Emergency Preparedness and Response
Content
Emergency preparedness converts plans into capability. Know the plan elements, the response structure, and the exercise cycle.
Plan elements. OSHA 1910.38 requires a written emergency action plan for employers with 11 or more employees; smaller employers may communicate it orally. Required content includes reporting procedures, evacuation routes and exits, procedures for employees who remain to perform critical operations, accounting for employees after evacuation, and rescue or medical duties, plus training and review. Fire prevention plans are a separate requirement.
Command and coordination. ICS and NIMS provide common terminology, unified command, span of control, and resource management. Know when to evacuate versus shelter in place.
Exercises. Tabletop (discussion-based), functional (command and communications tested), and full-scale (everything, including outside responders). Each should end with an after-action report and improvement plan.
Continuity. ISO 22301 and business impact analysis identify critical functions, dependencies, and recovery objectives. RTO is how quickly a function must be restored; RPO is how much data or work can be lost.
Traps. Treating a written plan as preparedness without drills; reversing RTO and RPO; and forgetting that plans must address visitors, contractors, and people with disabilities.
Worked example
A payroll system can tolerate 24 hours of data loss but must be running within 48 hours of an outage. RPO = 24 hours (acceptable loss); RTO = 48 hours (time to restore).