Businesses: Prep now to avoid H1N1 flu outages later

Don't be fooled by the mild flu season so far. Even a contained swine flu outbreak could disable IT departments

Last spring, when the first cases of H1N1 flu appeared, Gartner Inc. was getting lots of calls from alarmed clients wanting to know if and how they should adjust their disaster recovery plans.

Now? Not so much. "It's a very, very silent period right now," says Ken McGee, Gartner vice president and research fellow, who attributes the tepid reaction in the business community to the mild effects of the flu to date. Although there have been deaths, so far most people are simply ill for a few days and then back at work, he points out.

"Despite the fact that it's the first pandemic of the information age, it hasn't compelled people to the kinds of readiness activities we would've expected," says McGee.

That's a mistake, business continuity experts say.

As of late October, the swine flu was widespread in 46 states, according to the Centers for Disease Control and Prevention, and on Oct. 23, President Obama declared the H1N1 outbreak a national emergency.

Meanwhile, production and distribution of the H1N1 vaccine has fallen behind schedule, even as public debate has increased over its safety and necessity -- meaning, potentially, fewer vaccinated people and more live cases. The CDC has warned that the pandemic could produce absentee rates as high as 40% at schools and places of business.

Further, there's no telling whether or when the pandemic will worsen. Unlike a one-time disaster, flu pandemics are protracted and tend to come in waves, says Scott McPherson, CIO of the Florida House of Representatives and a Computerworld blogger, who is on a crusade to push organizations to better prepare for the pandemic. For example, the H2N2 pandemic hit in 1957, then returned in 1959 and in 1962, he notes.

Business continuity plans typically deal with disasters that bring down infrastructure, but most don't take into account an illness that can bring down 40% of your workforce, even if only temporarily. This past spring, a joint survey conducted by Forrester Research Inc. and Disaster Recovery Journal found that 32% of companies polled had business continuity plans that did not include a workforce recovery component.

The 68% that did have such a plan indicated that they were adopting a range of strategies to ensure coverage:

Workforce Continuity Strategies

(multiple responses allowed)

Provision employees with remote access technologies: 86%

Use another internal site as an alternative site for work: 72%

Arrange for mobile recovery units: 26%

Subscribe to shared seats at a business continuity/disaster recovery service-provider site: 22%

Subscribe to dedicated seats at a service provider site: 17%

None of the above: 3%

Source: Forrester Research/Disaster Recovery Journal survey of 259 business continuity decision-makers and influencers

Is your IT department prepared for significant staff outages? Read on for some advice from business continuity experts on what adjustments your company should be making to weather the flu season.

Boost your department's "Flu IQ"

First and foremost, companies should educate their employees about the flu. IT managers should coordinate with human resources or the executive team to make sure employees know how to prevent the spread of the virus and how to recognize the symptoms of the illness, and to determine the conditions under which employees should not come to work.

For example, a company may specify that anyone with two flu symptoms -- fever and muscle aches -- should stay home, says McGee. The company also should clearly spell out its policy on staying home to recover from the flu or to care for sick loved ones.

Most important, says McGee, the organization should demonstrate that it is as concerned about the health and safety of its employees and their families as it is about business continuity. "There's no way in the world you're going to get IT employees, or any employees, to address the needs of business before they address the needs of their families," says McGee.

Inside the IT department, mandate that employees wipe down all hard surfaces with antibacterial cloths every day. Data centers, in particular, can be breeding grounds for the flu because the air is recirculated and typically colder than normal, which can aggravate nasal passages and make them more susceptible to the flu, says Kevin Burton, CEO of Burton Asset Management, which specializes in disaster recovery and business continuity. "You're more likely to get sick from an airborne illness in a raised-floor environment like a data center or in an airplane than you are sitting in a cube farm or in a Starbucks," he says.

Clarify goals with top management

The most critical step in developing a detailed IT pandemic plan is to get guidance from the top. "The biggest mistake clients make is they assume they have to put together this complex response plan before even discussing things with management," says McGee.

Ask the CEO and the board what they want to do if there is a serious outbreak. First, at what rate of absenteeism should any pandemic response plan go into effect? Would parts of the company be shut down? How many people, and which ones, would need to be outfitted to work from home? Without answers to such basic questions, IT could spend a lot of time and money setting up remote access capabilities for hundreds of people, for example, when only 50 were needed.

Identify critical skills

In disaster recovery, it's common to identify systems that are critical to business operations, notes Burton. But the people who are critical to those operations are often overlooked. For that reason, a skills assessment is a key next step in any pandemic plan.

"Once you've identified the critical applications that support the business functions, you have to drill down further and say, 'So who supports those? Do you have only a few people with these skills? Or do you have multiple people who can do this?' " says Barry Cardoza, vice president and manager of business continuity for Union Bank NA in San Francisco.

For example, you may have only a handful of overnight tape-backup operators companywide. It's a relatively low-level job that's often not on management's radar, yet it's a vital function, says Burton. If all your tape operators are home sick, the organization might go a couple of weeks without a backup.

McPherson recommends that companies cross-train employees. Build a matrix of critical skills and train at least three people in each skill or task, he suggests. "So if both Jim and Joe on the server team are ill with flu, then Susan can step in and reconfigure a server or add some users to the network," says McPherson.

Just make sure all three aren't in the same department or physical location, notes Cardoza. Because it's so highly contagious, the flu is likely to sicken clusters of employees in specific geographic locations or departments. If your experts are centralized in a single location, they could all wind up ill at the same time.

"That's the kind of thing that really concerns me," Cardoza says. "If there is a cluster, do we have people outside of that cluster who can support the IT infrastructure?"

Prepare for telework

Burton recommends that you move critical people out of crowded buildings as a precaution, setting them up to work from home even before an outbreak occurs. And the "worried well" aren't the only ones who will need to work from home: Schools are considered the biggest breeding grounds for the flu, which means there's a strong chance that employees who are parents or guardians will ask to work from home while they care for sick kids or cope with school closures.

That's why IT needs to beef up its systems to handle a potentially massive increase in telework. Part of your skills assessment should include a determination of which jobs can be performed remotely and which cannot, says McPherson. For those that can't, you should take care to ensure that other employees have been cross-trained to fulfill those job requirements in case of illness.

For those jobs that can be performed remotely, do you know how many of those employees have computers and adequate broadband at their homes? Poll your workers to see what technology they have available. Are you able to loan them laptops to take home? Pay for broadband connections?

Will the home workers need Microsoft Office and other applications, and, if so, do your site licenses permit that arrangement? Are people trained to access the corporate network remotely? Is the corporate network capable of handling the increase in connections and traffic? Also, are corporate applications "webified," meaning are they easy to access and use over the Web?

Have your say

Has H1N1 hit your organization yet? How are you coping?

In short, consider the situation from the perspective of an employee new to telework. "Imagine an employee connecting from home, having to get through remote takeover of a computer or virtual desktop to be able to get to Attachmate in order to get to the mainframe, so they can do their work," McPherson explains. "That could be problematic.

"Ideally, all these steps should've been done three years ago, when bird flu first popped up," McPherson continues. If that never happened, he says, the most that companies can do now is evaluate their current capabilities, determine which jobs are appropriate for telework and find out which employees have broadband and a computer at home.

Check in with your DR outsourcers

If you've contracted with a third party for disaster recovery, take a close look at that contract. In many cases, the contract includes the facility and the equipment, but not the professionals who perform the work.

If the flu is causing many clients to turn to outsourced facilities, these providers will be under tremendous stress, says Burton. "If these third-party disaster recovery services can even staff up, under a pandemic situation the per-hour fee for subject-matter experts is going to be exorbitant," he says. According to the scarcity dynamics forecast by his firm, an e-mail administrator could cost $850 an hour, if one can be found at all, he maintains.

Many disaster recovery firms are busily signing contracts now with staffing agencies that have skill sets in areas where they have recovery sites. "We are aware of two firms that are actively putting locks, with guaranteed pay rates, on key platform expertise to make sure they can handle the professional services requirement that will occur during [flu] declarations," says Burton.

Also make sure you know where key information -- such as passwords and license keys -- are kept, in case your CIO or whoever is your keeper of this information becomes ill. This is a common oversight, says Burton. "I'll ask them to open up the e-mail recovery section of their disaster recovery plan and show me their Exchange license key and admin password. Ninety percent of our customers fail that test," he says.

Monitor the flu's progression

Have an early warning system for flu outbreaks. In addition to monitoring information from the CDC, pay close attention to the local news in areas where your company has a presence. Did the local high school just send 100 students home with the flu? If flu cases are rising rapidly in a given area, work with HR to increase the precautions at that facility and make sure the other steps outlined above have been put in place.

Take care of employees post-flu

Finally, pay special attention when employees return to work, says Burton. Workers may be physically weak or emotionally stressed. In addition to being sick herself, an employee may have been caring for sick family members as well. Or perhaps he's under economic pressure because he or another household breadwinner lost income or incurred expenses because of the flu. If the pandemic becomes particularly virulent, an employee may even experience the death of a friend or family member.

Burton suggests having a 10-minute intake interview to catch up with returning employees and to remind them of benefits like employee assistance programs. "If not handled carefully, the aftereffects of the flu on employees could be substantial. It will require a degree of vigilance to keep the upset these events might cause from spilling over into the workplace," he says.

Frequent Computerworld contributor Tam Harbert is a Washington, D.C.-based writer specializing in technology, business and public policy. She can be contacted through her Web site,

This story, "Businesses: Prep now to avoid H1N1 flu outages later" was originally published by Computerworld.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2009 IDG Communications, Inc.