Prepare for serious health threats with a pandemic recovery plan
COVID-19 has become a serious global threat and is rapidly becoming an issue for business continuity. Pandemic planning can help mitigate disruptive effects of disastrous events.
On its face, a communicable disease may not be considered a major threat to IT, but the novel COVID-19 has demonstrated the wide-ranging havoc a pandemic can wreak. Each day the media announces the number of new cases, as well as deaths, from the coronavirus, and recent statistics show that new applications for unemployment benefits have exceeded all previous records. That is a major indication of how the current pandemic affects business continuity.
The illness, which is spread by human-to-human contact or indirect contact with environments contaminated by the virus, provides real-time evidence of how such events can affect your employees and organization. To keep your organization operational, you should have a pandemic recovery plan in place along with business continuity and disaster recovery (BC/DR) plans. Regrettably, the nature and rapid spread of the COVID-19 virus is making execution of BC/DR plans and pandemic recovery plans a challenge, especially when employees work from home, are quarantined (typically, for 14 days at a time) or are sick with the illness.
While it may be too late to manage the impact of staff working remotely or a growing number of employee illness cases, it's still a good idea to have a pandemic plan in place for your organization.
As you progress through what is considered the early stages of a pandemic, examine your existing BC/DR and pandemic plans, if you have them. Are they up to date? Are the names, addresses and contact information for employees and external third parties accurate? If you have skills matrices and succession plans, are they up to date? Be sure to review any business impact analyses (BIAs) and risk analyses to ensure they accurately reflect the business and the most critical business processes.
Issues to consider when responding to a pandemic
Like other similar health events, the COVID-19 pandemic presents the highest risk to people. Risk assessments can help identify how an organization may be affected in a pandemic event by highlighting the likelihood of such a risk occurring and its potential effect on people. The same goes for a business impact analysis: Identify the most critical business processes; people; internal and external dependencies; information systems; resources; and vital records. The BIA can pinpoint the financial and reputational implications of a significant loss of staffing. You'll also be able to map the critical business processes and technologies with the key people who perform them smoothly.
As you progress through what is considered the early stages of a pandemic, examine your existing BC/DR and pandemic plans, if you have them.
The current pandemic began affecting people and organizations in the U.S. in early March 2020. Was that enough time to take the pandemic seriously? The challenge for this pandemic has been to decide when to start preparing for a disruptive health event, especially when the information being offered from various sources often seems in conflict.
As local and state governments initiate forced social distancing and quarantining, and efficient testing does not appear to be widely available any time soon, it becomes clear that BC/DR and pandemic plans may be too little, too late. At the least, business leaders and IT managers should take notice in time and start preparing for remote working.
Analyzing the workforce when managing through a pandemic
In advance of pandemic events such as COVID-19, work closely with your HR department to conduct a skills inventory of all employees. This can be as simple as preparing a spreadsheet with all employees on one axis, and a list of critical skills and responsibilities on the other axis. Enter an "x" where employees have specific skills. Map these results against critical business processes to identify the key employees whose skills are essential to the firm. Next, identify employees who are sufficiently trained -- or who can be trained -- to back up the key employees. Where gaps in backup staff exist, arrange for cross-training.
An extension of a skills matrix is a succession plan, in which specific individuals are identified as being suitably qualified to step in and assume the responsibilities and perform the duties of key company management, if senior managers are unavailable. It can also document critical business processes and procedures for recovering IT systems and services so that others can step in and assist if the primary and secondary employees are unavailable.
During a pandemic, try to keep track of who can work and is working, and determine if the necessary skills to support company activities are in place. Be prepared to adjust staffing as needed to accommodate changes in the business. Monitor the health of key employees and senior leadership and activate the succession plan if needed.
Keep employees in the loop
We are all hopefully familiar with the importance of washing hands, disinfecting surfaces that can come in contact with human touch and the use of protective face masks. As much as possible, communicate regularly with employees on how well the pandemic recovery plan, BC/DR plans and other measures are supporting the organization. Continue to distribute pandemic information from the Centers for Disease Control and Prevention (CDC), World Health Organization (WHO), and state and local agencies. Keep supplies of any relevant medications on site. Encourage employees to be vigilant about their own health, the health of their colleagues and the health of their families.
At this stage, it is hard to imagine a company being totally unaware of the COVID-19 pandemic and its progress. Check media coverage of the pandemic and information from local, state and federal health organizations regularly. Social media can also be an effective part of your efforts to keep employees informed. The CDC and WHO post the latest developments and resources on their websites and social media accounts.
Remember that the spread of a virus like COVID-19 within an organization may be slow at first but can expand quickly if employees do not take preventive measures. Err on the side of proactively taking care of employees and their health.
At this point in time, your emergency teams should be operational (be sure to include HR and senior management), as well as BC/DR and pandemic recovery plans. Schedule conference calls to follow any social distancing requirements, discuss the situation and decide the next steps to take.
What else can you do?
Establish a companywide pandemic policy in addition to business continuity policies and disaster recovery policies. Maintain up-to-date contact lists of employees; supply chain members and other key suppliers; healthcare facilities; emergency response units; and other relevant organizations. Ensure that employees who exhibit abnormal symptoms are quarantined as soon as possible. Maintain vigilance on the situation's progress. Set up authorities, triggers and procedures for activating and terminating the response plan you establish, altering business operations (e.g., shutting down operations in affected areas), and transferring business knowledge and responsibilities to key employees and their backups.
It may be too late in the game to create a COVID-19 recovery plan, but taking note of how the current pandemic affects your organization could help you protect your employees and have a plan for preserving business continuity in the future.
