eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
On Wall Street, a week after the collapse of the World Trade Center towers, it seemed almost like business as usual. Traders returned to their trading desks and logged on to trading systems that, because of well-executed disaster recovery plans, in most cases returned online with no losses of data.
Behind the scenes, however, it was anything but business as usual. Besides dealing with the horrifying loss of life, many companies in and around the WTC—companies such as Lehman Brothers Holdings Inc. and Aon Corp.—were forced to scramble to find the work space, desktop computers, network access and other essentials needed to resume operations. They crowded into hotels and even sought help from competitors. A few lucky ones were able to send employees back to work at standby recovery sites arranged long before the attacks.
The WTC disaster shed a harsh new light on many things, among them the often-overlooked need for companies to include alternative work space in disaster planning.
While most companies planning for business continuity traditionally concentrate first on the recovery of data and systems, now more than ever they must also make sure they plan for providing their most critical employees with alternate ways and places to work. That means deciding where to find additional work space, prioritizing critical business functions and employees, planning how theyll communicate with employees during and immediately after an emergency, and equipping employees to work remotely.
Getting employees back to work quickly after a disaster can mean the difference between staying in business and failing. Two out of five businesses that are struck by a disaster will cease operations within five years, according to Gartner Inc., of Stamford, Conn. Too many have yet to get prepared. Gartner also found that 60 percent of companies dont have adequate business continuity plans to begin with, let alone procedures for alternative work space.
“Its important to have computers up and running. Theyre a key tool,” said Michael Mayhall, director of business continuity planning at Nestlé USA, a division of Nestlé S.A., of Vevey, Switzerland. “But a computer running without people is useless.”
Theres no shortage of service providers willing to help companies find work space in case of a disaster. The services divisions of major IT vendors such as IBM, Compaq Computer Corp. and Hewlett-Packard Co., offer work space recovery options as part of their overall business continuity and disaster recovery services. So do the services from more specialized vendors such as Comdisco Inc., SunGard Data Systems Inc. and Rental Systems Inc., known as Rentsys.
Most commonly, service providers offer work space at the same sites they use to house backup data centers. Along with the physical space, they provide equipment such as desktop computers, LANs and business telephones. With the desktops, for instance, the customers IT department either configures them itself or contracts with the provider to do it by regularly providing updated mirrors of the standard desktop.
Using a providers space, though, isnt the only outsourcing option. Providers such as Rentsys offer mobile work space units that can travel to a customers site. The company also rents out desktops, servers and other hardware in emergencies.
Work space recovery services are typically priced either by the number of seats required or negotiated as a flat fee as part of an overall business continuity deal. The cost of a contract for a full range of business continuity services that include work space can reach as high as $200,000 per month, providers such as HP and Compaq said.
One of the first questions that enterprises will have to answer is whether to use outsourced alternative work space services or arrange for alternative space on their own, either from within their facilities or by finding a local hotel or other operation that can provide it on short notice. The answer often depends on how distributed a companys operations are, to what extent that space can quickly be transformed for displaced workers and how many workers it plans to relocate, experts say. A service provider is often the best fit, for example, when a companys operations are concentrated in a single geographic area with few office space alternatives nearby.
When Boston-based Pioneer Investment Management Inc. began searching for recovery space in 1992, for instance, it turned to providers because its operations were concentrated in one downtown skyscraper. Contracting for space from a provider made the most economic sense for Pioneer, compared with leasing alternative space on its own, said Michael Cady, assistant vice president of business continuity for the mutual fund company.
Pioneer initially contracted with a competitor, Boston Financial Data Services Inc., for use of call center space for about 50 people at the companys Quincy, Mass., location. In 1994, it added space for 75 more seats by working with SunGard. Today, Pioneer has plans to accommodate a total of about 225 employees out of about 800 between the providers, Cady said.
Other companies—particularly those with highly distributed operations—however, dont want to rely on outside providers. Business continuity plans at FedEx Corp., in Memphis, Tenn., for example, call for employees affected by a disaster to be sent to different FedEx locations or temporarily assigned new tasks. When the WTC attacks shut down FedEx hub operations in Newark, N.J., for four days, employees immediately were instructed to reroute packages to other FedEx airstrips in Memphis, Dallas and Indianapolis. Employees not directly responsible for the transport of packages were sent home and told to communicate with the office via mobile phones, two-way pagers or e-mail.
Enterprises should be aware, experts say, that using outsourcers doesnt guarantee that there will always be enough room if disaster strikes. The WTC calamity strained all providers of recovery space because they dont plan for such a massive, sudden loss of office space but instead expect that only a few clients in any given region will need space at once, said Colin Rankine, an analyst at Giga Information Group Inc., in Norwalk, Conn. Rankine estimated that there are only a few thousand commercial recovery seats usually available throughout North America.
“Nobody ever thought wed need 75,000 work spaces at once, and, hopefully, we never will again,” Rankine said.
While there were no reports of enterprises paying for alternative space being turned away following the Sept. 11 disaster, service providers themselves in some cases were forced to scramble. An IBM spokesman, for example, said the Armonk, N.Y., company used space normally used for internal IBM operations.
Of course, finding backup office space doesnt have to be an either-or proposition. Carlson Companies Inc. has plans to use its internal resources and space from providers to keep as many as three-quarters of its 5,000 employees from its Minneapolis headquarters campus working. Internally, it has rewired and configured the conference rooms at its three buildings so they can be used as recovery space if one or more of the buildings werent accessible, said Chuck Wachter, manager of disaster recovery and business continuity at the travel, hospitality and marketing company.
It can also tap into one of its core lines of business: hotels. Carlson owns a Country Inns & Suites across a highway from the campus and has plans to convert its rooms into office space for 400 people in case of a disaster. To help meet the increased demand for more PCs in the conference rooms and hotel, Carlson has contracted for 1,000 desktops from Rentsys, which would be drop-shipped to the Carlson sites.
But Carlson hasnt stopped there. It also has the option of using Rentsys to deploy mobile units to Minneapolis or one of its other locations. Just in case that werent enough, Carlson can relocate critical employees to a SunGard recovery facility in the Minneapolis area, Wachter said.
Who Matters Most
?”>
Who Matters Most?
No company can plan for every situation or have backup plans to provide all employees with alternative work space, experts say. What each company must do is ensure there is recovery space for employees in those functions critical to the operation of the organization. That means enterprises, as part of their disaster recovery plans, must identify in advance which employees need access to alternative space first.
At Visa International, in Foster City, Calif., every division of the company is required to identify high-priority employees, as well as determine recovery and backup needs, annually. Those surveys ensure that the technology and work facilities necessary for the company to operate are prepared and ready in the event of disaster.
“Im sure there are opportunities to do business continuity better, smaller, faster, cheaper,” said Ken Lieberman, executive vice president of international risk management at Visa. “I wouldnt presume to say that we have a desk, chair and pencil ready for every single person. But if an employee provides a critical function necessary to support customer service here at Visa, we will spare no cost to make sure they can do their job.”
The priorities will vary widely, depending on a companys type of business. Companies such as Visa and Carlson must initially focus on customer-facing operations such as customer service call centers. One aspect of Carlsons business, for instance, is providing call center customer service to other corporations loyalty programs, such as frequent flyer programs, Wachter said.
Identifying core functions is just the first step. Companies must also figure out which groups of employees should get up and running first. Nestlé USA, for instance, plans for a stepped approach to moving key employees to alternative work sites in a disaster. Mayhall likens the approach to triage, calling it an “emergency room hospital theory.”
If the food manufacturers headquarters in Glendale, Calif., became unavailable, the company has plans for its 100 most critical employees to be up and running with workstations within 24 hours at a Comdisco recovery center, Mayhall said. Then, within another three days, Nestlé USA can take over the 1,500-square-foot ballroom at a Southern California hotel to house another 300 employees. Using services from Rentsys, it can install about 100 workstations every 12 hours, once the ballroom space is ready, Mayhall said. But those plans wont cover all the companys 1,600 headquarters employees, so Mayhall has worked with Nestlé USAs lines of business to determine the functions needed to keep the business churning.
“You have to trade off strategy for tactical efficiency,” Mayhall said. “What you really want to do is recover your tactical operations, those that are essential to day-to-day running of the business as opposed to those that are focused and devoted to the growth aspects of the business and the general management aspects of the business.”
But its not enough to have plans and priorities. Periodic testing is also prudent, experts say.
Staying in Touch
Staying in Touch
Having a work space recovery plan in place means nothing if companies are unable to effectively communicate temporary office locations or other emergency instructions to employees. Experts say using public corporate Web sites to provide customers and clients with critical information—as enterprises such as Morgan Stanley Dean Witter & Co. and United Airlines Inc. did after the WTC incident—is among the fastest ways to deliver information to employees, customers and clients.
Lower-tech approaches are also important. At Visa, all employees are issued a plastic card printed with an emergency number to keep in their wallets. The back of the card states that in the event of an emergency, employees are to call the toll-free number to receive the latest general information. The card allows managers to record information specific to their business divisions outlining where employees should go or what they are expected to do.
On Sept. 11, the system worked. Visas emergency operations centers all over the world held hourly briefings with executives to ensure the status of Visa offices and people was communicated throughout the company. (The company had no offices in the WTC.) Visa also updated the information on its toll-free line hourly.
“The best business continuity plan means nothing if you fail to come up with an internal communications plan,” said John McCarthy, director of critical infrastructure for KPMG LLP, in Washington. “Companies need to decide how theyre going to communicate with people in a local, regional or national disaster. And they cannot rely only on e-mail or telephone service.”
Besides arranging for backup office space and technology, some enterprises have made sure employees can work productively from home in an emergency. Visa employees who perform critical business functions are issued computers with virtual private network capabilities for use at home. The computers are wired with broadband and telephone dial-up capabilities.
In the event that telephone communication is impossible, Visa requires executives to carry e-mail-capable two-way pagers so emergency alerts and information can be transmitted. They are also given mobile phones equipped with Wireless Application Protocol browsers. “In the event that an employee is unable or unwilling to leave his or her home, critical work functions and customer support can still be provided,” Lieberman said.
In light of the WTC attacks, many corporations that shunned telecommuting in the past are now setting up remote access capabilities, said Carl Greiner, an analyst at Meta Group Inc., in Stamford. “When you stop and think about it, theres not much you cant do from home,” Greiner said.
Even companies that were well- prepared came away from the WTC disaster with lessons to factor into their continuity planning process. While companies such as Visa had detailed emergency communication plans, few, for instance, have plans to deal with the closing of U.S. air space. Many contingency plans rely on the shuttling of employees among office locations via airplanes.
Executives at Visa said that while they have remote work policies in place, they are re-evaluating alternative ways of making sure critical employees can get to other office locations around the world.
“If a crisis goes on for a specific time, we look for interim plans that involve using our offices all over the world,” Lieberman said. “We are, however, recognizing the need to re-evaluate everything in light of air traffic controls and other restrictions. Right now, if people cant get into our offices, they are prepared to work remotely from where they are.”
The Sept. 11 attacks have made once-inconceivable disaster scenarios all too real. FedEx, for example, after hearing that Memphis was a top 10 target for terrorist attacks because of FedExs central role in the national economy, is now evaluating the terrorism portions of its business continuity plans, considering new ways it could be attacked.
Others, including Visa, are also wondering if perhaps continuity plans need to cover all potential outcomes, including the death of employees.
“We are conducting a full re-evaluation of our strategy,” Lieberman said. “I can honestly say that the loss of people was not a factor that we had planned for to any large extent. And, unfortunately, all businesses and Americans are going to have to reconsider reality.”
While even such ghastly aspects of business continuity planning are now necessary, experts agree that it is neither cost-effective nor practical to plan for every possible outcome.
“You cannot spend your time chasing large scenarios that you cant necessarily plan for or prevent,” KPMGs McCarthy said.
Pioneer, for instance, has planned its business continuity around events that could leave its buildings inaccessible for a few days at a time. But it hasnt planned for them collapsing outright. “Were not planning for the one-in-a-hundred-years event but for the one that occurs every year or two,” Cady said.