September 11, 2001
The most tragic events that comes to mind, of course, are the attacks on 9/11/2001. Not only was there tremendous loss of life and property, but many businesses were totally decimated. I bring up 9/11, not for shock value, but to highlight an important point. Can an organization plan for such devastation? Some businesses were totally decimated on 9/11. If your corporate headquarters were destroyed, and all personnel were lost, would your business survive? Do your BCP and DRP currently address such a scenario?
Hurricane Katrina has become the costliest and one of the deadliest hurricanes in the history of the United States. It was the sixth-strongest Atlantic hurricane ever recorded and the third-strongest hurricane ever recorded making landfall in the United States.
The levees had been constructed to withstand a Category 3 storm, even though storms exist with forces up to Category 5 winds. This was a trade-off. The likelihood was that a Cat 5 storm would not hit the Gulf Coast. After all, it hadn’t happened before. Therefore, the decision was made to settle for the more likely risk of a Cat 3 storm. The cost of increasing the protection from Cat 3 to Cat 5 would have been astronomical.
How would the government have justified the additional expenditure for what was probably considered a very low probability risk? Furthermore, how do you build something to withstand a storm that hasn’t hit before? Do you really understand the true impact of such a storm? At the time, the decision likely seemed correct.
What measures can you put in place "just in case" such an extreme situation occurs, even if you don’t build out your plan for the worst case? In New Orleans, some 200 school buses sat underwater in a flooded parking lot. Why weren’t they used? Should there have been such a plan in place? If there was, why wasn’t it executed?
Let’s look beyond the immediate impact. What about off-site storage or a backup facility? It’s a common practice that there should be "geographic separation" between the primary site and its back-up site, as well as the off-site storage facility. Would that have been sufficient in the case of Katrina? This storm affected the entire Gulf coast. What if businesses in New Orleans had a back-up site in Mississippi and off-site storage just over the border in Texas? Would those sites have escaped damage? Perhaps not.
When considering a back-up site or an off-site storage facility, consider the type of events that might occur. If you’re on the Gulf coast, perhaps look further inland for these facilities. Learn your lessons from those that have gone before.
The 100-Year Flood
In June 2006, the DC/Metro region was hit with severe flooding. Some areas got hit with as much as 14 inches of rain in a 24-hour period. Several federal buildings and museums were shut down, and it was expected to take a week to clean the Justice Department’s headquarters. It actually took much longer. Ironically, there was a flood that hit DC back in 1904, almost exactly 100 years earlier. While I was unable to find references to this flood online, there are archive photos of that event in a building where I work in downtown DC.
A 100-year flood is calculated to be the maximum level of flood water expected to occur on average once every 100 years. It is sometimes referred to as the one percent flood because there is a one percent chance of it occurring in any year.
Information on 100-year flood levels is generally available through your insurance companies because they make use of this for calculating the risk of coverage they are providing. Your organization should have reviewed this information when developing their BCP and DRP plans.