Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Don't Wait for Disaster

Security managers are covering their bases to curb the effects of an avian flu pandemic. We look at what some are doing.

Security managers are covering their bases to curb the effects of an avian flu pandemic. Here's what some are doing.

In the insurance business, planning for the unexpected is all in a day's work. But for the past several months, Paul Klahn has been planning for the unthinkable: an avian flu pandemic.

As information security officer for Assurant Employee Benefits, a Kansas City-based unit of insurance firm Assurant, Klahn is part of a team preparing the company should a pandemic strike. Team members plot out how to weather scary scenarios like severe workforce shortages, the need to keep employees apart and a possible surge in claims.

"You have to start planning," Klahn says. "Everything I've read from the Centers for Disease Control (CDC) and the World Health Organization (WHO) characterizes it as a real threat."

The warnings from experts about the possibility of an avian flu pandemic are certainly ominous. According to WHO, the H5N1 virus--a strain of avian influenza--has "considerable" pandemic potential. If the virus becomes fully transmissible between humans, it will spread throughout the world in three months, the organization believes.

If a severe pandemic similar to the devastating 1918 Spanish flu hits, U.S. officials estimate that 90 million people could become infected and 1.9 million may die. They advise businesses to expect an employee absenteeism rate of up to 40 percent due to illness, employees caring for ill relatives and fear of infection. The World Bank forecasts the economic impact of a pandemic on the U.S. at $350 billion.

A number of organizations, especially large companies, are heeding these dire predictions. They're figuring out ways to have employees work remotely, initiating employee education campaigns, identifying critical business functions, stockpiling hand sanitizers and masks, and making sure their suppliers are also preparing.

"If we have a 1918-like pandemic, it's going to be brutal," says Jay Schwarz, vice president of information systems at Alex Lee, a Hickory, N.C.-based wholesale and retail food company. "There are things that companies can do to prepare that could be the difference between survival or not for any organization."

A survey of 222 North American companies conducted by Gartner last year showed only tepid interest in conducting pandemic planning, but analyst Roberta Witty says that's changed this year, with about 20 percent looking to plan. Certain industries are more proactive than others, including financial institutions, food distribution companies and transportation firms, she says.

Aside from planning to have employees work at home by beefing up VPN capabilities and adding videoconferencing technologies, companies need to look at how they'll handle inventories--especially in our just-in-time economy--and adjust human resource policies to handle extended absences, travel and the myriad issues a pandemic presents.

"Some say it's like Y2K, a non-issue...but responsible companies put steps in place so the Y2K issues were addressed," says Ken Wilson, a management consultant who specializes in pandemic planning. "If responsible companies prepare and educate employees, we have a good chance of minimizing the [pandemic's] impact on our country."

Catastrophe Planning
At Assurant, planning for a possible avian flu pandemic began in earnest earlier this year. The employees involved in the effort serve on a handful of committees representing various departments, including IT, healthcare and human resources.

"It's a significant effort," says Klahn, who is on the IT committee. "We're running down every scenario we can."

For example, a pandemic may cause claims to go up, so the company--which has about 12,000 employees--needs to plan accordingly so it can best serve its customers.

Being able to have employees work remotely, either at home or elsewhere, is a top priority that comes with plenty of challenges. Experts suggest that paper-based processes and privacy regulations such as HIPAA are some of the issues companies face in creating offsite work situations. In some instances--such as customer-service representatives needing sensitive data to handle calls--having employees work at home raises privacy issues if that data is on their personal computers, Gartner's Witty says.

Understanding the company's critical business functions has been crucial in the planning effort, especially for IT, Klahn says. Rather than just throwing up a lot of remote-access technology, understanding essential processes can lead to other solutions.

"We have to prioritize which business functions are most critical to keep running. We might repurpose people and give them the opportunity to work in different parts of the company to keep those critical functions going," he says.


In the end, the planning will help the IT department become stronger because it will be more aligned with the business and more agile with enhanced work-at-home capabilities, Klahn adds.

"The reality for us, as a company, is that this type of broad planning just increases our capabilities to serve our customers and employees in the long run," he says.

Officials in Orange County, Fla., also expect a long-term payoff in preparing for a pandemic, which is part of the county's comprehensive emergency management strategy. The county's pandemic planning group includes emergency medical service agencies, hospitals and other community organizations that would respond in the event of an outbreak. The group considers issues such as how to continue services that can't be provided remotely.

"Even if we don't have a pandemic, the planning and infrastructure will serve us well no matter what the emergency is," says Dave Freeman, Orange County health and medical disaster coordinator and manager of the county office of emergency medical services.

"The most important element is the planning process itself. It brings together community partners working toward a common goal," Freeman adds. "As you do this consistently, your overall capability becomes more robust because people are used to working with each other.

You become much more adaptable no matter what the event is."

A Different Kind of BCP
The business continuity team and medical staff at Constellation Energy had been monitoring the avian flu situation since the middle of 2005. At the time, even though the probability of it becoming a pandemic appeared low, its impact would be high, making it a high risk, says Robert Cornelius, director of business continuity at the Baltimore-based Fortune 150 company.

"We look at everything from a risk perspective," he says. "We felt that the prudent thing to do was to start planning for this [possible pandemic outbreak]."

Protecting its 9,700 employees and keeping critical businesses functioning in the event of hurricanes or other disasters have always been priorities for Constellation. While the company could have used its existing business continuity plans (BCPs)--which identify critical business processes--as a starting point, a pandemic required additional work.

"This is an attack on your human resources," Cornelius says. "We felt we needed very specific plans."

Together with Constellation's medical and safety departments, his team spent time with experts to understand the threat, educated upper management on the risk, won senior leaders' endorsement for the planning effort and reached out to the company's business units.

In a worst-case scenario, in which a pandemic results in many infections and deaths, companies need to plan for how they'll take care of employees who must come into the facility to perform critical functions, Cornelius says.

"There are certain crucial functions that people have to come into our facilities to perform, like control room operations, electric substation repairs and gas emergency response," he says. "We need to have plans for those people to work. Other folks, we'd have work at home.... We're going to try to protect our people as best we can. So for the people coming in, we need to make sure we have the proper operational plans and supplies."

To that end, Constellation has stocked up on gloves, masks and bacterial cleaners. It is also educating employees on how to prepare at home for emergencies, including a pandemic. Using "lunch-and-learn" seminars and department safety meetings to educate employees has been effective, Cornelius says.

Every company should focus on educating employees about the pandemic threat, says Harold Bingham, business continuity program manager at Monster.com. He's done presentations throughout the online career firm to prepare employees.

"To the extent that your employees are informed, it's a higher likelihood that the panic and fear will be diminished," he says. "That's going to be key."

Lessons Learned
For Intel, the SARS crisis was a learning experience that's helped the chip giant prepare for a possible avian flu pandemic. In 2003, when Severe Acute Respiratory Syndrome was hitting Asia, Intel was forced to cancel conferences in the area and close an office in Hong Kong after an employee showed symptoms of the disease.

As the crisis unfolded, Intel put in place safeguards and established mechanisms for staying in touch with WHO and other health agencies about outbreaks, says spokesman Chuck Mulloy: "We'll monitor their activities closely and step up the response depending on what's called for in any place in the world where we have facilities."

A company-wide leadership task force has developed plans and supplemented existing policies so that Intel can respond in the event of a pandemic.

For example, the company has had a telecommuting policy for years, but needed to make sure it would apply in the event of an outbreak, says Jim Wick, task force chairman and environmental health and safety manager for the Americas at Intel. Human resources policies, including pay practices and travel support, have also come under scrutiny.

Workforce planning has included telecommuting, but, since Intel is a manufacturer, it has had to plan how to maintain business functions while protecting employees who must work onsite. The company has developed facility cleaning procedures, which include personal health and hygiene practices, such as the usage of antibacterial hand cleaners.

"And, we've tested. Every major business unit and site has gone through a pandemic exercise or drill," Wick says.

Intel has shared its preparations with its contractors and suppliers, and has encouraged them to plan, too. "We have some key suppliers; if they are crippled by the disease hitting their employee base, that hurts our business, too."

The task force has also done a lot of education for its nearly 100,000 employees, including an intranet site with tips on how they can safeguard their families from contagious diseases.

All of the planning is what Wick calls prudent preparedness. Unlike other companies, such as airline firm Virgin Atlantic, Intel made a policy decision not to stock antiviral medicine Tamiflu.

"I think we've done the prudent thing for our business--to protect our people, which are our most valuable resource," he says.

If a pandemic hits, it could last for weeks or months, notes Don Ainslie, global security officer at Deloitte & Touche. Once it's over, organizations will be evaluated on "how well they treat their people and how they service their clients," he says.

Food Industry Preps
After the epidemiologist who advises Alex Lee on food safety issues told executives last year about the pandemic threat, the company didn't waste any time. Information systems VP Schwarz pulled together a task force of 16 people from all parts of the business to brainstorm how the industry would be affected by a pandemic, and how the company would respond. The group came up with more than 120 ideas, which are summarized in a document that Alex Lee has made publicly available.

"We're in the food business, and we serve a lot of communities in the Carolinas. People have to eat--we have to keep this food supply going. We made a decision that this [planning] isn't going to be a competitive thing," Schwarz says. "We wanted to get the industry to wake up to this risk."

The group's report takes into account various scenarios such as consumers avoiding restaurants, and increased demand for online shopping and home delivery, and lists recommendations for dealing with those situations.

Coming up with the ideas was fairly easy, but putting them into action is difficult, and Alex Lee has a long way to go in its preparations, he says. The company has spent a lot of time analyzing its employee base, thinking through situations such as filling in a shortage of truck drivers with employees who aren't drivers but have the credentials.

Another focus is employee best practices in a pandemic: using phone and email instead of face-to-face meetings whenever possible. But having employees work remotely is fraught with problems, including security, ample VPN bandwidth and a reliance on the Internet running properly, Schwarz says. "If your job requires paperwork, how's all that going to flow?"

A big part of what his company does is distribute food to grocery stores, a job that obviously can't be done remotely. "We get pallets in from manufacturers and get them to grocery stores. You can't do that from home," he says.

Making sure its vendors also are preparing for a pandemic is another big focus for Alex Lee, and company executives have met with vendors to discuss how to maintain the supply chain in the event of an outbreak.

Schwarz advises other organizations embarking on pandemic planning to get upper management on board: "It's impossible to address this issue without top management support. You need resources in terms of people and money if you're going to do it seriously."

Preparing for such a catastrophe raises a lot of tough issues, but companies are better off thinking through them now, he adds.

"Even though it's difficult, it's got to be easier than waiting for the pandemic and having chaos," Schwarz says. "Pandemic planning is not optional."


Dig Deeper on Information Security Incident Response-Information

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.