October 30, 2012
On Monday, Hurricane Sandy slammed into the East Coast of the United States, flooding entire towns in New York and New Jersey, triggering large-scale power outages and killing at least 17 people. The health and safety of individuals is the first and foremost priority, followed by the recovery of critical infrastructure services (power, water, hospital services, transportation etc.). As these services begin to recover, many business and IT leaders are wondering how they will resume normal operations to ensure the long-term financial viability of the company and the livelihoods of their employees and how they will serve their loyal customers.
Most likely, if you have offices that lie in the path of Hurricane Sandy, you are experiencing some sort of business disruption, large or small. The largest enterprises, especially those in financial services, spend an enormous amount of money on business, workforce and IT resiliency strategies. Many of them shifted both business and IT workloads to other corporate locations in advance of the storm, proactively closed offices and directed employees to work from home or a designated alternate site.
If you are small and medium enterprise and, like many of your peers, you didn’t have an alternate workforce site, robust work-from-home employee capabilities, an automated notification system or a recovery data center, what do you do now? While it’s too late to implement many measures to improve resiliency, there are several things you can do now to help your organization return to normal operations ASAP. Here are Forrester’s top recommendations for senior business technology leaders:
1. Bring your crisis team together. If you haven’t determined the participants in your crisis team, you should include the senior-most executives across the business, HR, Legal, Technology and Facilities. Ideally, the crisis team would meet in a physical location — the crisis command center — but if necessary, you can leverage video and collaboration tools. During the crisis, the crisis team should be in constant communication to monitor events as they transpire and to make rapid decisions for the company.
2. Ensure that you are in constant communication with FEMA or state-level emergency management. This is important because you need to understand how long your area will be affected by the aftermath of the storm. For example, you’ll want to know when flood waters are likely to recede, when local government officials and utilities will resume critical infrastructure services and when it’s safe for you and your employees to return to your corporate location. The answers to these questions will also determine if you need to plan for a long-term shifting of business and IT workloads out of region for an extended period of time.
3. Determine the health, safety and location of employees. If you don’t have an automated communication system in place (i.e., MIR3, Send Word Now, Everbridge etc.), use a manual call tree starting with your senior-most executives to determine the location of direct reports. Engage HR to lead this process and use multiple modes of communication (email, mobile phones, SMS text, Twitter, Facebook). Modes of communication like SMS text and social media can be more effective in these situations because they require less bandwidth and can be accessed from multiple devices (e.g., smartphones). You should:
o Tailor the message for the audience (e.g., managers, individual contributors etc.) and the mode of communication (you can only send so much info via text or Twitter). Include useful information such as how to find more information, whom to contact with follow-up questions, when they can expect to return to work and where should they report for work. Make sure to ask them to update their location and contact information.
o Communicate often! You should communicate throughout the event, and you can't overcommunicate.
o Remember that employees must put their own safety and the safety of their families first so be sensitive to their needs. In addition, it's important to recognize that employees handle stress differently and under extended periods of stress, people can make poor decisions. Be sure to monitor stress levels and give employees time to sleep, eat and relax — don't work them around the clock during the crisis.
4. Set up impromptu collaboration sites using social media. If your existing enterprise collaboration platforms are unavailable (or difficult to access for remote employees), consider leveraging collaboration platforms such as Dropbox, Box, Google Drive, or even private Facebook groups that can be very quickly set up and are easily accessible to a wide range of employees on many different devices. This will allow some semblance of normal work and ongoing communication and collaboration to continue during the crisis. During the Japanese tsunami, a global services company told Forrester that it used private Facebook groups to keep in touch with employees in the days after the earthquake.
5. Consider moving specific business operations or functions to a location outside of affected area. If you determine the workplace will be inaccessible for a significant period of time, assess which of your critical business operations are good candidates to relocate. Because this is an expensive and disruptive proposition (especially to employees who might already be displaced from their homes), it should only be considered if the office will be impacted for a week or more. You will most likely want to use an alternate corporate location such as a branch or remote office, but organizations have also used hotel and other meeting facilities to quickly set up work areas. Disaster recovery service providers, depending on the availability of facilities and equipment, could possibly accommodate emergency requests for facilities at one of their sites or using mobile recovery units.
6. Determine if you can source temporary employees from a staffing agency. If you have to move business operations, it’s not always possible that all your employees can migrate to the new location. Many will want to stay to take care of family, friends, pets and their personal property. In the short term, you may need to hire temporary staff to fill in, especially for positions such as call centers.
7. Determine if there is a partner that can help with supplies and staff. During the Japanese tsunami, companies like Toyota and Nissan sent their employees to not only their own damaged factories but also to their suppliers' factories for recovery. Depending on the nature of your business, there could be a partner in your supply chain that can help or even a like company from a region outside of your own.
8. If you don’t have an alternate computing site and your data center is in an affected area, it’s a priority to reinforce the site or find an alternate site immediately. Most data centers do have backup generators, but usually only keep enough fuel onsite to run the facility for a few days. Determine how many days of backup power, diesel fuel, water etc. you have on hand and what your plan is for when/if you run out. Organizations that have not pre-arranged for emergency fuel deliveries will struggle to attain the supplies they need, as many large enterprises typically make these arrangements ahead of time and first responders and critical infrastructure providers (e.g., hospitals) will take priority for fuel. If absolutely necessary, begin making plans for standing up a new data center in an alternate location.
o If you are in a colocation or hosting site and your equipment was damaged or the site is down, many providers can help you migrate to another one of their facilities or lease equipment to you.
o It’s also possible to reach out to major IT suppliers for the quick ship of IT equipment to another office location out of region. However, this will likely take days to weeks and will only be possible for standard x86 infrastructure and other popular computing platforms
9. Remember, you must protect your sensitive data — no matter what the circumstances. If you’ve evacuated your corporate location, it’s critical that, when it’s safe, you return to secure paper records and IT assets that contain personally identifiable information for employees and customers and other highly regulated information. Failure to protect this sensitive information can lead to fines and damage your reputation. You also want to ensure that your intellectual property (trade secrets, designs, code, formulas etc.) is locked down securely. If this information falls into the wrong hands, it can lead to erosion of long-term competitive advantage, not just regulatory fines and impact to your corporate reputation.
10. Tell your customers how you are responding. No one expects you to be able to resume operations overnight, but customers both inside and outside your organization (as well as other stakeholders) do want to know how you are responding to the crisis, that you are doing everything in your power to recover and when they can expect a resumption of services. Like communication with your employees, communicating with customers often across multiple modes of communications and channels with appropriately tailored messages (written by someone not in IT) is critical. Make sure to partner with counterparts in marketing and customer service to develop the customer communication strategy.
11. Prepare for long-term duration of the event. A storm the size of Sandy will have a lasting impact on the region. You should not assume that critical infrastructure services like power, water and transportation will return without interruption. You should prepare for intermittent power and supply shortages for the foreseeable future. This means that if and when you return to your corporate locations, you should ensure that you conserve power, have backup power in case you need it and have food, water and other supplies available for your critical staff. This may also mean that you have to run at your alternate sites for an extended period of time before you can recover to your main locations.
We hope these tips will be helpful for those of you impacted by Hurricane Sandy. We encourage you to share any additional best practices you’ve learned or seen over the past few days!