Business continuity planning (BCP) is a critical aspect of commercial real estate (CRE) management in the United States. It involves identifying potential threats to business operations and developing strategies to mitigate those risks and ensure the continued operation of the business. Even minor disruptions can significantly impact commercial property owners and investors, affecting their ability to maintain a building and potentially leading to financial or reputational issues1. This report provides an overview of business continuity in CRE, including the types of services that affect business continuity, the different types of threats and risks, best practices and strategies for ensuring business continuity, relevant regulations and standards, technology and tools that can be used to support business continuity, case studies and examples, and the potential costs and benefits of investing in business continuity.
Investing in business continuity in CRE can have significant costs, including the costs of developing and implementing a BCP, conducting risk assessments, implementing preventive measures, and acquiring technology and tools. However, the benefits of investing in business continuity can outweigh the costs2. These benefits can include:
Several types of services can affect business continuity in CRE. These services are often interconnected and work together to ensure the resilience of CRE businesses. For instance, cyber security and disaster recovery services work in tandem to protect both digital and physical assets, while property management and tenant relations services contribute to maintaining a stable and secure environment for business operations. These services can be categorized into the following areas:
Cyber security is an essential aspect of business continuity in CRE. Cyberattacks can disrupt business operations, compromise sensitive data, and damage a company's reputation. Cyber security services that can help ensure business continuity include:
Disaster recovery and restoration services help businesses recover from natural disasters, such as hurricanes, earthquakes, and floods. These services can include:
Commercial property restoration contractors play a vital role in disaster recovery and restoration. They are experts in swiftly mitigating damage and facilitating the restoration process. Their services include pre-loss planning, rapid emergency response to minimize damage, thorough assessment of property damage, formulating a tailored restoration plan, handling hazardous materials and waste, streamlining the restoration process, and ensuring regulatory compliance6.
Emergency preparedness services help businesses prepare for and respond to emergencies, such as fires, power outages, and medical emergencies. These services can include:
Property management services play a crucial role in ensuring business continuity in CRE. These services can include:
Risk management services help businesses identify, assess, and mitigate potential risks to business continuity. These services can include:
Supply chain disruptions can significantly impact business continuity in CRE. Supply chain management services can help mitigate these risks by:
Maintaining good tenant relations is essential for business continuity in CRE. Tenant relations services can help by:
Effective third-party risk management is crucial for relationships with contractors, suppliers, and other vendors in CRE. It helps ensure the quality of work, timeliness, compliance with regulations, and overall stakeholder satisfaction7. This includes verifying that vendors have their own business continuity plans in place to ensure the continued delivery of products and services even during disruptive events. These vendor business continuity plans should be reviewed before contracting with the vendor and then on an annual basis through ongoing monitoring. The plan...source By integrating third-party risk management into their business strategy, real estate developers can strengthen resilience, protect business interests, and navigate disruptions and crises more effectively.
Ensuring compliance with relevant laws and regulations is crucial for business continuity in CRE. This includes complying with federal, state, and local regulations related to building codes, safety standards, environmental regulations, and data privacy. Failure to comply with these regulations can result in legal penalties, fines, and reputational damage, which can disrupt business operations.
Having plans in place to manage employee absences and ensure adequate staffing levels is essential for business continuity in CRE. This includes having policies for sick leave, emergency leave, and remote work arrangements. It also involves cross-training employees to ensure that critical functions can be performed even if key personnel are unavailable.
Having sufficient financial resources to support recovery efforts is crucial for business continuity in CRE. This includes having access to lines of credit, emergency funds, and business interruption insurance. It also involves having a sound financial plan that can help the business weather economic downturns and other financial challenges.
Several types of threats and risks can disrupt business continuity in CRE. These threats and risks are often interconnected and can exacerbate each other. For example, a natural disaster can weaken security infrastructure, making a business more vulnerable to cyberattacks8. These threats and risks can be categorized into the following areas:
Natural disasters, such as hurricanes, earthquakes, floods, and wildfires, can cause significant damage to CRE properties and disrupt business operations. For example, Hurricane Katrina in 2005 caused widespread damage to commercial properties in New Orleans, leading to prolonged business interruptions and significant financial losses8.
Cyberattacks are becoming increasingly common and sophisticated, posing a significant threat to business continuity in CRE9. These attacks can disrupt operations, compromise data, and damage reputation. For instance, a ransomware attack can encrypt critical data, preventing businesses from accessing essential information and disrupting their operations.
Terrorist attacks can cause significant damage to CRE properties and disrupt business operations. The September 11 attacks in 2001 highlighted the vulnerability of commercial buildings to terrorist attacks and the devastating impact they can have on businesses and the economy.
Pandemics, such as the COVID-19 pandemic, can disrupt business operations and impact tenant occupancy. The COVID-19 pandemic forced many businesses to adopt remote work arrangements, leading to decreased demand for office space and impacting the CRE industry.
Economic downturns can lead to decreased tenant demand and financial difficulties for CRE businesses. The 2008 financial crisis, for example, led to a significant decline in commercial real estate values and increased vacancy rates.
Civil unrest can disrupt business operations and damage CRE properties. Riots and protests can lead to property damage, business closures, and safety concerns for tenants and employees.
Other relevant threats to business continuity in CRE include:
Several best practices and strategies can help ensure business continuity in CRE. These include:
A business continuity plan (BCP) is a comprehensive document that outlines how a business will respond to and recover from disruptive events. The BCP should include:
Risk assessments are a critical component of business continuity planning. They involve identifying potential threats and vulnerabilities and assessing the likelihood and potential impact of those threats12.
Preventive measures are actions taken to prevent or minimize the impact of potential disruptions. These measures can include:
Effective communication is essential during an emergency. Communication protocols should be established to ensure that employees, tenants, and other stakeholders are kept informed about the situation and any actions they need to take12.
Regular training and drills are essential to ensure that employees are prepared to respond to emergencies. Drills should simulate different types of disruptions to test the effectiveness of the BCP and identify any areas for improvement12.
Other relevant strategies for ensuring business continuity in CRE include:
|
Strategy |
Actions |
|---|---|
|
Developing a Business Continuity Plan |
Conduct risk assessments, business impact analysis, develop recovery strategies, establish communication protocols, conduct regular testing and training, define recovery levels |
|
Conducting Risk Assessments |
Identify potential threats and vulnerabilities, assess likelihood and impact of threats |
|
Implementing Preventive Measures |
Enhance physical security, implement cyber security measures, conduct regular property maintenance |
|
Establishing Communication Protocols |
Define communication channels and procedures for emergencies, ensure timely and accurate information dissemination |
|
Conducting Regular Training and Drills |
Train employees on emergency procedures, conduct drills to simulate disruptions, evaluate and improve response capabilities |
Several regulations and standards apply to business continuity in CRE. These include:
ISO 22301 is an international standard that provides a framework for business continuity management systems. It specifies requirements for planning, implementing, operating, monitoring, reviewing, maintaining, and improving a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise14. This standard is particularly relevant for CRE businesses as it emphasizes the importance of documentation, risk assessment, and regular testing to ensure business continuity15.
NFPA 1600 is a national standard developed by the National Fire Protection Association that provides a comprehensive framework for disaster and emergency management and business continuity programs. It addresses all aspects of emergency management, including planning, response, and recovery16. For CRE businesses, NFPA 1600 provides guidance on emergency preparedness, fire safety, and overall business continuity planning17.
Other relevant regulations and standards that may apply to business continuity in CRE include:
Several types of technology and tools can be used to support business continuity in CRE. These include:
Cloud-based solutions can provide businesses with access to critical data and applications from any location, even during disruptions. Cloud-based backup and recovery systems can help ensure that data is protected and can be recovered quickly in case of an emergency19.
Backup and recovery systems are essential for protecting data and ensuring that it can be recovered in case of an emergency. These systems can include on-site and off-site backups, data replication, and disaster recovery as a service (DRaaS) solutions19.
Emergency notification systems can be used to communicate with employees, tenants, and other stakeholders during an emergency. These systems can send alerts via email, text message, phone call, and other channels19.
Other relevant technologies that can be used to support business continuity in CRE include:
Several case studies and examples demonstrate how businesses have successfully implemented business continuity plans in CRE. For example, one case study involved a managed services provider (MSP) that experienced a fire in its office building. The MSP had a comprehensive BCP in place that included off-site data backups and alternative work arrangements. As a result, the MSP was able to continue serving its clients with minimal disruption20.
Another case study involved an electric company that experienced a failure with one of its data lines. The company had implemented redundancy measures and off-site data replication, which allowed it to maintain critical systems and avoid any interruption in service20.
In one real-world example, a real estate firm in a high-density urban area sought to align its operations with ISO 22301 standards. Facing increased scrutiny from investors and regulatory bodies due to recent disruptions, the firm aimed to enhance resilience, reduce downtime, and ensure a robust response to incidents to safeguard assets and maintain investor confidence21.
Another example involves a metals processing company located in an area prone to natural disasters. The company faced challenges in maintaining operational continuity during adverse events, with its existing business continuity management (BCM) plan proving inadequate. Recognizing the need for a robust and responsive BCM strategy to avoid reputational damage and market share erosion, the company implemented improvements to its plan21.
Business continuity planning is essential for CRE businesses in the United States. By identifying potential threats, developing mitigation strategies, and implementing best practices, CRE businesses can ensure the continued operation of their business and protect their assets, tenants, and reputation. Investing in business continuity can have significant costs, but the benefits can outweigh the costs in the long run. CRE businesses are encouraged to prioritize business continuity planning and explore resources such as the BCESG.org website, ISO 22301 resources, and NFPA 1600 guidelines for further information and guidance.