What is your organization doing to assess the impact? Are you tracking your traveling workforce and helping them find alternate travel arrangements? And making alternate business operations plans such as having non-impacted staff step in to take the lead? Do you even have a workforce continuity management program in place? (Gartner clients can read my research notes on the topic: Workforce Continuity Defined and Workforce Continuity: Best Practices for Workforce Management.)

Of even greater impact is the supply chain – critical goods may not be able to arrive when needed by the customer due to the cancellation of flights. Are you assessing your supply chain and determining the impact on meeting contractual obligations? Given that this a force majeure event, your business insurance coverage won’t apply most likely.

And what would happen in the US if something of this magnitude happened? The US doesn’t have the extensive ground transportation network that Europe does – at least for passenger travel. US firms would be impacted to an even larger extent most likely.

How many of you are looking to expand your remote work programs? How much of your business operations can be managed remotely? Ata  minimum, senior executives not able to return to the office should be equipped with remote work capability such as PDAs and wireless Internet access for remote system access into your firm’s VPN. The Prime Minister of Norway is doing just that -  Norway Prime Minister governs with the iPad.  (Gartner clients can read our research notes on telecommuting and remote access: Gartner’s Telework Action Plan is Key to Successful Implementations and Critical Questions to Ask Your VPN Provider About Rapid Licenses Capability.)

As a result, cloud-related research was a major topic during our most recent set of recovery and continuity content planning meetings for 2010. One particularly hot topic was the extent to which cloud services could become a one-stop solution for midsized business that are already stretching their in-house IT resources to the maximum.

Today, the recovery and continuity management approach of choice for many of these businesses is little more than the use of managed backup services. Coincidentally, this aligns very well with storage cloud providers’ sweet spots.

However, backed-up data is of little use if it cannot be restored. Compatible server and storage equipment, as well as a supporting data center, are also needed. This is one of the main reasons why so many small and mid-sized organizations feel that they are unprepared to fully recover. For this and other related reasons, recovery-in-the- cloud services that support managed backup, restoration, testing and operations failover can become one of the future bright spots in what is otherwise a largely dormant industry. One key reason is the “always-on” nature of the cloud, making both recovery and failover testing far more flexible and actionable than is currently the case with more traditional shared subscription services. However, this service segment is extremely nascent and unfortunately its potential benefits are currently shrouded by far more questions than concrete answers at this point.

Would this class of cloud service be of interest to your organization? If so, what service functionality, price points and provider maturity would be needed in order to get your attention?

But does social media help or hurt private enterprises and governments and their partners during a crisis? On the positive side, you get direct input from many quarters – those directly involved in the event and those not. On the negative side, you have no way of validating the information sent on social media forums and some posts may actually harm the enterprise or hinder rescue efforts –panic can ensue based on false information, or comments may wrongly harm the reputation of the enterprise.

As many of my colleagues have stated: social media is here to stay – enterprises need to get over it and start embracing it their operations. But how does one do that during a crisis? One immediate action that enterprises need to do is set up a social media monitoring program as part of a BCM program. False or inaccurate comments can be immediately refuted so that problems are not created. Another action is to make social media forums an endpoint in your emergency notification process – not only send crisis communiqués by voice message, email and text, but post these messages to enterprise-sanctioned social media forums.

How is your organization embracing social media in the BCM program? What are examples of how your organization has been successful in doing so?

Many independent energy experts say that alternative energy and new scientific discoveries for turning shale, waste water, biomass etc. into the amount of energy we need to run our current lives is magical thinking. We don’t have the alternative energy generation infrastructure already in place to run our economy at current levels. And, we can’t possibly have it in place in the timeframe and at the supply levels needed because it takes oil to develop and maintain those systems. What runs the backhoe to dig the wind turbine site foundation, the trucks, trains and airplanes to get solar panels to the site, the furnaces to keep the factory heated during winter, the power systems that provide electricity to run those factories and so forth? OIL!

According to the experts, we are close to, or even past, the midpoint of how much oil we can safely and economically extract from the ground. Therefore, oil shortages, and price spikes, are in our future. As a result, there are social and political implications, not to mention nation state implications – China will be a huge consumer of oil to run their expanding economy and can easily run up the price of oil and make it out of reach for poorer nations. The cheap oil business model is not sustainable in the long run. Strategically, businesses must become less dependent upon the global supply chain.

In order to become less dependent on a supplier half way around the globe, supply chain managers must redesign the product fabrication and logistics processes to include local suppliers. In doing so, you help the economy in the process by creating jobs at home and stopping the blight of small towns. Large, big box retailers must start buying/leasing local, existing real estate and put in place mini stores instead of building brand new massive buildings. The franchise model could then be used to further ignite the local economy. Yes – we will be paying more for goods in a local supply chain business model.

BC managers must be aware of the added risk of a local supply chain: local suppliers are likely to experience the same regional disaster as you do, making it harder for the business to continue during such a crisis. Therefore, businesses need to:
1. Include the supply chain in the development of recovery time frames.
2. Brush off your business resumption plans – the manual and non-technical workaround procedures – that allow some part of the business process to continue when a business interruption occurs.

If you don’t start addressing the oil price issue now, you could risk going out of business in the near future.

Are you following the price of oil as part of your BCM program? If not, why not?

I ALSO had the pleasure of trying a new refreshment: Swine Flu Tonic from Avery Soda in New Britain, CT – www.averysoda.com. It’s a hoot!! The label says “I Survived Swine ’09″. A very flavorful lemon and ginger concoction that doesn’t provide any medicinal value (says so right on the label); rather it does provide some levity on a topic that continues to get some bad press and resignation – JUST because many of us followed all the rules put out by the CDC, Gartner and others.

Don’t you find it interesting that when an event turns out to be a bust, no one thinks it’s because we took as much action as we could to mitigate the risk?

1. How do you determine when to invoke pandemic preparedness plans such as workforce isolation and social distancing? Is it by absenteeism rate? Some other data point? If absenteeism rate, are you monitoring the change between the normal rate of say 5-7% and the pandemic influenced rate?

2. How are you invoking your plans – by enterprise, by location, by department? Are you conferring with your pandemic crisis management team in doing so?

3. How do you determine when you will issue a stand down order?

You need a management champion, and that’s where key business performance indicators come into the picture. If you translate availability/resilience risk to on-time delivery, supply chain performance, R&D success, customer retention and so forth – leading indicators of future business performance, then management can understand the impact to the business of a risk being exploited. It’s an educational and iterative process – few get it out of the gate unless perhaps they have been personally involved in a prior event.

BCM has to move from a FUD operation to a business enablement operation – tying risk to performance is the way to get there.

Read my latest research note “A New Approach: Obtain Business Ownership and Investment Commitment for Business Continuity and Resilience Management Through Key Performance and Risk Indicator Mapping” – free to clients or for a fee to non-clients: http://tinyurl.com/yjfcmpz .

On 15 October 2009, the U.S. Department of Homeland Security (DHS) announced three proposed standards that would be used by the Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) program, which enables private-sector businesses, nonprofit organizations and universities to receive emergency preparedness certification. The public can submit comments on the standards and the program at www.regulations.gov in Docket ID FEMA-2008-0017 by 15 November 2009.

Improving recovery capabilities will benefit all businesses and humankind globally. But certification is not a guarantee that an organization can recover from a disaster. Organizations should go slowly when starting down the path toward organization certification.

Read the rest of my First Take at: http://tinyurl.com/yjhwz3u.

At today’s general session, DHS, Cisco, Radian Compliance and I spoke about what PS-Prep and BCM organization certification are and what they aren’t, the value of it, how in the long-term it will likely be a mandatory requirement to do business – through market pressure rather than the voluntary program put forth through US Public Service law 110-53, and what organizations should be doing now to prepare for the time when your larger customers and partners will start assessing your ability to recover.

What is your organization doing to prepare for it? Have you already been approached by your customers and partners to show some level of maturity around business continuity management before they sign a contract with you, or when renewing a contract?

Information on the PS-Prep Program can be found at the FEMA web site.