Building a power outage business continuity plan: Step by step

Consequences of power loss

A loss of power can shut down an entire business unless organizations take suitable precautions. A complete loss of commercial power is the worst-case scenario, as opposed to local and/or regional outages that are confined to specific locations. Extended outages can cause catastrophic business losses that might last hours, days or weeks.

Unplanned downtime due to power outage might result in the following, if not remedied quickly:

• Data loss.
• Financial/legal troubles for not meeting compliance requirements.
• Reputational harm.
• Damage to critical systems.
• Employee injuries and even fatalities.

Causes of business power outages

Events that are most likely to cause power outages are often associated with natural causes, such as severe weather. Naturally occurring events likely to cause power outages include the following:

• Tornadoes.
• Wildfires.
• Earthquakes.
• Flooding.
• Mudslides.
• Lightning strikes.
• Sinkholes.
• Solar flares and storms.

Outages can also be manmade, by error or malicious action. Disruptions caused by human activity can include the following:

• Flooding caused by damaged plumbing.
• Electrical damage caused by improper wiring or lack of grounding.
• Incorrect data entry or programming of power management systems.
• Failure of systems within the nation's electric grid.
• Damage to high-voltage overhead power lines and towers.
• Electromagnetic pulses.
• Damage to power cables by construction equipment.
• Incorrect power system installation.
• Insufficient fueling of backup power systems.
• Failure to regularly test backup power systems.
• Fire/arson.

8 steps to design and implement a business continuity plan for power outages

Like most business continuity plans, several activities should occur before plan development begins. The following is a list of eight tasks IT teams and BCDR personnel must complete before implementing a plan.

1. Secure senior management approval and funding

Few, if any, business initiatives get off the ground if leadership is not on board, so it is critical to secure management approval early. Discussions with management will likely shape who is involved in a business continuity plan, as well as determine the budget. This stage is an opportunity to make the case for investing in business continuity and evaluating power sources for potential outages.

2. Establish a project team

Depending on the size of the organization, the size of a business continuity team varies. These teams are typically made up of IT personnel, with input from various department heads and HR. When creating a business continuity plan for power outages, members might also include internal facilities employees and external power professionals.

3. Conduct a business impact analysis (BIA) and risk assessment

Risks vary by organization, so it is critical that the business continuity team conduct a business impact analysis (BIA) and risk assessment before creating a plan. A BIA will identify the severity of different risks and how badly they are likely to affect key business processes. For example, the analysis might show that a loss of electricity to a data center's power source would cause significant downtime, resulting in compliance violations or data loss. That finding would affect the structure of a business continuity plan, making sure that the power source is a high priority.

A risk assessment, on the other hand, determines the likelihood of different risks that might affect operations. When it comes to a power outage plan, key risks to assess would be aging infrastructure, local weather patterns and the reliability of the region's electric grid.

4. Prepare a list of all power resources

When an outage strikes, you don't want to be scrambling to find the electric company's contact information. For a power outage business continuity plan, make sure someone has a copy of or access to this information. This could be a member of the business continuity team or HR.

Organizations should have contact information for key power resources, which might include the following:

• Primary and alternate electric utility companies.
• Emergency power system vendors.
• Fuel companies for backup power systems.
• Electricians and specialized contractors.
• Access to power system engineers and consultants.
• Access to suppliers of power protection resources.

5. Establish procedures for responding to power outages

Statistically, the likelihood of a short-term power interruption is fairly high. Short-term outages can last about 15 minutes. They are nuisances, but will not likely disrupt business operations. By contrast, longer-term power outages, lasting hours or days, require a more intensive business recovery process.

Organizations must establish several key procedures for resolving power outages. While some of the technical details will differ by organization, two key elements should be top priorities: people and power.

Confirm that employees are unharmed and commence evacuation of personnel as quickly as possible. Establish outside meeting locations where employees can gather, receive further instructions from management and first responders, and management can take headcounts of employees.

Launching emergency power systems can help keep the organization running, unless other circumstances necessitate a physical evacuation. Backup power and remote working make sense so long as the outage is of a relatively short duration, and is largely confined to a specific geographic area, such as a city or section of a city, and is not a statewide or nationwide disruption.

For larger-area and extended power outages, the above strategies might be insufficient, so it is important to discuss short- and long-term power outage strategies periodically with senior management, facilities teams and utility companies.

6. Establish recovery procedures post-outage

Once power returns, the business will need time to recover and restart systems, and reestablish network connections and related activities. Check with building facilities personnel on the cause of the outage and determine remedial actions that can help prevent future occurrences.

7. Establish and schedule testing activities

Testing is key to any business continuity plan. IT teams must test incident response activities, backup and restore operations, and communications resources to make sure the company can return to business smoothly. When creating a business continuity plan for power outages, you must also consider physical infrastructures that might be affected and test their backup power systems.

8. Schedule periodic assessments of power infrastructures

Business continuity plans typically include strategies for power outage response and necessary resources. These include local backup power systems, spare power supplies for equipment racks and devices, spare power cables, power connectors and spare power outlets.

Periodically inspect the building infrastructure for power protection equipment, and be sure to include the following resources and strategies:

• Lightning arrestors.
• Grounding.
• Power conditioners.
• Surge suppressors.
• Cabling with the proper rating for the intended usage.
• Backup power systems.
• Flashlights.
• Diverse cable routing in vertical and horizontal raceways and cable paths.
• Diverse power cable routing into the building.
• Service from two different utility power substations.

Make sure that emergency lighting is in place throughout each floor of the office and in stairwells. If an organization is a tenant in an office building or manufacturing facility, check with the facilities management team on their power protection activities.

Include power loss in BCDR and resilience plans

Power loss is one of the principal risks and threats to business continuity. No matter the size or location of an organization, IT teams must prepare for several vulnerabilities to prevent or reduce the effects of potential power outages.

When developing BCDR, incident response and resilience plans, organizations must include power disruptions in risk assessments and BIAs. These analyses help identify ways to prepare for power outages and how to mitigate the severity of an outage to the business. These assessments will also show the organization the likelihood of different disruptions, helping them dedicate resources where they are needed most.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.