Question:
Question 13: (Click here to View this Q&A Series)
We are trying to provide our dedicated DR staff with some sort of incentive. In the event of a disaster, it is common for staff to not show up. Do you have any ideas that will help us diminish this problem?
Answer 1:
Something that must be addressed in a crisis management and business business continuity program is which employees are actually involved and participating during an outage, disaster or disruption. It would be difficult to provide an "incentive" for showing up for work during a disruption. Instead of creating incentives for participation, a company should:
1. Document expectations
about key employees upon acceptance of the position -- work during outages,
potential travel, work beyond normal business hours.
2. List the roles that wil be required during outage -- facilities manager,
disaster recovery coordinator, heads of the crisis response teams, etc.
3. Be specific about the specific roles and responsibilities during the
outage -- where should they report, time, resources, etc.
4. Create a specific policy for over-time pay, travel & expenses,
etc. so that the company eliminates questions regarding those topics at
the time of outage.
5. If the company does have an outage try to do something "after
the event" to show your appreciate for the employee's dedication
to the company.
I hope this helps.
Damian
Damian N. Walch, CISSP, CBCP, CISA
National Practice Executive
IBM Business Resilience and Continuity Services
Answer 2:
Providing
special incentives to participate in a test exercise might actually create
a disincentive over time. Once incentives are introduced, there is an
expectation that the incentives will continue and they should become more
enticing. It is better to have a well coordinated event and demonstrate
that the participants are well taken care of and regarded highly. I've
found that good food is one of the better and more recognized motivators.
Issuing a certificate signed by the executive sponsor at the end of the
exercise helps to acknowledge the participants' contribution.
Fundamentally, there is a bigger problem at hand that management must
address if participants do not show up. You might want to address the
following:
* Clearly
define the roles and responsibilities of the participants. In addition,
identify the objectives and expected outcome that the participants are
responsible for.
* Make sure that you solicit the managers of the participants to staff
the exercise as the recovery plan indicates. This shifts accountability
to the management team and, as a result, makes the participants accountable
to the manager as well as the exercise coordinator.
* Post-exercise reporting should report on the outcome of the objectives
as compared to the exercise plan. The report should be shared with the
participants' managers and the Disaster Recovery program sponsor. Poor
outcomes, especially if related to inadequate staffing, is a management
failure.
* One of the most common problems in recovery planning is ownership. Its
common for the management team to assign responsibility to a Disaster
Recovery Coordinator (DRC) and for the DRC to accept complete responsibility
for failure or success. This is a recipe for failure. The DRC can only
coordinate and apply the resources that the Management team and Executive
Sponsor have committed to. If this hasn't been done, success can be very
elusive.
Submitted by David Ziev
The responses reflect the views of the individual EAB member, and do not necessarily reflect the views of their employers, the DRJ, or the EAB as a whole.