Pandemic Response Planning Policy

This policy is intended for companies that do not meet the definition of critical infrastructure as defined by the federal government. This type of organization may be requested by public health officials to close their offices to non-essential personnel or completely during a worst-case scenario pandemic to limit the spread of the disease. Many companies would run out of cash and be forced to go out of business after several weeks of everyone not working. Therefore, developing a response plan in advance that addresses who can work remotely, how they will work and identifies what other issues may be faced will help the organization survive at a time when most people will be concerned about themselves and their families.

 

Disasters typically happen in one geographic area. A hurricane or earthquake can cause massive damage in one area, yet the worst damage is usually contained within a few hundred miles. A global pandemic, such as the 1918 influenza outbreak which infected 1/3 of the world’s population, cannot be dealt with by failing over to a backup data center. Therefore, additional planning steps for IT architecture, situational awareness, employee training and other preparations are required.

 

This document directs planning, preparation and exercises for pandemic disease outbreak over and above the normal business continuity and disaster recovery planning process. The objective is to address the reality that pandemic events can create personnel and technology issues outside the scope of the traditional DR/BCP planning process as potentially 25% or more of the workforce may be unable to come to work for health or personal reasons.

 

The planning process will include personnel involved in the business continuity and disaster recovery process, enterprise architects and senior management of <Company Name>. During the implementation of the plan, all employees and contractors will need to undergo training before and during a pandemic disease outbreak.

<Company Name> will authorize, develop and maintain a Pandemic Response Plan addressing the following areas:

The Pandemic Response Plan leadership will be identified as a small team which will oversee the creation and updates of the plan. The leadership will also be responsible for developing internal expertise on the transmission of diseases and other areas such as second wave phenomenon to guide planning and response efforts. However, as with any other critical position, the leadership must have trained alternates that can execute the plan should the leadership become unavailable due to illness.

The creation of a communications plan before and during an outbreak that accounts for congested telecommunications services.

An alert system based on monitoring of World Health Organization (WHO) and other local sources of information on the risk of a pandemic disease outbreak.

A predefined set of emergency polices that will preempt normal <Company Name> policies for the duration of a declared pandemic. These polices are to be organized into different levels of response that match the level of business disruption expected from a possible pandemic disease outbreak within the community. These policies should address all tasks critical to the continuation of the company including:

How people will be paid

Where they will work – including staying home with or bringing kids to work.

How they will accomplish their tasks if they cannot get to the office

A set of indicators to management that will aid them in selecting an appropriate level of response bringing into effect the related policies discussed in section 4.4—for the organization. There should be a graduated level of response related to the WHO pandemic alert level or other local indicators of a disease outbreak.

An employee training process covering personal protection including:

Identifying symptoms of exposure

The concept of disease clusters in day cares, schools or other gathering places

Basic prevention - limiting contact closer than 6 feet, cover your cough, hand washing

When to stay home

Avoiding travel to areas with high infection rates

A process for the identification of employees with first responders or medical personnel in their household. These people, along with single parents, have a higher likelihood of unavailability due to illness or child care issues.

A process to identify key personnel for each critical business function and transition their duties to others in the event they become ill.

A list of supplies to be kept on hand or pre-contracted for supply, such as face masks, hand sanitizer, fuel, food and water.

IT related issues:

Ensure enterprise architects are including pandemic contingency in planning

Verification of the ability for significantly increased telecommuting including bandwidth, VPN concentrator capacity/licensing, ability to offer voice over IP and laptop/remote desktop availability

Increased use of virtual meeting tools – video conference and desktop sharing

Identify what tasks cannot be done remotely

Plan for how customers will interact with the organization in different ways

The creation of exercises to test the plan.

The process and frequency of plan updates at least annually.

Guidance for auditors indicating that any review of the business continuity plan or enterprise architecture should assess whether they appropriately address the <Company Name> Pandemic Response Plan.

Compliance Measurement

The Precision Computer team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

Any exception to the policy must be approved by the Precision Computer team in advance.

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

World Health Organization

 

The following definition and terms can be found in the SANS Glossary located at:

https://www.sans.org/security-resources/glossary-of-terms/

Pandemic