This month’s issue of Homeland Security Today (volume 11, number 3 – April/May 2014) features, along with a variety of other excellent articles, an article titled Virtual Crisis Response by David Smith.  Right up front they provide a thought-provoking factoid… The Congressional Budget Office estimates that the five-year cost of implementing telework throughout the federal government is about $30 million, which is less than the cost of a single day of shutting down federal offices in the DC area due to a snow storm.

Folks, this is 2014.  We have the capability to telework off of nearly any device you could imagine and for a very low-cost.  Like most, I have access to both work and personal email and files from anywhere… from my own laptop, from my smart phone, or from any other internet connected device.  I have this capability as a small business owner using tools that we set up ourselves.  I’ve worked for large corporations and state agencies that also have that capability, and even more with VPN and other tools available.  When speaking with people who work for other companies or government agencies, however, I’m astounded by the lack of interest in allowing telework.  I’m going to refrain from outlining the virtues of telework as a regular operation (don’t get me wrong, there are drawbacks as well), but telework does provide for a means of maintaining continuous business and government operations which many businesses and governments seem to be dismissing.

There are quite a few businesses and governments who maintain remotely accessible email and data as a means of enabling the conduct of business while traveling or working from an alternate site as a normal course of business – thankfully.  Many of these entities, however, due to a lack of trust in their employees, union issues, or simply an inability to adapt do not allow employees to telework.  This may have discouraged employees from even attempting to connect to these services from home, where they may likely be if some event – flood, snow storm, or otherwise – prevented them from going to work.  Maybe you do have the capabilities but generally don’t allow telework.  So how can you be sure that it will work in the event of a disaster?  The answer is simple… you have to test it.

The Homeland Security Today article provides some info on the tech stuff you need to ensure a viable network.  Follow their lead and talk to your tech people – either indigenous or consultants.  I’m not a tech guy, so I won’t even attempt to give that kind of information.  What I will tell you is that you need a business continuity telework policy along with plans and protocols to support it.  These plans need to identify the same critical business functions you identified in your base business continuity plan and address how they can be maintained remotely.  Just like any other plan we put in place, we need to train people to it and test it (exercise it).  How do we exercise it?  For starters, tell everyone (or at least key continuity staff) they don’t have to come into the office on Friday.  No, they don’t get the day off – they have to work from home, but this is a test to make sure it is possible.  Be sure to buy your help desk people something nice that day because they will be busy!  There will be plenty of connection problems.  Properly designed job aids will help facilitate this on the user end, but tech people will be needed to trouble shoot.  Of course before you even get into this you will have to make sure that everyone has the capability to connect from home.  Do they have high-speed internet at home?  Do they have an appropriate device for connecting and working through the day?

Next, once you have everyone on the network, consider how you will communicate.  Teleconference?  Video conference?  Remember that these people don’t have their work desk phones.  What information needs to be exchanged?  What is everyone’s role and can they perform it remotely?  Can they gain access to all the data and files they need?  Test the viability of the network, too… is your server in your office?  What happens if you lose power to your office?  Understand that some employees may experience utility outages during a disaster which may prevent some employees from accessing the network, but the goal is to get as many people on as possible to maintain critical business operations.  Given this, your plan should address how you will maintain critical operations in the absence of some employees – even remotely.

Just like any other exercise, put together an after action report, and not just from the perspective of the IT folks either.  Be sure to solicit input from the employees as well.  What were your lessons learned and what improvements need to be made?  Lastly, don’t just exercise this once.  Do this at least a couple of times each year.  Not only does this give you ongoing feedback of the plan, but it also helps to make sure employees can continue to connect remotely (especially new employees), and also helps to ensure that technology upgrades don’t interfere with remote access.

Do you have telework protocols integrated into your business continuity plan?  Have you exercised them?

© 2014 Timothy Riecker