DISASTER RECOVERY 
JOURNAL

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276 
Fax: (314) 894-7474
Internet www.drj.com 
E-mail drj@drj.com

PUBLISHER
Richard L. Arnold, CBCP
richard@drj.com

EDITOR-IN-CHIEF
Jon Seals
jon@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

COPY EDITORS
Richard Sandhofer
richards@drj.com
Pamela Clifton
pamelaclifton@hotmail.com

ADVERTISING 
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President 
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

EXECUTIVE COUNCIL
Jeff Dato, MBCP, KPMG
John Jackson, J Albright Advisors
Edward Devlin, E.S. Devlin & Associates
James Hammill, CBCP, JMH Consulting
Pat McAnally, SunGard Availability
Brian Turley, Strohl Systems
Belinda Wilson, Hewlett-Packard


INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity 
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Click Here for a Printable Version

Business Continuity and the Avian Flu

By JAMES MYERS

Consider this scenario. At least one-third of your employees have called in sick over the past two weeks. Another 15 percent of your employees cannot return to work due to caring for other sick family members, closure of schools, or closure of daycare facilities. Outside the workplace, key vendors, suppliers, shareholders and investors are feeling the same affect. The first wave of the Avian flu is here, and the government cannot give you a specific time table when your affected employees can return to work. Is your enterprise prepared to manage this type of business interruption event?

Avian Flu (H5N1)
Flu pandemics are like hurricanes, earthquakes, and tornadoes – they will happen. There have been 10 known flu pandemics over the past 300 years. There are several multi-billion dollar questions to be answered. When will the next pandemic occur, and how long will it last? Will it be the Avian flu? What magnitude of the population will be affected, and what is the predicted mortality rate?
The last flu pandemic in recent history was the Spanish Flu (H1N1) of 1918. Think of the Avian flu as the “kissing cousin” to the Spanish flu. A major difference is the lethality of H5N1 – meaning if a human contracts the virus, there is a 55 percent chance of death. The Avian flu is the most powerful influenza virus seen in modern human history. The good news to date is the virus has been contained only to birds and has not yet mutated itself for transfer between humans.
So far, those who have contracted the virus and died worked daily in close proximity to infected poultry. However, the Avian flu virus is following the same path of mutation as seen in the Spanish flu strain of 1918. It’s just a matter of time until the virus either mutates itself enough to support human-to-human transmission, or recombines its DNA with a human flu virus, enabling it to pass easily from person to person. Will the virus be as strong and lethal with a human-to-human transfer as it is within existing birds? No one really knows.

Just-in-Time Resources – The Achilles Heel
The only known anti-viral drug today is Tamiflu. But Tamiflu is in very short supply and is manufactured from a single source. To believe there will be a new vaccine on the market to effectively mitigate and control the Avian flu virus within the U.S. could be the death of American businesses. Every business must take a global view when planning and preparing for a flu outbreak.
The mindset that “it doesn’t happen here” no longer applies as with tornado or hurricane specific geographics. The global “just-in-time” economy we live in today will see the rest of the world shut down. Approximately 80 percent of all drugs used in this country – as well as the raw materials – come from offshore. If the rest of the world experiences a pandemic, the U.S. business economy will be brought to its knees.
Consider this example: Right after hurricane Katrina, the Federal Emergency Management Agency (FEMA) put out a call to anyone who had a refrigerated truck that could be placed in strategic locations to help with storage of as many as 10,000 bodies. A contingent of refrigerated trucks answered the call, and within 72 hours all major food manufacturers throughout the country reported a significant inability to ship their goods.
Remember, without trains, planes, and trucks you can forget about receiving any type of goods, supplies, or services. Our economy runs on a highly vulnerable just-in-time business model across all key verticals. The Avian flu virus will not discriminate and will have a definitive negative affect on the economy as a whole. According to a congressional budget office report, a widespread outbreak in the U.S. could kill as many as 2 million persons and cost the economy $675 billion annually and trim economic growth by 5 percent.

Invest in Business Continuity
First and foremost, business owners and their management teams (regardless of vertical industry) must understand that with the new global economy, the enterprise cannot survive without a formalized business continuity plan. A “formalized” plan means that business continuity has become part of the every day operating environment throughout the enterprise. Every business should have a capital budget set aside annually to ensure the ongoing viability of systems, functions, and business processes. Backing up enterprise data, replication of critical databases and investing in offsite storage is considered a starting point when building an enterprise wide business continuity plan. At a minimum, all enterprises should be backing up their most critical data to an off-site location. However, if data becomes unavailable due to inadequate business recovery processes and/or lack of planning, then money spent is money wasted.
Business continuity planning is an ongoing “work of action” and requires executives to become actively involved in planning and implementation. The goal for the business continuity team is to build an action plan that is practical for managing business interruption events. Moreover, the key is flexibility, as no two operating environments are the same and there are no pre-defined answers, only diminishing budgets. If you aren’t prepared to do more with less, then do so at your own inevitable failure. From an Avian flu and business continuity perspective, there are four key phases to preparedness.
Phase One: Animal-to-animal spread. This activity should trigger the collection of business information and the formation of a business continuity plan. Creation of a business continuity budget is required. This phase of the Avian flu is already under way and is spreading on a global basis.
Phase Two: Human-to-human spread. Assuming this is isolated to small defined areas, this phase should trigger intense technology provisioning and business continuity exercises. Inter-human transfer has not yet occurred. Scientists are now saying when, not if. At this phase, validation of information availability and communications is paramount.
Phase Three: Human-to-human spread across a large geographic area or demographic. Assumes the virus has successfully mutated accordingly. This phase should trigger the enterprises operating architecture to move from a physically connected to a virtually connected environment. Immediate remote connectivity for a pre-defined list of employees is required to ensure physical isolation yet virtual connection. Business continuity exercises and disaster recovery testing are required prior to initiating phase three activity.
Phase Four: An Avian flu pandemic. This environment pushes the business into a significantly scaled back operation. Most experts believe that approximately 30 percent of the enterprises workforce will be out sick or unable to work at any given time. However, in a worse case scenario, assume only 20 percent of employees will be connected and communicating at a level required to maintain business operations. Network capacity assumptions will be severely tested as Internet traffic increases without boundaries. Operating time in this environment could be weeks.
Throughout the four phases, one must expect other significant strains on the U.S. infrastructure. Healthcare facilities will become over burdened, emergency management at all levels will be working around the clock, telecommunication systems will see a significant increase in traffic, and people may feel panicked and stock up on food. If panic buying persists within any geographic area, then expect a shortage in consumables.
With the infusion of new technologies, the massive influx of storage capabilities from the desktop to the data center, and a plethora of unforeseen business interruption capabilities, business continuity planning should be taking a front seat in the boardroom. U.S. businesses are tied into a global economy that runs on a set of baseline assumptions more than ever before. Couple this with the annual movement of hundreds of millions of people across national borders, enterprise-wide risk management has become a strategic and tactical work effort.
The time is now for every business or enterprise to be operating with a formalized business continuity plan.

Is Your DR Plan Ready?

First and foremost, technologists and technology managers must assume that at least 40 percent of their workforce will be unavailable for between six to eight weeks. Couple this with a shortage of vendor resources that are leveraged during HW and SW upgrades, system changeouts, and infrastructure moves, you have an operating environment filled with vulnerabilities. To effectively manage system downtime and decrease financial exposure, the primary technology department within the enterprise must have a disaster recovery plan (DRP) that supports ongoing operations during and after an Avian flu pandemic. The DR strategy should plan for a worst-case scenario while preparing with training and exercises that minimize system downtime and ultimately decreases financial loss. Below is a non-inclusive list of action items the primary technology department should prepare and plan for:

©Copyright Systems Support Inc. All rights reserved. Reproduction in whole or in part in any form or medium without the express written permission of System Support Inc. is prohibited.