Managing Risk and Building Small Business Resiliency
Disaster Preparedness
Small businesses can be impacted by various types of disasters, including technological, natural, and other disruptions. Technological disasters encompass cyber-attacks, data breaches, and system failures, which can cripple operations and lead to financial losses. Natural disasters, such as hurricanes, floods, earthquakes, and wildfires, can cause physical damage to premises, inventory, and equipment, as well as interrupt business activities. Other disruptions include human-induced events like power outages, supply chain interruptions, and even pandemics, which can significantly impact business operations and cash flow.
Creating a continuity plan is crucial because it prepares businesses to respond effectively to these unexpected events, ensuring minimal disruption, safeguarding assets, maintaining customer trust, and securing a path to quick recovery. A well-thought-out continuity plan can be the difference between a temporary setback and a business-ending catastrophe.
of small businesses have a 3 month average recovery time from a disaster
* Source: Datacore.com
Disaster Preparation Basic Steps
1: Assess your risk
Every business has unique vulnerabilities and weaknesses. Statistics say that 25% of businesses won’t open again after a disaster. Knowing which disasters are most likely to affect your business can help you to return to operations faster. A self-assessment can help you to assess your risks for common hazards such as hurricanes, wildfires, flooding, or even cyberattacks.
2: Create a plan
Your response plan is your roadmap to recovery, so it should be tailored to your business’s specific needs and operations. It should address immediate priorities and be easy to access. Checklists and online toolkits are effective resources to help you develop your plan. Focus on disasters that pose a realistic risk to your small business.
Consider the following:
- The Federal Emergency Management Agency (FEMA) emergency preparedness checklist and toolkit
- The IRS guide on preparing your business for a disaster
Emergency plans should be reviewed annually. Personal and business situations change over time and so do preparedness needs. When employers hire new employees or when a company or organization changes functions, plans should be updated accordingly and employees should be informed of the changes.
3: Execute your plan
Practice your plan with your staff so you’re ready when a disaster occurs.
- Additional Resources
Natural Disasters
Make sure you have a means of receiving severe weather information; if you have a NOAA Weather Radio, put fresh batteries in it. Make sure you know what you should do if threatening weather approaches.
Click on the link below to learn more about preparing for different types of natural disasters:
Digital & Cyber Risks
Common Cyber threats
It’s important to use best practices in your cybersecurity strategy. Cyberattacks constantly change, and business owners should be aware of the most common types. To learn more about a specific threat, click on the link provided to view a short video or fact sheet.
- Malware (malicious software) is software designed to harm a computer, server, or computer network. Malware can include viruses and ransomware.
Viruses are harmful programs intended to spread from device to device like a disease. Cyber criminals use viruses to gain access to your systems. This can cause significant and sometimes unrepairable issues.
Ransomware is a type of malware. It infects and restricts access to a computer until the owner provides some sort of ransom. Ransomware can encrypt data on a device, and demand money in return for a promise to restore it. Ransomware exploits unpatched vulnerabilities in software and is usually delivered through phishing emails.
Spyware is a form of malware. It gathers information from a target and sends it to another entity without consent. Some spyware is legitimate and legal. It may operate for commercial purposes, like advertising data collected by social media platforms. Malicious spyware, however, illegally steals information and sends it to other parties.
Phishing is a common type of cyberattack. It can use things like links in an email to infect your system with malware to collect sensitive information. Phishing emails can appear legitimate, or appear to be sent from a known entity. These emails often entice users to click on fraudulent links or open attachments containing malicious code. Be cautious about opening links from unknown sources. If something seems suspicious from a known source, don’t click on it – ask the source directly if it’s legitimate.
More information regarding Cybersecurity can be found under our Data Assured program.
Artificial Intelligence Risks
Using AI can mean your business is assuming a certain amount of risk. If it is part of software you have purchased, those creators are responsible for their product’s use of AI.
If you are using free AI tools or software in your small business, have another person review all AI products. This will help make sure they are being used ethically, securely, and in a manner that accurately represents your business.
Other considerations include:
- Intellectual property. AI sources content from the web. Make sure anything you produce doesn’t infringe on any patents, copyrights or trademarks.
- Security risks. Try not to feed any sensitive data or proprietary information. This will help keep it out of the data pool that the system uses when producing content. Keep an eye out for phishing campaigns that might have been written using AI.
- Customer trust. Tools that recognize AI-generated content may mark it as spam, or as not generated with real knowledge of the recipient. This could create customer resistance to future outreach efforts. Make sure a person assesses all the messages and outreach campaigns that AI generates.
- Ethical concerns. Monitor and review content to make sure it reflects your business’s culture and principles. While there are currently no federal or state laws that require businesses to disclose the use of AI, it is becoming an expected best practice. Consider drafting a public statement that discloses how your small business uses AI.
Human Risk & Succession Planning
Review more information on Succession Planning here.
Pandemic & Shut Down Hazards
In the case of a shut down, epidemic, or pandemic it is important to consider:
- How to pivot to online
- How to cut overhead costs
More information on cutting overhead costs can be found here.
On-Demand Learning
Introduction to Risk Management
Course Overview
Break into the world of business procedures, disaster prevention, and more with Tempest Risk Management’s Andy Ziegler.
Risk Assessment & Business Continuity
Course Overview
Steer clear of risks and ensure your business is resilient with Tempest Risk Management’s Andy Ziegler.
Creating Policies & Procedures
Course Overview
Learn how to improve your policies and procedures with Tempest Risk Management’s Andy Ziegler.
The 7 C's to Plan & Prepare
Course Overview
Please join the Delaware SBDC, Small Business Administration, and Tempest Risk Management for a session on Leveling Up Your Business.
Attendees will learn the 7 C’s to Plan, Prepare and Position for What’s Next. Hear from Delaware-based resource partners about the importance of planning for your business growth and resiliency. Andy Ziegler, a local small business owner and resiliency expert, will also share his experiences and best practices to help you propel your business forward.
Selling or Closing Your Business
Course Overview
Review the Small Business Administration’s introductory course on things to consider when selling or closing your business.
Continuity of Operations
Review your emergency plans annually. There are real benefits to being prepared for disasters. The following preparedness strategies are common to all disasters. You plan only once, and are able to apply your plan to all types of hazards.
- Get informed about hazards and emergencies and learn what to do for specific hazards.
- Develop an emergency plan.
- Learn where to seek shelter from all types of hazards.
- Back up your computer data systems regularly.
- Decide how you will communicate with employees, customers and others.
- Use cell phones, walkie-talkies, or other devices that do not rely on electricity as a backup to your telecommunications system.
- Collect and assemble a disaster supplies kit. Include a portable generator.
- Identify the community warning systems and evacuation routes.
- Include required information from community and school plans.
- Practice and maintain your plan.
- Financial Assistance
If your business sustained damage or economic hardship due to a disaster in your area, you can apply for an SBA Disaster Loan. Businesses of all sizes may apply for up to $2 million to be used to repair damaged real estate, replace or repair machinery and equipment, or replace inventory and various other business assets. You may also be eligible to borrow up to $2 million for economic injury recovery.
You can apply online, or visit any FEMA Disaster Recovery Center, SBA Disaster Loan Outreach Center, or SBA Business Recovery Center in your area.
A loan officer will work with you to review your credit, inspect your business and determine your eligibility. As this process may take some time due to post-storm demand, it’s important to apply for an SBA Disaster Loan as soon as you’re able to safely determine whether you need assistance.
DisasterAssistance.gov, FEMA’s hub for disaster relief information, can guide you toward other options for financial assistance.
- have prepared documentation
Many people receive bank statements and documents by e-mail. This method is an outstanding way to secure financial records. Important tax records such as W-2s, tax returns and other paper documents can be scanned onto an electronic format.
Be sure you back up your electronic files and store them in a safe place. Making duplicates and keeping them in a separate location is a good business practice. Other options include copying files onto a CD or DVD. Also, many retail stores sell computer software packages that you can use for recordkeeping.
When choosing a place to keep your important records, convenience to your home should not be your primary concern. Remember, a disaster that strikes your home is also likely to affect other facilities nearby, making quick retrieval of your records difficult and maybe even impossible.
The IRS has disaster loss workbooks for individuals (Publication 584, Casualty, Disaster, and Theft Loss Workbook) and businesses (Publication 584-B, Business Casualty, Disaster, and Theft Loss Workbook) that can help you compile a room-by-room list of your belongings or business equipment. This will help you recall and prove the market value of items for insurance and casualty loss claims.
One option is to photograph or videotape the contents of your home and/or business, especially items of greater value. You should store the photos with a friend or family member who lives away from the geographic area at risk.
Downloadable Resources
Business Resiliency Guide
A guide for businesses disrupted by a disaster so they can resume regular operations sooner, recover faster, and sustain over time.
IRS Business Casualty, Disaster, and Theft Loss Workbook
This workbook is designed to determine loss on business and income-producing property in the event of a disaster, casualty, or theft.
Introduction to Ransomware
This document explains outlines how your business could be affected and how you can protect your small business from these attacks.
Disaster Recovery Guide for Business
Created by Vermont SBDC, this Disaster Recovery Guide contains all the steps small business owners need to take, and all the information one would need to gather post-disaster.