Speaker 1: Welcome to today's digital on-demand webisode, titled Business Continuity, How to Lead Through Challenging Times. The Greater Houston Partnership works to make Houston one of the best places to live, work, and build a business. With more than 1,000 member companies representing approximately one-fifth of the region's workforce, the partnership champions Houston's growth by bringing together businesses and civic-minded leaders who are dedicated to the region's long-term success. Learn more at Houston.org. The Small Business Matters program is designed for high-growth, smart small businesses to make valuable business connections. Members include C-suite, sales, marketing, and business development professionals. Included with this program is digital on-demand programming, workshops and meetups, business and professional leadership training, business expos, and access to data and research to get important information on the economy. And now a word from our sponsor.

Speaker 2: Over the course of Lift Fund's 24-year history, we are proud to have served nearly 20,000 small businesses with over $270 million in loans. We are the nation's leading micro-lender. We make loans as low as $500, all the way up to $500,000. So whereas Lift Fund continues to provide working capital to small business entrepreneurs, both for startups as well as growth capital, hiring employees, we do that through the micro-loans that we make, but also we fill a growing capital need for businesses whose borrowing needs encroach over the $50,000 to $100,000 range. We are also one of the leading CDFI lenders in the Small Business Administration's 7A Community Advantage loan program.

Speaker 1: Today's webisode will feature Greater Houston Partnership member Hub International and will focus on business continuity, how to lead through challenging times.

Speaker 3: Hi, I'm Jana Cheadle with Hub International. I am a licensed property and casualty insurance broker. What that means is I spend most of my days answering companies' questions about their insurance policies. And I think that's really great that people are trying to learn more about their insurance policies. But there's also that part of what happens after a claim, what happens after a loss. Can my business keep running? So I'm going to talk a little bit about business continuity planning. Business continuity planning is very specific to each and every business. So we're going to be talking in rather broad terms today. However, at the end, I am going to talk a little bit about hurricane preparedness and cyber preparedness. And those are some very specific tips and tricks that everybody can use for their business. So what is business continuity planning? Business continuity planning is what happens after the worst happens. Can your business keep running after you have a major disaster? So when you're working on your plan, what you're going to do is pick out what's most important for your business to keep running. And then you're going to think about what are things that could happen that could make your business stop running. And then you're going to look at ways to mitigate or lessen that possibility. So when you're thinking about business continuity planning, maybe you're thinking, oh, well, I've got my fire extinguisher, I've got my evacuation plan. Well, that's really great, but that is your emergency response plan. What happens when your building's on fire, right? And then after that, you have your crisis management plan. And that's, you know, thankfully the fire's put out, but you still have to alert your employees. You have to maybe do a little damage control of the media. Maybe you have to hire your contractors. Your business continuity plan is the fire happened two weeks before your largest order of the year goes out, the order that takes you from red to black every single year. And now how are you able to move forward with that? So first thing we start thinking about is what could happen, what could go wrong. So you have natural disasters we all know, bad hurricanes here. You have things like active shooter incidences. You could have health concerns, diseases. You could have a chemical spill. I mean, the list is really endless, right? So how do you plan for all of that? Well, you can't, right? What we end up looking at are what is the effect of that disaster. So we generally think there are five things that could happen from any big emergency. The first one being loss of technology. You can't get a hold of your computers. Are you able to keep working without your computers? The next one is loss of building. You know, the building burns down. You can't get into it. How do you move forward? The third one is denial of the entry of your building. I think we all saw that with Hurricane Harvey. You can't get into your building. How does that affect you? Number four is loss of staff. So this could be people are injured or sick, or you just can't get to the building. And then the fifth and final one is loss of a supplier. So your building is fine. Your employees are all fine. Your computers are fine. But your supplier 30 minutes down the road, your major supplier, he's not working. And guess what? Your secondary supplier, he's in Corpus, and he got hit too, right? So when we start looking at how to formulate the plan, we generally look at six steps. The first step being understanding your business operations. You know, if you're a small one-two-man shop, you know, obviously you know everything A to Z. But when you start getting 25 employees, 50 employees, there are parts of your operation that you're not involved in on a day-to-day basis. So maybe you can't be the only one involved in the business continuity plan. You might need other people to help out. The second step is to think about your risk mitigation strategies and then also build from that your continuity strategies. And we're going to talk a little bit more about that. The fourth thing we like to do is, you know, write it all down. Once you have the plan, write it down and have it so that other people can refer to it because what happens if you're not around? You need somebody else to take this plan and run with it. The fifth thing we like to do is train other people on the plan. And then the sixth is to develop training and develop an audit process, right? This plan that works today might not work, you know, tomorrow when the incident happens. So when we're looking at the operations and making sure that we understand what has to happen, we suggest getting everyone together. So that's, of course, senior management, but it's also IT and HR and marketing. And having all these people together will really help you figure out what goes on on a day-to-day basis and what could possibly be affected. So the first thing we suggest that everyone does is identify all of your organization's functions. Once you have a very complete list, then you're able to prioritize and say, you know, these 10 items absolutely have to happen. And all these other things, maybe these can fall to the side during a real emergency, but we have to do these 10 things, right? Well, when you have those 10 things and you have everybody in a room together, you start realizing, oh, that this one key critical component is interdependent on this thing down here that we haven't identified yet. So we want everyone to look at the interdependencies of all of your operations and figure out if we need these 10 things to happen, is there some things down below that we might need to have happen as well? You're going to prioritize. You're going to start looking at the impact of the risk on your different operations. And then once you kind of get your list of what is most important, you start thinking, how would I fix that if something really bad happened? How would I fix, you know, the people can't get into the office? Do I have an alternate site that I could go to? Do I have cross-training? Could a different employee get out payroll than my normal HR person? So we suggest things like installing protection systems, getting backup generators. I think everyone in Houston knows about that. Making sure that there's duplicate systems. Making sure there's manual workarounds for things. Maybe you don't need to have the computers to get a few things done. And talking about relocation. It's really hard after a large event like Hurricane Harvey, we know, but thinking about where could we go if we don't have access to the building. One of the really neat things that my company did during Hurricane Harvey was the leadership got on the phone call every single morning from start to finish through the whole process. And then after they got off the call, each supervisor called all of the employees. And at first it was just, you know, Jana, how are you? How's your family? Do you have food? Do you have water? Are you okay? Great. And that's all they really cared about. But then after, you know, the rain stopped and we started looking at what was left over, then it was, hey, Jana, we've got the claims number are forward to our Dallas and Fort Worth and El Paso offices. Can you call your clients and see if they are okay, see if they have claims? So it was a really clear communication process and calling every day. First off, it made me feel like Hub really cared about me, that first they were checking in on me. It made me, you know, want to help, want to work with them, but then also telling me what I need to do so that I can make sure our clients know what's going on, right? And there's all different ways that you can communicate to that. Obviously these days phone calls and texts seem to work pretty well. So now that we've talked a little bit about making a business continuity plan, what goes into it, how to get started, I thought maybe some specific things about hurricane preparedness might be helpful. One thing you might not have heard or thought about is when there's a storm coming, you can actually call a third-party remediation service like a ServPro, you know, the guys that come in afterwards and clean up the floodwaters. You can call them in advance of the storm coming and get on their list and say, hey, you know, if my building is damaged, I want you guys to come in. And what that does is puts you at the top of their list, and so after the storm you're one of the first people to have their building taken care of. And this can put you at a real advantage because, you know, if your competitors haven't done this and they're at the bottom of the list and you're back up and running before your competitors, well, you know, that's great for you guys. Something else that I think people didn't realize going into Hurricane Harvey was how long we'd be out. So certainly thinking about time-sensitive information like accounting or reporting information. Before a hurricane comes, you might have to just go ahead and get some of that reporting done in advance, early. We realize we need a backup location, right? But when you have such a huge disaster like Harvey, maybe you can't get a backup location. So talking to other businesses near you or your building management, seeing if there's some type of option you can work out in advance will really help you be able to set up business after the hurricane. You know, last, people think of floodwaters, but they don't always think of the fires that happen. But, you know, on your checklist with the hurricane preparedness, just go ahead and put on there, checking all your fire extinguishers, making sure people know where they are and how to use them. After the storm, just one quick tip on this. Have a good plan for communicating with your customers. People see the news and they might think, oh, Houston's underwater, I shouldn't call and place this order, maybe I should call Dallas instead, right? So making sure that you're able to tell people, hey, we had a little damage, we're up and running, and decrease the amount of people that might think, oh, hey, maybe we shouldn't call in and place that order. So after hurricanes, flooding, wind damage, cyber is something that I think every business should put a little bit of thought into and make sure they're prepared for. We've got five quick tips and then a few other items on cyber to talk about. The five tips I would say that you can do now, and most of them are no cost, but the first one you might have to hire somebody for is get a hacker to do a penetration test of your systems. And they'll tell you where you have holes, where you have leaks, identify, and help you fix those. Number two is teach your staff how to identify and deal with fake emails. Probably if you've got a CFO, they already know about callback features. You know, if somebody tells them to wire money, they always call back the email, right? But telling your HR person that too, like, hey, if somebody emails you and asks for a bunch of W-2s, don't just send them over email. Call that person and make sure that that request is legitimate. And letting everyone in your business know, hey, these are certain things that we just don't hand out over email without confirming via a phone call. Number three, backup your data, right? We all know that, but having an off-site place to backup your data will help you if you have a ransomware attack. If somebody comes in, grabs all of your information on your computer and won't let you in, and they say, give me $10,000 to get your information back. If you're able to just move forward with your backup, that makes things a lot easier for you. Number four, update security patches. So this sounds, you know, simple, right? It's something that maybe I don't do that while on my phone either. But hackers now, they hear about the security glitches in software, and they start immediately looking for companies that have not made those updates, and they target those companies. So that's something that as soon as you're able to make those updates. And the last one, you know, I think everyone knows this, but keep in mind, you've got to have antivirus software and you've got to have a firewall. So a cyber hack response plan. You know, do I really need that? What is that? Why should I do that? If you have a cyber attack and somebody gets a hold of the information, gets a hold of your customer's information and sends it out everywhere, all of a sudden you might be dealing with a lawsuit from your customers, from, you know, 1,000, 10,000 customers saying that you mishandled my information and we're going to sue you for it. If you have a written out post-hack response plan, when your lawyers go to defend you, they'll have a lot easier job of it. They'll be able to say, listen, my customer knew about cybersecurity. They took it seriously. Look at the things that they put in writing to make sure this didn't happen. And sometimes, you know, bad things happen to good people, but my client made a real effort to prevent this from happening. All right, so maybe I've convinced you you need to have a post-hack response plan. Great. Now I've got to do something else. How do I do it? What should be in it? You know, I would say start with calling your insurance person, your attorney, your IT person. They might have a template already set up to help you, and you can just kind of work with that. If you don't have those resources, start with just including a plan with your key contact numbers. You know, I would say probably your first call needs to be your attorney to see if there's any legal requirements that you have to fulfill. A lot of times, the state or the federal government will require that if you leaked out someone's information, you have to notify them so many times in the year and offer free credit reporting. And if you don't do that, you'll be hit with penalties and fines. I would also suggest calling your insurance broker. Even if you've never purchased a cyber policy, insurance companies now put a little cyber coverage on different policies, like your GL policy, your property, maybe your crime policy, if you have it. So even if you don't think that you have cyber, I would still suggest going ahead and calling your insurance agent. You'd also want to go ahead and put the contact information of an IT forensics team in your post-hack response plan. You're going to want to get them on the phone as quickly as possible to figure out how big the attack was and how to fix it. You'd also want some phone numbers for credit monitoring firms. And then probably the last thing you can put on there is how to respond to your customers. How do we get this information out to them? Well, I hope I've maybe pointed you in the right direction with your business continuity plan, maybe given you a few tips on hurricane preparedness and cyber preparedness. I really hope that you never have to deal with any of these issues, but I think a little planning in advance would make this go a little bit smoother. And make sure that your business is able to come out from the other side of a major disaster. Thanks, guys.

Speaker 1: Again, we would like to thank LiftFund as the inaugural Small Biz Matters digital on-demand series sponsor and Hub International for sharing. Reminder to check out the remaining bite-sized digital on-demand episodes in the 2018 lineup. Please access the Greater Houston Partnership Small Business Resource page and opt into our mailing list to receive additional release dates as well as imperative information pertinent to local small businesses. ♪