COVID-19: Getting Ready for the Next Business Continuity Challenge

Business continuity planning (or resiliency) consists of preparing for how to operate if we lose our technology, facilities, or people. During the COVID-19 pandemic, so far, we are mostly dealing with losing our facility and having to have employees work remotely. What could come next? How do we prepare to deal with a large portion of our workforce getting sick at the same time and requiring isolation?

Generally, the solution for the loss of personnel is cross-training and documentation, but many companies function on tribal knowledge and relationships. This can work fine when everything is normal, but when we start to lose key resources (those human routers that know how to connect to critical institutional knowledge), we need documented processes to reference.

Once you identify the folks who are the only ones who know how to keep a key technology or process running, you need to determine if you can get someone cross-trained and then use that training to document the function. If cross-training will not work, then the individual will have to automate or document everything needed to ensure continuity of operations. I have found this to be one of the hardest challenges but, considering the current pandemic, would say now is the time to pull your critical human and technology resources off of current operations, before you have to develop a crisis management plan instead.

Support phone trees for key functions are vital. It is important to know who the experts are for different key functions. This could include third parties and vendors. While I reference the classic fallback system of phones, today we can also use technology to minimize the impact to an isolated team. To do so, you will need to ensure application access, video teleconferencing capabilities, and collaboration tools with capabilities such as chat or document sharing. However, remember that collaboration tools are only useful if folks know whom to reach out to for support and information.

Map Out Staffing Depth for SLAs
Next, you need to determine your regulatory and contractual service-level agreements (SLAs) and map out the staffing depth you have in order to support them. For areas where you have risk, you need to determine what the criteria is for action. Ask yourself: If we lose 10%, can we still meet our SLAs? What if we lose 50%? What are the impacts, and do we have a plan for acceptable recovery? I will note there are formulas for business impact analysis (BIA) and return to operations (RTO) that can be leveraged here. Depending on the ability of the team to support cross-functional capabilities, you may want to develop a prioritized list of functions you will maintain.

Another option to consider is determining which of your vendors offer service support and making sure you have agreements in place to use them if needed. Having staffing augmentation available is a key lever to be able to pull if needed to keep systems running. 

Along the same lines, if you have not checked in with your suppliers and asked for their business continuity plans, the time to do so is now! You need to understand how mature their capabilities are and be ready to develop options if they fail.

If you don't currently have anyone certified in business continuity, it's a good time to get some of the team trained. Generally, the training is around both business continuity and disaster recovery. A pandemic doesn't really require disaster recovery, which focuses on returning the core technology or facility to operational capacity. If you follow ISO-27000 for security, there is an ISO-22301-certified business continuity manager (CBCM) course that would complement it. If you want more general certifications, there are a number of them run by different training organizations.

The bottom line is that while we are dealing with the challenge of remote workers, now is the time to conduct some exercises on how to fight through the loss of staff. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Three Ways Your BEC Defense Is Failing & How to Do Better."