© 2012-2023 eCuras LLC. All Rights Reserved.
This policy is intended for companies that do not meet the definition of critical infrastructure as defined by the federal government. Public health officials may request this type of organization to close their offices to non-essential personnel or completely during a worst-case scenario pandemic to limit the disease’s spread. Many companies would run out of cash and be forced to go out of business after several weeks of everyone not working. Therefore, developing a response plan in advance that addresses who can work remotely, how they will work, and identifies what other issues may be faced will help the organization survive when most people are concerned about themselves and their families.
Disasters typically happen in one geographic area. A hurricane or earthquake can cause massive damage in one area, yet the worst damage is usually contained within a few hundred miles. A global pandemic, such as the 1918 influenza outbreak, which infected 1/3 of the world’s population, cannot be dealt with by failing to a backup data center. Therefore, additional planning steps for IT architecture, situational awareness, employee training, and other preparations are required.
This document directs the planning, preparation, and exercises for pandemic disease outbreaks and above the normal business continuity and disaster recovery planning process. The objective is to address the reality that pandemic events can create personnel and technology issues outside the scope of the traditional DR/BCP planning process as potentially 25% or more of the workforce may be unable to come to work for health or personal reasons.
The planning process will include personnel involved in the business continuity and disaster recovery process, enterprise architects, and senior management of eCuras. During the plan’s implementation, all employees and contractors will need to undergo training before and during a pandemic disease outbreak.
eCuras will authorize, develop, and maintain a Pandemic Response Plan addressing the following areas:
3.1 The Pandemic Response Plan leadership will be identified as a small team that will oversee the creation and updates of the plan. The administration will also be responsible for developing internal expertise in transmitting diseases and other areas such as the second wave phenomenon to guide planning and response efforts. However, as with any other critical position, the leadership must have trained alternates to execute the plan should the leadership become unavailable due to illness.
3.2 The creation of a communications plan before and during an outbreak that accounts for congested telecommunications services.
3.3 An alert system based on monitoring of the World Health Organization (WHO) and other local sources of information on the risk of a pandemic disease outbreak.
3.4 A predefined set of emergency policies that will preempt normal eCuras policies for the duration of a declared pandemic. These policies are organized into different response levels that match the level of business disruption expected from a possible pandemic disease outbreak within the community. These policies should address all tasks critical to the continuation of the company, including:
3.5 A set of indicators to management that will aid them in selecting an appropriate level of response, bringing into effect the related policies discussed in section 4.4—for the organization. There should be a graduated level of response related to the WHO pandemic alert level or other local disease outbreak indicators.
3.6 An employee training process covering personal protection, including:
3.7 A process for the identification of employees with first responders or medical personnel in their household. Along with single parents, these people have a higher likelihood of unavailability due to illness or child care issues.
3.8 A process to identify key personnel for each critical business function and transition their duties to others if they become ill.
3.9 A list of supplies to be kept on hand or pre-contracted for supply, such as face masks, hand sanitizer, fuel, food, and water.
3.10 IT related issues:
3.11 The creation of exercises to test the plan.
3.12 The process and frequency of plan updates at least annually.
3.13 Guidance for auditors indicating that any review of the business continuity plan or enterprise architecture should assess whether they appropriately address the eCuras Pandemic Response Plan.
4.1 Compliance Measurement
The Infosec team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.
4.2 Exceptions
The Infosec team must approve any exception to the policy in advance.
4.3 Non-Compliance
An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Revised: March 14th, 2018