What a People-Centric Business Continuity Plan Looks Like

Just as we as individuals make provisions for a possible contingency, imagine what you need to do to prepare for an eventuality and be able to operate the most critical processes for which you are responsible in a company, whether they are legal, financial, technological, or human-related.

Imagine you are responsible for designing a response plan for a trading company of over 22,000 employees in one of the largest cities in North America, where the board committee has agreed the following two catastrophic disasters are the most likely to occur: the first one a Richter scale 8 magnitude earthquake, and the second a ransomware attack, with the contingency condition that in a matter of minutes, the personal computer equipment and local IT servers are lost, and instantly the redundancy, security, continuity protocol must be activated in an alternate data center, avoiding any data loss and recovering the human capital operation.

To accomplish that, you must dedicate several months of work, individually and collectively in remote sessions and workshops, detailing key operational processes of human capital related to employee services, payroll, and compliance, and consolidate as a northern region a comprehensive file with 150 pages — the Business Continuity Plan (BCP) — communicate and train each key member, and successfully perform three simulations.

That sounds OK, but is it easy to do?

What Is a Business Continuity Plan?

A BCP is formally designed in advance to ensure roles, explanations, and scope in case of an eventuality. It allows for key members to be aware of what to do in that situation and how to coordinate the technical and human efforts to ensure continuity of the essential processes of the business during an interruption and continue delivering products and services to customers while also fulfilling mandatory obligations. This significantly helps to focus the team, reducing the risk of improvisation.

Ironically, the detailed plans and resource allocation are more focused on data protection and hardware over the people who will carry out the contingency plan. Commonly, it is assumed that someone in human resources will make things happen.

What will result from this is failure. Who is responsible when in a non-simulated catastrophe, the plan does not help?

Let's review the ransomware scenario:

• In a simulated crisis, the first thing you need is the formal declaration that the company is under attack, but in a real scenario, employees, customers, and IT teams spend several hours discovering that they are really under an attack because the problem looks more like a connection error or software update failure than a threat.

• A cyberattack does not usually occur within the same time frame  as in a simulation. Besides that, the attack expands within a few minutes by locking the network, systems, and servers and at the same time infecting thousands of computers. Hence, the response time of the internal team assigned to mitigate the attack is quickly exceeded.

• The team's morale drops when they discover that the damage is very real.  The reputational impact of social media is exposed at that moment and  collective paranoia starts that it will worsen with another attack, affecting the work dynamic and creating distrust of the one who needs it most.

• Due to security and confidentiality protocols, key information is only kept in a safe environment, which paradoxically cannot be accessed for security reasons, making it impossible to retrieve employee emergency contacts, payroll data, and compliance protocols.

• Result: Hardware and software are taken offline, and the company is paralyzed. HR can reach and communicate to leaders and employees regarding payroll failure, and that governmental obligations and mandatory reporting to the stock market can’t be delivered.

• Real BCP: Everything that was previously marked and prohibited, even in the plan, is now encouraged, amid the emergency and chaos, including using personal computers and phones, allowing personal emails and public internet networks to start operating at a minimum  and start creating new information to make decisions.

Now let's review what happens in the case of an earthquake:

• The gravity of the situation is discovered very quickly, within a few minutes of the event, and even though it may occur during work hours, the response time of the internal team will directly depend on the seriousness of the damage and fatalities.  

• The internal team will give priority to solving any personal and family situations, not the needs of the company as the BCP outlined. This is a serious matter that simulations omit because fear and anguish cannot be disconnected.

• When a city collapses due to a catastrophe, power cuts occur, insecurity starts to rise, transportation networks collapse, meaning the team can’t get to work,  and water and food shortages occur.

• Result: Hardware and software are online in a remote data center, and the company is partially paralyzed. There are not enough HR staff to run the basic processes.  

• Real BCP: After the first seventy-two hours it starts to get more difficult for the team to move forward with daily work without the usual tools and comforts. This is in addition  to the request to deliver new information, and to focus on moving critical processes to alternate working sites. Complaints and non-compliance begin.

What a People-First Recovery Plan Should Include

According to the 2024 HR Budget and Efficiency Benchmarks from Gartner, the average for HR functional spend as a percentage of revenue is only 0.76%. Compared to other support functions such as IT with 3.25%, or sales with 4.37%, HR receives one of the lowest investments in the people who are creating the results.

Build BCPs that protect your people first because, without them, the company serves no purpose. Protect humans on the ground better than you protect cloud-based data.

Health and wellness support: Work overload, with so many technical limitations, uncertainty, pressure, and fear, results in a uniquely stressful situation that not everyone is ready to deal with. It is essential to prepare and provide support, before and during the crisis, to the people in charge of restoring operations, and to extend this support to their family environment.

Flexibility amid crisis: Having access to information and systems that do not depend on the internal network, backups, and access to encrypted data in alternate storage, recovery equipment that depends more on a service provider than on an internal one, and a tolerant environment with remote protocols make a difference when you need it most.

Fair and adaptive leadership: Use employee feedback to adjust recovery plans in real time, adapt resources, and embrace new, emerging leadership to solve critical needs before following rigid work protocols.

In a real apocalypse, the data and firewalls won’t boost morale, inspire, and motivate people to go further. Make decisions based on people, and the HR team will do the rest.

It took 48 hours to get the 150--page BCP file during the real emergency, and it was unnecessary.