Every IT organization needs to have a disaster recovery and business continuity plan in place. That’s not a new concept, but with the global emergence of a new strain of coronavirus, dubbed COVID-19, now is a good time to revisit those plans and ensure that your company can continue operating even in the worst-case scenario. 

Rick Barr, chief operating officer at OneLogin, believes that events like this are forcing companies to be more aware of the issues they would have in a large-scale disaster. Dan Timko, chief strategy officer for cloud backup at media company J2 Global, agreed, adding: “What we’re seeing with COVID-19 is kind of a forcing function causing people to rethink just how ready they are because this is one of those areas that for a lot of businesses gets put on the backburner until there is maybe a pressing need.” 

According Barr, the main difference between disaster recovery plans and business continuity plans is that disaster recovery deals with how you would get a platform or service back up and running after a disaster, while business continuity is about taking care of the rest of the business. 

“Particularly for technology companies, we must remember that it is not just the platform or the service,” said Barr. “The platform and the service is part of a disaster recovery plan. The business continuity plan is really about the people and the business processes and the infrastructure and so I think you need to take a more holistic view these days.”

Software development at home: balancing life, retaining compliance
IT disaster recovery planning can no longer be ignored 

Barr believes that companies should be taking a more holistic approach to business continuity planning. “An important and very critical piece is the disaster recovery of a platform,” said Barr. “But the other piece is do you have infrastructure and processes in place to be able to scale to a changing dynamic environment like we’re seeing with COVID-19.”

For example, at OneLogin, their business continuity plan has evolved from an IT/DevOps-led process to one that has operations leaders and a people leader in addition to an IT/DevOps leader.

Barr also added that one of the most important things to have in a business continuity plan is an internal open chain of communication. Being able to get in touch with employees not only through Slack, but by text message, by phone call, or by personal email is important. 

Another important part of that chain of communication is being open with your employee base “about what you’re doing as a management team and where you’re taking knowledge or expertise from, where we refer in our team to the CDC and the World Health Organization,” Barr continued. “That’s where we go and those are the bases by which we make decisions and share those decisions with our employee base. I think that’s another really important piece to do because nobody knows what’s going to happen, but when we’re not sharing I think people become more concerned. And I think overcommunication is better at a time like this.”

Timko also added that doing this kind of planning isn’t just for dealing with the current situation. These are things people should have been thinking about regardless of what is going on now.  “At the end of the day, the biggest point is you don’t need to look at this as just preparing for COVID-19 because this is just best practices stuff anyway,” said Timko. “I mean, these are things you should have in place and if you don’t have them in place right now this just becomes a forcing function to look at it and maybe provide you with that level of executive support you need to get things done.”

Companies transition to remote operations
With this particular virus, there’s a lot of uncertainty due to the fact that no one knows how far it will spread and how catastrophic it will be. But a lot of companies in the United States and in other areas where the virus is present have begun taking preventative measures such as telling their employees to work remotely in an effort to help prevent its spread.

“Obviously the need is to be a little bit more flexible, whether it’s work from home telecommuting or paid sick days, because the last thing you want is someone to come in sick because they can’t afford to take the day off,” said Timko. “To the business that becomes far more expensive in the long run than just letting that person stay home.” Timko also added that companies should be taking other preventative measures like reminding people about handwashing, making sure there are sanitation supplies around, and eliminating handshakes. 

Another thing to consider is that employees are likely going to be more concerned with making sure their family is safe than whatever their work commitment is, Timko said. Companies need to consider and plan for possible attrition. “Whether it’s people that are sick or people who have family that are sick or are too nervous to leave their house, you start to look at what resources you have to do work and you’ve gotta make some calls around what’s the most critical work that needs to be done,” he said. Companies should ask themselves questions like “Do you have the ability to augment staff? Are there third-party relationships in place where you can call on some remote help desk to fill in where you might be lacking?” 

Timko believes that the best way to position yourself in the early stages of an epidemic is to be able to allow employees to work from home now, and not just try to hold out in the office as long as possible doing business as usual. “So I think understanding the work that is done, the applications people are using, what the workflows are, now while they’re generally in the office and trying to think a lot harder about how you would accomplish those same work processes if everything was remote,” said Timko. “Are there things in the office you need access to to do the more important tasks of the business that would be prioritized? If there are, can they be put somewhere that is remotely accessible? Can someone have a copy of them at home? Any number of things, it’s going to depend on the business, but just trying to plan ahead. That’s what this whole thing is about. And then I think highly important is kind of what the communications plan is.”