Using a pandemic recovery plan template: A free download and guide

How to build a pandemic plan

When building a pandemic plan, the principal concern is availability of staff. Employees who contract the coronavirus may not be able to perform their daily activities for a few weeks to possibly a few months. Begin the process by completing a risk assessment that identifies critical company operations, as well as the systems and the staff needed to support them. Next, prioritize the business functions in terms of the most critical to the organization's survival. In collaboration with your human resources department, identify the employees who are deemed crucial to supporting critical business functions.

Download our free
pandemic planning
template here.

The incubation period for COVID-19 is not yet clear, but the World Health Organization lists an estimate of about five days. Given the potential lead time to respond to a coronavirus outbreak, the number of employees initially infected may be low but could increase quickly.

Pandemic plans are a combination of preventative measures and active response measures. Preventative measures may include hand-washing stations and the availability of face masks for those who need them, while active responses may include replacing absent employees with healthy staff members who can perform the same functions. An important strategy for achieving the latter goal is to cross-train employees in multiple functions within their business units. In addition, access to detailed step-by-step procedures for recovering disrupted systems and networks can help backup staff recover and resume normal operations.

The goal of these processes is to minimize any negative effects to company operations attributed to loss of staff through illness. A comprehensive pandemic plan includes primary and alternate supplier contacts; sources of medical supplies; and contact information for all employees, as well as stakeholders, customers and key supply chain vendors. Finally, it includes a logical sequence of actions that ensures employee heath is protected and critical operations are maintained.

Pandemic planning questions to consider

There are some additional issues to consider when crafting your pandemic recovery plan. Some are more effectively handled at a higher level, such as state departments of health, while others ought to be part of your own pandemic readiness program.

At what point would you consider quarantines? For example, if someone comes to work exhibiting flu symptoms, he or she should be sent to a local hospital emergency room for observation and testing. If an appropriate health facility is not readily available or nearby, it may be necessary to isolate the person in a separate room away from other employees until transportation can be arranged.

Pandemic plans are a combination of preventative measures and active response measures.

Regular review of messages from the CDC and local authorities should be maintained to determine the status of the disease and its spread. If the spread seems to be increasing -- for example, several employees have called in sick or have tested positive for coronavirus -- it may be time to activate a "reduced staff business model" and send most employees home, other than those designated for reduced operations support. Ideally, company leadership should have such a discussion well in advance of an actual outbreak to decide how/when to shut down operations. Closing the doors is the last activity.

At what point would you release antiviral stockpiles? Large companies may stockpile vaccines if they can afford it, have sufficient space and can actually obtain doses. Most other companies are not likely to stockpile vaccines. Err on the side of caution in stockpile situations. Release stockpiled doses of the vaccine as soon as the first verified case is reported.

How big should stockpiles be? Assuming that only a single dose of the vaccine is needed, stockpile one dose for each employee per location.

How quickly can you get to them? If they are stored on site, distribution can be almost immediate. If not, use of an overnight delivery service is advised. If on-site storage of vaccines is not available, the time to get doses could be anywhere from the same day to a week.

In addition to concerns about quarantines or vaccine stockpiles, you should also consider the following questions:

1. What steps are being taken to detect new cases?
2. What travel or trade restrictions are you considering or implementing?
3. What step-by-step preparation and action plan do you have?
4. What organizational response team roles and responsibilities have been assigned?
5. What succession planning actions have been arranged?
6. What cross-training activities have been arranged?
7. How easily can employees work from home?
8. What safety guidelines have been prepared?
9. How is information on the current situation being communicated to employees and clients?
10. What human resources and facility planning policies and procedures have been established for a disease outbreak?

Pandemic planning checklist

The following is a suggested sequence of plan development activities:

• Establish a pandemic recovery team (PRT); it is charged with plan development and coordinating the organization's pandemic response.
• Have the PRT meet with human resources, senior management, internal technology groups, and disaster recovery, business continuity and emergency response teams to establish the scope of the plan.
• Brief business units as well as senior management on these meetings so they are properly informed.
• Gather all relevant employee information, such as contact information and skills inventories.
• Gather all relevant business process information, such as critical activities that must be maintained.
• Gather information about the technology infrastructure that supports these processes.
• Obtain copies of existing business continuity and disaster recovery (BC/DR) plans.

Having a BC/DR plan in place is critical to a pandemic plan. A BC/DR plan identifies critical IT assets, maximum acceptable downtime, employee data and response procedures to disruptions and failures. A BC/DR plan can inform a pandemic plan by identifying situations where a single person is responsible for a critical function and determine the preparedness of emergency response teams. Knowing which employees are responsible for which functions can help ensure that there are no gaps in your pandemic recovery plan.

BC/DR plans can also identify vendor emergency response capabilities, if they have pandemic response plans and when they were tested, impact of a pandemic on contract obligations, and presence of service-level agreements (SLAs).

Once you have gathered all of the necessary information, compile results from all analyses into a gap analysis that identifies potential staffing issues associated with critical business functions and technology assets, with recommendations as to how to achieve the required level of preparedness, and estimated investment required.

Have management review the report and agree on recommended actions and prepare a pandemic recovery plan to address critical business functions, facilities and technology assets.

Once the plan is completed, conduct tests of plans, employee backups and system recovery assets to validate their operation and effectiveness. Update pandemic plan documentation to reflect changes. As with any recovery plan, be sure to schedule the next review and audit of pandemic recovery capabilities.

Pandemic planning best practices

Keep in mind the following best practices for your business:

• Senior management support. Be sure to obtain senior management support so that pandemic plan goals can be achieved.
• Take the pandemic planning process seriously. If the novel coronavirus continues to spread, it could affect your organization sooner than you think. Your pandemic plan doesn't have to be dozens of pages long. Plans simply need the right information, and that information should be current and accurate. A glossary can help ensure everyone uses the same terminology.
• Keep it simple. Gathering and organizing the right information is critical.
• Review results with business units and technology groups. Once the pandemic plan is complete, review the results with business units and technology leaders.
• Communicate the program with all employees. Also advise key customers, supply chain vendors and stakeholders of your program.
• Be flexible. The suggested template in this article can be modified as needed to accomplish your goals.

Testing the pandemic plan

Perhaps the most effective way to test a pandemic recovery plan is through tabletop exercises. Tabletop exercises enable an organization to run through every aspect of the plan, step by step, and discover any potential weaknesses or missing information.

The following is a list of items to cover with such an exercise:

1. Gather key members of the pandemic team and other relevant teams, including human resources, facilities, emergency response, and BC/DR.
2. Review the healthcare and preventive measures in place and those that need to be added.
3. Review effects on company facilities.
4. Review impacts on the organization's key business functions, who currently supports them and who can back them up if they are unavailable.
5. Discuss efforts to provide cross-training to employees who may be designated as backups.
6. Discuss succession planning to minimize any leadership gaps.
7. Discuss communications activities, both internal and external, that ensure employees have all relevant information about the pandemic and key external organizations know how the company is responding.
8. Address supply chain concerns by reviewing key suppliers and how they plan to provide a pandemic response.
9. Determine which supply chain firms should be part of a joint discussion on cross-organization pandemic responses and then schedule meetings to address these issues.
10. Identify where additional support, training, resources and funding are needed; secure these resources.
11. Update plan documentation as needed.
12. Schedule follow-up tests.

Considering the investments businesses make in their IT infrastructures, all businesses should also invest sufficient time and resources to protect those investments from unplanned and potentially destructive events, such as the coronavirus outbreak.