Coronavirus and its potential impact on Disaster Recovery and Business Continuity Plans (DR/BC)

A quick look at today’s news stories can demonstrate areas where we may need to review our business impact analysis and see how quarantines or forced working from home (telecommuting) can impact your business. If your management team is proactive, they may already be sending your employees information about preventive measures your organization may be implementing.

Is this enough? I say no, we must make sure that the Business Impact Assessments (BIA) performed prior to the current coronavirus issue really reflects the full ramifications of measures that may be necessary to mitigate a pandemic disease. The BIA must take in to account the risks and impacts of measures that may be necessary to mitigate spread of a pandemic disease.  New threats may involve the declaration of State of Emergency by Federal, state or local government and the specific preventative measures that may be invoked. Some interesting examples are, the current forced shutdown of education facilities, self-imposed or government-imposed quarantine, cancelation of group events, imposed distance restrictions between people, cancelation of travel, etc.  The quarantines alone (approximately two weeks recommended) are impactful. Many of these mitigations may restrict or even prevent normal course of business and they all impact our maximum tolerable downtime and other indirect impacts like cost of fuel, hording of food items and hording of water, etc. .

It is difficult to assess the full impact of the current coronavirus outbreak as full-blown wide population testing for the virus, at least in the United States is still far from being placed into effect. Countries like Italy and South Korea where more widespread testing is in place are seeing much broader spread of the virus than has been previously anticipated.

Review Potential Company Mitigations

Is your company ready to send workers home?  If so, can they continue to work from home?  Are the company mechanism in place to support telecommuting needs at a higher volume than discretionary telecommuting?  Are critical services for your company capable of being managed remotely?  What about disruption of your suppliers and supply chains? If suppliers are impacted and can not deliver the required supplies can you continue to meet your business needs? What about public transportation, if it is disrupted what is the impact on your workforce and ability to conduct business. How does your current insurance policy treat business loss due to pandemic disease are your coverages correct, are you covered?  All of these are now relevant questions to consider in your BIA.

Now Is the Time to Plan

Whatever your normal cycle of review is for your BIA and DR/BC, now is the time to revisit these critical items.  Thoughtful consideration of the new threats and risks is appropriate, and it should be undertaken in a calm and deliberate manner, not in a last moment of panic reaction.  Even though we may be forced by current circumstances to act quickly, risk management decisions should be well thought out and pre-event planning is the best approach.  Make sure that you include all appropriate stakeholders in these reviews and that you know what the roles and actions are for your Emergency Response Teams. Communicate the actions to be taken to those that will be affected. Do not wait to surprise them when the action takes place.