Continuity Planning Tips and Advice  

By Barbara DePompa

Prioritization, Periodic Analysis, Telework and Partners Can All Help

Officials at CDWG, along with industry observers and others interviewed for this report offered several recommendations to assist federal government organizations in their ongoing continuity planning efforts.

Here are some of their recommendations:

TIP: The most important part of any COOP plan is to prioritize risks. Think of the key pain point for that specific organization. If agencies don’t have the potential threat aspects included in the organization’s COOP checklist, then that checklist isn’t properly tuned to aid in recovering key assets, said Michael Montecillo, principal analyst at Enterprise Management Associates in Boulder, Colo.

TIP: Don’t stop planning. Conducting a periodic gap analysis to align IT operational capabilities with critical recovery risk mitigation priorities would likely have offset the impact of the July 4 web site attacks, for example.

TIP: In the intensifying relationship between security and COOP, the use of layered security solutions that include whole-disk encryption and advanced authentication technologies such as single sign-on or biometrics can greatly improve data protection and systems security, while allowing workers to stay productive from almost any location.

TIP: System passwords should be kept in at least two geographically separate, secure locations. Make sure that more than one IT staff person has access to the critical passwords and codes. And be sure to change the passwords immediately when key personnel leave the organization. 

TIP: It may help to start with a pilot Telework program that targets employees for COOP recovery operations. CDW-G officials recommend starting with one day per week of Telework to acclimate both employees and managers to the new work-management environment.

TIP: Because government organizations must create a robust, tested and ready continuity of operations planning (COOP) program, CDWG officials maintain that the plan must either include elements to enable remote workers to function during an emergency, or reflect the loss or mission impact of the downtime for all affected employees.

TIP: Don’t forget the partners who can help. Government organizations must rely on their industry suppliers and services partners more, especially in the aftermath of a disaster. Agency COOP planners should know who their key suppliers (including ISPs) are, and validate that those suppliers can do what they promise, in the aftermath of a disaster.

TIP: Practice, practice, practice. An unrehearsed, untested continuity plan is worse than no plan at all. Stress test the existing remote access system will ensure it can handle the load should most employees need to work remotely due to a pandemic flu outbreak, a storm or some other emergency.

TIP: Invest in the process, people and training needed for sustainable continuity of operations. The personnel responsible for helping the organization to recover after an event require continuous training and skills development. The organization can’t rely on one person with a pager. It’s important to identify and cross-train a team of employees capable of responding to emergencies. This team should be geographically dispersed in case of a large environmental disaster that affects local employees.