What are the key considerations for developing a contingency plan for remote workforces?

Disruptions and disasters can affect businesses of all sizes. In many cases, these incidents don’t prevent long-term access to your locations, but when it does, what’s your plan? For many, a work-from-home option for critical functions may seem like the best, or at least the easiest solution. Roadblocks include but are not limited to: - Inaccurate assumptions from leadership - The over reliance on powered devices - No clear understanding of event type - Failure to train and have clearly defined business continuity plans in place - Communication challenges and not having an out-of-band network in place

Assessing hazards for a contingency plan for remote workers involves identifying potential risks such as cybersecurity threats, communication breakdowns, and ergonomic issues. Conduct a comprehensive risk assessment, addressing each aspect of remote work, and tailor your plan accordingly. Regularly update and test the plan to ensure its effectiveness.

Let’s not forget protecting company provided materials that the remote workers keep at home. For instance are laptops and CPUs found in the home, do they have company sensitive or proprietary information on hard drives or thumb drives, do/can printed materials; ie contracts, files, etc secured, have passwords or dongles used and are they secure, are unauthorized people given access to remote work spaces and lastly are the appropriate security containers used to prohibit unauthorized persons from gaining access to materials. These are all considerations that must be considered to have a secure workspace and should be included in any plans.

Developing a contingency plan for remote workforces involves several key considerations. First, identify critical functions and roles that can transition to remote work. Ensure employees have the necessary technology and secure access. Establish communication protocols, including emergency contacts. Address data security and privacy measures. Test the plan, provide training, and maintain flexibility to adapt to evolving situations. Regular updates and clear roles are essential for a resilient remote workforce contingency plan.

In many cases, remote access following a disaster can be a great opportunity to work safely. The problem that occurs that is often overlooked is actual access to the communication infrastructure necessary. In my experience that has been the weak point in the process. While it is not completely insurmountable it does need to be a part of your COOP if you are going to the remote access route.

One thing I’ve learned is that having a good checklist for managers will lower the temperature of your employees and your executive team. It’s important that everyone knows their responsibilities and understands how they communicate with others during the crisis. In addition, larger organizations may find it helpful to form response teams that can be deployed to assist with evacuation, shelter-in-place at physical sites, or coordinate COOP efforts.

Complete a business impact analysis for each business unit and define dependencies, personnel, and what happens in case of an emergency, e.g. where employees go who are on-site, procedures to follow for both on-site and remote workers, and which systems are used to notify them. These plans and processes should be tested and exercised at least once annually.

An updated communication tree needs to be created and maintained. Including emergency contacts when you can't reach your remote workers. Often, a contingency plan can not be activated because teams can not contact their remote workers and assess the situation. Remote workers play a key role in letting their teams know what are the likely emergency events in their region and what would be the most effective way of communication.

I agree with Eric. Exercising this as a part has got to be done at least annually to validate its continued viability for your organization.

Defining roles & responsibilities is always valuable and additional definition will be required for remote employees. For example, what level of internet redundancy is required for remote employees and who supplies it? What will remote employees be expected to do if they can't function at their primary location? Who will be responsible for providing an alternate work location?

In addition to running tabletop exercises for your business continuity plan, each organization should also be conducting simulation based exercises specifically focused on workarounds in the event key systems or processes are taken offline, e.g. MS Teams or a system that allows remote VPN access. This is crucial to injecting stress into the overall process in a no-fault environment and allowing people to fail and struggle, in the hopes that it will enable gap remediation before a real world incident occurs.

In addition to tabletop exercises, periodic live exercises should be conducted. This will ensure that the plan can be executed in its entirety.

Most organizations have an annual requirement to do this, but pro-active organizations do this more than one time a year. Bi-directional feedback is crucial for both leadership and line-level employees. Finally, the plan and accompanying feedback should be put through multiple levels of review to ensure completeness.

One of the most effective ways I have seen is to ask remote workers to play a vital role in updating the plan regularly, as they have first-hand information not only on what to do in the event of a disaster or crisis; but also on how the situation is changing in their region. This is especially true in situations such as the recent pandemic or geopolitical unrest and in the aftermath of natural disasters. Then once a year, there can be a formal revision to validate with the organization that the information is up to date and still effective and relevant.

In my last role, we mandated specific plan update points monthly, quarterly and bi-annually. This ensures that critical elements are current.

When the pandemic occurred, one question arose to the forefront. How far does an organization's duty of care extend to remote employees? Now, most organizations extend the same level of care to their remote employees as they do on-site, to include workplace violence prevention, business continuity, etc. The moral of the story is, don't wait for a real-world event to test these processes. The history books are littered with the carcasses of companies who didn't think it would ever happen to them.

I agree with the other thoughts here. What does the organization do to ensure the health & safety of remote workers? Services like assistance hot lines, or some kind of periodic check-in can be useful.

From a Crisis Management and Business Sustainability perspective, a remote workforce has both positive impacts and negative risks. First, it is critical that an open line of two-way communication is established between business leadership and remote employees. For a centralized disruption event, e.g. a building fire or localized power outage, a remote workforce has the ability to maintain business operations, assuming cloud management. However, during a regional event such as a hurricane, impacts are transferred to the decentralized workforce. Employees should ensure continuity by having adequate supplies such as food/water, fire extinguisher, first aid kit, and portable batteries for business devices such as cell phones/WiFi, and laptops.

Does your organization truly have the capability to support remote access? Everyone tends to believe this is a great way to get the job done. However, if can't really support either short or long term its going to fail.

Companies also need to monitor the likelihood of disaster or crisis in their operating regions. Moreover, they often develop a system to monitor and record the current risk in a given region combined with the impact that an event in that region would have. And they look at this regularly. They have to. This allows them to take preventive actions. For example, if a company is highly dependent on a region where war or political unrest is imminent, this system allows them not to wait for the crisis to arrive but to take action earlier.