History has demonstrated that although high impact, low probability events could occur, recovery is possible. For example in 2001 when buildings were destroyed and blocks of Manhattan were affected, businesses and institutions with good continuity plans survived.
The lessons learned include:
- Plans must be updated and tested frequently;
- All types of threats must be considered;
- Dependencies and interdependencies should be carefully analyzed;
- Key personnel may be unavailable;
- Telecommunications are essential;
- Alternate sites for IT backup should not be situated close to the primary site;
- Employee support (counselling) is important;
- Copies of plans should be stored at a secure off-site location;
- Sizable security perimeters may surround the scene of incidents involving national security or law enforcement, and can impede personnel from returning to buildings;
- Despite shortcomings, Business Continuity Plans in place pre-September 11 were indispensable to the continuity effort; and
- Increased uncertainty (following a high impact disruption such as terrorism) may lengthen time until operations are normalized.