When Hurricane Katrina blew across the Gulf Coast and devastated New Orleans, she left countless businesses broken in her wake after she essentially wiped out critical communications infrastructure; dowsed systems and facilities with dirty, debris-laden water; and brought business operations to a virtual standstill for weeks, which then stretched into months.
While politicians and pundits debate what went wrong in the aftermath of Katrina and sister storm Rita, one thing is for certain: The twin storms represented a wake-up call for multifamily companies about their own disaster recovery preparations and business continuity plans.
"We're not where we want to be if we were rated by Standard & Poor's," says Dan Haefner, senior vice president and CIO at Lane Co. in Atlanta. "Our backup plan is to write it down with pencil and paper." But Haefner notes that the recent hurricanes have galvanized his company, which is now rallying to develop a disaster recovery plan that would allow the Atlanta-based firm to resume business in 24 hours and have a backup operation in place.
It represents a smart move. No one can stop the forces of nature–hurricanes, tornadoes, earthquakes, and floods–nor does it seem that disasters conjured up by mankind–be they terrorist attacks or chemical spills–are predictable either. But companies can make sure that they are prepared, if not for every inevitability, at least for those that present the biggest threat to them. "You need to know what to plan for," says Philip Rothstein, president of Rothstein Associates, a consulting firm in Brookfield, Conn., that specializes in disaster recovery and business continuity issues.
Unfortunately, most companies are woefully unprepared for major, and sometimes even minor, disruptions in business due to natural or man-made act. "People generally live in denial," says Greg McDonald, director of telecommunications at Camden Property Trust, a Houston-based apartment REIT, which has shored up the foundation of its disaster plans. He notes that many suffer from the "cry wolf" syndrome: They've heard about the "storm of the century" so many times that eventually they just ignore the warnings.
When disasters really do strike, multifamily firms face multipronged challenges. Not only must they get business operations up and running while a storm rages, they must also stay in contact with individual properties as well as residents, supporting the corporate technology infrastructure and keeping everyone informed about measures being taken to resolve any disruptions caused by the disaster.
When Hurricane Wilma roared through Florida in October 2005, Rothstein's mother was stuck in her condo for six days without electricity and other amenities. "If someone in the management company had gone around and put up one sheet of information in the building," it would have gone a long way, says Rothstein. "It's not what you're doing or not doing; it's just having someone tell you something is being done."
Assess Your Risks
While disasters vary in their intensity and the types of damage they may cause, there are some concrete steps multifamily companies can take to protect themselves against their biggest threats. First and foremost, a company must assess the actual risk it faces from certain types of problems. "You [also] need to do a business impact assessment–what and how much your business could be hurt," says Rothstein.
It seems like a no-brainer that businesses in California may be more vulnerable to earthquakes while those on the Atlantic and Gulf coasts brace against hurricanes and the heartland contends with tornadoes. Terrorists have had New York in their sights in the past. But sometimes the risks are not so obvious, which can leave companies unexpectedly vulnerable. When heavy rains last fall took out many of New York City's broadband communications lines, some businesses were dis-connected, according to Jeff Thompson, president and CEO of wireless broadband provider TowerStream, based in the Big Apple.
Still, determining and addressing the most likely risks will help a company spend its business continuity dollars wisely and effectively. "Usually things that happen are not global," says Camden's McDonald. "One place may be affected by a flood or a power outage."
Develop a Plan
Once risk is determined, company management should sit down and develop a solid, specific business continuity plan, which is critical to getting a business up and running after a challenge. "If a corporation is [affected] by a major disaster and hasn't developed a plan beforehand, lots of luck," says Rothstein.
Such a plan ensures that everyone in the company knows how recovery should be handled and what is expected of them. It specifies a timetable for bringing a business back up within 24 hours to 48 hours, which is customary in such circumstances. "We're an instant gratification society," McDonald says. "We want it in five minutes, not a few days."
However, in situations such as Hurricane Katrina, where people also need to tend to their families, companies may opt for a more reasonable timeframe for resuming operations. "I've seen situations where companies have said they're not going to do anything for 72 hours," says Rothstein, who notes that, conversely, some companies might have a plan to be operational in 24 hours, "but lose their business in four hours."
A business continuity plan should include a number of elements: how to restore communications, how to connect with colleagues in the interim, who to contact for help with different aspects of recovery, and any other details relevant to resuming company operations. "It could be as simple as a list of the phone numbers of [people] working from home," says McDonald. Or, it could offer a communications alternative for workers. "With cable modem backup for T-1 lines, you can still conduct business, but it may not be 100 percent." For some of the businesses in New York affected by last fall's unexpected deluge, the wireless broadband offering WiMax proved to be a worthy alternative to the lost land lines, says Thompson.
Safeguard Your Information
Whatever the details of the plan, the technology component of it is essential. After all, the servers and systems in any company's network hold the data critical to bringing a business back to life, so any worthy plan calls for the regular backup of that data. And there's no reason to "reinvent the wheel" to get this done, says Rothstein. "There are backup tools and templates [on the market] ranging from $100 to five to six figures."
Still, it's not good enough to just back up data regularly. Those files also should be secured and easily accessible, which definitely does not mean dumping them onto disks and storing them in an extra room down the hall. "In Florida and Louisiana, primary and backup data was destroyed or inaccessible," says Rothstein.
Smart planning dictates that data should be sent off-site, and ideally to an official "warm spot," a data center that can mimic the operations of on-premises operations. "Physically and electronically, you must transport the data and verify that it is there," says Rothstein, noting that the best plan has data saved to internal servers that are sent to an external server as well.
This isn't a solution for every apartment firm. McDonald points out that the offsite data centers often used by huge companies can be cost-prohibitive for many smaller firms. But there are third-party companies able and willing to accommodate essential data for firms that aren't global giants.
Others, such as Lane Co., rely on their business partners. Because Lane uses multifamily technology firm RealPage for its software applications, Lane's data is automatically shunted to RealPage's servers, Haefner says. But the CIO quickly points out that apartment companies must ensure that the third-party companies that they use are also well-prepared for disaster and interruptions to business operations. RealPage, Haefner says, has completed a Sarbanes-Oxley audit designed to ensure data integrity, so there's a "pretty good comfort level there."
Apartment executives can increase their confidence in their own plans by testing them thoroughly and frequently. "You have to have a test process to make sure the system is backing up properly," Haefner says. His advice is echoed by Rothstein, who has seen companies develop elaborate backup plans, only to have them fail in a real disaster. "They never tried restoring the data and validating it," he says.
Once a company has a good plan, though, executives must ensure it stays up-to-date, just in case the worst happens. "If a corporation has developed a plan and not maintained it, it can actually be more dangerous," Rothstein says.
–Teri Robinson is a freelance writer in New York.
