RESILIENCE

TOOLKIT

Strategies and actions for business, government, or development organizations to ensure ongoing viability. 

Resilience Toolkit Icons

CHAPTER 2 Managing To Be Resilient

To mitigate the impact of an emergency, like the COVID-19 pandemic, on businesses, workers, customers, communities, and the general public, employers need to plan. That process may involve updates to existing plans related to specific, identifiable dangers or risks. In the case of a pandemic, that may require information from infectious disease experts. In other cases, knowledge of severe weather, cyberthreats, disaster, and other threats is important.


Employers or communities who have not prepared for an emergency or disaster should prepare themselves and their workers as far in advance as possible to avoid worsening the effects of the emergency. Lack of continuity planning can result in a cascade of failures as employers or communities attempt to address challenges with insufficient resources and workers perform jobs they might not be adequately trained for under less-than-ideal conditions.


This guidance is intended for planning purposes. Employers, communities, and workers should use this planning guidance to help identify risk levels in workplace settings and to determine any appropriate control measures to implement. Additional guidance may be needed.

Know Your Operations


The operations of an organization or a community are essentially its core activities. It is important to document these key functions and processes critical to the survival and ongoing vitality of your organization.


Determine Key Operational Functions


Production, sales, service delivery, communications, accounting, and research are just a few examples of key functions or departments. Listing and acknowledging the importance of these anchors will keep your organization or community running smoothly and maximize its success. 

  • What are the key functions critical to the stability and profitability of your organization?


Establish Recovery Process


Organizational recovery is achieved through a set of actions to help an entity get through difficult times.


  • Determine priority level for the recovery process.
  • Identify individual(s) responsible for seeing this recovery process through.
  • Determine if training will be required, and if so, establish a timeline for completion.
  • Identify how the organization is obligated to complete the recovery process, along with potential money lost or fines that could be imposed.


Determine Entities Involved

Recognize each operational function or department and its experts who specialize in specific areas.


  • What is the key operational function?
  • Who performs this function?
  • Who helps perform this function?
  • What is needed to perform this function?
  • Who uses the output from this function?
  • How is this function completed?

Resources Required To Support Organizational Continuity


Recovery of a critical or time-sensitive process requires resources. Following an incident that disrupts operations, resources will be needed to carry out recovery strategies and to restore normal operations. Resources can come from within the organization or community or be provided by third parties. 


Identify Resources Required To Restore Organizational Operations


Resources are required to restore organizational operations following a disaster. Since all resources cannot be replaced immediately following a loss, managers should estimate the resources that will be needed in the hours, days, and weeks following an incident.


These resources include:


  • Employees
  • Office space, furniture, and equipment
  • Technology (computers, communication equipment, software, and data) 
  • Vital records (electronic and hard copy)
  • Production facilities and equipment
  • Third-party services
  • Inventory (including raw materials, finished goods, and goods in production)
  • Utilities (power, natural gas, water, sewer, telephone, internet, and wireless)


Identify Critical Software And Data Plus The Hardware Required To Run Them


Organizations and communities should compile an inventory of hardware (e.g., servers, desktops, laptops, and wireless devices) and software applications. The plan should include a strategy to ensure that all critical information is backed up.


Using standardized hardware will help to replicate and reimage new hardware. Ensure that copies of program software are available to enable reinstallation on replacement equipment. Prioritize hardware and software restoration. 


Documentation should include:


  • Hardware type 
  • Capacity
  • Model
  • Serial number
  • Date purchased
  • Cost
  • Person issued to
  • Software name
  • Description
  • Version
  • License number
  • Date inventoried
  • Inventoried by
  • Location

Develop Recovery Strategies


Recovery strategies require resources including people, facilities, equipment, materials, and information technology. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps. For example, if a machine fails but other machines are readily available to make up lost production, then there is no resource gap. However, if all machines are lost due to a flood, and insufficient undamaged inventory is available to meet customer demand until production is restored, production might be made up by machines at another facility — whether owned or contracted.



Strategies may involve contracting with third parties, entering into partnership or reciprocal agreements, or displacing other activities within the organization or community. Individuals with in-depth knowledge of organizational functions and processes are in the best position to determine what will work. Possible alternatives should be explored and presented to management for approval and to decide how much to spend.


POSSIBLE RECOVERY STRATEGIES


Use other owned or controlled facilities performing similar work. Operations may be relocated to an alternate site — assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to take on the work of the impacted site. Prioritizing production or service levels, providing additional staff and resources, and taking other action would be needed if capacity at the second site is inadequate.


Telecommuting is a strategy employed when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters have a suitable environment in their home to work and are equipped with or have access to a computer with required applications and data, peripherals, and a secure broadband connection. In an emergency, space at another facility can be put to use. 


Many vendors support business continuity and information technology recovery strategies. External suppliers can provide a full business environment, including office space and live data centers ready to be occupied. Other options include the provision of technology-equipped office trailers, replacement machinery, and other equipment. The availability and cost of these options can be affected when a disaster results in competition for these resources.


Cafeterias, conference rooms, and training rooms can be converted to office space. Equipping converted space with furnishings, equipment, power, connectivity, and other resources would be required to meet the needs of workers. 


Partnership or reciprocal agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation, and allocation of expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. A periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.


The development of manual workarounds is a recovery strategy used when information technology resources are not available. Develop manual workarounds by outlining steps in the automated process and identifying intervention points. Creating a diagram of the process can help. Manual workarounds require manual labor, so you may need to reassign staff or bring in temporary assistance.


Reduce Potential Disruptions


By identifying potential problems and creating a plan, you can minimize disruptions to your organization or community before they take place.


Items To Consider


  • What plans do you have in place if you are no longer able to use your current location for organizational operations?
  • What must be addressed to ensure that services, products, or inventory remain at levels similar to those under normal circumstances?
  • Are there concerns about potential spoiling or contamination of perishable stock?
  • If the power goes out, do you have access to resources to get everything up and running again?
  • What are the details of your shutdown and startup plans?

Emergency Response Planning


Essential to resilience management is to review — or create if needed — an emergency response plan that includes a risk assessment of potential emergency scenarios. An understanding of what can happen will enable you to determine resource requirements and to develop plans and procedures to prepare your organization. 


Determine Protective Action


Every emergency response plan should address the four main protective actions:


  1. Evacuation
    A hazard within a building such as a fire or chemical spill requires occupants within the building to be evacuated or relocated to safety.

  2. Sheltering
    A severe weather warning is sounded. Everyone should be moved to the strongest part of the building and away from exterior glass.

  3. Shelter In Place
    A transportation accident on a nearby highway results in the release of a chemical cloud. The fire department warns to shelter in place.

  4. Lockdown
    An act of violence by an intruder should prompt a “lockdown” broadcast, notifying everyone to hide or barricade themselves from the perpetrator.


Develop Emergency Response Teams

Emergency response teams are groups of people who prepare for and respond to emergency incidents such as natural disasters, security threats, public health crises, or other potential business disruptions.


  • Identify team lead and team members.
  • Compile team member contact information.
  • Clearly define each team member’s emergency response duties.


Define Protective Action Procedures

Protective action procedures are actions taken to reduce or eliminate exposure to a hazard.


  • Define the most appropriate action to ensure the safety of all individuals within the building. 
  • How will you warn building occupants to take protective action
  • Determine protocols and procedures to alert first responders. 
  • Identify how you will communicate with management and employees during and after the emergency.


Identify Public Emergency Services

Protecting the safety of people and property is the primary goal of local emergency services (fire department, police department, emergency medical services). They are available to help in times of disaster or crisis.


  • Compile contact information that is readily available to all.
  • Talk with public emergency services to determine their response time to your facility, knowledge of your facility and its hazards, and their capabilities to stabilize an emergency at your facility.
Share by: