“Homeland Security and Business Continuity Planning”
By Jane Bullock and George Haddow

Business continuity planning provides focus driven preparedness for businesses. At its simplest, business continuity planning (BCP) is the act of setting up a plan to ensure the survival of an organization. Computer technology prompted the original growth of BCP as the need for restoration of computer and data bank information drove many business operations. Since that time, the concept of continuity has evolved in response to an ever-changing environment. Major events have demanded that BCP encompass a growing number of concerns.

The severe impacts on businesses of the September 11th events have placed new requirements on the discipline of BCP. In addition, actions promulgated by various regulatory agencies as a consequence of this event and other economic market activities require a renewed focus on how businesses implement BCP. How BCP evolves will directly influence business, our economy and our society. This article will explore this new challenge and opportunity for BCP.

In today’s environment, businesses can no longer ignore the potential that disasters, including acts of terrorism pose a real threat to the survival of business. New concerns over the impacts of the potential threats have dramatically expanded. BCP must expand its role to consider: (1) concern for the physical safety of employees and for the human relationships that a business depends on for its survival; (2) expanding globalization and regional impacts where disasters across the country impact local business continuity; (3) renewed importance of critical data backup systems and decentralization as a solution to continuity; and (4) external factors outside of the direct control of business require new partnerships in order to be effective. Let’s focus on the issue of the new external environment for BCP and its implications.

September 11th raised awareness of the fact that the survival of business depends on many external factors. External factors such as physical and social infrastructure and the interface with public safety activities play a key role in whether or not BCP is ultimately successful. After September 11th, infrastructures vital to business operations came under the control of public safety authorities. Having little or no prior relationship, new operational alliances were hastily put in place. BCP became dependent on public safety authorities. This awareness has lead to attempts at greater communication between business and government since the attacks.

In early March 2002, the Office of Homeland Security unveiled its Homeland Security Advisory System. Business immediately responded with its own proposal, the Critical Emergency Operations Link, which is intended to be a direct, two-way communication link to government at all levels. Business is demanding interaction with government so that it can anticipate how to react in the event of not only terrorist attacks, but any catastrophe that threaten its survival. The attempt at greater communication and interaction by business is a proactive effort to turn its reliance on public safety authorities into an opportunity to ensure the success of BCP.

This suggests that business will solicit partnerships and a more extensive role for emergency management in BCP. The connection between emergency management and BCP is natural as it is authority that has the responsibility of public safety planning. By requesting that emergency management play an extensive role in BCP, business can interact with government to ensure its survival. Emergency management should meet this demand with an outstretched arm because it represents a great opportunity for the field. If emergency management sincerely cooperates, then business may demand that government at all levels allocate more resources to emergency management in order to ensure that it can provide effective assistance. Ultimately, with business as its advocate, emergency management may gain the influence it needs to assume a greater role in leading the local and national public safety agenda.

In the wake of the tragic events of September 11 and the subsequent economic and financial losses, business continuity planning has taken on a new criticality and importance within the private sector. Companies that, here to for, did not recognize the potential impacts of disasters, business interruptions and other external events, have acknowledged that events outside of their realm of control, such as acts of terrorism, or other man-made or natural disasters, can and will have a significant impact on their business operations, processes, profits, customers and employees. September 11 became a wake-up call to the business community that it needed to assess its operations and to look at business continuity from an entirely new perspective.

In addition to the events of September 11, actions taken by the Securities and Exchange Commission (SEC) in the wake of a series of investigations, resulted in the promulgation of a ruling that requires its members to establish and maintain business continuity plans and to report to its shareholders when any disruption has caused even a minimal percentage of profit change in financial operations.

These two events present a significant challenge and opportunity to BCP.

The September 11 events precipitated a dramatic increase in demand for training and credentialing of business continuity planners. To keep up with this demand, improved basic courses, more current, more advanced courses for continued credentialing, and topic specific courses, such as crisis communications, need to be developed, implemented and marketed. The universe for business continuity professionals has expanded and the need for more advanced training, credentialing and enhanced professionalism represents a significant market opportunity.

The new SEC rulings require a different approach. Businesses and policy makers need to be educated as to the impacts of theses changes, research on implications and modes of implementation need to be undertaken and best practices need to be identified. In addition, the knowledge, experience and expertise of the business continuity community, their constituents and customers need to have a representative voice and advocate in the public policy arena so both the business community and the legislative and policy makers can benefit from objective, professional research and analysis on issues, ideas and concepts that effect the economic well being of U. S. businesses.

The devastating impacts of September 11 have resulted in increased coordination and cooperation between business and emergency managers. Hopefully the emergency management and business continuity communities will exploit this opportunity and become more active in supporting each other and working together to create a more secure America.



About the Authors

Jane Bullock and George Haddow are Principals in Bullock & Haddow LLC, a disaster management consulting firm based in Washington, DC. They both serve as Adjunct Professors at the Institute for Crisis, Disaster and Risk Management at The George Washington University and are co-authors of “Introduction to Emergency Management” published in 2003 and “Introduction to Homeland Security” to be published in Spring 2004. Alfredo Lagos contributed to this article.