknowledge. This is why at Invictus Consulting we make sure that each debrief meeting isn't complete until the decision makers thoroughly understand both the findings and the recommendations.

by Joy Dike, PhD

After Hurricanes Katrina and Sandy, many office buildings were flooded. Flooding is bad. Flooding with seawater? Even worse. You want to know why? Because a lot of these office buildings had all of their servers and electrical distribution equipment in the basement. With all of your systems located in the basement, a flooded basement becomes more like a business crisis. Also? After 6 months of no power getting to these units, batteries start to leak toxic gases. A bad situation became even worse.
 
Now we’re not saying that your business continuity plan or business impact analysis can do anything to prevent or account for something like this. If you have a business continuity plan, it surely covers dealing with the aftermath of a natural disaster like a hurricane. The issue with these particular hurricanes wasn’t that the buildings themselves were structurally damaged. The issue was that tenants couldn’t move back in for over 6 months because the electrical equipment in the basement was a hazard, and it needed to be cleaned up, replaced, remediated, etc.
 
A business continuity plan that covers just the bare bones of IT (like Mr. Smith works remotely, Mr. Grey works at home, Ms. Franks is on call, and Mr. Boot moves to the Chicago office) isn’t going to cut it here. These people may be out of the office for half a year. They may need new computers, phones, supplies. They need a place to work for the next 6 months. Do your business continuity plan and business impact analysis take extended evacuations into account? The IT aspect of your business continuity plan and business impact analysis needs to go beyond which of your IT guys works from home after a hurricane.  
 
Continue to follow us as we wrap up this extended discussion about business continuity plans and business impact analyses. Hopefully you have realized that there are unusual situations that most business continuity plans and business impact analyses don’t take into account.