Including employees in your disaster recovery plan

Disaster recovery (DR) and business continuity (BC) are not just about assessments, business impact analyses, plans and exercises. They are also about the people who run the company, manage business processes and interface with clients, suppliers, investors and stakeholders. While most organizations that address BC/DR consider the impact of disruptions on technology and business processes, what can they do to protect their oft-stated most important asset -- their employees?

Whether it's a short- or long-term disruption, organizations need to identify relevant actions to sustain business operations following the onset of a crisis. Organizations that protect their employees have a far better chance of ensuring that their processes and technology can also be protected.

The impact of a disaster on employees

Aside from the threat of a pandemic, in nearly any kind of crisis or disruption to business, organizations will need to safeguard and support employees while continuing to manage the business. Let's examine key issues that are affecting employees in business continuity/disaster recovery situations.

Employee ability to work
Regardless of the situation, if employees are not at work, the business can suffer. In a disaster situation such as a tornado or flood, employees may be displaced from their homes, or unable to get to their work locations due to disruptions to public transit systems or highways. In the aftermath of a disaster, employee shock and grief can also lead to increased absenteeism, reduced productivity and even turnover. You must ensure that your organization has access to trained counselors who can work with individuals affected by the incident.

Employee ability to deliver critical services
Loss of both wireless and landline communications increases the difficulty in locating employees and sharing important information with them. If employees have to evacuate a building, they should have an agreed-upon meeting place so that a head count can be made. If employees suddenly have to work from another location, this needs to be addressed so they will not feel uncomfortable in unfamiliar surroundings.

Even the lack of communication with customers, suppliers, partners and stakeholders can hurt the organization. Create a communications plan for contacting key people as well as their families. It can be as simple as creating a phone tree using your phone system. You might also consider using one of the many available automated notification systems, such as those provided by 3n Global, Dialogic Communications Corp. (DCC), MIR3 Inc., Dell Inc.'s MessageOne and SunGard.

Human resources and disaster recovery planning
The human resources (HR) department is a key player in all of these issues, so be certain that the HR department can deliver core services during a crisis, as well as to monitor and report on the locations of displaced workers. The BC/DR plan should cover payroll, as well as the benefits administration system. Without the payroll system or the staff members who handle payroll, paying employees on time will be difficult. Additional funds for disaster relief may also be needed.

Ability to maintain business operations
Without knowledge of your employees and their condition following a disaster, it will be difficult to determine the organization's next steps. It may be necessary to arrange for temporary staff, or to have existing staff perform different functions. Have your HR department contact various temporary employment agencies so they will have multiple sources for emergency staffing.

You should also cross-train your staff in other functions -- and keep a record of who can do what -- so that you can look to your existing workforce first before investing in outside assistance.

Succession planning, or replacing key individuals when they are unavailable or incapacitated, is another critical function. Without formal succession planning, employees at all levels may have to assume leadership roles or increased responsibilities with little or no preparation. Increased workloads could also tax the remaining staff.

Policies and communications in business continuity planning
Before a disaster occurs, it's essential to identify and document policies and activities that will be most important to employees. Existing policies for sick leave, flex time and travel, for example, could be modified when a disaster occurs. Identify staff who will be the first responders in an emergency, as well as their duties and responsibilities.

Prepare a communications plan for dealing with the media, reporting to employees and their families, and reporting to customers, suppliers, partners and other stakeholders. Key components of such a plan should include the following:

1. Develop policies that are approved by senior management
2. Develop appropriate scripts and forms for disseminating information
3. Establish teams to respond to crisis; provide training for all teams
4. Compile contact numbers for all key personnel, teams, employees, clients, officials
5. In an incident, quickly convene the response teams; review the incident and decide on a response(s)
6. Launch response based on nature of incident
7. Ensure that employees are all safe
8. Launch notification process, e.g., by phone tree, email, automated notification system
9. Provide proactive outreach to all appropriate individuals, organizations and the media
10. Update the message regularly to keep all informed
11. Stand down once the incident has been closed
12. Conduct post-incident review and update communications plans accordingly

Educating employees about disaster preparation
When developing business continuity/disaster recovery plans, it is important to train employees how to respond when a disaster occurs. This includes the primary emergency response teams as well as employees at large. Make sure that employees have up-to-date information about disaster preparation; regularly post relevant policies and update them as needed; and train employees to implement emergency procedures.

Technology that supports emergency situations for employees not in the office
A growing number of organizations support employees working remotely, either from home or while traveling. Technologies to support this are widely available. Be sure to implement appropriate security provisions to ensure that remote employee access to the company's network infrastructure (e.g., via virtual private networks) is protected from unauthorized access, hacking, viruses and denial of service (DoS) attacks. Each employee's laptop should be configured with the company's approved security software, approved firewalls and multiple levels of authentication (e.g., two-factor).

Instill BC/DR in the corporate culture
Perhaps one of the most difficult challenges in BC/DR is to ensure that every employee is committed to the need for disaster planning, and is prepared to support it. This comes in many forms, such as visible senior management support, mentoring and teamwork.

BC/DR planning questions

To help your organization fully address the human issues surrounding BC/DR planning, ask the following questions:

1. Does the organization have critical policies regarding the safeguarding of personnel identified and alternatives designed specifically for use during a crisis?
2. How will employees receive critical information in the event of a crisis?
3. How will employees communicate among themselves to keep the business running?
4. Have we disseminated the right advice to employees to prepare them in the event of a crisis? How current is it?
5. How well are we able to provide immediate support to our employees and their families following a crisis? What support will be needed?
6. What job training is in place to ensure that staffing gaps can be quickly filled?
7. What succession plans are in place for critical management roles?
8. How should existing resource plans (e.g., access to office supplies, alternate office space, transportation to alternate sites) and supplier strategies adapt to crises?
9. What critical service plans, e.g., healthcare, are in place?
10. How can existing HR systems locate and redeploy key resources following a disaster?

For IT leaders and senior staff, ask these questions:

1. In a disaster, how will the company maintain critical communications systems?
2. What can be done to facilitate employees working remotely?
3. What BC/DR plans do critical suppliers have that will ensure continued operation of those functions following a disaster?
4. How quickly can critical systems and networks be recovered, either at the original company location or at an alternate site?

Remember, it's rarely business as usual after a disaster. The effort your organization makes now to protect its employees in the event of a crisis will go a long way in helping the firm -- and the staff -- recover after the worst is over.

Paul F. Kirvan, FBCI, CBCP, CISSP, has more than 20 years experience in business continuity management as a consultant, author and educator. He is also secretary of the the Business Continuity Institute USA Chapter.

Do you have comments on this tip? Let us know. Please let others know how useful this tip was via the rating scale below.

Do you know a helpful storage tip, timesaver or workaround? Email the editors to talk about writing for SearchDisasterRecovery.com.