Using a pandemic recovery plan template: A free download and guide

Pandemic plans differ slightly from traditional disaster recovery and business continuity plans in that they focus more on people and somewhat less on technology. Each type of plan provides a structured approach for responding to situations that threaten an organization's ability to sustain operations. Considering the health threat to employees from by a pandemic, a carefully designed pandemic recovery plan can help the firm remain viable, even with a reduction of staff. This article and SearchDisasterRecovery.com's free downloadable pandemic planning template provide an effective starting point.

DOWNLOAD our free pandemic planning template Pandemic planning template

The Centers for Disease Control and Prevention (CDC) has indicated that an H1N1 (swine flu) pandemic is threatening the U.S. population. The number of H1N1 cases continues to grow, as does the number of deaths attributed to the virus. Supplies of H1N1 vaccine have been slow to appear in appropriate quantities, but they are expected to improve later this year and into 2010.

In this guide on using a pandemic template, you'll learn what you need in a pandemic plan for your business and what to put on your pandemic planning checklist. To get started, read our guide, and then download our free pandemic plan that can be customized for your business.

How to build a pandemic plan
Pandemic planning questions
Pandemic planning checklist
Pandemic planning best practices for your business
Reviewing the pandemic planning template
Exercising the pandemic plan

How to build a pandemic plan

When building a pandemic plan, the principal concern is availability of staff. Employees who contract the H1N1 virus may not be able to perform their daily activities for a few weeks to possibly a few months. Begin the process by completing a risk assessment that identifies critical company operations, and the systems and the staff needed to support them. Next, prioritize the business functions in terms of the most critical to the organization's survival. In collaboration with your human resources department, identify the employees who are deemed most critical to supporting critical business functions.

Given the potential lead time to respond to an H1N1 outbreak (e.g., three to five days incubation period before the disease presents itself), the number of employees initially infected may be low, but could increase quickly.

Pandemic plans are a combination of 1) preventive measures, e.g., hand cleaning stations throughout the building, availability of face masks, and 2) active response measures, e.g., replacing absent employees with healthy staff who can perform the same functions. An important strategy for achieving the latter goal is to cross-train employees in multiple functions within their business units. In addition, access to detailed step-by-step procedures for recovering disrupted systems and networks can help backup staff recover and resume normal operations.

The goal of these processes is to minimize any negative impacts to company operations attributed to loss of staff through illness. A comprehensive pandemic plan includes primary and alternate supplier contacts; sources of medical supplies; contact information for all employees as well as stakeholders, customers, and key supply chain vendors. Finally, it includes a logical sequence of action steps that ensures employee heath is protected and critical operations are maintained.

Pandemic planning questions to consider

The following are some additional issues to consider. Some are more effectively handled at a higher level, such as state departments of health, while others ought to be part of your own pandemic readiness program.

Pandemic planning checklist

The following is a suggested sequence of plan development activities.

• Identify what management perceives as the most critical business activities.
• Identify what management perceives as the most critical IT assets, e.g., call center, server farms, Internet access.
• Determine the maximum outage time management can accept if the identified business processes and IT assets are unavailable.
• Correlate the employee data to the critical business processes and technology assets.
• Identify situations where a single person is responsible for a critical function, and identify possible backups.
• Identify the operational procedures currently used to respond to critical outages.
• Determine when these procedures were last tested to validate their appropriateness.
• Identify emergency response team(s) for all business functions and the technology infrastructure; determine their level of training with regard to critical processes and systems, especially in emergencies.
• Identify opportunities for cross-training of staff potential to prevent gaps in coverage.
• Identify vendor emergency response capabilities; if they have pandemic response plans and when they were tested; impact of a pandemic on contract obligations; presence of service-level agreements (SLAs).
• Compile results from all analyses into a gap analysis that identifies potential staffing issues associated with critical business functions and technology assets, with recommendations as to how to achieve the required level of preparedness, and estimated investment required.
• Have management review the report and agree on recommended actions.
• Prepare pandemic recovery plan(s) to address critical business functions, facilities and technology assets.
• Conduct tests of plans, employee backups and system recovery assets to validate their operation and effectiveness.
• Update pandemic plan documentation to reflect changes.
• Schedule next review/audit of pandemic recovery capabilities.

Pandemic planning best practices

Keep in mind the following best practices for your business:

Reviewing the pandemic planning template

Next, we'll examine the table of contents from the pandemic planning template, indicating key issues to address and activities to perform.

1. Statement of Intent: This sets the stage and direction for the plan.
2. Policy Statement: Very important to include an approved statement of policy regarding the provision of pandemic recovery services.
3. Objectives: Main goals of the plan.
4. Key Personnel Contact Information: Locate key contact data near the front of the plan, as it's the information most likely to be used right away.
5. Plan Overview: Describes basic aspects of the plan.
6. Emergency Response: Describes what needs to be done following the occurrence of pandemic cases.
7. Pandemic Recovery Team: Members and contact information of the pandemic team.
8. Emergency Alert, Escalation and Pandemic Plan Activation: Steps to take through the early phase of an outbreak, leading to activation of the pandemic plan.
9. Media: Tips for dealing with the media.
10. Insurance: Summarizes the insurance coverage associated with a pandemic outbreak and any other relevant policies.
11. Financial and Legal Issues: Actions to take for dealing with financial and legal issues.
12. Pandemic Plan Exercising: Underscores the importance pandemic plan exercising.
13. Appendix A: Suggested Pandemic Recovery Plan Forms: Ready-to-use forms that will help facilitate plan completion.

Exercising the pandemic plan

Perhaps the most effective way to test a pandemic recovery plan is through tabletop exercises. The following is a list of items to cover at such an exercise.

1. Gather key members of the pandemic team and other relevant teams, including human resources, facilities, emergency response, and disaster recovery and business continuity.
2. Review the healthcare and preventive measures in place and those that need to be added.
3. Review impacts on company facilities.
4. Review impacts on the organization's key business functions, who currently supports them and who can back them up if they are unavailable.
5. Discuss efforts to provide cross-training to employees who may be designated as backups.
6. Discuss succession planning to minimize any leadership gaps.
7. Discuss communications activities, both internal and external, that ensure employees have all relevant information about the pandemic and key external organizations know how the company is responding.
8. Address supply chain concerns by reviewing key suppliers and how they plan to provide a pandemic response.
9. Determine which supply chain firms should be part of a joint discussion on cross-organization pandemic responses; schedule meetings to address these issues.
10. Identify where additional support, training, resources and funding are needed; secure these resources.
11. Update plan documentation as needed.
12. Schedule follow-up tests.

Considering the investments businesses make in their IT infrastructures, all businesses should also invest sufficient time and resources to protect those investments from unplanned and potentially destructive events. This article/template will help you get started on developing plans to protect and recover your critical IT infrastructure assets following such events.

About this author: Paul F. Kirvan, FBCI, CBCP, CISSP, has more than 20 years experience in business continuity management as a consultant, author and educator. He is also secretary of the Business Continuity Institute USA Chapter.