The World Is Sending Warning Signals. Has Your Business Tested Its First 72 Hours?

Summary

Governments are telling families to prepare for 72 hours on their own. Businesses should do the same — by testing what really happens when power, communications, payments, and systems begin to fail.

Governments are telling families to be ready to be on their own for three days. Your business deserves the same honesty.

Over the last few weeks, governments around the world have been telling their people the same thing: keep food, water, and cash at home.

The UK launched its Be Ready campaign on October 22 and asked households to be ready for 72 hours. On November 3, the European Commission released new guidelines for the first 72 hours of a crisis, including a cash reserve in case digital payments fail. Japan is asking for at least three days, and a week if possible. Sweden and Norway say about a week. Germany says ten days. The Netherlands even tells people how much cash to keep: 70 euros per adult and 30 per child. Dozens of governments are now saying some version of the same thing.

I remember when we were going to bend the curve in a couple of weeks. We all know how that went. So when a government tells me to plan for three days, I take that as the starting point, not the forecast. Three days is how long they think it takes for help to get organized. It isn’t a promise about when life goes back to normal.

Then there’s our own military. Under a new initiative called FORTRESS, the Pentagon is reportedly planning for every major base in the continental U.S. to run for at least 90 days on its own power, water, fuel, and communications. The Army’s standard had been 14 days. Families are being told three days. Bases are planning for ninety. That tells you how the people who are paid to think about this are thinking.

I Wrote About This in 2024

In August 2024, I wrote an article about the cyber threats businesses face during global conflict. The USS Abraham Lincoln was heading toward the Middle East, and Iran was threatening Israel. I opened that piece by remembering how I kept in touch with friends and family during the early days of the pandemic. Then I turned to Sandworm, Andy Greenberg’s book about the Russian military hackers who turned off the lights in Ukraine and later released NotPetya, an attack that did more than $10 billion in damage around the world. My point was simple. When countries fight, the power grid and the businesses that depend on it end up in the middle.

I read that article again this week. I write differently now, a little less formal and a lot more direct, but the warning holds up. A lot has happened since then. In February, the United States and Israel struck Iran. This summer, hackers tied to Iran went after water systems in at least a dozen states, and in one Georgia community, a pump station went down, and families were told to boil their water. In the last few weeks, Iran has said data centers and undersea internet cables could be targets.

The world is clearly sending signals. I’m not writing to say I told you so, and I’m not going to predict what happens next. I’m asking you to do something with these signals while you still have time. Help may come eventually, but your business will not be first in line. For the first 72 hours, plan on being on your own.

Why This Has to Be an Exercise

Years ago, we worked with a mortgage company and gave them a simple scenario. Pretend IT is gone. No applications, no electronic files, and nobody promising it will all be back by lunch. Now run the business.

It’s a humbling exercise. You quickly learn what can keep going on paper, what information you can’t live without, who’s allowed to make decisions, which promises to customers you can still keep, and where everything just stops.

That exercise matters even more today, because so much of our technology isn’t in our buildings anymore. Your accounting system is in someone else’s data center. Your email is in the cloud. Your phones run through someone else’s cell towers, and your money moves through someone else’s bank. You can’t walk down the hall and check on any of it. The only way to know what happens when those things fail is to sit your team down and walk through it together.

In more than 25 years of assessments for Fortune 50 companies, hospital systems, universities and middle market businesses, I’ve learned that size and money don’t fix this. Plans sit on a shelf and never get tested. Recovery times are educated guesses. And almost every plan assumes the power, the internet, and the phones will still be working.

I’ve also noticed that the farther you get from New York, the less seriously people take this. If you lived through 9/11, the 2003 blackout, or Sandy, I don’t have to convince you. If you didn’t, continuity tends to be a binder somebody updates once a year. The risks we’re facing now don’t care where you live.

How One Outage Becomes Five

When the power goes out, it doesn’t fail alone. It knocks over everything that depends on it, and it happens faster than most people expect.

Spain and Portugal showed us what that looks like in April 2025. The grid went down a little after noon. Before long, phone and internet service started failing, people were stuck in elevators and subway tunnels, and anyone who wanted news ended up listening to a car radio. Card payments stopped working. ATMs went dark. Big supermarkets closed because they couldn’t ring anyone up, and small shops sold out of bread, milk, and water to whoever had cash.

Here’s the part I want every CEO to understand. The Bank of Spain later reported that its payment systems kept running the whole time on backup power. The banks’ data centers were fine. Card payments still fell by about 55 percent because shops and customers couldn’t reach them. Fewer than 4 percent of ATMs had a backup power source, and most ATM batteries are designed to last 10 to 20 minutes, just long enough to shut down safely.

The bank was up. The business was down.

Cell phones follow the same pattern. In California, the four major carriers told regulators their cell sites were designed with two to eight hours of battery backup, with generators at some sites. Two to eight hours. Over three days, your phones may be one of the first things to go, not the last.

So walk it forward. The grid goes down. Your data center switches to generators. The cell towers your employees depend on start dropping one by one. Card terminals and ATMs stop. Your customers can’t pay you, and you may not be able to pay your people or your suppliers. Every one of those systems may have a backup. The real question is whether those backups last long enough, together, for your business to keep working.

“The Data Center Has Three Days of Fuel”

When I walk a leadership team through this, that’s usually the first thing I hear. And I understand why. It sounds like someone has already thought about it.

So I ask a few questions. Three days of what? For which systems? And who brings more fuel on day four? The industry minimum is only 12 hours of fuel on site. Plenty of facilities plan for 48 to 72 hours and count on a truck for the rest. That truck is a promise someone made on a normal Tuesday. In a regional emergency, hospitals, cell carriers, water utilities and every other data center are calling the same fuel suppliers and using the same roads.

Hurricane Sandy showed us what that looks like. At 75 Broad Street in lower Manhattan, the generators were up on the high floors, and the fuel pumps were down in the basement. The basement flooded. The generators were fine, but the fuel couldn’t reach them. So employees from Peer 1 Hosting and some of their customers formed a bucket brigade and carried diesel up 17 flights of stairs, five gallons at a time, for about sixty hours.

I love that story. Those people refused to quit. But I think about it every time someone tells me the plan is covered, because sometimes the plan turns out to be a few dozen tired people in a dark stairwell.

It’s also worth asking where your systems actually live. For most companies, it isn’t one place. Your accounting may sit in one data center and your email in the cloud, while payroll, banking and phones each run through a different provider with its own generators and its own promises. A lot of middle market companies still have something important running in a closet down the hall, on a battery that lasts minutes. Ask your providers when they last tested their backup power under a real load, what their fuel delivery terms are, and whether they’ve ever actually switched over to their backup site. A brochure isn’t proof.

“Everyone Can Just Work From Home”

That’s usually the second answer. Okay. Everyone’s home now.

Does their house have power? Is the internet working? Can they get to the systems we just said are down? And honestly, are they working at all, or are they taking care of their kids, checking on an elderly parent, and dealing with the same outage as everyone else on their street? Sending people home doesn’t make the problem go away. It just gives it a new address.

Your cloud provider might keep its servers running for days. That doesn’t help much if the cell towers go dark within hours. During Sandy, about a quarter of the cell sites in the region went down, and more than half in the hardest-hit counties. A data center nobody can reach keeps your data safe. It doesn’t keep your business running.

So when I’m facilitating, and someone says everyone will work from home, I say, “Great. Everyone’s home. Show me how the business works.”

You May Lose Control Before You Lose Power

Picture this. The generator kicks on. The building is fine. People show up. But nobody can reach you.

The person next in line isn’t sure they’re allowed to approve emergency spending. A branch manager is waiting for someone to tell her what to do. Employees are getting different answers about whether to stay or go home. The emergency contact list lives in a system nobody can open. You still have people, power and equipment. What you’re losing is control.

That’s one of the most important things to test. Does your business lose its ability to make and carry out decisions before it runs out of fuel, food or batteries? Don’t assume you know the answer. Put your leadership team in that situation and see what happens.

Communications Are More Than an Emergency Contact List

Members of my team were on the ground during Katrina, and what they came back with taught all of us something we’ve never forgotten. One message isn’t enough. People need to keep hearing what’s happening, what they should do, who’s in charge and when they’ll hear from you next. They also need a way to tell you what they’re seeing, because the people in the field usually know things headquarters doesn’t.

Now take away the assumptions.

What happens when cell service gets spotty, or stops? When phones can’t be charged? When your normal messaging platform is unreachable? When headquarters can talk to one location but not another? Spain gave us the answer. People tried to call their families and their kids’ schools, and the calls wouldn’t go through. The prime minister went on television, and people without power had no way to hear him.

Having a backup phone or radio doesn’t solve this by itself. Who has it? Do they know how to use it? Is it charged and ready? Does the person taking over for you have one, and do they know where it is? A successor without the authority, information and equipment to act is a successor on paper only.

Most important of all, what have your people been told before contact is lost? That’s the question almost nobody asks. If the phones go down at 10 a.m., what does your branch manager do at 10:15 without hearing from you? Is there a time and place where people check in? Who decides whether a location stays open? What do employees tell customers? Those instructions have to be given before the outage, because once communications fail, you can’t send them.

If every meaningful decision has to come back to you, your business may stop the moment it can’t reach you, even if every location still has people and equipment.

A Generator Is Not a Plan

“We have a generator” is a good start. It isn’t the end of the conversation. What does it run? Under what load? For how long? Who knows how to operate it, and what happens if that person can’t get to the building? And what happens when the fuel truck doesn’t come?

You may be able to keep a few machines running and still not be able to run the business. Working computers don’t help much if the records, suppliers, communications or people you need aren’t there.

The same goes for your data centers. The big decisions don’t happen at hour 72. They happen well before it. When do you move to a backup site, and who signs off on the cost? If fuel is uncertain, what do you shut down first to buy time? If everything has to come down, who makes that call, and how do you protect the work that was in progress?

And don’t forget money. If card payments and ATMs go down, can you take payment from customers at all? Can you make payroll? Is there any cash on hand? Governments are telling families to keep cash in the house for a reason. A business should be asking the same question.

The CEO’s question isn’t whether you have backup power. It’s this:

“What part of the business does that power actually keep alive, and when do we have to make a different decision?”

Your Building May Have to Take Care of People

Now add a shelter-in-place order, or conditions that make it unsafe for people to leave.

How many people are actually in your building? Not just employees. Visitors, contractors, customers, patients, students, and anyone else who happens to be there. Do you have water, food, restrooms, lighting, and space for all of them for three days? Have you thought about people who need medication or have mobility needs? Or did someone buy a few cases of water and a first aid kit for the six people on the emergency team?

These aren’t side questions for the facilities manager. They decide whether you can safely keep people in the building and what leadership has to deal with first. Sheltering in place and evacuating are very different responses, so let your exercise follow whatever the hazard calls for.

Run the First 72 Hours Before You Have To

Get your leadership team in a room for two hours and walk through three days. Bring operations, finance, HR, facilities, IT and the people who actually keep the place running. If you can, invite your main IT or hosting provider. Use a facilitator, keep it on paper, and don’t touch the real systems, generators or safety equipment.

Start with the grid down, your systems unreliable, your data center on generators and communications getting worse. Then take yourself out of the picture. Ask the team who’s in charge whether everyone is accounted for, what can safely keep going, and what decisions can’t wait.

Then move the clock.

Hour 1: Card terminals and ATMs near you are down. Can you take payment? Can your employees buy gas to get home?

Hour 6: Cell service is getting spotty as towers run through their batteries. Which locations can you still reach? What were they told before you lost them?

Hour 12: Some people didn’t come in, and the ones who did are hearing different things. Who is giving instructions, and how?

Hour 24: Your data center provider says the next fuel delivery is late. Your payroll provider and your bank keep going in and out.

Hour 48: Supplies in the building are running low. You can move to a backup site, but it’s slow, expensive or has never been tested. Someone has to approve it.

Hour 60: Fuel is still uncertain. Decide what to shut down, in what order, and what you’re going to tell customers.

Hour 72: Some services come back, but not all of them. Who decides when you reopen? How do you know which records and transactions you can trust?

Let the consequences of earlier decisions show up later. If the team chooses work from home, test what that depends on. If it chooses to relocate, find out whether the other site really has the people, power, connectivity and supplies. If it chooses to switch to a backup site, ask where that site is, who can trigger it and when it was last tested. If it chooses to work manually, have someone show how they’d actually do a typical task with only the information they’d have.

Every time someone says “We’d handle that” or “The provider takes care of that,” ask four things:

Who would do it? With what? On whose authority? And how do we know it works?

If you have a plan, use it. If you don’t, write down every place where a decision got stuck. A tabletop exercise exposes your assumptions. Only a second test proves the fix works.

What I’d Do This Month

1. Schedule the exercise. Put the 72 hour walkthrough on the calendar and hold it before the end of the year.
2. Find out where your critical systems actually live. Ask each provider for proof: when backup power was last tested under a real load, what the fuel delivery terms are and when they last switched to a backup site.
3. Write down who decides when you can’t be reached. Include emergency spending, moving to backup systems and shutting things down. Then make sure those people have the information and equipment to act.
4. Give your people their instructions now, before the phones go down. Tell them where to check in, when, who’s in charge and what to tell customers. Put it on paper, not just in a system.
5. Don’t leave the room with reassurance. Leave with names and dates. Every gap gets an owner, a deadline and a date to test it again.

You don’t need to know what Iran does next to justify any of this. Governments are telling families to be ready for three days. The Pentagon is reportedly planning for ninety. Your business deserves an honest answer about what it can do when normal goes away, and enough time to change that answer.

The old Boy Scout motto still holds up: Be Prepared. Most of us know it. Fewer of us do it.

Do it.

P.S. The next time someone tells you the data center has three days of fuel, ask them one thing: “Great. Where are the pumps?” If they don’t know, you’ve found your first homework assignment. If they say “the basement,” start stretching.

Ready to run the exercise? Use our incident response plan template and tabletop exercise guide, which includes a 60-minute tabletop script you can run with your leadership team this month.