Business continuity planning is essential to keep people productive during planned or unplanned disruptions and protect the business from consequences such as financial losses, damaged reputation, weakened customer and partner relationships and lost productivity. A complete business continuity plan must encompass both datacenter and workforce recovery, with technologies and best practices to ensure seamless operations no matter what happens.

Every organization faces the possibility of major and minor disruptions of all kinds, from planned events such as IT maintenance and office relocations, to looming emergencies such as hurricanes, tsunamis, snow storms and epidemics, to unplanned events that strike completely without warning, such as earthquakes, tornados, terrorism, floods and fires. Even relatively small incidents like a failed water main, a power outage, transit or traffic delays, and the seasonal flu can have a major impact if it makes it impossible for work to continue at a given location. In a report by Forrester Research, more than half of the respondents—61 percent— reported in 2011 that they had invoked a business continuity plan at least once during the preceding five years.

While business continuity planning has traditionally focused on failover and disaster recovery for the datacenter, this is only part of the picture. If people can’t access the applications, data, files, communication and collaboration tools their work depends on, then the business is still down—and losing money, customers, productivity, reputation and opportunities every moment it takes to get them back to work.

This paper presents an approach to business continuity based on flexwork, mobility and remote access that keeps both the workforce and the apps and data they depend on up and running, including:

• Best practices for a complete business continuity strategy, including business continuity team structure, business continuity planning, disaster recovery and business continuity testing, crisis communications, and employee safety and awareness programs
• A technology approach to provide people with seamless remote access to their apps, data and collaboration services during any kind of business disruption; enable IT to protect and control business information accessed from any location on any device and in any situation; and simplify continuity by leveraging everyday infrastructure, tools and devices
• Real-world examples of four companies that have already implemented highly effective business continuity strategies based on remote access

The importance of business continuity—and the challenges it poses

Whether planned or unplanned, business disruptions that aren’t managed effectively come at a high cost. Lost revenue, missed sales opportunities and broken service level agreements can have a devastating financial impact. Disrupted partner relationships and supply chains can delay time-to-market, derail important initiatives and weaken competitive advantage. An inadequate response can harm the company’s public image as well as the confidence of its customers and investors. Following the disruption, people can find it difficult to regain full productivity due to lost data, interrupted work in progress and the loss of collaborative cohesion with teammates and management—not to mention the personal impact the event may have had on them.

For IT, recovering from a business disruption can be a complex and timeconsuming process:

• Bringing the datacenter back online and restoring any lost data
• Replacing lost or inaccessible devices and ensuring that each can run the user’s required software
• Provisioning and configuring applications
• Designing new ways of working and communicating them to users, from alternate network access methods to workarounds for applications which can no longer be accessed
• Accomplishing all of these tasks in the middle of an emergency

An effective business continuity plan greatly simplifies and accelerates this process, helping IT restore and maintain service to the organization while getting people back to work as quickly as possible. In events with some advance warning, like a planned office move or anticipated weather emergency, the organization can even prevent their work from being interrupted in the first place.

A global approach for your business continuity strategy

Although each emergency is unique and many decisions will always have to be made on-the-fly, a business continuity plan provides a framework and preparation to guide these decisions as well as a clear indication of who will make them. Executive buy-in is also key. Says Michael Emerson, senior director of infrastructure services at Citrix, “We’re asking people throughout the business continuity process to perform tasks in preparation for something that we hope will never happen, when they have things on their plate that are due today and revenue-based business goals to meet. Having buy-in and support from the highest level is essential for making sure they can give business continuity the time and attention it demands.” With this support, IT can lead the development of a comprehensive business continuity strategy that encompasses all of the following essential elements.

[Download PDF for charts]

Team structure

One of the top considerations for a business continuity plan is the development of a clear decision-making hierarchy. In an emergency, people shouldn’t have to wonder who has the responsibility or authority to make a given decision; if the designated leader is not available, the leader’s backup should be equally clear.

The organization should be able to address all business continuity tasks in every location in which it operates, both to respond to local events and to coordinate the organization-wide response for both local and broader-based emergencies. Personnel identified as key members of the business continuity team—including the people who will take their place if they should become unavailable—must remain focused and involved in planning and testing throughout the year. In addition to ensuring that the plan is effective and up-to-date, this helps build the familiarity needed to perform under the pressure of an actual emergency.

At Citrix, a core business continuity team for each region includes personnel from throughout the organization, including executive leaders, IT, facilities and real estate, as well as physical security, communications, human resources, finance and other service departments. Each of these teams reports into the Citrix executive management committee. Individual teams are dedicated to:

• Emergency response – leads business continuity planning efforts; makes final recommendations to the executive management committee; provides overall direction for preparation, response and recovery
• Communications – provides communication to all parties including employees, vendors, public service agencies and customers
• Campus response – prepares property and equipment for the impending disaster event; performs post-event assessment of damage and its impact on continuing operations; assists with insurance claims; secures buildings and grounds
• Business readiness – acts as a liaison with individual business unit teams; makes necessary arrangements to implement disaster business operations in accordance with the business plan for each unit; provides a tactical response and business direction

Business continuity planning

At a high level, a business continuity plan should identify potential business disruptions that can affect any of an organization’s locations, such as power outages, epidemics and fires, as well as those that are specific to individual locations, such as earthquakes and tsunamis in a seismically active region or civil unrest in politically unstable areas. To keep the number of scenarios manageable, planning should be based on worst-case scenarios, rather than multiple graduated versions of each incident.

It won’t always be possible to maintain normal operations in an emergency situation. To mitigate the impact of reduced capacity, the team should identify which operations are most essential, who will perform them, and how work will be redirected if key people are unavailable. At Citrix, this is handled by a team primarily composed of business unit owners and the business continuity director from IT, who are responsible for conducting business impact analysis. This group works together to rank the criticality of various business processes in terms of revenue, customer-facing and brand image concerns, regulatory implications and other business considerations, then map dependencies onto these processes in terms of the applications, people, facilities and equipment required to support them. Once the group has agreed on this analysis, it can start to identify recovery strategies and costs around continuing each process. For IT, this data provides a framework for making sure that critical applications will be available to the business within an established recovery time objective (RTO) and recovery point objective (RPO).

Testing

A business continuity plan is only as good as you make it—and keep it. Without an ongoing focus on preparedness, an organization can find in a time of emergency that its plan is no longer relevant to its business or operations, and find itself grappling with an ad hoc response made worse by a false sense of security.

Best practices call for annual updates of a business continuity plan to reflect changes in the criticality and dependency of applications, business priorities, risk management, business locations, operations and other considerations. At Citrix, business continuity personnel track and note such changes throughout the year to supplement this annual review. Full emergency simulations should be conducted at least annually as well. These guidelines should be considered the minimum; in addition to an annual review of all plans, as well as crisis communications testing, Citrix performs business continuity and recoverability testing for all mission-critical applications on a quarterly basis. Tabletop exercises introduce new twists into disaster scenarios to ensure the flexibility of the plans in place and give team members experience responding to the unexpected. Says Emerson, “Our success rate has been phenomenal on both the disaster recovery side and the business unit side. Still, no matter how many times we go through the business continuity process—real or not—we always find something we can add or improve to make it better and smoother.”

Crisis communications

Each year, Forrester Research asks organizations about the lessons they had learned from their business continuity plan invocations during events such as the Japan earthquake of 2011 and Superstorm Sandy of 2012. Respondents consistently report that their plans didn’t adequately address internal communication and collaboration.

Establishing a formal crisis communications program is a critical element of business continuity—one that can mean the difference between panic and smooth emergency response. The plan should identify all the stakeholders for emergency communications, including employees, contractors, clients, vendors, media and executive management. The organization’s communications toolkit should include internal and external resources such as telecom, email, public address, intranet, IM, texting and the company website. The communications team should work to convey a consistent message on the company’s behalf via external channels such as press releases, social media updates and interviews with spokespeople. Sample emergency messages can be drafted in advance, tailored to specific audiences and modes of communication; these can be updated quickly during an actual emergency to reflect current conditions.

Employee safety

Keeping people safe should be the top priority in any emergency response. There are many ways to develop an employee safety program. Local agencies such as the Red Cross, fire department, police department and federal entities, such as the FEMA Community Emergency Response Teams (CERT) in the United States, can provide emergency response training and other guidance for your program. Tabletop exercises can help you develop and refine the right procedures to fit your workforce, facilities and locations. Once your program is in place, it should be included in new employee orientation and reviewed regularly with all employees. Emergency evacuation procedures should be reviewed and tested frequently, and employees should know where to find business continuity documentation at all times. During an emergency, pay careful attention to peoples’ stress levels and make sure they are allowed ample time to sleep, eat and relax.

Want more like this?

Want more like this?

Insight delivered to your inbox

Keep up to date with our free email. Hand picked whitepapers and posts from our blog, as well as exclusive videos and webinar invitations keep our Users one step ahead.

sign up

By clicking 'SIGN UP', you agree to our Terms of Use and Privacy Policy

SIGN UP

By clicking 'SIGN UP', you agree to our Terms of Use and Privacy Policy

Business continuity planning checklist

Workforce continuity: enabling uninterrupted access to business resources

Datacenter continuity can keep IT operations up and running—but what if people themselves have been displaced from their usual workplace, or have lost access to their usual devices or systems? As Michael Emerson of Citrix says, “The workforce absolutely has to be a component of any business continuity program. Protecting data is only part of the picture; you also need to make sure that business processes and customers don’t suffer adverse effects because people are unable to do their jobs.”

While business continuity has traditionally revolved around a designated alternate workplace or recovery unit, organizations increasingly use remote access tools to enable people to work wherever it’s most convenient and effective. People who need to work at the disaster site itself, such as business continuity team members, emergency response workers, critical service workers and others such as insurance adjustors, can be housed in any available structure or mobile unit, without the need for special infrastructure or complex connectivity. According to Forrester Research, 81 percent of businesses have made remote access technologies part of their business continuity plans.

Headquartered in Ft. Lauderdale, Florida, Citrix has ample firsthand experience with business continuity events. Says Emerson, “We’ve relocated people to hotel conference rooms, shifted our workload around the world based on facilities closing, rapidly increased capacity in other areas based on potential disasters— we’ve done it all many times, especially when it’s hurricane season in Florida. The service we provide both internally and externally to our customers has never been affected. It’s a real credit to the workforce flexibility enabled by our technology.”

During routine operations, Citrix technologies let people connect with information and other people on-demand from anywhere so they can work whenever, wherever and however they choose. In an emergency situation, the same tools empower people to do whatever their priorities dictate—whether to continue working normally, perform new tasks required by the event, or focus on the needs of their families and themselves, then resume work as circumstances allow. The use of the same tools during both emergency and routine operations also enhances the effectiveness of the business continuity plan; instead of having to get used to disaster mode as an entirely different way of working, people are always working the same way and accessing the same experience regardless of their circumstances. All that changes is their physical setting.

Conclusion

The essence of business continuity is to minimize the impact of disruptions on people and the datacenter resources they rely on. In the past, organizations have had to rely on alternate work methods and locations in such situations, forcing people to adapt to unfamiliar ways of working at the same time they’re coping with the stress and uncertainty of the event itself. Remote access technologies provide a better approach, allowing people to work exactly the same way during an emergency as they would on any other day—even if their location, network and device have all changed. Seamless access to their usual apps, data and collaboration services help people and business units stay productive. IT can protect and control business information accessed from any location on any device and in any situation, maintaining security and compliance throughout the event. By leveraging everyday infrastructure, this approach also eliminates the need for separate business continuity access tools and devices, reducing the cost and complexity of business continuity planning.

Many IT organizations are already intensely focused on improving the mobility of their workforce and the remote access tools available to them. By incorporating these capabilities into your business continuity strategy, you can protect your organization far more effectively against the risks posed by planned and unplanned disruptions.