| How ICT continuity planning can improve your | | | | specialised skills that are performed by suppliers |
| resilience | | | | or outsourcing partners and seek to ascertain just |
| The potential for large scale absenteeism resulting | | | | how resilient these suppliers are in the face of a |
| from the so-called 'swine' flu pandemic has led | | | | major disruption to their operation. They should |
| many businesses to carry out extensive | | | | also be aware of that too often just one |
| pandemic planning to ensure that customer facing | | | | member of the ICT department is the key |
| and revenue generating services can be | | | | 'knowledge holder' or expert on a particular |
| maintained with reduced staff numbers. However, | | | | application, system or service. How much does |
| equally important to maintaining almost every | | | | the ICT department and the organisation rely |
| organisation's core business processes are the | | | | upon the skills and knowledge of just one person? |
| ICT services which underpin them. Yet, it is easy | | | | When evaluating ICT continuity, companies must |
| to forget that ICT services are dependent on the | | | | also consider how the loss of a particular individual |
| human touch to keep operating at the desired | | | | within their ICT team will affect the ongoing |
| levels. | | | | performance of their ICT services should an |
| It is imperative, when planning for staff absence, | | | | incident occur, and how critical they are in terms |
| that an organisation factors in the level of human | | | | of delivering front-line services. |
| interaction required to operate and maintain its | | | | Common hands-on ICT activities |
| ICT services. This article examines common | | | | Regardless of the organisation's size or the nature |
| interactive tasks such as day to day operations, | | | | of its business there will be several common |
| backup and recovery processing and break/fix | | | | activities that they all perform and that require a |
| activities, and the impact that a reduction in staff | | | | degree of hands-on activity. Some of these could |
| may have on these. | | | | be performed remotely whilst others will need |
| Back office ICT continuity | | | | access to the ICT facility. |
| The vast majority of organisations have prepared | | | | There is the basic systems monitoring and |
| specific 'flu-related' contingency plans and | | | | operations functions necessary to keep the |
| arrangements to manage the potential large scale | | | | services running. This is usually done directly at |
| absence of staff and ensure continuity in terms | | | | the ICT facility or via a remote operations bridge. |
| of their critical business processes. Absenteeism | | | | But what about the other functions the |
| may be for a variety of reasons - such as the | | | | operations team may perform? |
| corporate policy of "stay away", a significantly | | | | Continuity of ICT housekeeping and data backups |
| reduced public transport system making travel to | | | | Let's consider housekeeping and more specifically |
| and from work difficult, illness or a need to care | | | | backups. There are two main backup purposes: |
| for children or other sick dependents. | | | | firstly, to recover data from operational errors |
| The primary focus for most companies is to | | | | such as data corruption (however caused) and |
| ensure that customer-facing and | | | | user error; and secondly, for disaster recovery |
| revenue-generating services can be maintained | | | | purposes. Organisations should find out how their |
| despite reduced staff numbers. As a result, | | | | backups are performed and how much |
| pandemic business continuity plans tend to focus | | | | automation is deployed. Let's assume that |
| on two key aspects: firstly, the welfare of staff | | | | backups are written to tape and that operations |
| and secondly, the provision of 'front line' services. | | | | staff need to manually load and unload tapes. If |
| While the continuity of these two components is | | | | they are unable to do this what is the impact to |
| essential, plans often overlook one critical element | | | | the backup processing? |
| in their client-facing activities - the back office | | | | In some companies, the disaster recovery |
| functions that support them. The ICT operation is | | | | backups are shipped to an off-site facility. What |
| an integral part of these activities. It is easy to | | | | would the impact be if the courier service or |
| forget that even the most automated 'hands off' | | | | storage agents were unable to collect the tapes |
| ICT operation requires some degree of human | | | | and transport them on your behalf? Also, what |
| interaction. In truth, many organisations probably | | | | about the tapes that should have been returned |
| underestimate the level of hands on support | | | | to replenish the tape library, how many days |
| required in a solid ICT continuity plan. | | | | worth of 'scratch' tapes are available to allow |
| Keeping the technology running - ICT continuity | | | | backup processing to continue? You should also |
| during a major disruption | | | | ask whether your tape storage company has a |
| It is not uncommon for organisations to have | | | | pandemic plan to ensure their service |
| some degree of remote access capability for | | | | commitments to you are maintained. |
| their ICT systems. If this is the case then it is | | | | ICT maintenance and break/fix arrangements |
| likely that remote working is featured somewhere | | | | Let's now consider the maintenance and break/fix |
| in the company's business continuity plan. | | | | arrangements for the organisation. Whilst it is not |
| In many organisations, however, remote access is | | | | a major issue if maintenance tasks are delayed, |
| implemented to provide a remote working | | | | the same cannot be said for the response to |
| capability for a limited number of staff with only a | | | | break/fix callouts. How resilient are the ICT |
| small percentage of these utilising the service at | | | | services that support the front-line activities? |
| any one time. The subscription rates for remote | | | | Would the service continue, albeit in a reduced |
| access varies from 2:1 to 8:1 depending on which | | | | capacity, if a component failed or would the |
| set of statistics are used. Using the higher value, | | | | service fail? Again, what are the continuity |
| there could be as many as eight subscribers per | | | | arrangements of your break/fix suppliers? |
| available line. Normally, this is not an issue, as most | | | | These are just some of the questions that will |
| users can get access when required. However, all | | | | help identify vulnerabilities during your ICT |
| that changes when large numbers of staff cannot | | | | continuity planning. |
| get to the office, for example, because of | | | | What steps can you take towards effective ICT |
| inclement weather conditions or major transport | | | | continuity planning? |
| disruptions both of which were experienced in the | | | | - It is imperative that you conduct an audit to |
| UK in February 2009. When this situation occurs, | | | | identify all the hands-on ICT activities and establish |
| the remote access service can become severely | | | | how critical they are to the overall ICT service. |
| over subscribed. | | | | Don't ignore any activity; those that seem |
| Avoiding denial of remote access | | | | mundane are often the most critical. |
| Our experience has shown that there is often | | | | - Examine the ICT infrastructure for any key |
| little or no planning when it comes to the most | | | | single points of failure. Consider implementing a |
| productive utilisation of the limited remote access | | | | greater degree of resilience, this will provide two |
| capability. It's basically a 'free for all', with staff | | | | benefits: firstly, it will reduce the likelihood that a |
| vying for connectivity. This is inconvenient for | | | | component failure will cause a service interruption; |
| short periods of disruption, but may have serious | | | | and secondly, it will improve the overall long term |
| repercussions if the large scale displacement of | | | | robustness of the service. |
| staff extends to longer periods of time, especially | | | | - Establish a temporary backup and recovery |
| if remote working is a potential response option | | | | strategy. If tapes are at a premium then consider |
| for your organisation. | | | | reducing the number of generations retained. Is it |
| For effective business continuity planning, an | | | | really necessary to keep seven or ten day's |
| organisation must define the criteria for using the | | | | worth of backups or is three days retention |
| remote access capability. The plan should clearly | | | | acceptable in the short term? |
| identify who can have remote access, when they | | | | - Consider creating procedures (and training) |
| can have it and for how long. This will ensure the | | | | non-ICT staff to perform some of the tasks if |
| appropriate people and the functions they | | | | required. The tape management and handling |
| perform are given the necessary priority. | | | | process is a good example, this will at least enable |
| ICT on the front line | | | | backup processing to continue especially for |
| It is a safe assumption that without their ICT | | | | disaster recovery. |
| capabilities, many organisations would at best be | | | | - Liaise with all your suppliers and ensure they |
| inconvenienced or at worst be left unable to | | | | have adequate continuity arrangements in place. |
| provide any front-line services. It is essential | | | | Don't let their lack of resilience create difficulties |
| therefore that companies know exactly what | | | | for you. |
| their key ICT services are and what the 'must | | | | The devil's in the detail |
| have' human interactions are that keep them | | | | I hope this has highlighted the need to consider |
| running. By gaining a clear understanding of just | | | | the human element of ICT service continuity. As |
| how hands-on the ICT operation is, and the | | | | ever, the devil is in the detail, but overlooking this |
| activities involved, this will enable you to factor | | | | operational-level human dependency could |
| these elements into your continuity planning. | | | | exacerbate an already challenging situation as that |
| Organisations must consider not only the tasks | | | | 'key' person goes ill or can't get to work. |
| performed by their own staff but also any | | | | |