Best of the Best: Key Steps for Successful Contingency Plans

No one disputes that contingency planning (e.g., business continuity planning, disaster recovery planning, and incident response planning) is a critical business need for all higher education institutions, yet creating and keeping such plans up to date is often a difficult task. Higher education business continuity, crisis response, and disaster recovery professionals are constantly bombarded with articles, research reports, webinars, and workshops, all claiming to have the 10 or so most important steps to take to guarantee a successful response to a crisis. I too have published articles and given presentations identifying multiple lessons learned and best practices. However, I am still frequently asked to simplify and reduce this information down to a handful of key steps to take that will give a college or university the greatest chance of an effective response and, ultimately, continuity of operations in a crisis.

This list represents the "best of the best" practices for higher education crisis response. It is the result of recent response research and interviews with professionals who have been involved in high-profile crisis events. Following these five steps will help your institution respond during a crisis.

1. Practice your crisis response/recovery plan. No matter how well written it is, your plan's worthless if it's not practiced — and it should have two clear goals:
   • Rehearsal — A run-through gives the response personnel an opportunity to become familiar and comfortable with plan procedures.
   • Testing — Short of experiencing a real emergency, the only way to know if a response and recovery plan is effective is by testing through drills and exercises, which will help identify gaps in your plan.
2. Ensure your off-hours notification system works. Crises don't always occur during normal business hours. How are institutional leaders notified if a critical event hits at two o'clock on a Sunday morning? Test and evaluate the off-hours notification systems on a regular basis, as no one wants to find out from the media that a campus disaster occurred overnight, especially not your college president.
3. Implement an Information Technology Disaster Recovery Plan (ITDR) that can meet your institution's needs for recovering operations promptly following a business interruption. Proactively talk with faculty and staff about expectations for system recovery and identify realistic recovery time objectives (RTOs) and recovery point objectives (RPOs). Assist staff with understanding that in the IT world, "immediate recovery" may take four to eight hours.
4. Appoint an "official spokesperson" with training in crisis media relations. Poorly conducted media relations can overshadow a really effective response. There is usually only one chance to tell your institution's story, and conducting effective crisis media relations requires special training and preparation.
5. Require your essential service suppliers to have emergency response and recovery plans. You don't want to have a successful response only to experience further business interruption because a supplier you rely on cannot recover.

Not every crisis can be prevented; however, proper planning and preparation is key to institutional recovery during an unexpected event. Incorporating these five "best of the best" practices will help your institution have a much greater chance of conducting an effective crisis response, ensuring faster recovery and continuity of operations.

Joseph DesPlaines is a Business Continuity and Crisis Response Consultant with Districts Mutual Insurance (DMI), the exclusive provider of insurance and risk services to the 16 Wisconsin Technical Colleges.