Boost your department's "Flu IQ"
First and foremost, companies should educate their employees about the flu. IT managers should coordinate with human resources or the executive team to make sure employees know how to prevent the spread of the virus and how to recognize the symptoms of the illness, and to determine the conditions under which employees should not come to work.
For example, a company may specify that anyone with two flu symptoms -- fever and muscle aches -- should stay home, says McGee. The company also should clearly spell out its policy on staying home to recover from the flu or to care for sick loved ones.
Most important, says McGee, the organization should demonstrate that it is as concerned about the health and safety of its employees and their families as it is about business continuity. "There's no way in the world you're going to get IT employees, or any employees, to address the needs of business before they address the needs of their families," says McGee.
Inside the IT department, mandate that employees wipe down all hard surfaces with antibacterial cloths every day. Data centers, in particular, can be breeding grounds for the flu because the air is recirculated and typically colder than normal, which can aggravate nasal passages and make them more susceptible to the flu, says Kevin Burton, CEO of Burton Asset Management, which specializes in disaster recovery and business continuity. "You're more likely to get sick from an airborne illness in a raised-floor environment like a data center or in an airplane than you are sitting in a cube farm or in a Starbucks," he says.
Clarify goals with top management
The most critical step in developing a detailed IT pandemic plan is to get guidance from the top. "The biggest mistake clients make is they assume they have to put together this complex response plan before even discussing things with management," says McGee.
Ask the CEO and the board what they want to do if there is a serious outbreak. First, at what rate of absenteeism should any pandemic response plan go into effect? Would parts of the company be shut down? How many people, and which ones, would need to be outfitted to work from home? Without answers to such basic questions, IT could spend a lot of time and money setting up remote access capabilities for hundreds of people, for example, when only 50 were needed.
Identify critical skills
In disaster recovery, it's common to identify systems that are critical to business operations, notes Burton. But the people who are critical to those operations are often overlooked. For that reason, a skills assessment is a key next step in any pandemic plan.
"Once you've identified the critical applications that support the business functions, you have to drill down further and say, 'So who supports those? Do you have only a few people with these skills? Or do you have multiple people who can do this?' " says Barry Cardoza, vice president and manager of business continuity for Union Bank NA in San Francisco.
For example, you may have only a handful of overnight tape-backup operators companywide. It's a relatively low-level job that's often not on management's radar, yet it's a vital function, says Burton. If all your tape operators are home sick, the organization might go a couple of weeks without a backup.
McPherson recommends that companies cross-train employees. Build a matrix of critical skills and train at least three people in each skill or task, he suggests. "So if both Jim and Joe on the server team are ill with flu, then Susan can step in and reconfigure a server or add some users to the network," says McPherson.