The post first appeared on the MHA Consulting website.
By RICHARD LONG
Many observers think the COVID-19 pandemic might result in a more or less permanent shift toward a large number of office employees working from home. In today’s post, we’ll look at what business continuity staff would need to do to adapt to alternate workplaces.
No one has a crystal ball to tell them exactly how the coronavirus pandemic will unfold and what the impact on the workplace will be, long term.
There is at least a strong possibility that many of the people now working remotely will continue doing so even after the current crisis has tapered off.
If that happens, it will require significant adjustments by business continuity offices.
We’re talking about long term, permanent adjustments, as opposed to the improvised responses people have been making to contend with the pandemic.
If Home Becomes the New Permanent Workplace
At the moment, we’re still thinking about people’s homes as the alternate work location. What happens if employees’ homes—or wherever they choose to open their laptops and put on their headsets—become their permanent work location?
Business continuity management (BCM) offices will have a lot to do and think about in adapting to the new reality.
Two areas for BC professionals to consider and update are threat and risk assessments and business continuity planning.
We’ll look at both of these areas in detail below.
Updating the Threat and Risk Assessment
If working remotely becomes the new normal for a significant proportion of the workforce, organizations will find themselves confronting a new landscape of threats and risks for their organization.
These risks aren’t necessarily prohibitively high. But they will include many new twists and wrinkles that few organizations have previously thought about or factored into their continuity plans.
Organizations will have to update their threat and risk assessments (TRAs) to reflect the new reality.
Specifically, they will have to consider the new risks of disruption to the organization’s activities that may come from alternate workplaces over the following five areas:
1. Location
TRAs for office-centered businesses almost always look closely at threats to the physical location. In the new world, that same business might have hundreds or thousands of locations, namely the home of each employee who is working remotely. There might be more locations than that, since nothing says the employees have to work remotely from home. They might be at coffee shops, hotels, vacation homes, or friends’ homes. What sort of threats and risks does this pose to the organization? Consider such issues as the reliability of network connectivity, power supply, and cell phone connectivity, as well as natural events and the possibility of civil unrest.
2. Data security
We’ve mentioned this in previous blogs but it’s something that can’t be emphasized enough. What are the risks to the organization’s sensitive data in having employees work remotely? Consider requiring the use of a VPN at all times.
3. Communication
When work requires the use of collaboration tools such as Zoom, RingCentral, Citrix, or WebEx, problems with those tools can cause significant disruptions. The proliferation of dispersed, remote workplaces increases the chances of such problems occurring. Is there a risk that firewalls or other settings on computers and Wi-Fi networks used for remote work might impede the use of essential communications tools? Your TRA needs to reflect this possibility.
4. Technology
At the corporate office, technology typically enjoys multiple levels of backup and support, from redundant power supplies to onsite support staff. When many people are working remotely on a permanent basis, the level of such support is liable to vary widely and typically to be less. How will that affect the organization in terms of threats and risks? What if someone’s work laptop needs to be shipped somewhere for service? They might be without a computer for a number of days. How will hardware be replaced and updated? Does that pose new risks to the organization? Finally, what risks would the new arrangement present in terms of network security? See this recent blog for help in thinking through this issue.
5. Human issues
The last of the major categories to think about in updating your TRAs would be those relating to the workers themselves. Could the shift to remote management create new risks in terms of reduced guidance and oversight by management? Is there a greater risk employees might commit errors? Is there an increased likelihood of disgruntled employees perpetrating acts of sabotage? You should consider all these possibilities if you end up updating your TRA to adapt to a new work-from-home reality.
It goes without saying that, once you update your TRA, everything that is based on it would also need to be adjusted.
This leads us to the second area where major changes would be required if your organization shifts in a significant way toward having a permanent remote workforce.
Updating Your BCM Planning and Process
The second area where alternate workplaces would require changes is in your business continuity planning and process. Specifically, you should look at the following five areas:
1. Emergency communications
You will probably need to refine and update the methods used to communicate with staff during an emergency. People working remotely are more likely to tune out or turn off their email, chat, etc. You might need to have more options than just email, messaging apps or text to get in touch with people. Consider revising the expectations for staff in terms of communication methods and availability.
2. Personal technology resiliency
Consider providing specific regional guidance and strategies for people working at alternative workplaces. It might be advisable to require redundancies in terms of power, cell phone connectivity, and the like. Issues regarding the cost and reimbursement for these backups might need to be sorted out with HR.
3. New alternate workplace strategy
If home is the new permanent workplace, people will need new alternate workplaces that are not home. This could require having an office for use as an alternate. It might also be advisable to identify alternate internet-access locations. Consider what you would do if a regional event makes peoples’ homes and your alternate site unusable. In such a situation, the coffee shops and hotel lobbies in the area are likely to be inundated.
4. Accommodating a hybrid workforce
BC plans would likely need to be adjusted in multiple ways to accommodate the needs of a workforce that is part centralized and part remote. The following are some of the issues that might need to be considered in this new hybrid world:
- What will happen if events require that remote staff access facilities or technology in the central location?
- Are your remote employees logging in to desktop computers physically located in an office somewhere? This is not workable as a permanent solution since it makes their ability to work dependent on the fate of that facility.
- Do your plans incorporate workarounds that are not viable when a significant portion of the workforce is not at the central facility? If so, you’ll need to change them.
- Will your planned alternatives for interacting with your customers still function when your staff is working is remotely? If not, you will have to make adjustments.
5. Emergency response and crisis management
The last areas where a shift toward a remote workforce would require updates to BC plans are your emergency response and crisis management plans. Do your plans cover what should be done if an employee experiences an accident or illness while working in a remote location? Who is responsible in such a case? Does your emergency plan include specific training for individuals who are alone during working hours? Finally, your emergency and CM plans might need to set forth how people should handle being on multiple meetings at the same time using different technologies (via conference calls, web meetings, and multiple devices, etc.).
An Ongoing Need to Adapt
No one knows exactly what the future holds in terms of the COVID-19 pandemic and the permanent remote workforce. It seems safe to say that we will see a significant movement toward such a workforce at least over the near- and medium-term future.
If a shift toward alternate workplaces takes place at your organization, you would be well-advised to update both your threat and risk assessment (and everything based on it) and your BCM plans to reflect the new reality. The considerations laid out above are not exhaustive, but they should provide you with a leg up if and when you need to update your plans. At this point, all anyone can say for sure is, we are facing an ongoing need for continual reassessment and adjustment.
Further Reading
For more information on alternate workplaces, adapting to the pandemic, and other hot topics in business continuity and IT/disaster recovery, check out the following recent posts from MHA Consulting and BCMMETRICS:
- Working Remotely over the Long Haul: Living with COVID-19 as a Business
- Telephone Train Wreck: Crisis Call Chaos in the Time of COVID-19
- When the Quarantine Ends: How to Be Ready to Reopen Your Company
- Learning from COVID-19: 7 Lessons for Business from the Pandemic
- Sidelined: The Strange Fate of BCM During the COVID Pandemic
- Weighing the Danger: The Continuing Value of the Threat and Risk Assessment
- Emerging from the Lockdown: 6 Things to Think About for the Next Phase
Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements.
