Difference between revisions of "Continuity of Operations"

Revision as of 22:11, 21 April 2020

About

Here we present a checklist of items to consider for maintaining business continuity during institutional closures, specifically when circumstances do not allow some or all staff to be on site.

Contributors

Breda Zimkus

Introduction

Various emergencies, including acts of nature, accidents, technological emergencies, and military or terrorist attack-related incidents, have increased the need for viable continuity of operations capabilities and plans that enable institutions to continue their essential functions across a spectrum of emergencies. Institutions may suffer damage roadways may be inaccessible due to man-made incidents or natural disasters, such as floods, hurricanes, tornadoes, earthquakes, or wildfires. In addition, public health emergencies may require staff to stay home to prevent or contain outbreaks. We have learned many lessons from events over the last twenty years, including terrorist attacks on September 11th, large-scale blackouts, and the COVID-19 pandemic. For related topics, see Emergency Management, Disaster Planning, and Risk Assessment.

Continuity of Operations Policy

Many institutions may have had a disaster preparedness plan, but the COVID-19 pandemic revealed that many did not have a continuity of operations plan. Continuity planning ensures that an institution can execute its mission, perform essential functions, and deliver services to its stakeholders through all circumstances. Although certain assets may be damaged or inaccessible, the institution as a whole should not fall victim to the event. Institutions should have both short-term and long-term plans if the collections remain inaccessible. According to the Federal Emergency Management Agency (FEMA) in the U.S., continuity plan objectives are generally to:

• Ensure that institution can perform its mission essential functions under all conditions
• Minimize property damage and loss
• Execute a successful order of succession with accompanying authorities in the event a disruption renders leadership unable, unavailable, or incapable of assuming and performing their authorities and responsibilities of the office
• Reduce or mitigate disruptions to operations
• Ensure that institutions have facilities where it can continue to perform its mission essential functions during a continuity event
• Protect essential facilities, equipment, records, and other assets, in the event of a disruption
• Achieve the institution’s timely and orderly recovery and reconstitution from an emergency
• Ensure and validate continuity readiness through a continuity test, training, and exercise program and operational capability
  

FEMA identifies four phases in a continuity of operations plan:

1. Readiness and Preparedness: The first phase is the ability of an organization to respond to a continuity event, including institutional continuity readiness and preparedness activities.
   
2. Activation and Relocation: Phase II should explain continuity of operations plan activation procedures and any relocation procedures. The plan must provide a process or methodology for attaining operational capability with minimal disruption to operations within. This section should also address procedures and guidance for non-relocating personnel. Continuity Plan activation and relocation are scenario-driven processes that should allow flexible and scalable responses to the full spectrum of emergencies and other events that could disrupt operations with or without warning during business and non-business hours. Continuity Plan activation is not required for all emergencies and disruptive situations, since other actions may be deemed appropriate. The decision to activate the Continuity Plan and corresponding actions to be taken are tailored for the situation, based upon projected or actual impact and severity, that may occur with or without warning.
   
3. Continuity Operations: Phase III should identify initial arrival procedures as well as operational procedures for the continuation of essential functions. A significant requirement of this phase is to account for all personnel.
   
4. Reconstitution: The last phase identifies and outlines a plan to return to normal operations once organization heads determine that reconstitution operations for resuming normal business operations can be initiated.

Notification and Essential Personnel

• Institutional management should be familiar with continuity of operations policy and know individual roles and responsibilities in the event of plan activation.
• A formal notification system or phone tree should be in place to notify employees about an incident and inform them whether they should plan to work from a secondary site or from home.
• Staff should understand whether they are or are not permitted to be on-site, and this can most easily be done by the identification of essential personnel. Employees deemed essential have permission to access the collections when institutions have been closed to perform duties. These staff may need to 1) care for live animals or 2) tend to temperature-sensitive equipment (e.g., cryogenic freezers).

Packages and Mail

• Have a system in place so incoming mail can be monitored to identify any temperature-sensitive or important materials. For some institutions, this may include leaving contact information posted on doors so that personnel are called when packages are delivered.
• If possible, inform stakeholders that they should not send specimens or other materials during a specific time period when a collection is closed. This is especially important if stakeholders are unaware of local or regional issues that may have led to institutional closures.

Checking on Collections

• If it is safe to do so (and social distancing can be maintained in the case of a pandemic like COVID-19), the institution should be visited on a regular (e.g., weekly) basis to check on collections.
• If there is already someone on site regularly, such as a security officer or building operations personnel, consider creating a checklist for that individual to use and report back to you if visiting in person is not possible.
• You be able to check in on collections remotely by using security cameras.
• Dataloggers and water alarms can also be installed to alert you via phone or email if environmental conditions have gone out of range.

Communication with Stakeholders during Closures

• The ability of an organization to execute its essential functions depends on communication with stakeholders during crisis and disaster conditions.
• Some phone systems will allow you to either activate call forwarding or configure simultaneous ring so that your primary telephone number rings on a non-institutional phone number, such as a cell phone. If neither of these are options, you may consider changing your voicemail greeting to indicate that staff are currently working remotely and stakeholders should use other means, such as email, to contact staff.
• Contact researchers who made plans to visit the collections, give seminars, or come to the institution for other reasons should cancel or reschedule their visit.
• Update websites to indicate institutional or collection closures.
• Be aware that any automatic notifications associated with transactions, such as expired loans, may need to be suspended during time period when collections are closed.

Preparing to Work Remotely

Computers and Software

• Confirm that staff have work-issued laptops and/or personal computers are updated and secure if being used for business purposes. Institutions should consider having laptops issued to staff instead of desktops for business continuity purposes.
• Regardless of whether a work-issued laptop or personal computer is being used, a virtual private network (VPN) is recommended. A VPN extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network.
• Have staff check to make sure that all the applications that they need to complete their work and attend virtual meetings.
• Consider using cloud-based system to store needed files and documents, so staff can always access documents remotely.
• Staff may be able to digitize materials at home using mobile apps on Smart Phones, so remind them to bring home any relevant documents.
• Make sure that staff can access departmental shared drives remotely.
• Suggest the use of online collaboration tools (e.g., SharePoint, GoogleDocs) instead of email to share documents among staff.
• Confirm that built-in microphones and cameras are functioning as they will likely be needed for video conferencing.
• Ensure that all additional computer equipment (e.g., home cables, power adaptors) are taken to remote locations.
• Make sure that you have any required passwords.

• If possible, do a test run of laptops at home to ensure that everything that will be needed during remote work is functioning properly.

Projects and Employee Expectations

• Identify projects that staff can work on remotely. This may require shift from specimen-based curation to data-driven work.
• Do hands-on training and/or testing of workflows while staff before staff are working remotely.
• Have managers and staff discuss expectations regarding remote working should the institution have a temporary or long-term closure.

References