News Stay informed about the latest enterprise technology news and product updates.

Tips for business continuity and contingency planning for swine flu

IT business continuity plans for swine flu outbreaks focus on people and remote access issues. Here are experts' tips on what to include.

With many students back to school this week, the federal government and health organizations are doubling down on efforts to get out the word on a second wave of the H1N1 virus, also known as swine flu. A presidential advisory group of leading scientists has warned of possible absentee rates of 30% to 50% for an unknown duration. So what should CIOs be doing to their business continuity and contingency plans to help prepare for a swine flu outbreak?

More pandemic planning resources for CIOs
Swine flu -- not hurricanes -- leads disaster recovery agenda

Avian flu possibility shifts IT's focus to people

 A few basic guidelines should help you customize your business continuity plan for this kind of disaster, in which absenteeism and an uncertainty of duration are key factors. For this advice, we conferred with Alan Berman, executive director at the Disaster Recovery Institute International and former CIO for a major financial institution, and two analysts specializing in business continuity and disaster recovery: Stephanie Balaouras of Cambridge, Mass.-based Forrester Research Inc., and Roberta Witty of Stamford, Conn.-based Gartner Inc.

 First, some context: The virus is classified as a pandemic because of its global spread to 170 countries, not its severity. Less than 1% of the people who have contracted the H1N1 virus have died from it, compared with 60% of those who came down with avian flu -- also known as bird flu -- during the outbreak in 2003. Still, the 1 million cases of swine flu to date dwarf the 421 cases of avian flu (H151), and that number is expected to grow dramatically -- especially among children between ages 12 and 17.

For CIOs and other executives, that poses a serious risk. "Senior IT officers have a fiduciary obligation to their organizations to reduce the negative risk potential in advance or quickly instate mitigating actions if and when those examples of risk materialize," said Bruce Barnes, president of Bold Vision LLC, a Dublin, Ohio, consulting practice.

Here, then, is a snapshot of the risks and potential mitigations stemming from H1N1:

Risk: Absenteeism.

Absenteeism is the issue to focus on for swine flu. IT is an important business unit, and as such should be planning for workarounds in case of a 40% IT workforce absenteeism, Witty said. That means CIOs need to focus on both organizing their own staff and enabling remote access for the greatest number of employees, who will need to stay home if their children get sick or there is an outbreak at the office.

Mitigation No. 1: Identify and cross-train your key IT players. CIOs need to designate which personnel are critical to IT operations, DRI's Berman said, so these staff members are on the list to receive preventive and reactive medicines in case of an outbreak.

"This has to do with the distribution of Tamiflu, not only to the key personnel but to their families," Berman said. "What we found in H151 is that if you don't give Tamiflu to the families as well, employees are not coming to work."

Then be prepared with some switch hitters. "The loss of senior staff whose knowledge cannot be readily replicated can hit these organizations especially hard," Witty said.

Mitigation No. 2: Test your VPN, and make sure all employees know how to use it. Absenteeism doesn't necessarily translate to nonworking personnel. But employees need to be able to access corporate systems remotely, and IT needs to be prepared to handle an increased volume of users. Testing a virtual private network (VPN) isn't easy, but it's critical.

No cause for alarm here
Kathy Lang, CIO at Marquette University, said much of the work to prepare the university community of students, faculty and even parents for a swine flu outbreak is being handled by Student Health Service. Unless the virus mutates, the university health services will be treating H1N1 like any other influenza, she said.


"This means asking people to stay home if you are sick and using basic precautions," she said. Only those people with high-risk conditions such as asthma will be treated with Tamiflu if they get the virus.

As for remote access capability, Land said most applications are already accessible from off campus. And she is prepared should her own staff get hit hard by the bug. "One of our practices is to try and cross-train all the time, so that isn't different either," she said. -- L.T.

Berman worked with a number of large insurance companies during the bird flu outbreak. "One of the things the organization failed to do was run enough actual tests or simulations of having, say, 1,000 people try to use a virtual private network during H5N1," he said. "What we saw then was that organizations ran out of TCP/IP addresses."

Balaouras advises CIOs to work with their telecom providers to make sure their organizations have enough bandwidth in place and stipulate that service levels be maintained during a potential H1N1 outbreak.

In addition, Berman discovered in his consulting work during the avian flu that many employees simply did not know how to use the VPN. "We found out that instructions were outdated; different sets of passwords were being used, and employees didn't have them," he said.

Finally: Our experts dismissed the notion that the Internet is at risk for shutting down -- a popular rumor right now. "All those people are on the Internet today, sitting in their offices. The capacity for the Internet and for the ASPs is almost infinite. And if you look at all those people working from home, there is not that much throughput from their work, compared with downloading music and things like Twitter," Berman said.

Risk: Employees will be uncertain what the rules and plans are in case of an H1N1 outbreak.

Mitigation: Communicate the business continuity plan, the policy regarding what to do if you or a household member gets sick and specifics about where to find updated information. Most companies will want to encourage people who are sick or have been exposed to the H1N1 virus to stay home, Forrester's Balaouras said.

"A lot of the disaster recovery plan and business continuity plan for swine flu will focus on preventative measures and communication," Balaouras said.

As for technology, automated notification systems -- hosted, easily scaled and available from any number of vendors, including Dell MessageOne and Everbridge -- can be useful for broadcasting company messages.

Risk: Your vendors will be affected at levels that have an impact on your service.

Mitigation: Set up your communication strategy with vendors now to keep apprised of the impact of the pandemic on the vendor.

More than half of respondents to a Gartner Inc. survey in June said they were already conferring with IT providers and vendors in their swine flu planning efforts. Find out now how your organization's service levels would be affected by absenteeism at your vendors.

A global provider with a follow-the-sun policy poses less risk, although quarantining and other measures may be stricter in other parts of the globe. For example, some airports in Asia already use heat scanners to screen passengers at airports for fever and bar entrance to buildings for those who aren't tested or don't pass.

In summary, with swine flu, as with any disaster, there are unknowns such as how people will react to it. The fear factor can be huge, Berman said. "After 9/11 we saw spontaneous evacuations, where people would panic and run down the stairs after nearing a noise," he said.


Let us know what you think about the story; email: Linda Tucci, Senior News Writer

Dig Deeper on Risk and compliance strategies and best practices