1. How do you determine when to invoke pandemic preparedness plans such as workforce isolation and social distancing? Is it by absenteeism rate? Some other data point? If absenteeism rate, are you monitoring the change between the normal rate of say 5-7% and the pandemic influenced rate?

2. How are you invoking your plans – by enterprise, by location, by department? Are you conferring with your pandemic crisis management team in doing so?

3. How do you determine when you will issue a stand down order?

You need a management champion, and that’s where key business performance indicators come into the picture. If you translate availability/resilience risk to on-time delivery, supply chain performance, R&D success, customer retention and so forth – leading indicators of future business performance, then management can understand the impact to the business of a risk being exploited. It’s an educational and iterative process – few get it out of the gate unless perhaps they have been personally involved in a prior event.

BCM has to move from a FUD operation to a business enablement operation – tying risk to performance is the way to get there.

Read my latest research note “A New Approach: Obtain Business Ownership and Investment Commitment for Business Continuity and Resilience Management Through Key Performance and Risk Indicator Mapping” – free to clients or for a fee to non-clients: http://tinyurl.com/yjfcmpz .

On 15 October 2009, the U.S. Department of Homeland Security (DHS) announced three proposed standards that would be used by the Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) program, which enables private-sector businesses, nonprofit organizations and universities to receive emergency preparedness certification. The public can submit comments on the standards and the program at www.regulations.gov in Docket ID FEMA-2008-0017 by 15 November 2009.

Improving recovery capabilities will benefit all businesses and humankind globally. But certification is not a guarantee that an organization can recover from a disaster. Organizations should go slowly when starting down the path toward organization certification.

Read the rest of my First Take at: http://tinyurl.com/yjhwz3u.

At today’s general session, DHS, Cisco, Radian Compliance and I spoke about what PS-Prep and BCM organization certification are and what they aren’t, the value of it, how in the long-term it will likely be a mandatory requirement to do business – through market pressure rather than the voluntary program put forth through US Public Service law 110-53, and what organizations should be doing now to prepare for the time when your larger customers and partners will start assessing your ability to recover.

What is your organization doing to prepare for it? Have you already been approached by your customers and partners to show some level of maturity around business continuity management before they sign a contract with you, or when renewing a contract?

Information on the PS-Prep Program can be found at the FEMA web site.

Linda Tavlin of Tavlin Training a crisis communications firm based in Paris (you can see the fruits of her work by watching how the Air France Flight 447 disaster is being managed in the press), asked the attendees a thought-provoking question: “Are you a commercial firm selling safety to your stakeholders, or are you a safety firm selling a commercial product/service?” Depending on your answer, your approach to crisis communications will be vastly different — and the impact on your brand and reputation will be damaged, preserved or enhanced as a result. Those that seeing themselves as safety firms have a crisis communications program focused on addressing the intangibles of a crisis — the emotional and the investigation/fact-based side of the incident. I didn’t have to think too hard to understand Linda’s basic point: that an enterprise that says, “We’re sorry this happened” immediately after a crisis is addressing the emotional needs of everyone involved, including employees and their families, customers, business partners and the community at large. (I admit I do struggle with the idea that saying you’re sorry about something means implying that you’re at fault. Maybe that’s a female trait?)

Linda made another important point: that a crisis communications program should focus more on investigating and remediating a crisis than on public relations. Lawyers, executives and other key stakeholders will inevitably want to put the firm in the best possible light following a crisis, but their efforts to do that may run counter to what really needs to be done from a formal and perhaps regulatory perspective. Misleading or insensitive statements can put your firm in a precarious position, so the inevitable media questions should be referred to authorized investigators. (Remember, every country, region and jurisdiction has its own approach to these issues, so make sure you have the necessary legal and regulatory knowledge before moving ahead.) Taking this approach achieves several key goals: It lets everyone know that there are many parties involved in the crisis, its impact and its investigation, and it diverts some of the media attention away from the firm to other parties. Perhaps most important, it focuses attention on fact-finding activities that can determine conclusively why the crisis occurred and lead to the implementation of mitigation controls to prevent it happening again.

One more thing: Pay keen attention to your executives and their ability to act as spokespersons for the firm. Their interpersonal skills may not be the type you need during the initial crisis and its aftermath. (You may need to shift spokespersons over the course of the investigation, based on their skill sets and your communication needs.) Empathy and respect for all involved — especially members of the community, the jurisdictional investigators and political leaders — will serve you better than bravado and posturing.

Immediate steps for organizations to take include:

• Go to www.pandemicflu.gov to find out the actions the US government recommends to ensure workforce safety and continuous business operations.

• Download and examine the FFIEC’s “Pandemic Flu Exercise of 2007 After Action Report” immediately, and disseminate their findings across your organization. To the best of our knowledge, this is the only large-scale testing of business pandemic plans ever conducted.

• Download Rick DeLotto’s research note “New U.S. Guidance on IT in Pandemics” dated March 3, 2008.

• Emphasize the urgency of performing personal hygiene disciplines that will inhibit the spread of the virus.

• Identify existing and projected critical skills shortages; and initiate staff cross-training, testing and certification. Make sure that cross-trained personnel are also given the appropriate access rights in your applications. This is the longest lead-time and most disruptive of the improvements.

• Determine which business operations are sustainable, at what level, and likely durations of downtime for normal business operations with staff absentee rates of 40%. Test for various combinations of leaders and skilled staff.

• Testing should start immediately to isolate and remediate problem areas. Testing should be rigorous, inventive, ongoing and documented.

Gartner has many research notes related to pandemic planning and we will continue to update you as to the severity of events and actions you should take as the situation evolves. Please visit our business continuity blog for more information.

Rick DeLotto and Roberta Witty

On Tuesday, Rick DeLotto and I were briefed by the Sahana Project, an award winning, free and open source, web-based disaster relief management system designed to “Help alleviate human suffering and help save lives through the efficient use of IT during a disaster”. It was first developed by the open source community, and is maintained by volunteers, with support from IBM, Google, NSF and Sida. You should run right over to Sahana and get a look at it, tell your friends, and spread the word. It might be just what your home town needs to keep YOU safe.

So far Sahana has quite a track record since its introduction in 2005; it has helped manage disaster outcomes in Sri Lanka, The Philippines, Indonesia Peru and Myanmar. It has been selected for use by the City of New York, Pakistan’s National Database and Registration Authority, The Disaster Management Bureau of Bangladesh, the Disaster Management Center of Sri Lanka and Indonesia’s NDCC and by various agencies across the EU, South America, Australia and China. It is available in 30 languages, has very limited infrastructure requirements, and can be run effectively on systems ranging from a simple laptop (with data exchange by USB drives) to satellite-linked client server.

As shown to us it has 4 main modules:

* Organization Registry, which helps maintain data (contact data, services offered, region, etc) of organizations, groups and volunteers working in the disaster
* Missing Persons / Disaster Victim Registry, which helps the authorities track and find missing, deceased, injured and displaced people and families
* Shelter Registry, a central repository for data on all temporary shelters setup following the disaster, and
* Request Management System, which tracks all requests and helps match pledges for support, aid and supplies to fulfillment.

Other modules include inventory management, volunteer coordination and situational awareness for incident managers, with more in the pipeline.

This is a non-profit, volunteer organization—and you or one of your professional organizations might have some skills, resources or spare time to help.

Want to find out how prepared you are? At the Gartner Business Continuity Management Summit - April 27-29, 2009 in Chicago, IL, you will have an opportunity to participate in a special 2 1/2-hour “Mock Disaster” crisis management exercise. Led by Eagle Rock Alliance, the workshop will test your mettle and your ability to make quick, viable decisions as the senior manager of a fictitious company. Are you up to the task?

BCM isn’t just about terrorist attacks, natural disasters and IT failures. The global economic meltdown shows, among other things, just how interconnected enterprises are, and how wide-ranging – and how important – BCM is today. It isn’t enough for just your enterprise to be prepared. You also have to look long and hard at your suppliers and customers. If your suppliers can’t supply — and your customers can’t pay — the impact on your business will be every bit as devastating as a direct hit.

And there’s more: When profitability is low, the damage can be felt much sooner and much harder than when financial resources are more plentiful. Business managers need to be ready to answer tough questions from senior executives who are making equally tough decisions about how to allocate increasingly scarce resources. And to do that, they have to ensure their BCM processes and recovery plans truly take into account the rapidly worsening global economic situation.

BCM professionals need to be asking themselves some very tough questions, too. Questions like “How will our BCM programs — our jobs — survive this crisis?” And “Is this a crisis for the BCM discipline, as well?” The answers to these questions are at the heart of a paradigm shift, both professional and personal, that we’re seeing in BCM. Some of the old ways — long, detailed processes that aren’t intuitive to the business, or focusing strictly on technology outages or loss of key facilities — simply aren’t working. And they aren’t positioning you, as a business continuity manager, for future success — or even survival.

The BCM professional must shift from a recovery-only mind-set to one that focuses on risk management and business resiliency. Business continuity managers must transform their scenario planning to account for the economic downturn. Failing to prepare for the business consequences of the worst economic downturn since the Great Depression would be inexcusable. And downsizing the personnel who could put the necessary processes into place would make no sense. Not only would the enterprise be removing hard-to-replicate institutional knowledge, it would risk going out of business for lack of the workforce skills needed to recover from even a minor crisis.

Business continuity managers must also enhance their communications and persuasion skills, so that they can present comprehensive, well-thought-out crisis management plans to senior executives and line-of-business managers. Now’s the time to show the business how BCM really works and what it can do. For example, the business definitely needs to streamline processes and reduce costs. You have the dependency mappings that can help make that happen, and you should be using them. Expand your crisis management and recovery plans, make them relevant to the business and talk about them in the language of the business manager — right now — or you and your role may not survive.

The Gartner Business Continuity Management Summit, scheduled for 27-29 April in Chicago, will focus on the BCM paradigm shift and what you need to do to prepare yourself, and your enterprise, for the future of BCM. The speakers will include Emily Landis Walker, a widely recognized expert on emergency preparedness, and John Challenger of the outplacement consultancy Challenger, Gray & Christmas. Register now.