Before the Rain: Flood Preparedness Relies on Regular Risk Reassessments
In the first eight months of 2025, the National Weather Service issued more than 3,600 flash flood warnings across the United States, already approaching the nation’s annual average of around 4,000 flash flood warnings. For communities in Texas, New Mexico, West Virginia, and New Jersey, this year’s floods have been deadly. In other regions across North America, flooding caused severe damage to homes, businesses, and infrastructure.
While flooding is an age-old problem, current rates of high-rainfall events heighten the need for proactive flood preparedness.
Mapping Your Risk
Breaking down a site’s flood risk depends a lot on its geography, flood history, local infrastructure, and first responder access, says Anders Noyes, CPP, vice president and business continuity program manager at the Bank of Hawaii. Start with the broadest categorization—is your site urban, suburban, or rural?
Urban. Consider the site’s history of flooding, the presence of storm drains, the altitude above or below the water table, any ground slopes around the facility (toward or away from the site), and any areas with a history of pooling water during rains. Just because a city has storm drains, though, doesn’t mean they are properly maintained and working, so additional analysis of historical storm impacts is helpful, Noyes says.
Suburban. All of the urban considerations still apply, but business continuity and emergency management teams should review any potential access challenges for emergency response crews to reach the site, including whether local roads to the site could be affected by heavy flooding. Assess septic system function and vulnerabilities. Also, account for proximity to any potential sources of flooding, such as rivers or lakes.
Rural. Additional considerations unique to rural sites include how the facility connects with wildland and any debris that might be caused or carried by floods—including trees, portions of structures, or mechanical equipment, Noyes adds. Emergency response plans will need to include guidelines and resources to remove that debris or maintain local land to mitigate the risk of debris clogging up waterways.
Noyes has managed flooding incidents in all three settings. When working at the urban Honolulu Museum of Art, Noyes had to contend with both seasonal and hurricane rains. Because the museum’s vaults were underground around the building, soil depth for water absorption was limited. During heavy rain, water would accumulate around the building, sidewalks, and streets, so the museum would close to the public to keep visitors safe.
In his previous work as the CSO for Skywalker Ranch, Noyes had other challenges. Film production company Lucasfilm’s headquarters is located in Presidio, California, near San Francisco. The site has a suburban, city park atmosphere, but water would flow from the hills above into campus during heavy rains. The site built in landscaping berms to route water around the campus, rather than through it.
But at Skywalker Ranch itself—a 6,000-acre private campus in Marin County, California, owned by filmmaker George Lucas—the site is thoroughly rural, and heavy rains would flood a lot of water into nearby canyons, eroding parts of the landscape and shifting water patterns.
“It’s got to be put into perspective, and each facility has to be evaluated individually. You can’t look at it as an enterprise-wide thing,” Noyes says. “It’s got to be done, piece by piece. And it’s a lot of work, but that’s the work that needs to be done. So, not making assumptions on the facility next door, either. You’ve got unique characteristics to every building and every property, and I think that those all have to be considered.”
Each individual facility will have a different profile, even within the same region or campus, so those micro-scale risk assessments are essential. For instance, one building in a corporate campus might have sensitive IT or electric infrastructure in a sub-basement, so if that part of the campus floods, it has more serious business continuity ramifications than if a lesser-used underground parking lot floods, says Thomas Henkey, director of emergency management for Titan Security Group. Another site might have aging piping or water infrastructure that could be susceptible to leaks or bursting in inclement weather, which could cause water to seep down multiple floors.
“We need to be very cognizant that water will find the lowest point that it is able to,” he says. Security and emergency management teams should be acutely aware of facilities with below-ground storage, whether it’s for generators, utilities intakes, or security offices.
“That’s where the collaborative piece comes in,” Henkey adds. “We’re not engineers per se, we’re not property owners per se, but we are problem solvers, and we are folks who need to deal with crisis management. So, we need to really think about what water could damage in our facility and what we could do to mitigate or prepare for that sort of damage. And that is absolutely going to require interaction and collaboration with folks who do have those areas of expertise.”
Henkey strongly recommends regular risk reassessments—at least every three to five years, and more often if hazards or facilities notably change.
“No facility is static, even if there’s been no major change in infrastructure or in function,” he says. “There will be new people, there will be new subsystems, and there might be new procedures or protocols. All of that needs to be accounted for in a true, holistic risk assessment.”
To get an accurate picture of risks, leverage historical data from insurance companies and flood zone maps provided by counties and local authorities, Noyes says. Also evaluate any recent flooding history nearby, as well as weather projections from authorities like the National Oceanographic and Atmospheric Administration (NOAA). Topographic maps are also useful to determine geographic elements and slopes that could direct water toward or away from facilities.
“Once risk is evaluated based on probability, vulnerability, speed of onset, impact, criticality of disrupted operations or facility, and response and recovery potential, a plan to eliminate, mitigate, or accept the risk can be adopted,” Noyes says.
Preparedness Measures
Flood preparedness can range from simple to extremely complex, Noyes says, and a lot of these efforts involve partnerships with facility management teams. Based on risk assessments, crews can pre-event condition the risk area by digging moats, creating berms, or placing barriers to reroute water. They can also leverage an environmental lens to facility design (similar to crime prevention through environmental design, or CPTED) by considering strategic landscaping, the topography of the surrounding area or land, and the drainage characteristics of soil. For instance, hard-packed clay will not drain as quickly as porous rock.
Teams should also stage tools and materials to protect entrances in a hurry, including water dams, shovels, sandbags, or trenching equipment. Staff should be trained on how to respond appropriately to flood risks, whether taking action to protect the facility or evacuating. Flood evacuation areas on higher floors or higher ground should be designated, keeping in mind that evacuees might need to be rescued by boat or helicopter. The evacuation site will likely be different than the mustering location after a fire evacuation.
Preventative maintenance and testing of pump equipment or sensors is also critical so that teams have early warning of water risks, Noyes says.
Look into holistic redundancy measures, as well, Henkey says. If data center A goes offline because of rising water or other crises, can the organization fail over smoothly to data center B? Has that plan been tested? How confident can the organization be that essential data and systems will remain accessible?
“Doing all of that work ahead of time is really critically important,” Henkey says.
Part of that pre-work includes setting up staging areas for emergency response that keep topography in mind, says Anthony Hurley, CPP, PCI, PSP, consultant with Critical Preparedness, LLC. Check flood risks before parking heavy equipment, generators, and other emergency supplies in any area, too.
“I don’t know how many times that we would go to pick up material, and the material wasn’t there anymore,” Hurley says. “It either got captured by the flooding and taken downstream, or it was underwater, so it was basically damaged, or there was debris on top of it.”
Complex Responses and Recovery
One notable challenge with flooding is that it rarely happens in isolation, says Hurley. Not only does flooding often trigger additional natural issues like landslides or downed trees, but it can wash out roads and shut down key resources needed for emergency response.
The problems can cascade quickly, even just with logistics. If a county shuts down one road, traffic gets rerouted to a different highway, which is then gridlocked in bumper-to-bumper traffic. If the new road or bridges cannot handle the weight or height of emergency response equipment, the detour gets much longer.
In one case, traffic diversions and detours cost Hurley’s team a half-day of time they had planned to spend on power restoration after a major storm.
Emergency response personnel should also be prepared for a rough few days when responding to a major disaster, Hurley says. They might be housed in hotels that lack power, and nearby restaurants might be closed or unable to provide the right level of service to responders. Hurley recommends being honest with responders when they are called up, telling them to expect primitive conditions and giving them time to collect water, a few days’ worth of snacks, and any prescription medication they may need for the next week or more.
Responders may also face additional nerve-wracking issues, such as working in knee-high water, avoiding high-risk debris like propane cans, and watching for wildlife that might have been displaced by flooding—including snakes or alligators, Hurley says.
On-site personnel might face similar challenges. If the security operations center (SOC) is in a flood zone and personnel cannot evacuate, what will they eat? Hurley recommends stocking critical operation sites that could experience flooding with enough provisions to get through a few days. For larger-scale operations, Hurley has seen organizations bring in catering or build out a kitchen in the SOC or emergency operations center to keep staff comfortable in case of emergencies or long-term crises, especially if local curfews or travel restrictions are likely to close restaurants.
Beyond food, critical sites should be stocked with cots, blankets, and personal hygiene items like toothbrushes or shower wipes. Organizations should also make plans for fuel, both for vehicles and generators. Emergency management personnel should estimate daily fuel usage and make arrangements for fuel to be regularly delivered or for a tanker to be parked on-site ready to refuel necessary equipment. If the roads to and from fuel depots are at risk from flooding or erosion, having on-site fuel is recommended, Hurley says.
Recovery is another complicated challenge, especially since sites and operations will come back online asymmetrically, based on how the flooding impacted them, their staff, and access needs.
“The pivot from response to recovery is never clean,” Henkey says. “It’s a transition; it’s never a light switch. So, we will still be in a response phase when we begin the recovery phase, and that’s important to acknowledge as security professionals and also to our stakeholders.” Security and emergency management leaders will need to educate stakeholders about the inevitable overlap between responding to the crisis and getting operations back up and running.
A big element of starting the recovery efforts is calling in the cavalry—outside vendors and support teams, including water damage mitigation and emergency disaster cleanup professionals.
“There is a set of expertise that comes with water damage and recovery from water damage that is unlike anything else,” Henkey says. “So, find out who those people are in your area of operations, do those introductions ahead of time, and, if possible, have those contracts in place.”
In a large-scale flood, your enterprise will not be the only facility affected, he adds. Vendors and service providers will answer calls from their existing contracts first, and emergency requests for service without an existing agreement can be incredibly expensive, so it’s worthwhile to build those relationships well in advance.
“Recovery is a really long process. It is extraordinarily expensive and extraordinarily time consuming when you have one of these major incidents,” Henkey says. “Clearing the water, clearing the mud, clearing the debris, and clearing the contaminants that may have been in the water and debris, and then you have to deal with mold remediation.”
Some facilities will have to be torn down or significantly renovated, and any sterile environments—such as data centers, clean rooms, or medical sites—will complicate things even further.
“We need to be very realistic for our stakeholders,” he adds. “If we have a major internal or external flooding event, the recovery process is going to be extended, and it is going to be very resource-heavy. And that’s personnel, that’s time, that’s money—it’s going to take longer and cost more than you think.
“As the safety and crisis management folks, we're seen as the problem solvers,” he continues. “And so, it's really important to put those pieces in place ahead of time, and then to understand that this is going to be a marathon. And as leaders, we need to step up, keep morale up, keep the function moving forward, stay on top of any contractors or subcontractors that you have, and keep them on time and on task and on budget. But understand that this is going to be a lengthy process, and we will very much be seen as leaders in getting that accomplished and getting business back to normal, or to a sense of normalcy, at least.”
Claire Meyer is editor-in-chief of Security Management. Connect with her on LinkedIn or at [email protected].
