Human Concerns of Business Continuity
By Ted Brown
The fastest growing segments of the alternate site/hot site business are the work group, end user and call center areas. Essentially these are different names for the same basic arena, that of business UNIT recovery. To paraphrase a comment that a CIO made to me, “What’s the point of having a hot site for our data center if our critical people have no place to go to work?” The growth analysis applies from a dollar value, number of contracts, number of locations, and even number of vendors. It’s also true in terms of investment in in-house solutions.
This was true prior to September 11, 2001. But the terrorist attack brought even more attention to the need for business unit plans. Sarbanes Oxley also points out the need to protect business data and business functions.
Historically, Disaster Recovery plans focused on technology (hot site) and data (back up and off-site storage). Very little attention was given to the people component. The assumption was made that the required people would be available and would simply go to the internal or external hot site, even if it were hundreds or thousands of miles away. It was also assumed that they would stay away for weeks or even months.
These are probably not valid assumptions for workgroup recovery. Let’s examine why.
We will assume that we are dealing with a critical end user department of 100 people: order entry or customer service or call center.
Let’s examine the profile of these 100 employees. Most are women. Most consider this a job, not a career. Many are single parents. Many use public transportation for their commute, others car pool. Most bring their lunch. Most have other commitments that don’t allow for overnight stays, much overtime or schedule changes. Some have special needs family members: children, spouse, parent, or pets.
What are the complications for our Business Recovery Plan? The work group recovery center is almost certainly not near their primary work locale, (it shouldn’t be, in order to protect from a regional disaster) and is located on a different power grid, etc. So how do these people get to the recovery center?
Do we contract for bus service from the normal work location vicinity to the recovery center? Can a charter bus service respond within hours of a disaster? Will these employees accept the double commute? Will we ask them to come earlier? Not likely, because of the profile already described. Can we accept a 6-hour workday versus 8 (caused by the double commute)? Do we use temporary help to augment our employee count? Years ago a company had a disaster that destroyed their office space. They developed an ad hoc solution. They leased an alternate facility an hour away from the primary location. Their employees made their normal commute downtown. Then they were bused an hour to the temporary location. They only required them to work six hours because of the two hours of extra commute. Within a week, people started quitting because of their commute growing from two hours a day to four hours a day, even though they were being paid to just ride a bus for two hours.
Have we recognized (and planned for) the fact that if it’s any kind of regional disaster, many of the 100 will not come? It could be because of impact to their home, inability to travel, or something as simple as the schools being closed and the kids are home.
These are all issues that must be dealt with in our plans. Perhaps our plan needs to treat each one of these 100 employees as a critical resource with dependencies on transportation, etc. If this is a 24×7 operation, it is even more complicated.
Let’s assume we solve all these problems and we’ve figured out how we would get 100 employees to our alternate site.
I believe that there are bigger issues that we have not considered because we ASSUME that the hot site vendor has considered these.
If we can get those 100 people to drive to the center, is there enough parking for 100 additional cars? Is there a cafeteria that will hold 100 additional people? Are there coffee pots? Are there rest room facilities for 100 additional people? I recently visited a hot site with 100 seats and only 4 ladies room stalls. Not enough. Imagine the congestion at lunchtime, even with staggered lunch hours.
I visited another actual work group facility that can house 400 people. They’re located in an office building with an unrelated company with 400 employees and a cafeteria with a capacity of 400 people and daily food for 400 people. So, if there is a declaration, do we now tell these people from our work group who have already been inconvenienced, that lunch is at 11 AM or 1 PM? Are the climate controls sufficient for 400 additional people?
What provisions have been made for children? We must assume that if there is ANY kind of regional disaster, that the ONLY way we can get some employees to go to the recovery facility is if there are provisions for children. Recently, I visited a major work group recovery facility. This company specializes in this type of recovery. They offer “shared” seats and “dedicated” seats. One of their clients has a contract for 400 dedicated seats. They conducted a test on a Saturday. A total of 308 people showed up, including 31 children. There were no plans for children. They ranged in age from infants to teenagers.
What provisions are there for medical treatment of ANY kind? Are there sufficient supervisor offices? Are the workstations equipped with headsets? What will the noise level be? Too many work group recovery facilities consist of workstations on tables or minimal partitioning.
Work group hot site providers cannot be expected to understand all the benefits that a company may provide to their employees. But the person that owns the Business Continuity Plan must be aware. We cannot ignore the fact that employees who are provided with on-site day care, workout facilities, and medical center people are going to EXPECT the same benefits at an alternate location, especially for an extended period of time.
Let’s assume we solve all these issues. The next challenge is how do we uncover more exposures, i.e., how do we test? Is it likely that our organization will take 100 people to an alternate site to test? Probably not. Therefore it’s likely that these people won’t know how to get to the center.
This is a great situation for the use of a tabletop test. You will need: directions to the recovery center, a COMPLETE floor plan of the recovery center (work stations, cafeteria, entrances, exits, rest rooms, etc.). Each of the 100 people MUST be preassigned a workspace, using the recovery center floor plan. In the test that was mentioned earlier, all 308 people (including children) stood around waiting to be told where to go and what to do. Names, addresses, and phone numbers of all 100 people (privacy issues?) and how each one will get to the center (car, public transportation, recovery bus) must be addressed. Call trees must be defined. Logic suggests that each supervisor call his/her own people. Who makes the call if the supervisor isn’t available?
Now let’s conduct a test. I suggest the first test be done during work hours at the normal work location, perhaps during lunch in a conference room. Buy lunch for the entire test team. Have each supervisor write their employees’ names on the board, how they’ll get to the hot site, what their exact assignment is, what their desk location is, and an issue for each. This last item is very important. You must insist that they think of an issue for each: children, commute, day care, etc. After this exercise is successfully completed, schedule another test at the hot site again with select supervisors on some pre-planned Saturday.
Good luck!