FORTIFYWhere most plans fail
before the first alarm sounds.
Every cell in the first column reflects a gap pattern we find in over 70% of first-time assessments. Amber text marks a documented deficiency against the cited standard.
| Assessment Area | Your Current Plan Typical first-assessment finding | Industry Minimum Standard FEMA / NFPA / ISO baseline | Fortify-Assessed Standard Delivered at engagement close |
|---|---|---|---|
| Response Time | No documented target; staff estimate 45–90 min mobilization | < 30 minutes for Tier-1 incidents per NFPA 1600 §5.3 | Defined role-by-role mobilization with verified 8-min primary / 22-min full-team benchmark |
| Communication Redundancy | Single primary channel (cell network); no backup documented | 2 independent channels required; annual test recommended | 4-channel matrix (cell, satellite, radio, in-building PA) with quarterly drills and failover log |
| Utility Failover | Generator exists; last tested 14 months ago; no transfer-time SLA | Monthly no-load test; annual full-load test per NFPA 110 | Automated transfer <10 sec; 96-hr fuel contract; monthly load-bank test with timestamped records |
| Staff Certification Rate | 34% of staff hold current ICS-100; no re-cert schedule | ≥ 60% ICS-100/200 per FEMA CPG 101 recommendation | 100% role-critical staff certified; annual re-cert calendar built into HR onboarding |
| Evacuation Route Verification | Posted floor plan from 2019 renovation; 2 routes added since | Annual review; updated after any structural change | LiDAR-verified routes updated post-renovation; accessibility compliance audit included |
| Mutual Aid Agreements | Verbal agreement with neighboring facility; nothing signed | Written MAA recommended; FEMA encourages regional compacts | Executed MAA with 3 regional facilities + county EOC MOU; contact tree verified quarterly |
| Plan Review Cycle | Last updated 2021; no scheduled review | Annual review or after any major incident | Annual re-certification with Fortify; mid-year regulatory change scan included |
No proprietary black box.
Here is exactly what we do and when.
Every phase has a named deliverable. Every deliverable has a measurable outcome. You will know what you are getting before you sign anything.
Two-person assessment team on-site. We walk every access point, utility room, and egress path. We interview department heads — not just the safety officer. We photograph, measure, and cross-reference against your current EOP.
- ✓Site audit report (photos + annotations)
- ✓Current EOP gap matrix
- ✓Preliminary vulnerability score (1–100)
- ✓Priority deficiency list
We apply the Fortify Readiness Index — a 147-variable scoring model built on FEMA CPG 101, ISO 22301, and NFPA 1600. Each vulnerability is rated by likelihood × consequence × current-control-effectiveness. No gut feel. No generic checklists.
- ✓Full Fortify Readiness Index report
- ✓Risk heat map by facility zone
- ✓Peer-benchmark comparison (your sector)
- ✓Insurance documentation package
We rewrite or build from scratch. Every protocol has a named owner, a backup, a communication trigger, and a measurable completion criterion. We write for the person who will execute under stress at 2 AM, not the committee that approves it at 10 AM.
- ✓Revised Emergency Operations Plan (EOP)
- ✓Role-specific quick-reference cards
- ✓Communication cascade flowchart
- ✓Utility failover runbook
We run a 4-hour facilitated tabletop with your actual response team — not stand-ins. Scenario is facility-specific: we use your floor plan, your staff roster, your identified vulnerabilities. We break the plan on purpose so you find the failures in a conference room, not a corridor.
- ✓Scenario narrative (facility-specific)
- ✓After-action report with findings
- ✓Corrective action plan (CAP)
- ✓FEMA-formatted exercise record
Regulations change. Your facility changes. The threat environment changes. Re-certification is not a rubber stamp — it is a structured annual audit that closes the corrective actions from the prior year, incorporates any regulatory updates, and re-benchmarks your readiness score.
- ✓Annual readiness score update
- ✓Regulatory change impact brief
- ✓Updated insurance documentation
- ✓Renewed FEMA exercise record
Anonymized. Verified.
Repeatable.
Every outcome below is from an actual engagement. Details are anonymized per client agreement; sector, facility size, and regulatory context are accurate.
Insurance carrier flagged emergency power documentation as insufficient; premium increased 40% at renewal.
FRI report accepted by carrier within 6 weeks of submission. Premium returned to prior level. Utility failover SLA reduced from 47 seconds to 9 seconds.
New FEMA CPG 101 v3 guidelines required updated EOPs across all campuses. District had 18 months and no internal capacity.
All 34 campus EOPs rewritten, tabletop exercises completed at 12 priority campuses, FEMA exercise records filed. District passed state review with zero deficiencies.
Supply chain audit by Tier-1 customer required documented disaster recovery capability. No formal plan existed.
Full FRI completed in 6 weeks. Supply chain resilience protocol designed and tabletop-tested. Tier-1 audit passed. Estimated $4.2M annual contract retained.
Request Your
Vulnerability Snapshot.
A 15-minute structured intake call followed by a preliminary readiness assessment — no charge, no commitment. You will leave with at least three documented gaps regardless of whether we proceed.
Score yourself before
the auditor does.
The 14-Point Readiness Checklist is the same intake framework our assessors use on day one. Most facilities fail 6–9 points. Download it, score your facility, and you'll know exactly where to call us.