Online Roadmap

 

 
Dear Early Reader – I welcome you to the Online Roadmap!

The Online Roadmap is intended to be used with the Ultimate Business Continuity $uccess Guide. Many of the steps map to detailed chapters in the book. I hope you enjoy the book and the Roadmap. Please contact me with any questions.

The Online Roadmap

ID Chapter Category Name Description
0
2
Prepare for Success Position your program to demonstrate your indispensable and unique value to your organization! It is time to change the misconception of what we bring to an organization. Position your program for our true value!
– Resilience: the difference between an organization being destroyed or severely impacted during an event as opposed to surviving and thriving
– Process improvements: uniquely understanding the business and suggesting bottle line improvements
– Revenue generation: I discuss specific projects, all of which I have succeeded in that help my employers generate more revenue
– Cost reduction: I discuss specific projects, all of which I have succeeded in that help my employers reduce costs

Business Continuity-Resilience is no longer an expense center!You go way beyond writing plans. I present this new value rich mindset that is a central theme throughout the book.

I share specific ‘beyond BC’ projects that will get management excited. I have completed them all. They all align with our core objectives in building resilience. They just go a step beyond to produce significant value for you and your organization.

2
2, 3, 4, 5
Prepare for Success In the Beginning Your first few days building your program are important to set the tone. If you are new to the company it becomes even more important.

In the book we discuss what to expect the first few days, how to get off to a fast start and how to make a great impression. You never get a second chance at a first impression. A wide variety of fast start tips and techniques are provided.

3
6, 7, 8
Prepare for Success High level meeting with management Management support is critical to you and the success of your program. I believe a top down approach is most effective. Senior Management is critical to providing monetary resources and they must be an example for the rest of the organization in actively supporting the program.

In the book we discuss what to say and do and what not to say and do. It is important to establish realistic goals and expectations – and then to surpass them! You and upper management must be on the same page to achieve success as a team.

4
6
Prepare for Success A management hosted lunch (meet-and-greet) can be a leap in the right direction In the book I discuss personal experiences on the reasons a management hosted lunch can be a program and career maker or breaker. I will discuss the extremes.
5
2, 4
Prepare for Success Get an org chart asap! Your department secretary, admin or one of your new process owner friends can help you get this critical document. It is really important. I promise you will get lots of use out of it.

The org chart should be current and list processes (departments) and process owner names.

6
4
Prepare for Success Build a tracking spreadsheet The tracking spreadsheet will be used to track successes (for reports and yearly reviews) and challenges/issues that must be escalated to management. In the book I list the type of data that should be captured.

Be organized and track everything important. It is too easy to forget things and let them ‘fall through the cracks’. Those are the ones that come back to bite you.

7
6, 8, 9
Prepare for Success Begin learning the ‘culture’ of the organization It is very important you align with the culture of your organization. You must adapt – not them. Trust me, being a bit of an ‘adaptable chameleon’ will make you more successful and your life a lot easier.

I provide techniques and tips that will help you quickly become a valued part of the organizational culture. If you push the right buttons you will get ‘high fives’ in the hallway and you will be a key contributor to the success of your organization.

8
3, 6, 9
Prepare for Success Become familiar with the Business Process Owners from the org chart you now have Learn where their offices are located. Perhaps some light Googling or LinkedIn searching to get on the same wavelength with the process owners. It will come in handy soon.
12
9
Prepare for Success Conduct the important process owner meetings It is critical to position and conduct the process owner meetings properly. These meetings can be some of the most valuable ones you participate in. This is the beginning of building meaningful relationships, earning respect and understanding the business from the front lines. In the book I describe all of the whys and hows of conducting these meetings.

Ace these meetings and you are on your way to success.

13
13
Prepare for Success Spend time with critical employees… ‘It is where the rubber meets the road’ After you meet with the process owners and get familiar with each process at a high level, begin learning about each process on a more granular level. It is important for you to spend time with the folks that really do the work. For example, tag along with a salesperson to visit customers, sit with a customer service representative; listen and learn. Take great notes. Repeat – take great notes.

In the book we discuss important nuances of these meetings.

14
4, 99, 103
Prepare for Success Establish a central point for all resilience related documents In the book I will provide many options so you always have information close at hand at all times. In my case, I have lists and plans on me even when racewalking 5K’s and 10k’s. I describe how I do it in the book.
15
0
Prepare for Success Build a Business Resilience / Continuity Program Project Plan You need a project plan. It does not have to be fancy and you do not need a professional project manager to create it for you. There are certain elements essential to any good project plan, for example, deliverable dates. I will discuss what you need to include and the best tool(s) to use for your plan.

You should then add your own ideas to the plan to customize it for your organization and make it exciting. Maybe add some stretch items – such as the real-time assessments or integrate real-time situational awareness with your mass notification capabilities… both of which I speak about in the book.

I am a Project Manager for a Fortune 100 company and I speak from experience that project plans work.

16
4, 21
Prepare for Success Create an issues log with resolution dates and responsibilities Document issues as they occur. Figure out next steps to resolve each issue. Assign people that are responsible for working on each issue. Create deliverable dates. Follow-up on each issue until resolved. Escalate to management where necessary.
17
0
Prepare for Success Develop a Business Continuity Policy Statement Develop a simple and straight forward business continuity policy statement. You do not want to write a novel with this one. Simplicity is best.
18
6, 8, 27
Team Building Build your Steering Committee A very key team, indeed. Insure your goals are always aligned with upper management. Never, never, ever let them get blindsided. In the book we go into details about this important team. Who should be on it, how often meetings should take place, types of communications during BAU and during a crisis…
19
27
Team Building Build your Incident Command Team (ICT) First responders and decision makers. In the book we go into details on members, responsibilities, preparations and how you will interact during a real crisis.
20
27
Team Building Build your Emergency Operations Team (EOT) Process owners and others are listed in the book. Make sure this team can communicate with you and with their recovery team members. They are key to a successful response.
22
27
Team Building Build your Managers Team All managers should be part of this team. There may be overlap with the Emergency Operations Team. Customize for your organization. Test the ability to communicate with all members of the team. It is a moving target as people and contact numbers change.
23
27
Team Building Review all teams with Senior Management Get Senior Management’s feedback on the members of each team and make adjustments as required.
24
27
Team Building Finalize all teams Adjust as necessary to meet management’s expectations. Create awareness of each teams roster. Store contact lists in digital and paper form. Consider my highly portable ‘tiny plan’ and foldable list ideas in the book.
25
27, 78, 79, 80
Team Building Document teams and keep in safe places I describe interesting ways to insure you always have team contact info at your fingertips – even during a long walk or a 5k race – won 5 of those with the ‘tiny plan that could’ in my sock! Yeah, I explain how you can easily create it in the book. Process owners will love it and so will you.
26
Prepare for Success Create an exciting Business Continuity Program kickoff meeting presentation In the book we discuss details that can make this very important meeting one the attendees will not forget. I discuss ways to draw them in, make it interactive and insure they realize the end goal. It is all about them!
28
Official Kickoff Host the kickoff meeting We discuss how to hold the attendees attention and when they leave the meeting they completely ‘get it’ and thank you for being there.
29
Prepare for Success Congratulations! Treat yourself to a nice dinner at a good restaurant. You deserve it! You have accomplished a lot to get to this significant milestone. Take a breather and then let’s move onward and upward!
31
5, 7, 8, 52, 53, 54
BIA – RA Understand the criteria you want to measure to accurately determine time sensitive (critical) processes and risks In the book we discuss how to develop key metrics you want to analyze to determine impact and time sensitivity. For example, critical processes, regulatory requirements, legal impacts, fines, revenue, customer confidence, RTO, RPO, impact of new technologies
32
52, 53, 6, 7, 8, 9
BIA – RA Determine the best way to collect the data – surveys, interviews, individual or group meetings We discuss the advantages and disadvantages of all of the options. The methodology should align with your organizational culture for optimum results.
34
52
BIA – RA Develop a BIA form to help you collect and later analyze the data from participants It is important to collect the data in a simple and efficient manner. We will discuss tools that can make this ‘easy peasy’. Data you collect in this phase should be re-usable at many levels. You should never have to re-enter data that has already been collected. It is wasteful and error prone. We discuss data ‘normalization’ and data integrity. Storing data the wrong way can become a very expensive nightmare to clean up.
35
52, 53, 5, 7, 8, 9, 11
BIA – RA BIA level-set meeting with management. Please do this pre-launch This is an important meeting with management to review the processes in scope for the BIA project. I suggest, from experience, if you have the bandwidth include all processes. I provide reasons to do so and case studies on why it is important. I also share many additional experience based tips and techniques for a successful BIA.
36
52
BIA – RA Email the BIA to process owners, meet in person or on a web-ex Make sure you include a good introductory email reinforcing the importance of the BIA and breaking it down into simple steps. It is important that the email is not too complex. Do not use BC’ish acronyms. You will lose them before you even begin the process.

In the book I provide a concise template that has worked well for me for many BIA’s I have conducted. You can use it as-is or customize. Why re-invent the wheel?

38
52
BIA – RA Receive BIA forms (spreadsheets/docs) back from Process Owners Review goals, timeline and deliverables of the BIA. Gently remind them if they are over-due. Some level of follow-up is generally required. Do not be surprised. Everyone is busy with their ‘day job’. Provide a ‘drop-dead date and if they do not make it maybe a ‘gentle reminder’ and then escalate to management.

I provide some tips and techniques to help get the results back by the deadline.

39
52
BIA – RA Schedule follow-up BIA meetings with process owners to review their input, answer questions and finalize their BIA Schedule the follow-up meeting which is described in the next step…
40
52
BIA – RA Meet with process owners to review and validate their responses Review the BIA to insure they understood the questions and answered as accurately as possible. Address their questions and concerns.

See my chapter on scheduling meetings tips and tricks. I provide many nuances, tips and techniques that may significantly improve the quality of this meeting and others.

41
52
BIA – RA Collect information on IT systems Have IT provide information either in your BCM system or in a spreadsheet. You will soon use this system information to identify gaps between business requirements/expectations and what IT can actually provide. Do not be shocked if you uncover gaps.

In the book I provide a list of suggested fields that are important to include in the analysis.

43
52, 53, 88
BIA – RA Use the IT data and the BIA results to create a gap analysis report Identify gaps in business vs. IT RTO’s and RPO’s. Identify single points of failure and backup strategy risks. For example, an analysis for all systems showing a visual relationship map and dependencies for each system. You may have critical tier 1 systems dependent on tier 3 systems. That can pose risk. In organizations with hundreds of interdependent systems this can be a complex project but it is worth it. It can be an organization saver in a crisis. Often it is something that organizations never quite finish. Let’s finish it!

In the book we discuss specifics as to how you can automate this analysis to a real-time risk metric and notification system. I suggest techniques to eliminate the tedious, error prone, latency riddled manual effort.

44
52, 75
BIA – RA Equipment requirements Include quantity, backup vendors, critical and single points of failure and comprehensive equipment recovery information in the book.
45
52, 75
BIA – RA Employee requirements Include critical employee information and a skills matrix. I discuss detailed information in the book on employee data quality issues and how to overcome them. Also, valuable information concerning employee safety, recovery, awareness…
46
52, 75
BIA – RA Vendor / Supplier Analysis – Upstream and Downstream You want to eliminate single points of failure. You want redundancy. You also will have an opportunity to improve services and reduce expenditures.

We discuss how and why it is critical to design and execute a thorough vendor / supplier analysis. It must include both upstream and downstream dependencies. Tiers 1, 2 and 3 must be part of the analysis. Some organizations were severely impacted during the Fukushima tsunami – power outage. We will discuss identifying and mitigating single points of failure throughout the supply chain.

48
52, 75, 43, 56
BIA – RA Vital Records – often low-hanging fruit Vital records are critical and the identification project is often low-hanging fruit. I have been able to identify thousands of at risk documents. We discuss how to do it and include a nice email template that gets results. After we identify the records we discuss what to do to insure redundancy. I promise you everyone will sleep better!

A few questions and answers we deep dive in the book include:
Is there a program already in place such as RIM? If not, how to start one for a big win.
Is there a vital records leader or champion?
Do you know of all vital records and their retention policy? Are there risks of losing vital records due to fire, flood, etc?

50
52, 66
BIA – RA IT Network Topology Diagrams and Analysis Gather the network topology diagrams. Store them in your central repository so IT will have them at-hand when they really need them.
53
66
BIA – RA Evaluate VPN Capabilities – often overlooked until it is too late! Understand the true VPN connectivity requirements and capabilities including how many users can be supported concurrently, available gateways, bandwidth, etc. Rotate test users. You do not want to find out during an ice storm that the gateway ‘chokes’ and users cannot work. In the book I describe how and why (from experience) it is critical you get this right before everyone is working from home during a disruptive event – and the network ‘chokes’ to a crawl.
54
52, 88
BIA – RA Analyze all of the data that was gathered – BIA, IT, Dependencies… We are only as good as our data. You want to turn the raw data into knowledge. There are powerful techniques and technologies to create real-time metrics and a pulse on the health of your program.
55
54, 5, 7, 8
BIA – RA Develop a comprehensive executive level BIA – RA Summary report for your management. Organize and summarize all of the data you collected. Include both your BIA and Risk Assessment findings. Format it in a professional executive report. We discuss what to include and how to present it for optimal results. This is an important meeting.
56
54
BIA – RA A time to shine! – Meet and review the BIA – Risk Assessment Executive Summary Report with your management You completed the hard work. Not it is time to wow management with what you have done and what you can do going forward!

After you have completed your Business Impact and Risk Assessment it is time to build an executive report for management’s review.

In this chapter we discuss tips and techniques to concisely convey the data you captured. You will go into the meeting confident, proud and very relaxed. You will shine and they will love your analysis!

57
54
BIA – RA Update the report with management’s modifications During the meeting management will likely have some tweaks to your report. That is to be expected and it is fine. Update the report within 24 hours and return it to management for final sign off.
58
BIA – RA Congratulations! This was a big step in building your program. There is a lot of work to be done but for now please treat yourself to another nice dinner at a good restaurant. You deserve it at this significant milestone!
60
68 – 74
Recovery Strategies Recovery Strategies and Beyond… We discuss in detail:
– A broad spectrum of recovery options including sister-sites, mobile trailers, work-from-home, vendors hot and cold sites
– How to identify strategic cost effective steps that are essential to recover each business process
– How to define primary work recovery locations, secondary work recovery locations and tertiary work area locations for each business process
– How to develop and document cost effective multi-tier strategies for site, local and regional recovery strategies
– Creative recovery strategies – that have ‘saved my butt’
61
68
Recovery Strategies Review plan, costs and get management sign off We discuss how to review recovery strategies and costs with management. They may sign off as-is or adjust expectations down or up. They may even decide to assume the risk and do nothing. Make sure you get everything in writing so there is no miscommunication when the proverbial s#*t hits the fan in a crisis. You will be glad you did. I describe how that can happen.
63
75 – 80
BC Plan Creation *BC PLAN CREATION PHASE* Your organization should have plans that cover Crisis Management, Crisis Communications, Incident Response, Disaster Recovery and Business Continuity. We discussed Crisis Management, Crisis Communication and Incident Response in previous steps. This section is focused on Business Continuity plan creation.
64
75, 76, 8, 9
BC Plan Creation Carefully decide on the format for your plans The plans must fit your culture. The right type of plan will be valuable. The wrong type of plan might still be used – but probably as a door-stop. Some elaborate plans that were costly to develop were failures during major disruptive events. In the book I discuss plan formats that work best. I also highlight case studies and discuss what could have been improved.

Give a lot of thought to the tool you will use to manage your plans. I recommend a BCM system for all but the smallest organizations. In the book I share a lot of knowledge on selecting and implementing the right tool. Selecting the wrong tool can be detrimental to your program and your health.

Your tool should provide a variety of plan templates that you can use out-of-the-box or customize to fit your precise needs. The tool must adapt to your needs, you should not have to adapt to its capabilities.

66
75, 78, 79, 80, 81
BC Plan Creation Create and publish laser focused department (process) continuity plans Focus, simplicity and ease-of-use is critically important.

In the book We discuss the types of templates that work well in a crisis. A list of suggested fields are presented. You can use as-is or customize. We also discuss a few high profile events in which recovery that failed due to overly complex and untested plans.

67
75, 76, 77, 95, 96, 98, 103
BC Plan Creation Store plans in an accessible central repository Options you can consider include a Business Continuity Management System, Network drive, SharePoint, secure web site, spreadsheets I discuss what has worked well, what has not worked so well and why.
68
75, 76, 77, 95, 96, 98, 103
BC Plan Creation Provide the appropriate people access and responsibility for their their plan accuracy and quality Process owners must understand that they own the plans – not you. Otherwise, the plan information will become outdated and your recovery will fail. Make sure they can easily access their plans. In addition, you will be spending an inordinate amount of time updating plans. I discuss techniques that work. Remember, there is sensitive information in plans so only authorized people should have access to them.
69
52, 53, 68, 69, 98
Locations Do a locations (facilities) deep-dive It is critical you understand your physical location assets. They play a big part in your strategies and resilience. I discuss critical information you should capture about each facility. Store all of the information in your central repository so it is easy to get to during a disruptive event. You cannot waste time gathering it during an event.
74
4, 27, 53, 54, 57, 88
BIA – RA Risk – Identifying local risks – neighbors / infrastructure You must have a high degree of situational awareness. Walk the neighborhood. Learn who your neighbors are. Is there a furniture warehouse nearby? What about a company producing toxic chemicals? Take detailed notes.

In the book I describe great resources that can help you identify nearby risks, without leaving your desk.

75
52, 53, 68, 69, 98
Locations Location photos and maps Take photos of the exterior and interiors of all locations. Exterior photos should include fuel storage, access points, exterior buildings, perimeters, etc.
Interior photos should include computer rooms, and other critical locations.
We all carry smart phones with us and most of the cameras are outstanding! I have leveraged them prior to and during disruptions.
76
52, 53, 68, 69, 98
Locations Aerial Pictures I have used drones, Google Maps and up-to-date satellite images. Fun fact – I used the drone video in a BC Kickoff Presentation. I discuss these and more interesting ideas in the book.
77
52, 53, 68, 69, 98
Locations Site Diagrams are needed for all locations Develop detailed diagrams of each site and facility showing important information ex: exits, fire extinguishers, AED, shut off valves, power panels, etc. This information can be extremely valuable to first responders during a crisis.
78
68, 73, 88, 98
Locations Determine sister-site recovery space and capabilities Leveraging sister sites for internal recovery is smart but you have to make certain the assets are not over-subscribed. For example, if 50 processes in NJ indicate another site as their relocation strategy and request 175 seats and the site only has 50 seats you will have a problem if multiple locations had to declare and recover simultaneously. You need to have a back-up to the single site recovery.

In the book I discuss a real-time method I developed to automate the recovery requirements versus capabilities analysis. The method can be applied to analyzing any type of data in real-time.

300
53, 54
BIA – RA Risk – Perform your Risk Assessment The value of a risk assessment has been debated by many professionals. I believe you need one and I go into the why’s and how’s in the book.

I suggest you build a comprehensive risk assessment. Consider both scenario and impact approaches.

A few areas we deep dive in the book include:
How to perform a risk assessment
How to identify threats and opportunities
How to prevent, mitigate or transfer risk
How to calculate the probability of risk
How to develop and document risk response treatment
How to summarize your results for management
How to meet with management and shine
How to elevate your ‘sometimes’ risk assessment to a real-time assessment of risk with no additional effort.

1001
25, 26 and many additional references
Crisis Management People are our number one concern! Always!
1010
29, 30, 31, 32, 33, 37, 39, 40
Crisis Management Evacuation I discuss evacuation best practices and issues in great detail in the book including:
– Who is responsible
– Wardens and Searchers
– Rally points
– Accounting for employees
– Drills
– Best practices
– Non-compliance
– Critical lessons learned from major events
and a lot more. Make sure you get it right.
1020
26, 47, 48, 50, 97, 99
Crisis Management Active shooter and intruder detection The time to plan is NOW! Training and awareness is important.

In the book I discuss resources for best practices and provide ideas on end-to-end automation of situation awareness and activating mass notifications to streamline response and minimize confusion.

1021
27, 81, 82, 83
Crisis Management Team readiness and awareness Make sure the previously discussed Incident Command Team, Emergency Operations Team, Managers Team and Strike Team all know their roles and responsibilities. Walk through scenarios to flesh out gaps before a real event.
1022
28
Crisis Management You need a strong and decisive Incident Commander. The right Incident Commander is key to surviving a disruptive event. We discuss attributes of great Incident Commanders and leaders in the book.

I have partnered with all types of Incident Commanders (called Site Leaders in some organizations) during my career. Some were great and some not so great. I discuss my experiences.

1023
24, 28
Crisis Management Command and Control Hierarchy Whether you are using NIMS or a hybrid methodology as your frameworks for Crisis Management make certain everyone is aware of the process. I discuss the important implications of this one in the book. There should be zero confusion on the chain of command and to those who makes decisions at time of crisis.
1024
34
Crisis Management Command Center / Emergency Operations Center – physical and virtual are needed We discuss many important attributes of your command center / emergency operations center in the book. A lot of important tips to insure success. You must establish both physical and virtual command centers. There will be times people cannot travel to the physical command center.
2016
27, 34, 46, 48, 49, 50, 51, 99, 100
Crisis Communications Team communications is critical Insure you are able to reach all team members on multiple devices. Team members and their contact information will change on a regular basis. Have a process in place to make additions, updates and deletions. Test the ability to reach everyone on a regular basis.
2017
20, 21, 75, 85
Crisis Management The value of developing simple action oriented checklists Checklists can be valuable for both simple and complex tasks. In the book I provide examples of how checklists can help you throughout your program.

I describe how pilots and surgical teams have relied on simple checklists for decades.

I also demonstrate how my daily checklists have helped me build world-class resilience programs, write software, books and win national athletic championships while facing adversity.

2018
87, 45, 46, 47, 27, 100
Crisis Communications Verify all managers have up-to-date contact lists. It is critical managers can reach their employees. Have them test their manual call trees or automated call lists on a regular basis. Also, exercise the lists during recovery tests. See the IWARE chapter.

I describe ways to build and test manual and automated contact lists. Detailed information on improving contact data quality and selecting/implementing automated communication tools is provided.

2019
46
Crisis Communications Implement an Emergency Hotline (There is additional emergency hotline high level steps in the Online Road-map ‘Tools’ category)

In the book I discuss detailed information on the importance of an emergency hotline, best practices, tips and techniques. An emergency hotline can provide life-saving value but it can also become a convoluted mess if not done correctly and with foresight.

2020
Crisis Communications Incident reporting It is critical that all stakeholders understand what is happening during a crisis. I provide a ready to use incident communication template. Use as-is or modify for your organization.

You should have your escalation procedures and ability to ‘report up’ tested and ready to go.

2021
Crisis Communications Incident tracking form It is important to track the incident from start to finish. You can later analyze the events and improve your response for next time. I provide a template to track an incident and suggest tools that can enhance and simplify the tracking process for you.
2022
88, 93, 8, 52, 53
Assessments Develop program assessment criteria from A-Z It is important to understand the criteria you are assessing your program against. You can then do manual assessments and ideally convert them into simple algorithms that can power real-time assessments between any data elements you track. That is a very powerful proposition which can easily be done.
2024
81, 82, 83, 84, 85, 86, 87
Testing Determine the type of tests you must perform to insure you are building true resilience There are a wide variety of test/exercises to choose from. I recommend a mixed approach. I have heard of programs that only do tabletops. To me, that is not nearly enough.

In the book we discuss each type of test in depth and map them to the maturity level of your program. The goal is to validate, plans, identify gaps and learn before a real event. To maximize employee productivity during tests stress that you are testing the plans, not the people! They do not have to score 100%

2025
81
Testing Develop a comprehensive testing schedule Create a test schedule that is comprehensive and scalable.

In the book we discuss how to create a comprehensive testing schedule. I also describe how to handle push-back from divisions/departments that do not feel it is necessary to test. I think I have heard all the excuses (some very creative) and I will share my experiences and strategies to overcome them with you.

2026
81, 83, 84, 85, 86
Testing Tabletops I highly recommend tabletops being a core component of a well rounded testing program.

The book contains multiple sample scenario based and impact based tabletop exercises you can use as-is or modify. Check the testing part and the hazards central part of the book. There are many tips and best practices learned through the experience of having hosted over 200 tabletops.

Fire is a realistic and common scenario that I often begin with and I include a detailed tabletop in the book. Earthquakes – West Coast and Hurricanes – East Coast are relevant. Power outages, Cyber, Flood, Active Shooter all are important and provide great value. Test the capabilities and plans as written.

For the best results make your tabletops interesting, informative and fun! I will show you how.

2027
47, 48
Testing Call list (automated) and call tree (manual) exercises It is important to use care leading up to call list and call tree exercises. You should also know what to expect the morning after the exercise from recipients.

For the first series of exercises make sure the recipients know the date and time they will be called. They should be comfortable and aware of what they have to do when the phone rings. Subsequent call list exercises can be more of a surprise with less lead-up and hand-holding.

In the book I provide extensive information on setting up and performing call list exercises. We discuss devices in scope, types of activations that can be used such as blast or escalation, recipient response requirements and wringing extra resilience awareness value from each exercise.

I also share my experience and knowledge on how you can improve the quality of your organizations employee contact information. Although it can be challenging improving contact info allows you to reach a higher percentage of people during a crisis. I provide some template emails that help sell this benefit to employees…Do they really want to jump in their car during an ice storm at 7 am and endanger their life when you can let them know the office will have a delayed opening at 11 am?

Data quality improvement in general can be a big win for you even beyond business continuity. We will discuss many resilience, revenue and cost reduction opportunities for your data. All of which I have done in my career and benefited my organizations. They can be good for your career!

2028
69
Recovery Strategies Toll free customer telephone line recovery Customer-facing critical toll free numbers (800 type numbers) must be identified, documented and part of a recovery strategy. Typically this means partnering with the telephony group to add the numbers to a telephony routing table and building out redirection strategies. I have done this on numerous occasions with a verrrry compressed RTO. We were up-and-running well within the required timeframe.

I describe the process in easy straightforward terms in the book. I also describe how this can be a revenue generator and a career enhancer!

2029
99, 95, 48, 49, 46
Tools – Mass Notification System Mass Notification System If your organization is mid or enterprise size you must consider an automated mass notification system. In the book I discuss why you need it, critical questions to ask during the selection process, streamlining implementation, improving contact data quality, comprehensive call list testing, disaster notification best practices and lessons learned (good and bad) .
2030
97, 95, 40, 41
Tools and Technologies Situational Awareness – a life-saver and revenue generator It is critical that your organization understands threats and opportunities:
– Make sure you have completed a thorough risk assessment
– Walk or drive around the local neighborhood of each of your locations. You will learn a lot
– Speak with your employees that live near your locations. What local threats are they aware of that may not be public knowledge

Don’t stop there!!! Implement tool(s):

I use many excellent free and commercial situational awareness tools. These are tools that can provide you with critical alerts and threat analysis. I discuss the free services as well as my favorite situational awareness commercial vendors.

Each system has unique strengths and weaknesses. Some provide basic information, some provide ready-to-circulate management reports, some are stronger with weather reports and some with travel hazard info. Some allow you to integrate real-time video feeds and updated satellite images. Some can geolocate threats to mobile assets such as commercial vehicles. All very cool!

I also take it to another level by sharing my ‘getting to real time’ notification ideas and techniques. Imagine integrating situational alerts with business continuity management (BCM) and mass notifications systems to trigger notifications ultra quickly. This will catapult your resilience toward world-class.

2031
98, 95, 75, 76…
Tools and Technologies Business Continuity Management (BCM) I discuss the advantages and potential issues you can encounter. Correctly done, a BCM tool can provide incredible core value to your resilience program. It can improve your ability to recover your organization. In addition to being a repository for plans, it can integrate with incoming situational alerts and outgoing notifications.

A great BCM tool will also provide real time metrics and gap analysis across your organization. Management at all levels will love it! It can provide value beyond business continuity and resilience for IT, Audit, Compliance… Unfortunately, selecting the wrong product can be counter productive and a huge waste of time for you and your team. It can cause you pain and stress.

I discuss the advantages and disadvantages of BCM tools, critical selection questions you must ask vendors, benefits the BCM tool must provide, critical implementation/roll-out considerations and real time automated assessment analysis on every data element that is desired.

2032
87
Testing IWARE – Integrated Work Area Recovery Exercise If you have not done work area recovery exercises you are in for a treat. Do not stop at tabletops. It is important to actually physically recover the departments. It is a lot more work than a tabletop, but it is worth it.

I will share many tips and techniques for a robust work area recovery exercise you can use at various maturity levels of your program.

I did so many of these exercises and enjoyed every one of them.

2033
27, 24
Team building Build your Crises Management Team I discuss the types of member roles and responsibilities for this critical team.
2034
45
Crisis Communications Develop a comprehensive Crisis Communications Plan Your Crisis Communication Plan is essential to properly communicate during a crisis. You must understand your communication protocols and audiences prior to an event. Now is the time to develop and test this plan. In the book we go into specifics about audiences that should be included and how notifications should be approved and sent.

You will want your Communications Plan to blend seamlessly with your Emergency Hotline and Mass Notification tools. If you are not careful the two communications channels can conflict. It is not pretty when it happens. I suggest best practices that will eliminate the possibility of mixed messages.

2035
76
BC Plan Creation Roll-up Business Continuity plans for wide scope events In the book we deep-dive the value and how-to details of an automated roll-up plan. This type of plan can be instrumental when managing wide scope disruptive events that impact multiple departments and locations. The plan should be designed to roll-up to any level in your organization with zero manual effort. Simply pass a scope parameter and the template should auto populate with the appropriate data whether it is at the department, location, city, region or global enterprise level.

To accomplish this your data model must be designed properly. Yes, we discuss that in the book in simple understandable terms.

2036
77
BC Plan Creation Do you have a business continuity plan for the Business Continuity Department? Tip – Remember to create a plan for the time sensitive (critical) Business Continuity / Resilience Department and to include it in the BIA, RA and recovery strategy. Believe it or not, it can sometimes be overlooked.
2037
79
BC Plan Creation The Tiny Business Continuity Plan ‘That Could…’ Consider developing a super compact but information rich little BC plan. I carried mine in my sock during many 5k’s the past year. You never know when you will need it. We discuss specifications and an easy way to create the tiny plan.
2038
78, 80, 103
BC Plan Creation Easily make your plans into full featured eBooks for Kindle, Nook, mobile I am so proud of this original idea and I get great feedback from users. So I am patting myself on the back.

Consider creating full-featured plans that can be read on durable, inexpensive and long battery life eReaders such as the Kindle and Nook. Tablets, laptops and even cell phones have approximately 24 hours of battery life – if you are lucky. My Kindle easily lasts for three weeks. Crisis events can easily go beyond 24 hours. Your employees and management will be wowed by your eBook plans. I do it all the time and the results are great. Yes, you can password protect the eBook plans.

2040
5, 7, 8, 87
Prepare for Success Establish metrics criteria to measure progress, risks and maturity of your program.,, then measure them in real-time through automation. In order to measure progress, risks levels and maturity it is important to establish metrics. Management will expect informational dashboards that accurately describe the resilience of your organization.

This can be done manually at the beginning. Eventually you will want to improve by leveraging technology to produce a real-time metrics pulse.

In the book we talk a lot about getting to a real-time world-class program. Technology, whether in-house or off-the-shelf, helps makes that happen. Stretching technology is a passion of mine and has been core to my most significant accomplishments. I explain the technology you can use in simple understandable terms. I am confident I can help you become the most tech savvy resilience professional in your organization and a key contributor.

2041
9
Prepare for Success Schedule Process Owner meetings I provide a ready-to-use email invitation and scheduling tips and techniques that work. Process owners will respect you from the first minute. Success is all about relationships.
2042
11
Prepare for Success Missing deliverable dates can co$t you! Meeting deliverable dates is key to building a strong resilience program in a timely manner. It is critical to your organization and your career that you understand, achieve and surpass deliverable dates. As a former Project Manager I describe how and why you should create realistic, achievable deliverable dates and how you can exceed expectations.

I also describe a personal story of the one time in my career I missed a deliverable and how it co$t me.

2043
12
Prepare for Success Why you need a powerful continuity-resilience elevator speech – and how to create one Many people in your organization will not understand the incredible value you provide. You need a couple of continuity-resilience laden elevator pitches that concisely tell your story. I recommend 15 seconds, 30 seconds and optionally 1 minute.

In the book we discuss why it is essential and how to craft a great pitch.

I also share a based on a true story of a BC pro who did not have one when cornered in an elevator with Big Dog Senior VP on the way up to the 72nd Floor. To make matters worse it was the BC pro’s first day on the job! It was not a pleasant ride.

2045
17, 98, 99, 88
Prepare for Success Create a program that is built to scale If you are building a program for a mid or enterprise size organization you will need to scale. If you try to do it all yourself you will fail professionally and you may take the stress home and impact your personal happiness.

I present a few simple first-hand techniques that will insure your program scales even if you have hundreds or thousands of locations. Been there, done that!

2046
18
Prepare for Success Be ready for the 2:00 a.m. crisis call It is critical you are ready and able when the call comes. We go through a ‘ring ring ring – hello…’ scenario from your Senior VP and what must happen next. It is a key career moment – either very good or very bad.
2048
22
Prepare for Success Be careful in a Factory or Warehouse If you are building resilience for ‘beyond office’ departments use care. Factories, warehouses etc. demand focus at all times.

I share a few personally embarrassing near horror stories when I was a warehouse rookie. I share them because sometimes there is no second chance.

2049
24
Prepare for Success How to build resilience fast and strong – Go Wide and Go Deep! How to build resilience fast and strong. Disasters do not know that you are not ready!

It is important to be proactive. I know from experience that establishing a program with tens, hundreds or thousands of locations can be daunting but it must be done in a timely manner. I share some tips and techniques that can help you get there.

2050
35
Crisis Management Go Bags and Disaster Supply Kits We discuss the basics and not-so-basics that may be overlooked when you create your kits. You can use the list as a starting point for your own kits.
2051
35, 39, 41
Crisis Management Create awareness on how to report an event Everyone should know how to report a fire, intruder, bomb threat… every second counts. Seconds can mean the difference between life and death.
2052
37
Crisis Management Shelter in place – plan ahead What is your policy on sheltering in place? Now is the time to decide and plan.

We also discuss when a person will not shelter in place even though it is recommended by your team. What do you do?

2053
38, 83
Crisis Management In Case of Emergency (ICE) – it can save a life, maybe yours Spread the word on ICE. I discuss how it could have saved my life on a basketball court. I have provided awareness and best practices for ICE to thousands of tabletop attendees and through my resilience programs, newsletter and blog. I share my work, personal experience and ideas in the book.
2054
39
Crisis Management Provide people with a plan for their pets – they will love it! This is a very important subject that is sometimes overlooked.

In a disaster pets that are forced to be left behind generally do not survive. A valuable service is to provide people with a pet plan. I include tips, best practices, some cool technology and ideas in the book.

2055
40, 42
Crisis Management Hazards Information Central I include a special robust curated section in the book which provides resources on many natural and man-made threats and hazards. The section includes access to subject matter expert developed checklists, playbooks, tabletops and videos.

Some of the hazards in the growing section include:
– Biological Threats
– Bomb Threats and Explosions
– Chemical Threats
– Droughts
– Earthquakes
– Fires
– Floods
– Hurricanes
– Landslides
– Power Outage
– Radiation and Nuclear
– Thunderstorms & Lightning
– Tornadoes
– Tsunamis
– Volcanoes
– Winter Storms and Blizzards

2056
56, 43
Crisis Management Vital Records – be ready to salvage in a worst case scenario If vital records are damaged you must be prepared to salvage them where possible. I include a chapter with best practices including what to do and what not to do. I also include professional resources that I feel are valuable.
2057
0
Locations Location contact information Gather contact information for all locations. This includes internal people and local emergency numbers near each facility such as fire, police, hospitals
2058
0
Locations Map facilities geographic location Buy a wall map and pushpins. Include distance and travel time between locations. Consider recovery options and constraints.
2059
4, 52
Locations Get an updated list of all facilities in your organization Facilities, real estate or your departmental administrator can help you.
2060
0
Locations Professional location risk and health audit If you have concerns about your location from a safety, security or continuity aspect you might want to consider bringing in an outside expert company to review your locations and provide a comprehensive report of risks and opportunities. I can recommend an excellent resource.
2061
75, 68
BC Plan Creation Succession Planning! Leadership succession is critical. Develop a detailed succession plan for all critical leadership positions. This is often overlooked but soooo important.
2062
75
Recovery Strategies Document all critical recovery people List roles, contact info, skill-sets and tasks in plans. Have at least 2 contact numbers for each person. If less than 2 contact methods ding it as yellow during the plan assessment. Test the ability to reach each person on multiple devices.
2063
27, 75, 79, 78, 80
Crisis Communications Contact lists of critical employees – paper and digital Foldable lists or tiny plans that are easy to put in a wallet and pocketbook are very useful. I enjoy miniaturizing lists and plans. It is very handy to have that critical information in paper form at all times to supplement their digital cousins. I discuss details on how to develop concise foldable lists and tiny plans in the book.
2064
81, 82
Testing Plan walkthroughs These are low stress, first pass-throughs of the plans to determine usability, viability and operational readiness. It is a good way to identify low-hanging opportunities for improvements. Other will become evident during more stringent testing.
2065
83, 87
Testing Document and track corrective actions for all exercises. You will have to follow-up on the ones not completed by the deliverable date. Never let tasks ‘fall through the cracks’. For each test, document and track corrective actions. Assign responsibilities and deliverable dates to have each item closed. Follow-up where necessary.
2066
72
Testing Take laptop home exercise – and work from home policies If your policy is that employees must take organization provided laptops home every night you will find this interesting.

I describe a cool exercise that can help your team validate laptops are being taken home or if there is risk.

2067
65, 61
Testing Cyber phishing expedition test I discuss a quick test that will quantify your exposure to a potentially devastating malware phishing expedition. You might be shocked by the results. I describe the test and many cyber best-practices. Cyber issues can quickly become very serious continuity – resilience issues. Often when I interview C level executives and ask a favorite question of mine, ‘What keeps you up at night as far as operations is concerned?’, they forcefully say cyber issues and general system availability.
2068
65
Testing Cyber penetration (PEN) tests are critical Unfortunately, cyber threats are now an important part of your life. Your IT or Cyber department should work with a reputable cyber security company to implement a penetration test to determine gaps in system security.

Cyber security companies are very good at identifying risks in your infrastructure and will advise on hardening it to potential threats. I ha e a couple of favorites.

2069
61
Testing USB parking lot test Cyber security or IT department can drop a shiny new thumb-drive in the parking lot. Good chance it will wind up on your network. Create awareness with employees on the danger of malware infested thumb drives.

I will share a scary story with you about this exact scenario and the devastating impact on a company that should have known better, in the cyber risk part of the book.

2070
84
Testing Tabletop invitation template I share a tabletop invitation template that has worked well for me. You can use as-is or customize.
2071
85, 83
Testing Tabletop takeaway gift I like to give attendees a gift at the end of each tabletop that will help them improve resilience.

I describe takeaways in the book that you can use as-is or customize.

2072
82
Testing An untested plan is a useless plan! Create awareness on the deficiencies of an untested plan. Many organizations have been blindsided by relying on untested plans that do not work. I describe some high profile cases gone bad.
2073
57
BIA – RA Risk – Beware of the More Common ‘Little’ Risks – They Can Create Major Havoc! Often it is the little risks that bite you. The big ones are easier to see coming. The little guys are often poo-poo’ed away. Poo-poo is not a tech term – it means they are often not thought of as serious – until they are!

In the book we deep-dive the large risks and the ‘little’ risks (some have four legs) that are more probable to disrupt your business. I describe first hand experiences and lessons learned. In the Hazards Central chapter we also learn about prevention, mitigation, useful checklists, tabletops…

2074
58
BIA – RA Risk and opportunity – Be the disruptor, never the disruptee Modern Business Resilience extends far beyond preparing for acts of nature and power outages. More and more companies are being disrupted by quick moving disruptive companies such as Amazon, Lyft and Netflix. Many of the companies that formerly ‘owned’ market sectors have gone out of business (Blockbuster…)

We discuss tools that will help you identify threats entering your niche, before it is too late. As I describe in the book, business resilience professionals are in a key position to identify threats and opportunities.

2075
59
BIA – RA Risk – Health Threats – Achoo!!! How the 100 MPH Sneeze Can Become a Business Continuity Issue People are our most important asset. I cannot tell you how to run your business but I will suggest when people are sick they be encouraged to work from home or take a sick day. Germs and disease can trigger a crisis.

Health threats can become serious BC issues. They do not have to be at a pandemic level to cause havoc.

I describe what seems to be an innocuous event and how it can have wide ranging business continuity impact. Included in the book are suggested prevention and mitigation tips.

2076
60, 61, 62, 63, 64, 65, 66
BIA – RA Risk – Cyber Security – laptops, tablets, mobile phones and Internet of Things Mobility has many advantages but it also exposes us to greater risk. One breach can become front page news and will have serious business continuity repercussions. The viability of your organization can be at stake.

In the book I describe a plethora of serious threats, vulnerabilities and risks as well as prevention and mitigation best practices. Mobile devices have a way of ‘walking’. Losing a laptop is bad but losing sensitive unencrypted data can imperil the survival of an organizations survival. It is important that your Cyber and IT people are preventing and mitigating risk. There are also a number of physical security preventive steps that can stop thieves in their tracks and have them look at easier targets elsewhere.

I also include a related chapter (C’s on the Hot Seat) listing companies whose C level managers lost their jobs (they abruptly retired to spend more time with their family or pursue other opportunities) as a result of a devastating costly data breach. You can use it to ‘light up’ your management to the serious career derailing consequences of cyber security gone bad.

2077
63
BIA – RA Risk – Cyber Security – software threats and vulnerabilities including malware, ransomware, sniffers… Yes, I assure you cyber threats are a serious business continuity-resilience concern. One cyber breach such as happened to SONY and Yahoo, can put your organization on the front page of newspapers and blogs for all the wrong reasons.

Make sure your IT and Cyber Security experts are patching and hardening your network. You should be involved for your organization as well as for your protection.

In the book we discuss threats and vulnerabilities. I include a chapter on cyber security best practice prevention and mitigation. I suggest you do not skip that chapter. You do not want to have to answer after the fact as to why patches were not applied to prevent a WannaCry type ransomware attack.

The solutions are available. For example, automated patching and inventory audit programs. Many more are discussed in the book.

2078
62
BIA – RA Risk – Cyber Security – personal uncontrolled cloud storage drives mean danger ahead If employees are uploading organizational files to personal cloud storage drives you have a big risk. Do you really want sensitive data to ‘leak’ onto a non-approved cloud environment? Imagine if the vendor was hacked or a competitor got access to the data. Imagine if the employee left your organization with a list of customers. We discuss ways to control this serious risk.
2079
67
BIA – RA Risk – Soft targets Soft targets are becoming more prevalent targets for terrorists. Your security and safety experts must have a holistic approach to hardening your infrastructure. Your people and your organization depend on it.

In the book I include an essay I wrote five years ago that was published, in part, in a major newspaper. I followed it up with chillingly accurate predictions of future events. Unfortunately, the issue continues to grow. It is a life-and-death issue and a business resilience concern.

2080
71
Recovery Strategies Store specialized equipment and supplies off-site Some of your departments will depend on equipment and supplies such as atomic clocks, scanners, MICR printers, rubber stamps, trade tickets, headsets (don’t forget the batteries), check forms… to continue their work. Make sure these are stored at the recovery site or at a central point accessible by multiple recovery sites.

In the book we do a check-down on equipment, supplies, inventory audits… plus some important lessons I learned along the way that can come back to bite you.

2081
73
Recovery Strategies Build an in-house recovery hot site for extremely time sensitive (critical) departments Building in-house recovery capabilities can offer value in many ways, including resilience and revenue generating opportunities. Not all organizations can do it but if you can it is worth considering. I discuss how I built in-house trading floors, customer service call capabilities and shadow recovery teams to meet extremely compressed <1 hour RTO's. I actually achieved 10 minutes in some instances.
2082
74
Recovery Strategies Think ‘outside the box’ to uncover creative recovery sites and strategies I have recovered successfully in some unusual places. I provide a list in the chapter, ‘Saving My Butt and Career with Creative Recovery Sites’.
2083
68
Recovery Strategies Review the signed-off strategies with process owners Meet with your process owners so they have a complete understanding of the recovery strategies. Perhaps, they will see some gotcha’s in the strategy. Now is the time to find out – not at time of crisis.

You will be documenting specific tasks and roles of responsibility in the upcoming plan creation phase.

2084
75
BC Plan Creation Be detailed when documenting department recovery tasks and roles Specific tasks to be carried out during a crisis must be carefully documented. They should be detailed but written in a simple understandable manner. If the process owner lists them make sure other people read and are able to interpret them – before a crisis. Remember the process owner may not be available during a disruptive event. Also assign people to roles and assign each role to tasks. It is better than assigning names directly to tasks. Your BCM tool must be able to support this methodology.
2085
75, 76
BC Plan Creation Meet with process owners to review the plan template and answer questions Meet with process owners individually or in a group environment. This can also be done on a group webinar. Explain the template and the information required. Answer all questions.
2086
89, 90, 91, 92, 93, 94
Awareness & Training Training – crisis management, emergency response and business continuity People need crisis management, incident response and business continuity training. There are many options to accomplish training such as classes, exercises and web site documentation. Most likely you will use a hybrid approach.

Online training coupled with an interactive quiz can be very effective in teaching and determining the maturity of your program. You will learn where there is a lack of knowledge and you can place emphasis on providing insight. If you have a ‘Learning & Development’ department they can be key in helping you make online training a reality.

2087
91
Awareness & Training Participate in an existing corporate newsletter or create one for business continuity Tips, best practices also include personal family tips to prepare, respond and recover. Remember employees are our main concern. In the book I describe valuable information to include in your newsletter. You can also use my tips and techniques if you mention the Ultimate Business Continuity Success Guide.
2088
0
Awareness & Training Create an incident response business continuity process for new employees So much happens when an employee joins an organization that emergency response and business continuity can be overlooked. Develop a process so that all employees have critical information. I deep-dive this potential gap in the book and provide ideas.
2089
90
Awareness & Training Tasty ‘Lunch and Learns’ are a fun way to boost awareness Lunch and Learns are great opportunities to communicate important information. I provide a buffet of ideas that can work for you and will make people very knowledgeable, happy and well-fed.
2090
90
Awareness & Training Posters and desktop premiums create awareness Posters, desktop magnets, stress balls and solar flashlights can be great awareness tools.
2091
92
Awareness & Training Go viral with my resilience email signature idea I devote a chapter to an idea I get great feedback on and you will too.

We send a lot of emails in the resilience profession. Why not have each one deliver a targeted piece of awareness that is valuable to the recipient. I developed this process over a weekend, mostly at Starbucks, and I will to share how I did it and you can too.

2092
93
Awareness & Training The ‘Walk Down The Hall’ awareness assessment It is important to mingle with users. You learn a lot. The ‘Walk Down The Hall’ awareness assessment is a great way to get a feel for the maturity of your program. It is quick, easy, fun and provides lots of value. It will also make you ‘famous’ in your organization. Building relationships is a very good thing.

I describe how to do it and why people will gravitate to you.

2093
94
Awareness & Training Gamification ideas build awareness and resilience Wikipedia defines gamification as: the application of game-design elements and game principles in non-game contexts. In my experience gamification works very well when building a resilience program. I discuss ideas and techniques that will help you spread awareness in a fun and stressless manner.
2094
45
Crisis Management Emergency Guidebooks (Desk Guides) Desk guides can serve incident response and continuity purposes. They must be concise and written in a checklist fashion. They work for incident response and continuity purposes.

In the book I provide detailed information and good resources to save you time and effort.

2095
88
Plan Maintenance Plan maintenance Process owners must own their plans – not you. They must update their plans to reflect the current state of their department.

You can use a BCM Tool to automate a portion of the maintenance process or a manual effort if you only have a handful of plans. If you have anything beyond the simplest program, I recommend a BCM tool to build the most resilient and scalable program.

In the book I discuss factors you must consider to streamline your plan maintenance process.

2096
88
Plan Maintenance Develop an mandatory maintenance schedule Although you will need mandatory maintenance periods such as quarterly or semi-annually, process owners must understand that their plans must be updated to reflect the current requirements of the business. There will be changes to the business such as critical systems, employees, new sub-processes. All significant changes should be reflected in plan updates as they happen. Process owners should not wait for the official maintenance period to update their plans.
2097
88
Assessments Assessments are critical to determine risk. Which do you prefer – manual or world-class real-time? The high level purpose of your BC team assessing your program and plans is to identify and treat risk.

Early in my career I developed a simple manual assessment process. It was staff resource intensive and fairly effective. Eventually I completely automated the assessment process so we were doing assessments for 2,135 plans in real-time! Any new risks in a plan due to a negative update initiated an automated alert to the proper process owners and updated our management risk reports and real-time dashboards. It empowered management to have a real-time pulse on the health of our plans and enabled them to see how much risk we assumed at any moment. Management loved the real-time process!!! I describe how you can do it.

2098
88
Assessments Define tiers of business process recoverability I like to use Green, Yellow, Red. I have found people like colors. You should develop your own indicators.
Green = High degree the business process can be recovered
Yellow = Possibility the business process can be recovered
Red = Unlikely the business process can be recovered

The value assigned to each process will be a result of measuring the plan against the criteria you defined. Each criteria can be distilled to simple algorithms. Let your system do the grunt work while you sleep or do something more fulfilling.

2099
88
Assessments Build customized plan assessment rules for your organization! Whether you are assessing your plans manually or with an automated system customize the rules and weighted scoring parameters to meet the needs of your program and the expectations of management.

For example:
– do you require 2 contact numbers for each critical employee in a plan?
– must the recovery site be > 50 miles from the production site?
– are team leader or alternate team leader positions not populated?
– is the recovery site the same as the production site? Ouch! Actually I would build a rule against this when the process owner selects a recovery site. It is simple – I explain it in the book.

Build all of the rules into your assessment formula.

2100
88
Assessments Stakeholder notifications are critical Alert the process owners after you assess their plan. If you have automated the process, as I suggest, the system can automatically send an automated email letting them know the results of the assessment.

If there are issues that must be remediated by a certain date let them know that in the email. After they complete the updates in their plan you, or preferably the system, must reassess the plan and send another email.

Sometimes this back-and-forth process can take a few labor intensive cycles. But we can make it so easy with automation…

2101
88
Assessments Getting to nirvana, I mean real time automation! Now that you have the basics and see how time consuming thoroughly assessing plans can be let’s fix that and free up your valuable time…

Automation allows you to do detailed assessments of even thousands of plans in real-time! Any new risks in a plan due to ANY TYPE OF DATA CHANGE is calculated in real time. An automated email or text can be triggered and delivered to the proper stakeholders. Risk reports and real-time dashboards can change on-the-fly like a stock market ticker and deliver critical information. Real-time automation empowers management to have a real-time pulse on the health of your plans, program and the organization. Management loves real time information!

A core thread in the book is the value of tools and getting to real time in the simplest manner possible. I provide sample use-cases of the value of real-time automation. For example, applying it to real-time recovery seat capability throughout an organization. If recovery requirements change in any plan it is analyzed against locations and available recovery seats. This methodology can be applied to automating the analysis of any information in your program upstream and downstream.

2102
95, 99, 46, 47, 48, 49
Crisis Communications Implement an Intelligent Mass Notification System (I have included additional intelligent mass notification information in the Online Road-map ‘Tools’ section).

Mass notification is a passion of mine. I have successfully implemented mass notification systems for some of the largest organizations in the world. They accounted for some of my most satisfying successes including life-saving notifications during Hurricane Sandy (multiple customized notifications sent to 38,000 appreciative employees), Oklahoma Tornadoes (extremely time sensitive notifications triggered in seconds) and The Boston Marathon bombing (shelter-in-place notifications customized to the zip-code level), to name but a few of the hundreds of notifications for many types of hazards. All are discussed in the book.

In my opinion, small organizations may be able to live with manual call trees but they can easily break down for mid and enterprise organizations including businesses, schools and government. In addition, manual call trees are incredibly slow compared to a good automated system. This is a critical factor considering during many fast moving disruptive events every second counts. It can even be the difference between life and death.

In the book we discuss detailed information on the importance of a cost-effective mass notification system, best practices, the selection process and first-hand tips and techniques. A mass notification system can provide life-saving value but it can also become a drain on your resources if not done correctly and with foresight. I deep-dive every aspect of mass notifications in the book.

2103
81, 82, 45, 48, 49
Crisis Communications Test all manual call trees and automated mass notification call-lists I discuss the importance of testing and data quality steps and issues in the Online Roadmap Testing and Tools sections below.

In the book we have a deep-dive discussion on testing:
– how to schedule
– how to conduct
– issues that will arise and how to prevent/mitigate them
– tips
– techniques
– good and bad lessons learned. Information that can make your life much easier and prevent needless stress.

2104
52, 51
Crisis Communications VOIP Phone Services can be a lifeline Services such as Google Voice can be useful during a crisis when cell phone service becomes overloaded and does not work. I learned of Google Voice from an attendee of a tabletop I hosted years ago. I have relied on it ever since then. I have shared it with many people who enjoy it as well. In fact, I use it now for business as usual meetings. The only limiting factor I found is a 3 hour limit on each call. I surpassed that once during a way-too-long conference call. I simply called back in and had another 3 hours for the call. Fortunately, the call did not go that long – imagine a 6 hour meeting!

We also discuss Push to Talk (PTT) technology which I find provides significant benefits.

2105
51
Crisis Communications Creative communications channels There are many creative ways to reach people during a crisis. Don’t stop at landline, cell, text and email. In the book I list some very interesting ideas. Some are quite creative and potentially life saving.
2106
96, 100, 47, 49, 50, 88,
Tools and Technologies Intelligent Mass Notification You probably need a mass notification system if you are a mid or enterprise organization including businesses, schools and government. Perhaps, a small organization may be able to live with manual call trees but they can easily break down.

Manual call trees are incredibly slow compared to a good automated system. This can be a critical issue during fast moving life-threatening disruptive events when every second counts.

Some of the topics we discuss in the book include:
– The importance of a cost-effective mass notification system
– How to select a good mass notification tool
– How to streamline the implementation process
– Testing guidance – including some hard lessons learned that you must avoid
– Reporting, measuring and maturing your mass notification communication capabilities
– Marty’s best practices, tips and techniques

I deep-dive every aspect of mass notification systems in the book.

2107
48, 49, 50
Crisis Communications Sending ultra time sensitive notifications. Be ready. Every second count! Be prepared and authorized to send ultra time sensitive notifications. Every second counts!

The procedure for authorizing and sending an ultra time sensitive notification to your organization must be designed before a crisis.

Unfortunately, it is a consideration often ignored until it is too late.

Imagine if there was a dangerous event such as a robbery nearby and employees were getting ready to go to lunch. Would you send a notification warning them not to go near that locale? What if the Incident Commander, HR or Communications expert was not available? Are you authorized to send the message? Do you know the right message to send?
Every second counts… you must get this right.

In the book we go into examples and provide suggestions of possible improvements.

2108
54, 56, 64, 67, 68, 58, 55
BIA – RA Risk – Marty’s top threats My top common, not-so-common and Black Swan threats. Be careful, they can all take you down. What you can do to predict, prevent and mitigate.

Every day I get hundreds of threat alerts from situational awareness sources I monitor. They include earthquakes, floods, shootings, fires, power outages, protests… Some sort of threat event occurs every few seconds somewhere in the world.

I analyze the threat data for trends and possible impacts to my organization. Geo-location enables me to manage the avalanche of threats to those most likely to impact my assets. In the situational alerts chapter, in the technology part of the book, we will dig deeper into alerts services you can leverage.

2109
79, 80, 81, 100
BC Plan Creation Provide plans in digital AND paper formats You need both. I am a technologist at heart but there are times the paper plans will be a great insurance policy.
2110
55
BIA – RA Receive final signoff back from management. Store it in a safe place. Smile! Well done!
2111
0
Locations Location based video feeds for impact assessments Create a list of traffic cams and internal video feeds. I have received tremendous value from traffic cams during blizzards and hurricanes. These can even be integrated into good situational awareness tools to save you time, when every second counts.

In the book we also discuss easy to implement inexpensive Internet of Things video chips and sensors, robots and drones, all of which can help you assess location based impacts when it is too dangerous to travel to the location.

2112
28, 84, 91
Team Building Public officials Although they are not precisely teams, make sure you have up-to-date and accurate contact information for police, fire, EMS… teams near each location.

In the book I discuss ideas to build relationships with these critical heroes and have them participate in your program in the book.

2113
84, 88
Team Building Team exercises must be ongoing Exercise and test your teams on a regular basis. It is the only way to improve and uncover gaps – before a real crisis. I suggest tabletop AND physical recovery steps.

Start with simple exercises as soon as possible. As your resilience maturity grows introduce more complex injects during exercises. Insure that each exercise is monitored and documented.

2114
97
Tools and Technologies Please, please, please do a pilot before buying It is critical before you buy enterprise software to do a pilot. I describe why and how to do it.

I describe the details of doing the pilot in the book. A pilot is the best way to really understand what the product can do.

Selecting the right tool can be nirvana. Selecting the wrong tool will be an expensive nightmare.

2115
101, 96, 97, 98, 99, 100, 102 and many other references
Tools and Technologies Quality data is essential You are only as good as your data. In many organizations data is one of the most important assets. We are in the information age. Information is the new gold. More and more companies are now built on systems and data.

Think about it, Uber and Lyft do not own vehicles, Google does pretty well on little text links in their search results

You need quality data throughout your resilience program and your organization:
– Employee contact data must be accurate
– Location data must be accurate
– System data must be accurate
– Sales, inventory, regulatory data, etc… all must be accurate

Unfortunately, getting to quality data is often a big issue in organizations. Fortunately, creating quality data is one of my favorite endeavors. I will divulge my tips and techniques to painlessly get you there. The data opportunities for you are limitless. I have scored many of my biggest successes with data oriented projects. I will share those successes with you.

2116
102
Tools and Technologies Database or Spreadsheet? A big important decision. Spreadsheets and databases have unique strengths and weaknesses. It is important to know the right tool for the job. You will find that most enterprise resilience tools are powered by an underlying database, for good reasons.

The right choice will make all the difference between success and failure. It can take years and a huge expense to dig out from the wrong system and troubled data.

I will share my knowledge and experience with technology to help you get a good simple grounding on what a database can do and when it should be used. It will help you when working with vendors and your IT experts to understand some of the tech terms. You will also surprise them with the questions you ask. I know, it has happened to every resilience professional I have worked with. I am so proud of them all!

2117
103
Tools and Technologies DR testing must be done before ‘the baby is born’ All new systems must be DR tested with user participation BEFORE going into production. This should be part of the IT implementation roadmap.

It is critical to business continuity and will directly impact you if a critical system is not available during a crisis. Keep in mind that there can also be cascading impacts on upstream and downstream systems.

I describe what should be done and who should be involved in the book.

2118
104
Tools and Technologies Build your resilience web site and mobile app It is easy to build a web site and even mobile apps for your resilience program! Anyone can do it. I have created hundreds of systems and I will show you how to do it with ease.

You have many choices of technologies to use such as:
– WordPress – lots of cool plugin functionality
– SharePoint – it will work but not my favorite
– Web template – inexpensive and very professional
– HTML coded (easy)

In addition, you can fairly easily create and brand your own mobile apps with no extra effort or with some extra effort with cross platform tools.

I discuss how you can build a web site and apps in detail in the book. You can do it!

2119
Tools and Technologies Incident Management Mobile App The right Incident Management Mobile App has great value. Some are full featured where you can display photos of impact, chat with teams, assign tasks and get feedback from members assigned those tasks.

In the book we discuss some BCM and Mass Notification tools I work with that have Incident Management capabilities built into their products.

2120
105
Tools and Technologies Webinar software I have probably hosted over 1,000 webinars in my career. I enjoy doing them. You need the capability to host webinars.

I offer product suggestions and discounts in the newsletter which is free to book owners.

2121
105
Tools and Technologies Survey tool Survey tools provide a great method to get feedback from people. You should do a survey after every tabletop, work area recovery exercise and call tree / call list exercise. I am sure you will find many other opportunities for surveys.

The good survey tools will take the raw recipient input and produce valuable metrics including cool graphs.

If you are so inclined you can code your own survey functionality with JavaScript and HTML although with the low cost of robust products and rich feature-set it would not be cost effective.

In the book we discuss my favorite survey tools that I use on a daily basis in more detail.

2122
35, 105
Tools and Technologies Push to Talk (PTT) two way radio apps Push to Talk is one of my recent golden nugget finds! Very worthwhile technology.

Here is one example of its value: if you are a fire warden or searcher you probably have a handset two way radio. Often these devices sit on peoples desks and are in the midst of charging. If you have to evacuate you will not go back for the handset. In that case simply use the PTT app to connect with other wardens and searchers. At the rally point it can be critical to reach other rally points to determine if everyone is accounted for. There are many other uses for the tool. In fact, my entire family uses PTT now! We are hooked on it!

I am not saying you go out and replace the habdsets as they have value. Push to Talk is a great augment to these handsets. I am testing a few PTT apps that work really nicely. The interface mimics a two way radio with a big button in the middle that you press to speak with one of your contacts directly or to a group you set up.

Groups can be private invite-only if sensitive information is being communicated.

One of the apps I like has 100 million users globally. It also has public groups – some emergency groups – that you can listen in on. The app comes in IOS and Android flavors.

Currently I am testing hooking my app to groups that include my organizations handsets – which is the best of both worlds.

I mention specific products in the book and I will be reporting on my hooking to handsets testing effort results when I complete my evaluation in my free Ultimate Business Continuity Tips, Techniques, Tools and Technologies Newsletter for readers of the book.

2123
51, 105, 108
Tools and Technologies Instant Messaging Valuable but be careful! I use Skype and Slack every day. It is a great way to communicate with teammates. Both products go way beyond simple IM’ing.

If you read the the true story chapter in the book about IM’ing while hosting webinars you will know what I mean about being careful. I shared that chapter with friends and the feedback and gratitude I received was far beyond what I expected.

I almost pulled that chapter before the bok was published but I am so happy I didn’t. It can save a career and embarrassment. The story I share was both sad and somewhat funny.

2124
96, 98, 105, 35
Tools and Technologies Traffic cameras (cams) I use them for many crisis events where it is difficult to travel and I need a birds-eye view of the roads near my locations. I have recently used traffic cams for blizzards, hurricanes and volcano lava flow in Hawaii.

In the book I discuss my favorite ways to find them
and situational awareness tools that can display traffic cams and satellite image updates.

2125
96, 98, 105, 35
Tools and Technologies Drones I discuss how I have used drones and will be making even more use of them in the near future. I share some interesting advances in drone technology which enables you to send them on a pre-determined route and monitor multiple drones from a command center anywhere in the world.
2126
105 and many other chapters
Tools and Technologies Let’s Get Visionary! Let’s get visionary was a really fun chapter to create and share with you. It let me stretch my thinking and share some technology I am currently using such as tracking and monitoring objects anywhere in the world for – unlimited! For this use case I bounce pings off satellites and display the exact location on apps and the desktop.

The chapter allows me to discuss many other current and near term technologies that can change the face of resilience and provide benefits we have only dreamed about.

I also keep readers informed on a monthly basis of new resilience tools, tips and techniques through the free Ultimate Business Continuity Tips, Techniques, Tools and Technologies Newsletter for people that own the book.

2127
Crisis Management Keep cash on hand During certain crisis events ‘cash is king’. There are times you need to get something done or employees need assistance and cash is your best or only choice.
2128
106, 107, 108, 109
Career Business Resilience / Continuity as a Career Business resilience – continuity is critical to the survival of any business.
2129
106, 107, 108, 109
Career How to become a great business resilience – continuity professional There are certain attributes that are key to success in our profession. All can be learned.

Whether you are thinking of becoming a professional, new to the field or a seasoned pro you will find this an interesting chapter.

2130
107, 106
Career Considering a career move from IT to BC? BC is a great career path for many IT folks. I took the leap years ago and never looked back. I now have the best of both worlds and I am very happy.

BC is not for everyone. For many of my IT buddies it would not be a good path.

I point out the advantages and disadvantages in the book.

2131
109
Career Managing stress is key Business Continuity, Safety, Security, Operations… sometimes it gets stressful. Especially during a real disruption. We handle serious situations. Our employees and management count on us to get it right. This can lead to stress. Below are some ideas that have helped me manage stress. I am sharing them but I am not a doctor. If you are experiencing extreme stress it is best to get guidance from a medical professional.

I admit it, early in my career I was bad at handling stress. I let little things get to me. The danger in this situation was that I did not realize how bad it was getting.

In the book I discuss my personal story of how I learned to control stress and enjoy life.

2132
Back Cover
About the book About the book – from the back cover What keeps you up at night? Cyber attacks, hurricanes, earthquakes, floods, tornadoes, terrorism, soft-target vulnerabilities or ransomware? Will you be ready when disaster strikes? Will you be confident when your phone rings at 2:00 am and the future of your entire organization is at stake?

Organizations world-wide are currently under siege from a rapidly growing variety of devastating natural and man-made threats. One failure can seriously impact people and destroy your organization. You may not get a second chance. Do not let the nightmare happen to you.

The Ultimate Business Continuity Success Guide is your A-Z roadmap to becoming an unbreakable organization. Written by a successful Business Continuity professional, it features 1001 proven and powerful ‘real world’ tips, techniques, ideas, tools, technologies and templates. The author uses best practices, first-hand accounts, true stories and case studies to demonstrate how he succeeded and how you can too!

You will learn:

How to protect your organization by building a strong world-class always-ready program
How to identify threats, risks, gaps and opportunities in real-time with no extra effort
How to prevent, mitigate and prepare for threats that can impact the survival of your organization
How to create organizational enthusiasm, excitement and a resilient ‘bend but never break’ culture
How to elevate your program from an expense to a profit center while unleashing exciting new value $treams
How to supercharge your program leveraging powerful new business continuity and resilience tools and technologies
Bonus: The Ultimate Continuity Online Resilience Roadmap. A step-by-step tool to real resilience.

Marty Fox, CBCP has achieved success as both a Business Resilience-Continuity Director and a Senior Technology Officer for Fortune 100 Companies. In this book he provides a bold new vision and gateway to the vast opportunities business continuity and resilience can provide you.

Please join Marty on this inspiring, educational and fun journey straight to the top.