ibm global technology services © 2007 ibm corporation pandemic preparedness and response planning...

IBM Global Technology Services

© 2007 IBM Corporation

Pandemic Preparedness and Response Planning

Keeping your business running in the face of this new threat

Pandemic Preparedness and Response Planning

Keeping your business running in the face of this new threat

Paul D. SaxtonConsulting Services Practice Leader IBM Business Continuity and Resiliency Services February 2007

Paul D. SaxtonConsulting Services Practice Leader IBM Business Continuity and Resiliency Services February 2007


© 2007 IBM Corporation22

AgendaAgenda

• Introduction • Key drivers

• Why Bother?

• The Differences between pandemic and traditional continuity plans

• Why non-pandemic specific plans are unlikely to work in this scenario

• Key components and critical success factors

• How will you know when you’re done?

• Final Thoughts



Preparedness has lagged behind as infrastructures and business models have evolved

Preparedness has lagged behind as infrastructures and business models have evolved

Centralized Computing

Distributed Computing

'60's - Early 80's

1. Mainframe model: centralized control, standardization, batch reporting

2. Focus: data center, internal stresses, very localized disruptions

3. IT: reactiveBusiness: none

4. Recovery Time in weeks

5. Mindset: insurance

Disaster Recovery

Mid - Late 80's

1. Midrange & client-server model: departmental computing, creativity, independence

2. Focus: satellite hubs, internal stresses, very localized disruptions

3. IT: reactive/noneBusiness:

reactive

4. Recovery Time in days


Business Recovery

The '90's - 2000

1. Hybrid model: connectivity, data sharing cross-bu, re-standardization

2. Focus: enterprise I/S, internal/external stress, localized disruptions

3. IT: reactive Business: reactive

4. Recovery time in hours


Business Continuity

Year 2001 - today

1. Virtualized model: extended supply chain, mobility, direct customer access

2. Focus: extended global I/S, internal/external stress, broad disruptions

3. IT: proactiveBusiness: proactive

4. Always up

5. Mindset: survival

Business Resiliency

Network Centric Computing

On-Demand Computing



Key Drivers Key Drivers There are many key drivers behind the intense focus on pandemic preparedness and response planning.

1 More potential threats of disaster

There is a growing exposure to risk from both natural and man-made disasters.

More intense natural disasters

A rapidly aging lifeline infrastructure

Increasing terrorism

Complex disruptions to business have occurred throughout modern history with devastating impact on corporations globally:

Hurricane Katrina South Asia tsunami SARS flu outbreak September 11 terrorist attacks Anthrax and other chemical threats London, Madrid and Bali bombings Ice Storm 2003 Blackout Current Pandemic threat and

associated risks to human capital



Key Drivers Key Drivers

Globalization of business operations and travel.

Insurance coverage limitations. Critical facility consolidation. Changing social and financial standards. Government regulations and issues. Greater responsibility and span of control

for key employees. Departmental silos, incentives,

measurements. Brand reputation and competitive health.

2 More potential harm from any single disaster

Our marketplace and business environment are now increasingly complex, so any disruption has a greater impact on your business operations and supply chains.

Key challenges in today’s environment:

If you have not yet been affected by a major disruption, it means you are getting closer to the time when you will be.




Critical assumptions: A new flu pandemic could break out

soon. It is expected to have global impact and

all countries need to be prepared. The flu virus could become highly

transmissible and cause widespread sickness and death.

There are likely to be significant shortages of vaccines and antiviral medications.

Significant disruption to economies, international and national infrastructures, and society in general, may occur.

An influenza pandemic is caused by the global outbreak of a new virus that causes illness and spreads easily from person to person, and for which people have no immunity and there are no vaccines immediately available.

Organizations must ensure that critical operations will continue in the event of widespread absenteeism.




High rates of illness and death could impact your employees and their families—and your customers, partners and suppliers.

You should expect significant disruption to international and national infrastructures and commerce.

Employee absenteeism may reachoperations-crippling levels.

Lessons from SARS taught us that the human factor in planning is a critical component for any continuity plan and that organizations were not as well prepared as they thought they were.



Why Bother? Why Bother? The big question on the minds of so many: “Is it going to happen or not?”

“The H5N1 virus has given us not only a clear warning, but time to enhance preparedness. ….Nonetheless, our highly mobile and interconnected world remains extremely vulnerable. No one can say whether the present situation will turn out to be another narrow escape or the prelude to the first pandemic of the 21st century. Should the latter event occur, we must not be caught unprepared.”

Dr. Lee Long-wook, Director General, World Health Organization,

“Avian influenza: assessing the pandemic threat”

Many organizations have adopted an aggressive, proactive approach to pandemic preparedness.

Others continue to adopt a “wait and see” attitude.



Why Bother? Why Bother?

Pandemics have occurred in the past (1918, 1968, 1957) and experts tell us they will continue and that we may be overdue for the next one.

The media has saturated us with pandemic related content for months. Is this hype or is it possible?

We must be prepared to mitigate the risks and exposures that come with a pandemic.

Many businesses have already started or are thinking about developing pandemic preparedness plans.

Planning for other disasters and planning for a pandemic is not the same.

Existing business continuity and/or crisis management plans are not sufficient to respond to the unique requirements of a pandemic.

Scenario dramatically changes the traditional view of business continuity – focus is on impact of human resource loss on business operations.

Health authorities advise that we may be on the verge of a flu pandemic resulting in significant disruption to economies and business around the world.



Why Bother? Why Bother? A pandemic’s impact on human resources can significantly impact business operations for an extended period of time.

Expect staff absences up to 40% during a pandemic.1

Expect multiple waves of infection, each lasting up to eight weeks.

A pandemic could last many months and may contain peaks followed by periods of reduced illness.

There could be government-ordered reduction of people at nonessential places of employment.

Planning should includeemployees being un-willing or unable to work,even if they do not become ill themselves.

1 Source: washingtonpost.com, “U.S. Plan For Flu Pandemic Revealed,” by Ceci Connolly; April 16, 2006



Why Bother? Why Bother? The impact of a pandemic on other aspects of your business may also severely impact your continuity of operations.

Supplies of materials you need may be disrupted, as transportation may be curtailed.

National authorities could control critical supplies and professionals needed for disaster response.

Availability of services from your subcontractors and partners may be limited, as they may face the same human resource and other business issues you will.

Demand for services may be impacted – both up and down.

Ability to communicate with key staffmay be disrupted.

A pandemic could cost between 0.8% and 12% of economic output

worldwide—up to US$4.4 trillion. 1

1 Source: McKibbin W. and A. Sidorenko (2006) "Global Macroeconomic Consequences of Pandemic Influenza" Lowy Institute Analysis, Lowy Institute for International Policy, February. 100 pages.



Difference between Pandemic and Traditional Continuity Plans Difference between Pandemic and Traditional Continuity Plans

Traditional Business ContinuityTraditional Business Continuity

Assumes this is only your problem – competitors, customers and community infrastructure is unaffected – localized impact

Normal staffing levels are available Critical business processes supported

Normal cyclical peaks and valley’s in business Shorter duration Limited or no advance notice

Survival of your company is primary focus

Key employees and backups identified and assumed to be available

Pandemic Related Business ContinuityPandemic Related Business Continuity

This is everyone’s problem – customers, competitors and surrounding community are affected by the same event – widespread impact Up to 40% staff absent May need to prioritize critical processes due to limited staff May be drastic fluctuations in demand – up or down Longer duration, multiple waves Some advance notice

Company survival, plus contribution to community response Risk of large % key employees unavailable

Most crisis management and business continuity plans focus on a disaster’s impact on sites and equipment.



Mismatch exists between business requirements and recovery plans and capabilities

Plans do not effectively address the impacts of a regional emergency

Dependency on key personnel not properly addressed in plans

Internal and/or external communications processes are not crisp

Plans developed do not consider the impact across the industry and/or community

Network availability can be a major bottleneck in restoring business operations

Plans are not exercised or maintained at appropriate levels of detail

FacilitiesFacilities

TechnologyTechnology PeoplePeople NetworkNetwork

InformationInformation

Major disruptions to availability of human capital resources not previously considered

Existing business continuity plans are unlikely to be adequate to respond to a pandemic type of disruption.

Why Non-pandemic specific plans are unlikely to work. Why Non-pandemic specific plans are unlikely to work.

Internal and external dependencies are not adequately identified or properly documented.



Why are interdependencies so critical?Why are interdependencies so critical?

No organization is an island with its systems or operations.

Organizations depend upon the public infrastructure for criticalservices:

• Electricity, Gas, Water, Telecommunications, Transportation.

• Services including Police, Fire, Public Safety and Emergency Management.

• Medical and Government Services.

Companies interact electronically with their suppliers, customers and partners.

Many organizations do not fully understand all internal and external interdependencies.

Pandemic preparedness strategies must consider interdependencies in order to achieve their intended goals. .



Key Components Key Components

Company pandemic strategy, policy and guidelines.

Executive sponsorship of pandemic planning.

Critical resource identification and tracking.

Communication and education plans for employees, customers.

Human resource planning and monitoring.

Employee impact and mitigation plans.

Proximity to healthcare facilities.

Supply chain impact and mitigation plans

Government interface plans.

Linkages to crisis and business continuity plans.

Business function and location-specific impact.

IT, network, security and workplace infrastructure continuity.

Pandemic plan testing, audit and maintenance.

Many companies are unsure of where to start, or how well their accomplishments to date measure up to emerging standards and guidelines.



Critical Success Factors Critical Success Factors

1. Senior Executive Support – designated sponsor.

2. Capital – there is no free lunch.

3. Training – participants are learning something new.

4. Time – When is the right time, and how much is enough?

5. Clearly defined plans - to get the work done, and content of plans themselves.

6. Qualified resources – internal and external; this is not easy to do.

7. Recognition of rates of change – ongoing maintenance.

8. Interdependencies and associated coordination – complexity of business.

9. Complexity of Technology – simple is easier – who has that?

10. Communication – internal and external; getting the right message to the right audience at the right time.

Several critical factors will have a significant impact on the success or failure of a pandemic preparedness and response program.



How will you know when you are done? How will you know when you are done?

You must be able to answer the following questions:

1. Have critical policies been defined including alternatives designed specifically for use during a pandemic-type crisis?

2. What are your policies regarding sick or absent employees?

3. Have you educated your employees on your policies and plans?

4. Do you have a crisis communications plan?

5. Do employees have preparatory advice on potential crisis events, including pandemic?

Is it up to date?

6. How will employees receive critical information in an actual event?

7. How will you manage if a large number of employees become ill? Will you be able to

track infected employees? Absent employees?

8. How can HR systems be used to locate and redeploy critical staff resources during a crisis?

9. Have you determined/confirmed your most critical business processes?

10. Do you know who your key players are and how to operate without them?

Cont.



How will you know when you are done? How will you know when you are done? You must be able to answer the following questions:

11. Will you have continuity of systems and processes in a crisis?

12. How is critical job training being rolled out so that personnel gaps can be filled or capabilities supplemented via business partners on short notice?

13. How will employees communicate with colleagues to keep the business running?

14. Can you enable employees to work from home—and manage them—if they are unable or unwilling to travel to a central work location?

15. Can you ensure electronic access to data, processes, tools and plans?

16. Will you be able to communicate and share data with suppliers and partners?

17. Can you provide immediate support to your employees and their families if a crisis were to occur? What kind of support would you provide?

18. Are there short and long-term succession plans for critical management and operations roles?

19. How should resource plans and sourcing strategies change to accommodate crises?

20. What plans are in place to provide critical services such as payroll?

21. Have you rehearsed, exercised and updated your plans?



Final Thoughts Final Thoughts Pandemic is a relatively new stressor in the world of business and industry.

Effective pandemic preparedness and response capabilities are part of an overall business resilience program that protects you and your key stakeholders.

Pandemic is global in its scope and impact.

It is a situation characterized by widespread risk and uncertainty.

Business and industry have little related experience with this new threat.

We are all on a new learning curve – some farther along than others.

You don’t know what you don’t know.

This is not easy to do – get help if you need it.

Independent third party reviews are an effective way of getting an objective assessment of your degree of pandemic preparedness.The hardest part of building a recovery capability is explaining why you didn’t.



Resilience is integral to your survival… and beyondWhere are you on the path?

Resilience is integral to your survival… and beyondWhere are you on the path?

Current CapabilitiesCurrent Capabilities

Resilience GoalsResilience Goals

Evaluate PreparednessEvaluate Preparedness

Plan for Business Resilience

Plan for Business Resilience

Develop Business Resilience

Develop Business Resilience

Implement Business Resilience ProgramImplement Business Resilience Program

Manage Business Resilience ProgramManage Business Resilience Program

UnderstandNeed for Resilience

UnderstandNeed for Resilience

Understand Risks to Resilience

Understand Risks to Resilience



World Community GridWorld Community Grid Individuals collectively contributing their unused computer time 500,000 devices from 200 countries for humanitarian research since Nov/04 World Community Grid ranks among the top 5 super computers in the world About 75,000 years of computational time shave decades of years off research

without World Community Grid Global research network, with projects from the USA, Latin America, Europe and in

the queue from Africa and Canada IBM donated hardware, software, technical services, expertise to build infrastructure

as well as hosting, maintenance and support One grid that runs 5 simultaneous projects Some on-going projects:

Help Cure Muscular Dystrophy Project

Help Defeat Cancer Project

Genome Comparison Project

FightAIDS@Home Project

YOU CAN HELP CHANGE THE WORLD. Join the WORLD COMMUNITY

GRID to contribute to projects that benefit humanity.

http://www.worldcommunitygrid.org/

ibm global technology services © 2007 ibm corporation pandemic preparedness and response planning...

Documents

reactive business

ibm global technology

proactive business

insurance business recovery

business models

reactivenone business

resiliency services

localized disruptions