|
By Ted Brown
The fastest growing segments of the alternate site/hot site
business are the work group, end user and call center areas. Essentially
these are different names for the same basic arena, that of business UNIT
recovery. To paraphrase a comment that a CIO made to me, "What's the point
of having a hot site for our data center if our critical people have no
place to go to work?" The growth analysis applies from a dollar value,
number of contracts, number of locations, and even number of vendors.
It's also true in terms of investment in in-house solutions.
This was true prior to September 11, 2001. But the terrorist
attack brought even more attention to the need for business unit plans.
Sarbanes Oxley also points out the need to protect business data and business
functions.
Historically, Disaster Recovery plans focused on technology
(hot site) and data (back up and off-site storage). Very little attention
was given to the people component. The assumption was made that the required
people would be available and would simply go to the internal or external
hot site, even if it were hundreds or thousands of miles away. It was
also assumed that they would stay away for weeks or even months.
These are probably not valid assumptions for workgroup recovery.
Let's examine why.
We will assume that we are dealing with a critical end user
department of 100 people: order entry or customer service or call center.
Let's examine the profile of these 100 employees. Most are
women. Most consider this a job, not a career. Many are single parents.
Many use public transportation for their commute, others car pool. Most
bring their lunch. Most have other commitments that don't allow for overnight
stays, much overtime or schedule changes. Some have special needs family
members: children, spouse, parent, or pets.
What are the complications for our Business Recovery Plan?
The work group recovery center is almost certainly not near their primary
work locale, (it shouldn't be, in order to protect from a regional disaster)
and is located on a different power grid, etc. So how do these people
get to the recovery center?
Do we contract for bus service from the normal work location
vicinity to the recovery center? Can a charter bus service respond within
hours of a disaster? Will these employees accept the double commute? Will
we ask them to come earlier? Not likely, because of the profile already
described. Can we accept a 6-hour workday versus 8 (caused by the double
commute)? Do we use temporary help to augment our employee count? Years
ago a company had a disaster that destroyed their office space. They developed
an ad hoc solution. They leased an alternate facility an hour away from
the primary location. Their employees made their normal commute downtown.
Then they were bused an hour to the temporary location. They only required
them to work six hours because of the two hours of extra commute. Within
a week, people started quitting because of their commute growing from
two hours a day to four hours a day, even though they were being paid
to just ride a bus for two hours.
Have we recognized (and planned for) the fact that if it's
any kind of regional disaster, many of the 100 will not come? It could
be because of impact to their home, inability to travel, or something
as simple as the schools being closed and the kids are home.
These are all issues that must be dealt with in our plans.
Perhaps our plan needs to treat each one of these 100 employees as a critical
resource with dependencies on transportation, etc. If this is a 24x7 operation,
it is even more complicated.
Let's assume we solve all these problems and we've figured
out how we would get 100 employees to our alternate site.
I believe that there are bigger issues that we have not
considered because we ASSUME that the hot site vendor has considered these.
If we can get those 100 people to drive to the center, is
there enough parking for 100 additional cars? Is there a cafeteria that
will hold 100 additional people? Are there coffee pots? Are there rest
room facilities for 100 additional people? I recently visited a hot site
with 100 seats and only 4 ladies room stalls. Not enough. Imagine the
congestion at lunchtime, even with staggered lunch hours.
I visited another actual work group facility that can house
400 people. They're located in an office building with an unrelated company
with 400 employees and a cafeteria with a capacity of 400 people and daily
food for 400 people. So, if there is a declaration, do we now tell these
people from our work group who have already been inconvenienced, that
lunch is at 11 AM or 1 PM? Are the climate controls sufficient for 400
additional people?
What provisions have been made for children? We must assume
that if there is ANY kind of regional disaster, that the ONLY way we can
get some employees to go to the recovery facility is if there are provisions
for children. Recently, I visited a major work group recovery facility.
This company specializes in this type of recovery. They offer "shared"
seats and "dedicated" seats. One of their clients has a contract for 400
dedicated seats. They conducted a test on a Saturday. A total of 308 people
showed up, including 31 children. There were no plans for children. They
ranged in age from infants to teenagers.
What provisions are there for medical treatment of ANY kind?
Are there sufficient supervisor offices? Are the workstations equipped
with headsets? What will the noise level be? Too many work group recovery
facilities consist of workstations on tables or minimal partitioning.
Work group hot site providers cannot be expected to understand
all the benefits that a company may provide to their employees. But the
person that owns the Business Continuity Plan must be aware. We cannot
ignore the fact that employees who are provided with on-site day care,
workout facilities, and medical center people are going to EXPECT the
same benefits at an alternate location, especially for an extended period
of time.
Let's assume we solve all these issues. The next challenge
is how do we uncover more exposures, i.e., how do we test? Is it likely
that our organization will take 100 people to an alternate site to test?
Probably not. Therefore it's likely that these people won't know how to
get to the center.
This is a great situation for the use of a tabletop test.
You will need: directions to the recovery center, a COMPLETE floor plan
of the recovery center (work stations, cafeteria, entrances, exits, rest
rooms, etc.). Each of the 100 people MUST be preassigned a workspace,
using the recovery center floor plan. In the test that was mentioned earlier,
all 308 people (including children) stood around waiting to be told where
to go and what to do. Names, addresses, and phone numbers of all 100 people
(privacy issues?) and how each one will get to the center (car, public
transportation, recovery bus) must be addressed. Call trees must be defined.
Logic suggests that each supervisor call his/her own people. Who makes
the call if the supervisor isn't available?
Now let's conduct a test. I suggest the first test be done
during work hours at the normal work location, perhaps during lunch in
a conference room. Buy lunch for the entire test team. Have each supervisor
write their employees' names on the board, how they'll get to the hot
site, what their exact assignment is, what their desk location is, and
an issue for each. This last item is very important. You must insist that
they think of an issue for each: children, commute, day care, etc. After
this exercise is successfully completed, schedule another test at the
hot site again with select supervisors on some pre-planned Saturday.
Good luck!
About the Author
Ted Brown, CBCP, President & CEO of KETCHConsulting,
Inc. with 36 years in IT/15 years in BCP is a leading proponent of business
continuity. In 2002, Ted was elected, with Rudy Giuliana, to the CPM Hall
of Fame, which recognizes leading contributors to BCP. For more information,
contact the author at tedbrown@ketchconsulting.com
or visit ketchconsulting.com
or call (888) KETCHYC.
|
