Founded in 1833 in New York City, McKesson has a long history – over 178 years in healthcare as a trusted provider of medical goods and supplies. According to CNN Money, a full one-third of all medicines used in the U.S. run through its pipeline. Today McKesson is headquartered in San Francisco with a variety of customers including:
- 200,000 physicians
- 26,000 retail pharmacies
- 10,000 long-term care sites
- 5,000 hospitals
- 2,000 medical-surgical manufacturers
- 750 homecare agencies
- 600 health care payers
- 450 pharmaceutical manufacturers
With these responsibilities, McKesson's investment in business continuity becomes paramount.
But how can McKesson and other large enterprises manage increasing levels of complexity, provide better management visibility and ensure that the impact to business due to adverse incidents is adequately managed for risk?
Complexity - Information Technology
Today, Information Technology (IT) is tightly integrated into the daily operations of the business. Some would argue it is the business. With this critical dependence, IT must to be protected against failure in order to keep the business running and allowing McKesson to continue providing its services to those that depend on it.
There are complexities of managing DR recovery of an environment in which:
- workers are geographically disparate
- systems are interconnected and
- utilize several technology platforms
If ignored, lives are endangered, employment is jeopardized, and the very existence of the company can come into question.
Evolution of Recovery Exercises
The management of the recovery exercise process has evolved from tracking paper forms and logs to recover systems, to the use of spreadsheets and other manual tools assembled from the modern office enviornment. Some purpose-built, industrial strength tools have emerged, but for those still evolving from spreadsheets, the learning curve for those proprietary systems and the cost for implementation can be steep. The most popular evolution has been the adoption of collaborative tools in the enterprise such as SharePoint, and adapting for special purpose DR tracking.
SharePoint as a Collaboration Platform
It is now estimated by Microsoft that SharePoint has over an 80% market share within the enterprise as an enterprise collaboration platform.
The use of SharePoint as a platform has reached a critical mass with most IT teams standardizing on it, and end-users adopting due to the user-friendly interface requiring minimal re-training.
In addition, SharePoint offers the combined benefits of project management software, spreadsheet flexibility, security, dashboard creation and ease of use and implementation.
Combined with content and document management, this became a natural fit at McKesson in the management of business recovery.
Searching for the Right Solution
As McKesson searched for a tool to manage exercises and actual recoveries, many tools were reviewed, which proved too robust for the needs of the IT organization. And upon further discussions with other Business Continuity professionals, their use of SharePoint as a tool that meets their needs came to the fore.
Improving RTO with SharePoint-based tools
McKesson was able to create specific templates for exercises in SharePoint with WinWire's Recovery Manager tool. In addition, teams, locations of DR sites, roles, and tasks were defined to complete a successful exercise.
By creating templates for exercises in SharePoint and using these at time of disaster, McKesson is able to monitor recovery time objectives in a measured manner with every test.
In addition, McKesson was able to delegate the individual tasks to various operating teams freeing up valuable time and eliminating effort on the DR team, which could now be leveraged for more strategic activities than status tracking.
SharePoint's use of Active Directory enabled McKesson to secure the right pages based on role permissions. Management teams automatically got the highest rolled-up view, whereas the operating teams were able to zero-in on their immediate updates of their assigned tasks.
Operational Improvement and Efficiency
A typical full scale exercise used to consist of an open teleconference line for over 72 hours with teams reporting status and handoffs periodically into a Live Meeting enabled war room. The DR team in the war room collected, aggregated and disseminated the content to management teams as snapshots via LiveMeeting.
With the SharePoint tool, the biggest impact was the ability for teams to automatically get the most updated status post login, tailored to their role. In addition, management reporting became more streamlined with better visibility into exercise status during the events, not just after the fact.
Practice, practice, practice
The weakest link in any DR plan is the ability to practice frequently and consistently demonstrate improvement in both Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
With diligent planning, semi-annual exercises, and the use of the right tools to facilitate the recovery of complex interdependencies, McKesson implements and maintains processes and solutions designed to protect its people and workplaces. This also ensures continuity of critical business processes from natural disasters, operational incidents, accidents and human-caused threats. The solutions developed and implemented by the Service Continuity Office (SCO) can thus ensure McKesson can provide customers with consistently reliable services, even after an unplanned technology interruption.