Pandemic plans differ slightly from traditional disaster recovery and business continuity plans in that they focus more on people and somewhat less on technology. Each type of plan provides a structured approach for responding to situations that threaten an organization's ability to sustain operations.
The Centers for Disease Control and Prevention (CDC) has indicated that coronavirus disease 2019 (COVID-19) is threatening the U.S. population. The number of COVID-19 cases continues to grow, as does the number of deaths attributed to the virus. Previous instances of coronavirus outbreaks include MERS and SARS. Considering the health threat a pandemic poses to employees, a carefully designed pandemic recovery plan can help a firm remain viable, even with a reduction of staff.
In this guide on using a pandemic template, you'll learn what you need in a pandemic plan for your business and what to put on your pandemic planning checklist. To get started, read our guide to building and executing a pandemic recovery plan, and then download our free pandemic plan that can be customized for your business.
When building a pandemic plan, the principal concern is availability of staff. Employees who contract the coronavirus may not be able to perform their daily activities for a few weeks to possibly a few months. Begin the process by completing a risk assessment that identifies critical company operations, as well as the systems and the staff needed to support them. Next, prioritize the business functions in terms of the most critical to the organization's survival. In collaboration with your human resources department, identify the employees who are deemed crucial to supporting critical business functions.
The incubation period for COVID-19 is not yet clear, but the World Health Organization lists an estimate of about five days. Given the potential lead time to respond to a coronavirus outbreak, the number of employees initially infected may be low but could increase quickly.
Pandemic plans are a combination of preventative measures and active response measures. Preventative measures may include hand-washing stations and the availability of face masks for those who need them, while active responses may include replacing absent employees with healthy staff members who can perform the same functions. An important strategy for achieving the latter goal is to cross-train employees in multiple functions within their business units. In addition, access to detailed step-by-step procedures for recovering disrupted systems and networks can help backup staff recover and resume normal operations.
The goal of these processes is to minimize any negative effects to company operations attributed to loss of staff through illness. A comprehensive pandemic plan includes primary and alternate supplier contacts; sources of medical supplies; and contact information for all employees, as well as stakeholders, customers and key supply chain vendors. Finally, it includes a logical sequence of actions that ensures employee heath is protected and critical operations are maintained.
There are some additional issues to consider when crafting your pandemic recovery plan. Some are more effectively handled at a higher level, such as state departments of health, while others ought to be part of your own pandemic readiness program.
At what point would you consider quarantines? For example, if someone comes to work exhibiting flu symptoms, he or she should be sent to a local hospital emergency room for observation and testing. If an appropriate health facility is not readily available or nearby, it may be necessary to isolate the person in a separate room away from other employees until transportation can be arranged.
Regular review of messages from the CDC and local authorities should be maintained to determine the status of the disease and its spread. If the spread seems to be increasing -- for example, several employees have called in sick or have tested positive for coronavirus -- it may be time to activate a "reduced staff business model" and send most employees home, other than those designated for reduced operations support. Ideally, company leadership should have such a discussion well in advance of an actual outbreak to decide how/when to shut down operations. Closing the doors is the last activity.
At what point would you release antiviral stockpiles? Large companies may stockpile vaccines if they can afford it, have sufficient space and can actually obtain doses. Most other companies are not likely to stockpile vaccines. Err on the side of caution in stockpile situations. Release stockpiled doses of the vaccine as soon as the first verified case is reported.
How big should stockpiles be? Assuming that only a single dose of the vaccine is needed, stockpile one dose for each employee per location.
How quickly can you get to them? If they are stored on site, distribution can be almost immediate. If not, use of an overnight delivery service is advised. If on-site storage of vaccines is not available, the time to get doses could be anywhere from the same day to a week.
In addition to concerns about quarantines or vaccine stockpiles, you should also consider the following questions:
The following is a suggested sequence of plan development activities:
Having a BC/DR plan in place is critical to a pandemic plan. A BC/DR plan identifies critical IT assets, maximum acceptable downtime, employee data and response procedures to disruptions and failures. A BC/DR plan can inform a pandemic plan by identifying situations where a single person is responsible for a critical function and determine the preparedness of emergency response teams. Knowing which employees are responsible for which functions can help ensure that there are no gaps in your pandemic recovery plan.
BC/DR plans can also identify vendor emergency response capabilities, if they have pandemic response plans and when they were tested, impact of a pandemic on contract obligations, and presence of service-level agreements (SLAs).
Once you have gathered all of the necessary information, compile results from all analyses into a gap analysis that identifies potential staffing issues associated with critical business functions and technology assets, with recommendations as to how to achieve the required level of preparedness, and estimated investment required.
Have management review the report and agree on recommended actions and prepare a pandemic recovery plan to address critical business functions, facilities and technology assets.
Once the plan is completed, conduct tests of plans, employee backups and system recovery assets to validate their operation and effectiveness. Update pandemic plan documentation to reflect changes. As with any recovery plan, be sure to schedule the next review and audit of pandemic recovery capabilities.
Keep in mind the following best practices for your business:
Perhaps the most effective way to test a pandemic recovery plan is through tabletop exercises. Tabletop exercises enable an organization to run through every aspect of the plan, step by step, and discover any potential weaknesses or missing information.
The following is a list of items to cover with such an exercise:
Considering the investments businesses make in their IT infrastructures, all businesses should also invest sufficient time and resources to protect those investments from unplanned and potentially destructive events, such as the coronavirus outbreak.
04 Mar 2020