1. What Works and What Doesn’t? S. Rusty Sailors Battalion Chief Special Operations – IFRD CTO – LP3 Gordon Fellow – UCSD 2013/05/01 5/1/13Small Business Continuity & Resiliency1

2. Topics What doesn’t work when disaster hits? What helps the most for continuity and persistence? Moving resiliency into daily operations so you can fail soft 5/1/13Small Business Continuity & Resiliency2

3. What doesn’t work when disaster hits? #1: Lack of preparedness and planning Deploying untrained employees / resources into critical assignments – (BERT) pre-certify and turn employees into resources rather than burdens – interact with first responders and bring value Trying to make connections or develop relationships last minute Shooting from the hip with an unloaded gun – get the information you need ahead of time to make the right decisions as a leader Trying to save equipment or data without a prearranged destination – you may cause more harm than good Trying to establish emergency communications without a plan – contact plans, devices, ties into emergency information Assuming employees will consider the business as a priority – ensure you understand those who will and automate when possible 5/1/13Small Business Continuity & Resiliency3

4. What helps the most for continuity and persistence? Developing a strategy for disaster preparedness and recovery – engage your employees in the process Having plans in place that reflect your strategy; don’t talk – do! To get plans in place – develop the 80% solution, claim GEMO! and then iterate to get it finalized Understanding the interdependencies across the board – internally and externally; know your first responders and community Training your employees – they are your best asset; protect them and leverage them; certify for emergency interaction when possible Developing good partners – don’t go this alone and they can probably use your help as well; don’t be myopic pre-disaster Understanding your physical and virtual community – involve them in your planning and in your exercises to strengthen relationships 5/1/13Small Business Continuity & Resiliency4

5. Moving resiliency into daily operations so you can fail soft Practice like you play – make training realistic, relevant and meaningful – if you make it real, they’ll take it seriously Set the expectation – create an effective culture; people respond to perceived value and tend to ignore the rest Bring new people up to speed in the same culture – propagate your preparedness Practice and monitor security practices – retrain and update as needed Exercise with partners – critical failures occur by faking it and not exercising critical infrastructure After identifying your key risks, exercise those by priority Plan for related costs accordingly Mitigate all you can afford – ensure insurance covers the rest 5/1/13Small Business Continuity & Resiliency5