Every year-end, the northeast monsoon brings floods to Malaysia's East Coast and the coasts of Sabah-Sarawak. Every few years, a gas leak, fire or major disruption occurs somewhere in the country. The question is not if a disaster will affect your organisation — but when, and are you ready?
Research shows organisations without continuity plans take longer to recover — and many never fully recover.
Four Plans You Need
A prepared organisation has four related documents:
| Plan | Function |
|---|---|
| BCM / BCP (Business Continuity) | How operations keep running during disruption |
| DRP (Disaster Recovery) | How IT systems are restored after disaster |
| ERP (Emergency Response) | How lives & assets are protected immediately |
| Crisis Comms | How communication with media, customers & staff is controlled |
All four complement each other — and most importantly: all must be tested.
Building a Plan That Works
Step 1: Business Impact Analysis (BIA)
Identify critical processes. For each, answer:
- How long can it stop before consequences become serious? (RTO)
- How much data can be lost without being fatal? (RPO)
- Who depends on it — internally & externally?
Step 2: Risk Assessment
List threats relevant to your location and industry:
- Natural: floods, storms, mild earthquakes, haze
- Technical: power failure, server damage, telco failure
- Human: fire, negligence, cyber attacks, sabotage
- Environmental: pandemics, civil unrest, regulatory shifts
Step 3: Recovery Strategy
Determine approaches for each critical process:
- Alternate locations — backup office or qualified work-from-home
- Data backups — 3-2-1 with regularly tested restoration
- Alternative vendors — for single points of failure
- Core team — who runs minimum viable operations?
Step 4: Usable Documentation
A plan sitting in a "POLICIES" folder never opened is worthless. A good plan:
- Concise, with checklists & up-to-date contact numbers
- Accessible outside primary systems (print & cloud)
- Every role knows its part
Step 5: Test, Test, Test
- Tabletop every 6 months — structured scenario discussion
- Full simulation annually — execute part of the plan for real
- Honest post-mortems — improve the plan after every test
Common Mistakes
- Plans written for audit compliance — not for use
- Staff contact numbers out of date (people have moved on)
- Backups exist — but restoration is never tested
- All plan copies live inside the systems that will be affected
- Senior management not involved — the plan has no authority when crisis hits
Conclusion
Disaster readiness is the cheapest insurance you hope never to claim. Organisations that bounce back quickly after a crisis are not the lucky ones — they are the prepared ones.
Raya Protech helps organisations develop and test realistic BCM/DRP/ERP plans — from business impact analysis to full simulations with management teams.