Business Protection ToolkitPreparing IS Your Business

1

Business Protection ToolkitPreparing IS Your Business

Contents2 Introduction

4 Why the Private Sector Should Care

6 BenefitstoPreparedness

7 ThePS-Prep™Program

8 AStandards-BasedApproach

9 GettingPrepared

10 ThePS-Prep™Continuum

11 Small/Medium-SizedBusinesses

14 CorporateEntities

20 Non-ProfitOrganizations

21 FrequentlyAskedQuestions

23 Resources

2

Theworldcanbeadangerousandunpredictableplace.Itseemslikewearecontinuouslyenduringthepainful—andsometimestragic—effectsofdisasters.ThetsunamiandearthquakeinJapan,andfloodingandtornadoesinthesouthernandcentralUnitedStates,arerecenteventsresultinginpropertyloss,personaldamages,liveslost,andeconomicloss.Thelong-termimpactoftheseeventsisstillnotfullyunderstood.Foronething,automobileandconstructionfacilitieshavebeendrasticallyaffected,manyofwhichhavebeenshutdownbothnationallyandinternationally.Asaresult,oureconomyhaswitnessedan11%declineinhousingandnearlya9%declineinautomanufacturing.Largeentities,includingJapan-basedToyotaandSony,andevenfacilitiesasfarawayascentralKentucky,

havebeenaffectedbythesenaturaldisasters.Norshouldbusinessownersdiscountsmallerevents,suchaswatermainbreaksandpoweroutages,whichcanprovejustasdetrimental.Everyyear,electricalpowersurges,spikes,andoutagesyieldmorethan$150billionindamagestotheU.S.economy.Noorganization—whethersmall,large,for-profit,ornon-profit—isinvincibletotheaftermathofadisaster.

Itisessentialthatleadersofbusinessesandorganizationsproactivelypreparefordisaster,asitisnolongeramatterofifadisasterwillhappenbutwhen.ThePrivateSectorPreparednessProgram(PS-Prep™)isheretobringyouone-stepclosertoachievingsurvivabilityintheeventofanemergency.

Introduction

“Private organizations across the country—from businesses to universities to non-profit organizations—have a vital role to play in bolstering our disaster preparedness and response capabilities. These new standards will provide our private sector partners with the tools they need to enhance the readiness and resiliency of our nation.”

–JanetNapolitanoSecretaryoftheDepartmentofHomelandSecurity

3

TheDepartmentofHomelandSecurity(DHS)begandevelopingtheprograminDecember2008.PS-Prep™isavoluntaryprogramdesignedtoprotectprivatesectorentities(corporateentities,small-tomedium-sizedbusinesses,andnon-profits)againsttheeffectsofadisruption.Byequippingleadersandstaffwithkeyresources,PS-Prep™canimproveanorganization’sabilitytomaintainoperationsduringandafteranemergency.

Whetheryourorganizationissmallorlarge,anyeffortstoimprovepreparednessarebeneficial.PS-Prep™offersseveraloptionstowardpreparedness:followingbest-practiceprograms,aligningtoastandard,orcertifyingtoastandard.Prepare to become resilient. Whether your entitymaybeaffecteddirectly,orviathesupplychain,it’scriticaltohaveaplaninplace—aplanthatcanprotectyouremployeesandorganization,andenhanceyouroverallabilitytoberesilient.

4

Privatesectorentitiesareuniquelyaffectedbycatastrophicevents.Withvariedresourcesandnumerousstakeholders,privateorganizationshavearesponsibilitytobeprepared.Thefollowingexampleshighlighttheimportanceofpreparatorymeasures:• The9/11CommissionReportidentifiedtheprivatesectorashavingsignificantrisksinbeingabletorespondtoandrecoverfromdisruption.

• Privatesectorleadersshouldconsidertheimpactofdisruptionsandpossibleconsequencesforemployees,families,andneighborhoods/communities.

• Beingunpreparedintheeventofacrisiscanleadtosignificantrevenuelossandunanticipatedcosts.

• Interruptedoperationscouldimpactorganizationalrelationshipsandtarnishreputation.

• Anorganizationcanexperienceasignificantcompetitivedisadvantageiftheyhavenotmadeplanstomitigatelossanddown-timeduringahazardousevent.

• Survivorsofdisasterstypicallywaitupto72hoursforhelptoarrive.Thismakesitevenmoreimperativethatentitiespreparetobeself-sufficientforthefirst72hours.

Why the Private Sector Should Care

5

2011 Mar 11, 2011 8.9 earthquake andtsunami strike Japan,affecting U.S. PacificCoast

Apr 14-16, 2011 Three days of stormsand tornadoes hit NorthCarolina to Mississippi

Apr 27, 2011Storms sweep vastsouthern region of theU.S.

May 23, 2011Tornado strikesJoplin, MO

Jun 1, 2011Series of tornadoessweep western regionof the U.S.

Jun 6, 2011Major wildlifespreads acrosseastern Arizona

2005 Sep 25, 2005Hurricane Jeanne hitsFlorida

Oct 24, 2005Hurricane Wilmapounds South Florida

Sep 20, 2005 Hurricane Rita strikesGulf Coast Florida

Aug 29, 2005Hurricane Katrina lashesthe Gulf Coast

2009 Jun 17, 2009 Asbestos contaminationplagues Libby, MT;declared a public healthemergency

2010 Feb 6, 2010 Snowstorm paralyzeseastern coast of the U.S.

Apr 6, 2010Coalmine explosion atMassey Energy Co., WV

Jun 11, 2010Flash floods tearthrough Langley, AR

Sep 28, 2010 Heat wave and poweroutages strikeLos Angeles, CA

Dec 27, 2010 Damaging blizzardssweep the northernAtlantic coast of the U.S.

Jan 2010 Cyber-attack on Googleaffects 34 firms

2006 Oct 15, 2006 Earthquakes tremblenorthwester region ofHawaii

Aug 25, 2006Hurricane Ernestoproduces torrential,flooding rains overMid-Atlantic region

2008 Feb 6, 2008 Severe tornadoes andstorms sweep mid-southregion of the U.S.

Sep 13, 2008Hurricane Ike poundsTexas coast

Dec 13, 2008Ice storm cripplesnortheastern region ofthe U.S.

Dec 22, 2008 More than a billiongallons of toxic coalsludge floods CentralTennessee

2007 Oct 23, 2007 Wildfires engulfsouthern California

2004 Sep 17, 2004Hurricane Ivan strikeseastern U.S.

Sep 5, 2004Hurricane Francesstorms Southern Florida

2001 Sep 11, 2001 Terrorist attack devastatesNYC; Arlington, VA; PA,and by extension, theentire nation

2003 Feb 20, 2003 4th-deadliest fire in U.S.history destroys RhodeIsland nightclub

Aug 14, 2003 Major power outageaffects dozens of citiesin the eastern region ofthe U.S.

May 4, 2003 Tornadoes pillageU.S. Midwest

Sep 18, 2003 Hurricane Isabel plundersMid-Atlantic states

“The 21st-century incidents are increasing in frequency, scale, and consequence, and the private sector needs to be prepared to bounce back and help our nation recover.”

–BobConnorsDirectorforPreparednessatRaytheonCorporation

6

Benefits to Preparedness

Develop a Plan of Actionforhandlingdisruptionsthatissharedwithemployeesandpracticedthroughexercises.

Increase Reliabilitybyprovingyourorganization’sabilitytomitigateall-hazardconditions.

Minimize Impact to Essential Operations,increasingentity’sopportunitytocontinuetooperate.

Protect Market Share and Minimize Financial Lossesbyproactivelyplanningandaccountingforrecoveryresourcesbeforetheyareneeded.

Protect Data and Informationtoensuredecisionscancontinuetobemadetofacilitateorganizationrecovery.

Gain Industry Recognitionbypromotingpreparednesswithsuppliersandclientsalike.

7

PS-Prep™isavoluntaryprogramdesignedtobuildawarenessandgiveprivatesectorentitiestheabilitytosafeguardtheirorganizationsagainsttheeffectsofanytypeofdisruption(naturalorhuman-induced).Theprogramincludesstandardsthatwillequipdecision-makerswithkeyprocessestoimprovetheirorganizations’abilitytomaintainoperationsduringandafteranemergencyordisaster.

Throughthe9/11CommissionActof2007,CongressrequiredDHStodevelopandimplementaprogramtoencouragenationwidepreparedness,resilience,andrecoveryamongprivatesectorentitiesintheeventofanyemergency.PS-Prep™offersanorganizationapathtobecomebetterpreparedutilizingofficialstandards.

Asprivatesectorentitiesvaryinsize,structure,andspecialty,PS-Prep™offersthreedifferentstandardsforcontinuityandrecoveryprocesses.Thesestandardsweredevelopedbypreparednessexperts,approvedbyANSI-ASQNationalAccreditationBoard(ANAB),andadoptedbyDHSforthisprogram.Theyare:1. Disaster and Emergency Management and Business Continuity {NFPA

1600: 2007/2010 editions} Providesaholisticapproachtopreparednessthataddressesorganizationalmanagement,riskassessment,prevention,mitigation,resourcemanagement,responsecontinuity,andrecovery.

2. Organizational Resilience and Security Preparedness and Continuity Management {ASIS SPC.1-2009} Providesthestepsnecessarytoprevent,preparefor,andrespondtodisruptiveincidents.Itpromotessurvivalandorganizationalresilience.

3. Business Continuity Management {BSI BS 25999} Providesabasisforunderstanding,developing,andimplementingabusinesscontinuityprogramsothatorganizationsmightavoidinterruptionstooperations.

The PS-Prep™ Program

8

Manyarenotawareoftheimportantrolethatstandardsplayinourday-to-daylives—productsmaynotworkasexpected,bridgesandroadsmaybeimpassable,buildingswouldtakelongertobuild,andmayevenbeunsafetoinhabit.Weshouldreallyaskourselves,“Whatwouldtheworldbelikewithoutstandards?”

PS-Prep™usesastandardsbasedapproachtobusinesscontinuityandrecoverythatwillalloworganizationstounifytheirpreparednessactivitiesunderstandards.Thesestandardsprovideamanagementsystemthatincludespolicies,processes,procedures,performancemeasures,andqualityimprovementpractices.Preparingtoastandardallowsforuniformandconsistentplanning,implementing,andimprovingbusinesscontinuitywithindepartmentsandthroughouttheorganization.PS-Prep™caninstillconfidenceinyourorganizationforyourcustomersandstakeholders.

PartialListofCommonElementsof PS-Prep™AdoptedStandards

1. Program Policies and Management • Developpolicy,vision,andmissionstatements.• Devoteappropriatepersonnelandfinancialresources.• Assignanindividual(orcommittee)withappropriateauthoritytoleadthepreparednessefforts.

2. Analysis • Evaluatelegal,statutory,regulatory,andindustrybestpractices,aswellasotherrequirements.

• Defineanddocumentthescopeofthepreparednessprogram.

• Conductariskassessmentandimpactanalysis.3. Planning

• Preventionandmitigation• Incidentmanagement• Resourcemanagementandlogistics• Training• Testingandevaluation• Recordsmanagement

A Standards-Based Approach

9

Nowthatyouknowthebenefitsofbeingprepared,itisimportanttounderstandthatbeingpreparedisanongoingprocessofimprovementsthatmustbereviewedandauditedregularly.Weunderstandthatthejourneytopreparednessisnotaone-size-fits-allapproach;itwillbedifferentforsmall,large,andnon-profitentities.

Ifyouaremakingthedecisiontogetpreparedforthefirsttime,congratulations!Youcanstartbydevelopingapreparednesspolicy,avisionormissionstatement,andcontinuetoevolvebystrengtheninginternalprocesseswiththedevelopmentofacomprehensivepreparednessprogram.

Ifyouhavebegunapreparednessprogramyoumayimproveyourorganization’slevelofpreparednessthroughanassessmentofinternalandexternalvulnerabilities.Suchareviewwillhelpyouandyouremployeesidentifypotentialgapsinyourexistingpreparednessprogram.

Theinformationfoundinthisbrochurewillprovideyouwithquestionsandnextstepsthatyoucantaketobeginorimproveyourpreparedness.

Preparing IS Your Business.

Getting Prepared

10

The PS-Prep™ Continuum

11

Toprotectallthatyouhaveinvested,itisimportantthatyouplanforandconsiderhowyourbusinesswillsurviveandrecoverintheeventofadisaster.Ifyouthink,itcannothappentome,youaremistaken.MoreandmoreAmericansaredealingwiththeeffectsofweather-relateddisasters,poweroutages,cyber-attacks,anddataloss.Anyoneoftheseeventscanbedetrimentaltoabusinessofanysizebutoftenleavessmall-andmedium-sizedbusinessesvulnerabletobusinessinterruptionorclosures.

Wherewouldadisasterleaveyourbusiness?Planningtoremaininbusinessafterbeingimpactedbyanemergencyrequiresanassessmentofyourinternalandexternalfunctions.Preparingcan:• Improveitsabilitytorespondandrecover• Mitigateriskandoffersafeguardsfortheinvestmentyouhavemadeinthebusiness

• Promoteastrategicdecisionthatwillinfluencehowyouwillhandleemployees,customers,suppliers,andyourworkspaceintheeventofanemergency

• Tellyourcustomersandstakeholderswhatyouvalue• Distinguishyoufromyourcompetition

WhatYouCanDoToday

Aninternalauditwillhelpyouidentifywhereyoumightimproveyourpreparedness.Preparingtoastandardwillprovideyouwithauniformandconsistentbasisfordevelopingtheanswerstothefollowingquestions.

Assessyourorganizationbyanswering“yes”or“no”tothefollowingquestions.Yourresponseswillguideyouinimplementingnecessaryactionplanswithinyourorganization.

Ifyoupreferastandards-basedmanagementsystemforpreparednessthatinvolvesthecycleof“Plan,Do,CheckAct”PS-Prep™fitsyourorganization’sneeds.

Small/Medium-Sized BusinessesProtect Your Investment

So,youarelivingyourdream.Youareindependentandmakingyourowndecisions.Youmayworkaloneorwithemployees.Youhavepouredallofyourtime,energy,andresourcesintomakingyourbusinessasuccess.

12

Small/Medium-Sized Businesses

Question Y N

1. Doyouknowwhatcriticaloperationsneedtoremaincontinuousintheeventofadisaster?(Key personnel, alternate location/facility, processing systems, documentation, vital records, policies and procedures)

2. Doyouknowwhichassetsaremostvulnerabletoadisaster?

3. Doyouknowhowyouwouldsafeguardassetsandmaintainorganizationoperationsinthecaseofanemergency?

4. Doyouhaveadisasterplan?

5. Isyourplantestedandapprovedbyinternalleadershipandstakeholders?

6. Doyouoryouremployeesknowwhattodointhecaseofadisastertoavoidoperationalinterruptions?

7. Isthereadisasterteamorganized?

8. Doyouknowwhotheteammembersareandwhattheirrolesare?

9. Doyouhavekeycontactsdocumentedandaplanofcommunication?

13

Thefollowingaresampleimprovementstoincreasepreparednesslevels:• Ensuresufficientcommunicationsystemsareinplaceandoperational.

• Maintainproperemergencysupplieson-site.• Reviewyourinsurancepolicy.• Evaluateyourinformationtechnologynetwork.• Verifythatcertainprotectionandback-upmechanismsareinplace.

• Coordinatewithemergencyresponseteams.

• Compileakitthatincludesblueprintsforkeyfacilitiesandanemergencycontactlist.(I.e.fireandpolicedepartments,psychologists,traumaspecialists,etc.).Ensureemployeesknowwherethekitislocated.

• Confirmthatemployeesarefamiliarwithyourorganization’semergencyresponseplanandknowwhomtocontactinsuchanevent.

• Scheduleadrilltotestyouremergencyplanandcontinuitysystems.

• Makedevelopmentandimplementationofadisasterplanapriority.

14

Nowisthetimetomakethedecisiontopreparefortheinevitable:disaster.Whetheritisanactofbio-terrorismoranincidentofextremeweather,catastrophesareunpredictableinalmosteverysense.Properpreparednesswillhelpyourcorporationminimizelossofrevenue,data,productivity,or,worse,life.Thedisruptionofoperationsforafewhoursorafewdayscandeeplyaffectyourorganizationinternallyandexternally.Makingthechoicetopreparetodaycanprotectyourcorporationtomorrow!

Largecorporateentitiesarenostrangertodisruption.However,disasterpreparednessinvolvesmuchmorethanacrisis-managementteamandpreparedpressreleasesattheready.Poor(ornon-existent)preparatorymeasurescouldcompoundtheeffectsofadisaster.Largeentitieshavetheuniquecapabilitytousecrisesasopportunities.Resilientcorporationsarelikelytorecoverfasterthanthecompetition,gainingmarketshareandcustomerloyalty.

Preparednesscanmitigatedisruptionsby:• Reinforcingcorporatesurvivalbyplanningtosustaincoreoperationsandrevenuestreamsthroughthelifecycleofacrisis;

• Protectingrevenueandcashflowsasaresultofplanningtoprotectkeyassetsandsustaincentraloperations;

• Protectingkeyassets,includinginventories,property,equipment,data,documents,andintellectualproperty;and

• Protectingandsupportingemployees.

Corporate EntitiesPrepare to Prosper

Youarealeaderinalargecorporateentity.Youhaveworkedextremelyhardovermanyyearstoreachthispoint.Younowmanagedozensorperhapshundredsofstaffmembers.Youmakeconnectionswithpeople—employees,partners,andconsumers,tonameafew.Youplanforthefuturewiththesepeopleinmind.Youmakethetoughdecisions.

15

ProvidingaUniformManagementSystem

Creatingamanagementsystemthatunifiesdifferentdepartments(riskmanagement,IT,security,etc.),andoutlinesthesameprinciples,isvitaltothepreparednessofyourcorporation.Onceimplemented,PS-Prep™standardsprovideasystemofpolicy,planningprocesses,procedures,performancemeasures,andqualityimprovementpractices.

ConformingyourenterprisetoPS-Prep™standardscanleadtocertificationtothatstandard,ultimatelybringingvaluetoyourentity’soverallworth.

WhatYouCanDoToday

Thefollowingoutlineshowanorganizationcanbegintoplanforpeople’srolesandfunctionsinemergencyresponseandrecovery.1. Scope and Policy–Developascopeand/orpolicystatement

thataddressesdisastermanagement,businesscontinuitymanagement,andorganizationalresilience.• Definescopeandboundariesfordevelopmentandimplementationofthepreparednessprogram.

• Establishapolicytoprovideaframeworkforsettingobjectives,alongwiththedirectionandprinciplesforaction.

2. Requirements–Assessyourorganizationtoidentifyandconformtolegal,statutory,regulatory,andotherrequirementsthatmaybeconsistentwithPS-Prep™.• Identifylegalandotherrequirements(laws,regulations,codes,zoning),whichgoverntheorganization’sactivity.

• Applyandreceivecorporatesponsorship.

16

3. Objectives and Strategies –Outlinestrategicplanstoaccomplishobjectivesinriskmanagement,incidentprevention/preparedness/mitigation/response,businesscontinuity,recovery,andcorrective/preventiveactions.• Identifytypeandavailabilityofhuman,infrastructure,processing,andfinancialresourcesneededtoachieveyourorganization’sobjectives.

• Plantheoperationalprocessesforactionsrequiredtoachievetheorganization’sobjectives.

4. Risk Management–Includehazardandthreatidentification,riskassessment,vulnerabilityanalysis,andconsequence/businessimpactanalysis.• Establishaprocessforriskidentification,analysis,andevaluation.

• Identifyhazardsandthreats,toincludecyber-andhuman-securityelements.TheseshouldincludelossofIT,telecommunications,keyskills,negativepublicity,employeeorcustomerhealthorsafety,reputationdamage,supplychainoutage/disruption,lossoffacilities,etc.

5. Operations, Control, and Risk Mitigation–Identifyrequirementsforyourorganization’sbusinesscontinuitystrategy,tactics,operationalplansandprocedures,and/orcontingencyplans.• Establishoperationalcontrolmeasuresneededtoimplementthestrategicplan(s)andmaintaincontrolofactivitiesandfunctionsagainstdefinedtargets.

• Documenttheformsandprocessestobeusedbeforeorduringaneventtoensureactivitiesandparticipantsarecapturedforreviewandimprovement.

6. Communications–Identifyrequirementsforcommunicationandwarningastheyapplytodisaster/emergencymanagementandbusinesscontinuity.• Developandmaintainasystemrequiredforcommunicationsandwarningcapabilityintheeventofanincident/disruption.

• Identifyrequirements,messages,andcontentrequiredforexternalcommunication.

Corporate Entities

17

7. Competence and Training–Assess,develop,andimplementtraining/educationprogramsforpersonnel,contractors,andotherrelevantstakeholdersinvolvedinemergencyandbusinesscontinuitymanagement.• Identifyandestablishskills,competencyrequirements,andqualificationsneededbytheorganizationtomaintainoperations.

• Assignappropriatesupportrepresentative(s)toleadpreparedness.

8. Resource Management–Identifyresourcemanagementand/orlogisticsasitrelatestotheallocationofhuman,physical,andfinancialresourcesintheeventofincidentsthatthreatenoperations.• Establishanddocumentprovisionsforadequatefinanceandadministrativeresourcesandprocedurestosupportthemanagementprogramundernormalandabnormalconditions.

• Makearrangementsformutualaidandcommunityassistance.

9. Assessment and Evaluation–Identifyrequirementsforassessments,audits,and/orevaluationofdisastermanagementandbusinesscontinuityprograms.• Conductinternalauditsofsystemorprograms.• Establishmetricsbywhichtheorganizationassessestheabilitytoachievetheprogram’sgoalsandobjectivesonanongoingbasis.

10.Continuing Review–Identifyrequirementsforprogramrevisionandprocessimprovement,includingcorrectiveactions.• Conductmanagementreviewofprogramstodeterminecurrentperformance;toensurecontinuingsuitability,adequacy,andeffectiveness;andtoinstructimprovementsandnewdirectionswhennecessary.

• Makeprovisionsforimprovementofprograms,systems,and/oroperationalprocesses.

18

TheValueofCertification

Theintegrationofuniformpreparednessprocessesequipslargeprivatesectorentitieswiththeresourcestohandlemajorinterruptionstooperations.Independentandobjectiveevaluationthroughthird-partycertificationoffersvalidationofthatfact.Certificationendorsesanassociationwithareputablebrand,facilitatesorganizationalrecognitionbystakeholders,andmakesregularauditsofpreparednessapriority.Thisprocessdevelopsdisasterawarenesswithinandoutsideanorganization,therebyfosteringaheightenedsenseofsecurityanddistinguishingonefromcompetitors.Herearesomeconsiderationsbeforepursuingcertification:

1. Initial Review • Definethescopeofvoluntarycertification.• Determinewhichpreparednessstandardismostappropriateforyourorganization.

• Forecasttheallocationofinternalresourcesrequired.• Seekexecutivesponsorship.• Organizeaninternalworkingteamofexperts.

2. Internal Analysis• Cross-referenceyourchosenpreparednessstandardwithinternalprograms,policies,bestpractices,andexistingregulationsthatwillberelevanttocertification.

• Gathersupportingdocumentation.• Completeaself-assessmentwithyourinternalworkingteamofexperts.

• Brieftheexecutivesponsorontheresultsoftheself-assessment.

• Developaprojectplanandtimelinetocloseanygapsdiscoveredthroughself-assessment,bringingyourentityclosertocompliancewiththechosenstandard.

Corporate Entities

19

3. Certification • Research,interview,andselectaccreditedthird-partycertifiers.

• Reviewyourscope,selectionofpreparednessstandard,andprocessofself-assessmentwiththecertifier.

• Discusscostandtimelineforcompletionofcertificationprocess.

• Brieftheexecutivesponsorandinternalworkingteamofexpertsonallaspectsofthecertificationprocess.

• Completecertification.

Onceyourorganizationiscertified,therewillbeaperiodicreassessmenttomaintainemergencypreparednessandcontinuitysystems.ANABmanagesPS-Prep™certificationandadministerstheprocessthroughindependentauditors.

20

Whatifyouwerenotabletocontinueyourmissionthroughnofaultofyourown?Unexpectedexternalfactorscouldleaveyourorganizationseverelyweakened.Manynon-profitorganizationsbeginplanstopreparebutquicklygetboggeddownintheday-to-dayoperationsoftheirmission.However,makingpreparednessamissionkeepsyourvisionintact.Preparednessplansarebeneficialforrecoveringfromdisasterslargeandsmall.Makethedecisiontodaytoprotectyourmissiontomorrow!

Withmorethan1.6millionnon-profitorganizationsintheUnitedStates,effortstopreparefordisastermustmeetimmenselydiverseneeds.Ascategoriesoforganizations(religious,educational,charitable,scientific,literary,agricultural,fraternal,etc.)vary,thesegroupsmightsufferfromacrisisorhelpvictimsrecoverfromone.Manyhavenotimplementedeventhemostbasicdisasterplan.Havingoneinplaceiscriticaltoanorganization’sabilitytosustaindisaster.Qualitypreparationmeasurescan:• Safeguardyouremployees,volunteers,beneficiaries,communityatlarge,andotherinternalandexternalstakeholders;

• Promotepartnershipswithcorporatetargetsmoreeffectively;• Appeaseconcernsofmembersofyourorganization’sboardorothercontrollingbodyaboutthelevelofpreparedness;

• Boostyourorganization’sreputationatthelocaland/ornationallevel;

• Makevitalneedsandservicesavailabletovulnerablepopulationsintheeventofacrisis;

• Protectorganizationalassets;and• Strengthenpartnershipsandcollaborationswithothernon-profits,government,andprivatesectororganizations.

WhatYouCanDoToday

• Assessthehazardsthatcouldpotentiallyaffectyourorganization—planforthosefirst(forexample,isyourfacilityvulnerabletoflooding,orhowcouldanelectricaloutageaffectyourabilitytoprovideservices?).

• Communicatewithstaffandvolunteersaboutyourpreparednessplan.

• Formaplanningteam,identifyaleader,designateanalternatefacility,andplanforstaffwithspecialneeds.

• Ifyourorganizationdoesnothaveaspecificmissionfordisasterresponse,discusswhatrole,ifany,yourorganizationwilltake.Ifaroleemergesforyourorganization,begintoplanandcreatealliancestomeetthemissionofthatrole.

• Ifyourorganizationhasaspecificmissionfordisasterresponseactivities,reviewanddrillyourplan.

Non-Profit OrganizationsMake Preparedness Your Mission

Yourmissionstatementtakesonalifeofitsownasyourorganizationwholeheartedlyembracestheworkthatyoucollectivelycareabout.

21

WhatisthePS-Prep™Program?

PS-Prep™isavoluntaryprogramdesignedtobuildawarenessandgiveprivatesectorentitiesofallsizestheabilitytosafeguardtheirorganizationsagainsttheeffectsofanytypeofdisruption(naturalorhuman-induced),equippingownerswithkeyprocessestoimprovetheirorganizations’abilitytomaintainoperationsduringandafteranemergencyordisaster.

Whoistheaudience?

PS-Prep™offersaprivatesectorentity(acompany,facility,not-for-profitcorporation,hospital,stadium,oruniversity)apathtoassessandmeetnationallyrecommendedstandardsforlevelsofemergencypreparedness.

Whatarestandards?

Standardsmakeourliveseasier,saferandhealthier.Withoutthem,manyeverydayactionswetakeforgrantedwouldbeunpredictable.Theyarefundamentalbuildingblocksofsociety,representingacommoncommitmenttoquality,safetyandethicalpractice.

Whydoweneedstandards?

Manyarenotawareoftheimportantrolethatstandardsplayinourday-to-daylives—productsmaynotworkasexpected,bridgesandroadsmaybeimpassable,buildingswouldtakelongertobuild,andmaybeunsafetoinhabit.Weshouldreallyaskourselves,“Whatwouldtheworldbelikewithoutstandards?”Theremaybeinferiorqualityandincompatibilitywithotherproductsandservices,orinextremecases,non-standardizedproductsmayevenbedangerous.Standardizedproductsandservicesprovidetheuserwithaddedconfidenceintheirsafety,quality,securityandflexibility.

Frequently Asked Questions

22

Whatmakesthispreparednessprogramdifferentfromotherprograms?

PS-Prep™canofferorganizationsseveraloptionstowardpreparedness,whetherit’sfollowingbestpracticeprograms,aligningtoastandard,orcertifyingtoastandard.

Istheprogrammandatory?

No,PS-Prep™isavoluntaryprograminwhichprivatesectorentitiesareencouragedtoparticipatetowardoffthedetrimentaleffectsthatcanresultfromoperationalinterruptions.

Whooverseesthecertification?

DHShasselectedtheAmericanNationalStandardsInstitute(ANSI)–AmericanSafetyforQuality(ASQ)NationalAccreditationBoard(ANAB)todevelopandoverseePS-Prep™certificationandmanagetheprocessthroughindependentauditors.

Cost

Certificationcostswillvarydependingonthescopeoftheconformityassessment.VisittheANSIwebsiteforfurtherdetailsaboutqualifiedcertificationbodieswhocanaudityourpreparednessprogram.

Frequently Asked Questions

23

Websites

FEMAVoluntaryPrivateSectorPreparednessAccreditationandCertificationProgram(PS-Prep™)ResourceCenterwww.fema.gov/privatesector/preparedness

FEMAPrivateSectorFocuswww.fema.gov/privatesector

AreYouReady?AnIn-depthGuidetoCitizenPreparednesswww.fema.gov/areyouready

ReadyBusinesswww.ready.gov/business

TheRedCrossReadyRatingProgramwww.readyrating.org

InstituteforBusinessandHomeSafety(IBHS)www.ibhs.org

ANSI-ASQNationalAccreditationBoardwww.anab.org

ASISSPC.1-2009OrganizationalResilience:Security,Preparedness,andContinuityManagementSystems–RequirementswithGuidanceforUsewww.asisonline.org/guidelines/ASIS_SPC.1-2009_Item_No._1842.pdf

BS25999BusinessContinuitywww.bsiamerica.com/en-us/Assessment-and-Certification-services/Management-systems/Standards-and-schemes/BS-25999

NFPA1600StandardonDisaster/EmergencyManagementandBusinessContinuityProgramswww.nfpa.org/assets/files/PDF/NFPA1600.pdf

U.S.SmallBusinessAdministration–DisasterPreparednesswww.sbaonline.sba.gov/services/disasterassistance/disasterpreparedness

Resources

24

LinkstotheApplications

OrganizationalResilience:Security,Preparedness,andContinuityManagementSystemwww.anab.org/media/22041/fa2024-ps-prep-asis-spc.1ap.pdf

BusinessContinuityManagementwww.anab.org/media/22044/fa2025-ps-prep-bs25999-2ap.pdf

NationalFireProtectionAssociationwww.anab.org/media/22047/fa2026-ps-prep-nfpa1600ap.pdf

SocialMedia

www.facebook.com/fema

www.twitter.com/fema

ContactInformation

MarcusPollock999EStreet,NW Washington,DC20472 (202)646-2801

Resources