Disaster recovery and business continuity (DR/BC) plans are living documents that generally reflect the best available information companies have at a point in time. Many modern plans are themselves a reflection of the lessons learned from the attacks on 9/11 that stress tested—and broke—many organizational assumptions about what companies needed to be prepared for in order to support regular business operations.
Disasters Never Follow Expectations
A key aspect of DR/BC plans is that they give organizations a chance to summarize the best information they have as a foundation, then practice those plans repeatedly and routinely. I have had the opportunity to exercise DR/BC plans a number of times, and in my experience, the events that actually triggered these plans never fit nicely into the scenarios we’d planned for. The practice, however, created a form of muscle memory, which allowed our teams to take care of simple things effortlessly.
This created mental and organizational capacity to deal with the unexpected. When we lost the power grid in the Northeast in 2003, our plans worked like a charm; part of that plan had us moving large numbers of employees by bus between operations centers. Later, however, when we confronted the SARS outbreak, we realized that an assumption embedded in our plans about mobility was completely unrealistic in the face of an epidemic.
Weighing Proactivity Against Unintended Consequences
Now, IT leaders and their business partners are facing a new challenge with COVID-19 sweeping quickly through many countries. Efforts are underway to contain the spread of the virus and, over time, we’ll see how effective these proactive programs prove to be. In the meantime, before things progress is the perfect time to consider options and the potential unintended consequences that come with them. In London, for example, some companies have started to ask employees to work from home. Twitter has announced a similar approach for its employees worldwide.
This begs a new series of technology-oriented questions, starting with whether the impacted corporate infrastructure can handle that kind of change in traffic patterns. Do strategic partners have similar capabilities? What would happen if they executed such a plan either in concert with others or on their own? Performance issues may also arise if the applications business employees are using aren’t optimized for operating with relatively low network bandwidth (e.g., “chatty” client/server applications can become brutally slow in this scenario). While the working from home approach seems logical in theory, knowing how it will go in practice is a question that IT leaders should strive to answer before moving to execute such a plan.
This type of testing is not just theoretical. This week, at least one major biotech firm in Silicon Valley announced plans to have a “work from home test day” to make sure it understands what works, and what breaks, when the company attempts to make tele-work the norm rather than the exception.
Insurer IT organizations may want to learn from this test run, perhaps as part of a broader review of emerging CDC guidance on planning. Knowing the breaking points when pressure testing an ecosystem may create new work, but it is better to do that when the team is calm and running at full strength than when it is trying to operate in crisis mode with a depleted staff. The best time to work out the details in a disaster recovery plan is always before the bad thing happens.
Add new comment