While ensuring that the IT infrastructure is up and running is a crucial part of disaster recovery (DR), you still need to provide users with the ability to work. Therefore, workforce continuity must be part of any effective DR plan. In this interview, business continuity specialist Pierre Dorion discusses the importance of ensuring workforce continuity. His answers are also available to download below.
Table of contents:
>>Setting policies to ensure workforce continuity
>>Conducting a business impact analysis
>>Available technologies to ensure workforce continuity
>>Unified communication for system reliability, disaster recovery
>>Tabletop exercises for workforce continuity
At a high-level, workforce continuity should be included in every disaster recovery (DR) plan. Disaster recovery in general can't be just about restoring servers, it must also tie into business continuity (BC). There's a tendency to believe that this is a business problem, but you need to ask yourself why you would bother restoring servers in the first place if you don't do anything to ensure user access.
Workforce continuity includes access for users. As much as you want your IT infrastructure up and running, you want users to be able to continue working. So in workforce continuity, there's a very strong component that includes access and the ability to work. We see that more and more with the ability to telecommute being a part of lot pandemic plans. So it should be included in any disaster recovery plan. Regardless of whether or not you decided to plan for a pandemic, it makes sense to ensure that you can resume work with more than just IT.
It's a question of establishing priorities and the criticality of each component. So when we're doing a business impact analysis (BIA), the BIA helps establish a number of things. First of all, by determining the impact of an outage of a certain business process to your company, we are able to establish criticality and potential losses which allow us to situate things as a recovery priority.
It also allows us to establish recovery time objectives (RTOs) and recovery point objectives (RPOs) from a workforce continuity perspective, which is very important to determine how quickly we need things back up and running, and to which point.
Finally, it allows us to establish the relationship or interdependencies between specific processes, which again goes to establishing the RPO. So in order to understand what we need, we need to understand what the impact is to the business. Some things may be able to wait, other things can not. If you're not going to deploy a continuity strategy for the entire workforce, a business impact analysis will allow you to establish which groups need to be recovered first.
There are a number of things used in a non-DR perspective that can be leveraged to ensure workforce continuity, particularly the various virtual infrastructure components that are available today. We are quite familiar with some of the virtual server technologies, such as VMware, that virtualize the backend component. But there is also a very solid component with a virtual desktop infrastructure, where to a large degree you're trying to eliminate the hardware boundaries of your endpoint. By endpoint I mean the devices that the users will use to communicate.
This provides the ability to not have to worry about the technology or software versions or compatibility that may exist, especially if you're talking about a remote communication situation. For example, with users logging in from a home PC to your recovered infrastructure, you don't want to have to send out your IT specialist to make sure that everybody has the right version of the OS and the applications that you want to use.
By removing that layer through a virtual desktop infrastructure, users can pretty much connect to your applications through any Web browser. So that's a great piece of technology that eliminates the need to have everything on the same level.
Now you can have people connecting from various places and not necessarily in a DR situation. You can leverage this technology in a production situation, which makes it seamless in the event of a disaster. So when it comes to testing these things, you don't have to make sure that it works the day you need it, you know it works beforehand.
This is another very important component. We talked about application access and we want our workforce to keep working, but communication is a very important component of conducting daily business. It's nice to know that you can still use email and have everything in place for basic communication, but telephones are another issue.
The ability to communicate internally, typically with people just lifting their heads out of the cubical to talk to a coworker, is lost in a telecommunicating situation, although you may rely on that for your day-to-day activities. Things like instant messaging will help you in that perspective.
Unified communication technologies can actually help you combine all of these technology aspects. In other words, you don't want to have to install multiple solutions to meet all of these needs. You can have technologies like the Cisco Unified Personal Communicator that allows instant message and telephony capabilities, and can be tied into your IP phone system. Anything that can be accessed through a Web browser allows you to not have to worry about any specific pieces of equipment at various locations. So that helps you keep your workforce in tight communication during a disaster, which is even more important during those situations than any typical business activity.
By integrating unified communication and a virtual desktop infrastructure into your day-to-day operations, as opposed to relying on it for strictly DR purposes, you can test the infrastructure in place on a daily basis. A tabletop exercise will help you establish the basic guidelines so that people understand what they have to do during a disaster. This may be external for the technologies and access because there are components of disaster recovery in workforce continuity that include communication and training.
That said, if your technology is well implemented and used on a daily basis in the production environment, you don't really have to test it. It's working, you know it will be available, and as long as you have the proper redundancies in place on the backend and failover capabilities, it should be relatively seamless, regardless of where the user is. So while a tabletop exercise can help, it does not have to be overly elaborate and should be more of a question of making sure of how things work in the event of a disaster. The rest should be in place and operational.
Pierre Dorion is the data center practice director and a senior consultant with Long View Systems Inc. in Phoenix, Ariz., specializing in the areas of business continuity and disaster recovery planning services and corporate data protection.
This was first published in April 2009