• Workforce shortage – A workforce shortage could be caused by an infectious outbreak, a labor strike, or a breakdown in a critical transportation hub. The result is the same – a significant workforce shortage. Most businesses would feel significant effects if about 40 percent of the workforce was absent, but adjust as is appropriate for your company. (Don’t look now, but by planning for a workforce shortage, you’ll also be planning for a pandemic event!)
• Technology unavailable – A major power outage, flooding, cyber attack, or telecom interruption could render your data center or communications infrastructure inoperable. What strategies will you have in place to recover your business from this type of loss?
• Facility unavailable – Fires, earthquakes, hazardous spills, and workplace violence are all examples that could prohibit your employees from entering the worksite. Plan for coping with the relocation of your operations first. This is not to say that your facilities team shouldn’t have strategies to deal with water, fire, etc., but that the bulk of your effort here will be on recovering your business functions.
• Critical vendor failure – Your business may have one or more vendors or business partners that it relies heavily upon for data, materials, or services … a significant event there could severely hinder your company’s production. Does it matter to you what caused it? No, your concern is how rapidly the vendor recovers.

While these four categories have worked for me, this may not be the complete list of all possible significant impacts.
Can you think of a scenario that doesn’t fit one of these categories? If you can, add it!

Forget about all the what-if’s and focus on these four effects. Unfortunately, it doesn’t make the job easier but it does give participants responsible for recovery strategies a place to start. I find people get so mucked up in the possible scenarios that they fail to get anything meaningful accomplished. By focusing on each of the effect categories, participants can hone in on what recovery tasks can be accomplished to address it, regardless of the cause. Only when these are fully fleshed out should event-specific precautions and strategies be addressed, and then only when deemed necessary.

The result is the same. You can expend tremendous energy defining plans for every conceivable disaster that could possibly affect you, or you can plan for the four effect-based scenarios described. Either way, you’ll have a well-conceived, comprehensive set of plans to ensure your business survives a significant event, including a pandemic outbreak. The difference is in how long it will take to get there.

Audry Agle, CISSP, CBCP, MBA, is vice president of information security for the First American Corporation. In her current role she is responsible for assisting in the development and maintenance of the corporation’s information security and business resilience programs.

Comments (0)