How do you conduct a risk assessment for your COOP?

How about asking the question to managers thusly, what if we loose people, data, stuff in those categories? When do you bend, when do you break and what 3 - 5 steps will make you resilient in those categories? Isn't that the hazard? There is much better value with this approach to the organization than parsing out the size of dragons.

Hazards can also come from within the operation. Consider hazardous material leaks, catastrophic accidents, maintenance failures, single point failures, and other similar hazards within the operation.

To conduct a risk assessment for your COOP, first, figure out what absolutely needs to keep running even if things go haywire. Then, think about all the bad stuff that could happen, like natural disasters, cyber-attacks, or the coffee machine breaking down. See where your weak spots are and how bad things could get if any of these disasters strike. Next, decide which risks are most likely to happen and put them in order from "Oh no!" to "Eh, we can handle it." Come up with plans to prevent or handle these risks, and write it all down. Make sure everyone knows the plan and practice it, so no one's caught off guard. Finally, keep your plan up to date because things change and new risks pop up all the time.

Coordinate with local, State and Federal law enforcement to collect the region/ area All Hazards Threat Assessments. Using the information develops your probability and severity metrics to determine what threats/ risks are present and determine what mitigation measures need to be developed to ensure continued operations from the selected COOP space.

Evaluate the geographical area and business’s you are surrounded by-Can your business cope with a 2-3 year bridge replacement that impacts traffic? What’s going on in those neighboring businesses? Are they targets for social unrest? What are they producing? Are there any hazards? Will they impact access to your business in the event of an emergency? Will you/they cooperate and offer assistance to each other in the event either of your businesses suffer a serious impact event?

If you are from the private sector and you want a good source of information for historical data of risk occurrence I would reach out to the local emergency management office and ask for a copy of the hazard mitigation plan. This source is can help especially if you are assessing risks for multiple locations throughout the country. I have used hazard mitigation plan as a resource to justify why I ranked a particular risk higher for a region. Another valuable source the National Climatic Data Center database. This database provides data on natural hazard occurrences by location. For non hazard prioritization I relied on interviews with internal departments as well as alerts and guidance from government and non government organizations.

Keeping your risk assessment updated is important in a world that is ever changing. A risk assessment, when it is created, is only a still frame snap shot of the risks that were a threat at the time of the assessment was created. Third party threats, a change in risk appetite, advances in technology, and even a pandemic can quickly make your risk assessment outdated. It is important to create a regular cadence that will ensure that the assessment is reviewed and updated to reflect changes in the risk landscape.

Risk is all around us and it is important not to rely solely on one source of information to conduct your assessment. Interview people who have been at your organization longer than you to get historical data. You would be amazed at the data you can gather by just talking to people at lunch or just in casual conversation. Become active in organizations that focus on cyber security or join a group to learn about physical security and access control protocols. There is a wealth of information continuity professionals can gain by going outside of there normal areas for information and data.