In-Depth

Managing the H1N1 Crisis

For partners, part of swine flu readiness is being able to provide best-in-class advice for customers.

• By Joanna L. Krotz
• October 15, 2009

If you figured last spring's hysteria about the so-called swine flu was just that, and now you're heads down, back to business as usual, here's a reality check.

The H1N1 flu outbreak was officially declared a global pandemic last June. Thankfully, of course, it's not been nearly as deadly as first feared. Even so, according to the World Health Organization (WHO), the virus has now killed nearly 3,500 people worldwide with hundreds of thousands suffering severe cases. WHO continues to assess the threat as "moderate" but that could change in a hurry. Building into a second, more serious wave this fall, swine flu is spreading fast across the United States. As of this posting, the Centers for Disease Control and Prevention (CDC) reported 37 states with widespread infection, with the peak expected late in October -- well before the vaccine is widely available -- and a flu season that extends through January. What's more, younger people appear unusually vulnerable to this strain of influenza. That augurs significant workplace absenteeism at a time when most companies have already cut staff and resources to the bone and many retailers and service firms face their busiest selling season.

Coping with the potential effects of the outbreak is thus categorically different than other kinds of disaster planning. For one thing, said Nick Cavalancia, vice president of Windows Management for ScriptLogic, a Microsoft Gold Certified Partner based in Boca Raton, Fla., "most disaster planning takes account of all the things that are essentially unlikely, like fire or a hurricane or a chemical spill. But the pandemic is not only possible, it's very probable."

Then, "a pandemic event is unlike any technology disaster," pointed out Bill Hughes, director of consulting services at Sungard Availability Services, an IT solutions provider based in Wayne, Pa. "Systems will continue running although there may be a degradation of performance over time as maintenance and infrastructure weaknesses develop owing to a lack of preventive maintenance and on-site support staff."

Perhaps most critically, businesses are woefully unprepared. A nationwide survey of more than 1,000 representative businesses across the United States by the Harvard School of Public Health found that more than eight out of 10 firms (84 percent) were concerned that a widespread H1N1 outbreak would "negatively affect their business." They anticipated "severe operational problems" because of absent workers, which some experts think could spike to a staggering 40 percent. Of course, many employees may not themselves be sick, but may stay home to care for family members or for children whose schools have shut down. Workers also may not show up because commuter travel options are disrupted.

Packaging Your Services: Where To Begin, What To Emphasize
Clearly, heightened anxiety about H1N1 translates into timely risk-and-reward opportunities -- as well as responsibilities -- for IT providers and consultants. Whether or not you've ever broached the subject, it's prime time to set up meetings with customers to talk about possible challenges and how they can protect business operations.

To begin, Mike Emerson, director, IT Security, Governance and Business Continuity at Citrix Systems in Ft. Lauderdale, Fla., suggests that you advise clients that such planning is mostly common sense. "You want a business continuity plan in place that's short and clear. It ought to have specific trigger points that are actionable from a team perspective," Emerson said. "You don't want 300 pages of fluff that no one can remember." And since you can't predict which critical operations or which essential staff will be out of commission or unavailable, focus on "redundancy" and "flexibility." In other words, businesses need to cross-train skills and create several backup scenarios beforehand so if one fails, the other kicks in.

No doubt, in this tough environment, customers will resist the idea of investing dollars, time and talent in what-if scenarios. "Frequently," said Lew Smith, manager of Virtualization Solutions at Interphase Systems, a Microsoft Gold Certified Partner in Plymouth Meeting, Pa., "the initial reaction when an organization is looking to take precautionary steps against the impact of H1N1 is 'how much is this going to cost?'" In response, he emphasizes the price of doing nothing. "What's the cost of losing business and staff in the long run if there's no ability to buffer the impact?" But before recommending any services or products, Smith encourages clients to "re-evaluate systems that they have and to think about utilizing them in different ways."

Likewise, when marketing your services for pandemic preparedness -- or, indeed, for disaster planning generally -- ScriptLogic's Cavalancia suggests that the "Labrador retriever approach is better than the bulldog one. Deliver some upfront value and practical help that will keep customers productive rather than shoving solutions, money and costs down their throats." The idea is to help customers understand what's needed and then to craft scenarios that will shore up support whenever it becomes necessary. For instance, says Cavalancia, you could arrange a plan to lease pre-configured laptops to staff who may or may not need to work from home. Then you can structure your fees around ongoing costs and services rather than a single-solution project.

What It Takes To Put a Plan in Place
There are several critical arenas to investigate in order for businesses to remain up and running during a pandemic outbreak. Of course, each area depends on the other to be effective overall.

Identify key employees and vital functions. "For every key employee, most of what they do is not critical and can be delayed. So you must fine-tune the job and determine exactly what they do that makes them critical," said Michael Miora, a CISSPI-ISSMP certified advisor and president of ContingenZ Corp. in Los Angeles. "Then, plan for how you will work around the loss or inability if one or more key staff can't come to the office." 

Communicate early and often. In contrast to one-time catastrophic events -- say, a tornado or power blackout -- the flu outbreak will likely have rolling and extended impact. Employees may be in and out over several months. Some may become fatally ill. Early communication will reduce anxiety and head off rumors. "The first step is to make sure the company actually has up-to-date contact info for all employees and outside contributors as well as an integrated system and protocols for reaching everyone," advised Vicki Wheaton, employee communications manager at Varolii Corp., an on-demand communications software provider in Seattle.

Work in advance to create guidelines that inform staff about preventive measures to avoid contagion, HR policies for leave or absences, and company expectations for job performance. "Offer ongoing, targeted communications that enable people to know what the situation is, what they need to do, when they need to work from an alternate site, like home, who needs to perform which tasks and how long the situation will persist," said Anyck Turgeon, chief of market strategy and security at Crossroads, a data security provider in Austin, Texas. Remember to include outside team members, such as accountants and contractors, publicists and investors or crucial vendors.

Stay alert to compliance and regulatory needs. For instance, Turgeon said, "multimode communications are critical in case of emergencies, yet privacy standards must be met. So personalized messaging and communications may need to be created." Plus, firms will need to be able to address various constituencies in specific ways -- board members will have different concerns than customers. Businesses also will need redundant channels, including toll-free phone numbers, microsites or intranets, e-mail distribution, call list protocols and the like.

Every shop has different priorities and procedures, but the goal remains straightforward: Keep everyone in the loop and on the right track.

Evaluate and reinforce IT security and remote-work capabilities. Given how numerous, customized, secure and affordable telework and remote-access solutions have become, IT recommendations may be the easiest part of any preparedness plan.

Which solutions you deploy or beef up will obviously be dictated by a customer's remote-work needs, budget and sophistication, whether VPN ports, webcam videoconferencing, VoIP, Microsoft SharePoint, Citrix terminals and its GoToMeeting, Salesforce.com or other virtual or real-time applications or proprietary products. Providers put the average cost to a small business for a preparedness plan anywhere from $5,000 to $20,000, depending on what's in place and what's requested.

Nevertheless, when it comes to advising customers, you'll still need to account for the human factor. Or, as Jim Lippie, put it, "Salespeople are notorious for not adhering to technological best practices."

Lippie's experience with his own company's business continuity plan provides a case in point. As president of Staples Network Services by Thrive, a managed services provider in Lawrence, Mass. launched by the global office products company in 2008, Lippie recently oversaw an office move for the firm's 86 full-time staff.

"This wasn't your average company move," Lippie said. "We're responsible for more than 300 networks and we couldn't afford to be down for a minute." So Lippie used the move as a drill. "We didn't tell our client base about the move until after the fact." Instead, he deployed the company's disaster recovery program, with employees working from home for the better part of four days until office systems were again up and going.

In fact, all systems were seamless and pitch perfect. "No client noticed a thing," Lippie said. So what improvements did the drill suggest? Lippie sounds rueful. "Communications," he said. "We had no technical issues, but people weren't as responsive as they are in the office. We could have done a better job about work-from-home policies." That, he explains, means setting clear expectations about how and when employees are at their desks and accessible via instant messaging, mobile and soft phones, e-mail and the like. "It takes less time to write up a policy than it does to do the technology, but we didn't have one in place," Lippie said.

Clearly, his next drill will be different. And the takeaway is just as clear: Make sure you routinely test plans rather than just putting one on a shelf. Deployment drills should run at least once a year and preferably once a quarter.

Keep workplace technology clean. Professional cleaning crews, of course, rarely touch technology gear. It's up to you to suggest safety-first procedures to customers. Besides the now-familiar advice to avoid contagion by installing hand-wash sanitizers and workstations spaced with social distances, also advise clients about sanitizing keyboards, terminals, laptops, phones, headsets and more. Some companies have instituted "wipe-down Wednesdays," so employees clean equipment on a weekly basis.

Looking To the Future
Obviously, fourth quarter 2009 offers unprecedented openings to talk to clients not only about preparing for the pandemic but also about business continuity and disaster recovery going forward. Veterans like New York entrepreneur Donna Childs, who have experienced the unimaginable and emerged whole, emphasize that it pays to start small.

Childs runs her own social venture capital firm in lower Manhattan. "When the planes struck the towers on the morning of Sept. 11, 2001," she said, "my business was located in 'Zone 1' of the World Trade Center" -- one of three areas officially designated as experiencing the greatest exposure to the disaster. "Because of the symbolic importance attached to reopening the New York Stock Exchange, our office building was reopened on Sept. 18," Childs said. "However, we were without essential services for some time, such as electricity, gas, telephone, water, mail delivery and pedestrian access." Still, Childs had a comprehensive disaster plan in place, mostly, she says, because she had been tutored by earlier jobs in the reinsurance industry. "My business stayed up and running and our insurance claim was paid in full, 100 cents on the dollar, within three days of submission."

Childs, who has since written a book about her experience titled Prepare for the Worst, Plan for the Best, has what may sound like counterintuitive advice for disaster planning: "Many people believe you should prepare for the worst-case scenario and that such an approach automatically subsumes all lesser risks," she said. "But that is exactly what small businesses should not do." Rather, Childs suggests firms prepare for the "everyday" disaster.

"That way, you obtain an immediate benefit against a more imminent threat at a more affordable cost. And you will gradually build resilience against the more serious threats. That process will enable temporary remote operations, including employee telecommuting, for emergencies, such as for the upcoming flu outbreak."