Pandemic Response Planning Policy

This policy is intended for companies that do not meet the definition of critical infrastructure as defined by the federal government. Public health officials may request this type of organization to close their offices to non-essential personnel or completely during a worst-case scenario pandemic to limit the disease’s spread. Many companies would run out of cash and be forced to go out of business after several weeks of everyone not working. Therefore, developing a response plan in advance that addresses who can work remotely, how they will work, and identifies what other issues may be faced will help the organization survive when most people are concerned about themselves and their families.

Disasters typically happen in one geographic area. A hurricane or earthquake can cause massive damage in one area, yet the worst damage is usually contained within a few hundred miles. A global pandemic, such as the 1918 influenza outbreak, which infected 1/3 of the world’s population, cannot be dealt with by failing to a backup data center. Therefore, additional planning steps for IT architecture, situational awareness, employee training, and other preparations are required.

1. Purpose

This document directs the planning, preparation, and exercises for pandemic disease outbreaks and above the normal business continuity and disaster recovery planning process. The objective is to address the reality that pandemic events can create personnel and technology issues outside the scope of the traditional DR/BCP planning process as potentially 25% or more of the workforce may be unable to come to work for health or personal reasons.

2. Scope

The planning process will include personnel involved in the business continuity and disaster recovery process, enterprise architects, and senior management of eCuras. During the plan’s implementation, all employees and contractors will need to undergo training before and during a pandemic disease outbreak.

3. Policy

eCuras will authorize, develop, and maintain a Pandemic Response Plan addressing the following areas:

3.1  The Pandemic Response Plan leadership will be identified as a small team that will oversee the creation and updates of the plan. The administration will also be responsible for developing internal expertise in transmitting diseases and other areas such as the second wave phenomenon to guide planning and response efforts. However, as with any other critical position, the leadership must have trained alternates to execute the plan should the leadership become unavailable due to illness.

3.2  The creation of a communications plan before and during an outbreak that accounts for congested telecommunications services.

3.3  An alert system based on monitoring of the World Health Organization (WHO) and other local sources of information on the risk of a pandemic disease outbreak.

3.4  A predefined set of emergency policies that will preempt normal eCuras policies for the duration of a declared pandemic. These policies are organized into different response levels that match the level of business disruption expected from a possible pandemic disease outbreak within the community. These policies should address all tasks critical to the continuation of the company, including:

  1. How people will be paid
  2. Where they will work – including staying home with or bringing kids to work.
  3. How they will accomplish their tasks if they cannot get to the office

3.5  A set of indicators to management that will aid them in selecting an appropriate level of response, bringing into effect the related policies discussed in section 4.4—for the organization. There should be a graduated level of response related to the WHO pandemic alert level or other local disease outbreak indicators.

3.6  An employee training process covering personal protection, including:

  1. Identifying symptoms of exposure
  2. The concept of disease clusters in daycares, schools, or other gathering places
  3. Basic prevention – limiting contact closer than 6 feet, cover your cough, hand washing
  4. When to stay home
  5. Avoiding travel to areas with high infection rates

3.7  A process for the identification of employees with first responders or medical personnel in their household. Along with single parents, these people have a higher likelihood of unavailability due to illness or child care issues.

3.8  A process to identify key personnel for each critical business function and transition their duties to others if they become ill.

3.9  A list of supplies to be kept on hand or pre-contracted for supply, such as face masks, hand sanitizer, fuel, food, and water.

3.10          IT related issues:

  1. Ensure enterprise architects include a pandemic contingency in planning
  2. Verification of the ability for significantly increased telecommuting, including bandwidth, VPN concentrator capacity/licensing, ability to offer voice over IP, and laptop/remote desktop availability
  3. Increased use of virtual meeting tools – video conference and desktop sharing
  4. Identify what tasks cannot be done remotely
  5. Plan for how customers will interact with the organization in different ways

3.11          The creation of exercises to test the plan.

3.12          The process and frequency of plan updates at least annually.

3.13          Guidance for auditors indicating that any review of the business continuity plan or enterprise architecture should assess whether they appropriately address the eCuras Pandemic Response Plan.

4. Policy Compliance

4.1  Compliance Measurement

The Infosec team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

4.2  Exceptions

The Infosec team must approve any exception to the policy in advance.

4.3  Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5. Related Standards, Policies, and Processes

World Health Organization

Revised: March 14th, 2018

Table of Content

  1. Acceptable Encryption Policy
  2. Acceptable Use Policy
  3. Clean Desc Policy
  4. Data Breach Response Policy
  5. Disaster Recovery Plan Policy
  6. Digital Signature Acceptance Policy
  7. Email Policy
  8. Ethics Policy
  9. Pandemic Response Planning Policy
  10. Password Construction Guidelines
  11. Password Protection Policy
  12. Security Response Plan Policy
  13. End User Encryption Key Protection Policy
  14. Acquisition Assessment Policy
  15. Bluetooth Baseline Requirements Policy
  16. Remote Access Policy
  17. Remote Access Tools Policy
  18. Router and Switch Security Policy
  19. Wireless Communication Policy
  20. Wireless Communication Standard
  21. Database Credentials Policy
  22. Technology Equipment Disposal Policy
  23. Information Logging Standard
  24. Lab Security Policy
  25. Server Security Policy 
  26. Software Installation Policy
  27. Workstation Security (For HIPAA) Policy
  28. Web Application Security Policy
  29.  Analog/ISDN Line Security Policy
  30. Anti-Virus Guidelines
  31. Server Audit Policy
  32. Automatically Forwarded Email Policy
  33. Communications Equipment Policy
  34. Dial In Access Policy
  35. Extranet Policy
  36. Internet DMZ Equipment Policy
  37. Internet Usage Policy
  38. Mobile Device Encryption Policy
  39. Personal Communication Devices and Voicemail Policy
  40. Removable Media Policy
  41. Risk Assessment Policy
  42. Server Malware Protection Policy
  43. Social Engineering Awareness Policy
  44. DMZ Lab Security Policy
  45. Email Retention Policy
  46. Employee Internet Use Monitoring and Filtering Policy
  47. Lab Anti Virus Policy
  48. Mobile Employee Endpoint Responsibility Policy
  49. Remote Access Mobile Computing Storage
  50. Virtual Private Network Policy