ITIC Americas: Disaster preparedness

Yanni Jota, Sales Vice President, Aetna International Health Services

Jota began by saying that companies need to build resiliency in this age of disruption, and that a people-first approach to disaster preparedness and crisis response is imperative. She discussed resiliency – that it doesn’t just mean not giving up, but also adapting to change.

She added that ‘organisational resiliency means withstanding setbacks and bouncing back from adversity’. Building a framework that puts people first is essential.Jota asked the question: “Which employee or industry factors pose the biggest challenge to your business? Would it be skills and talent shortage, talent retention, or mentally/physically exhausted employees?” She also asked what factors are most important as your business prepares for a disaster – operational processes, agile decision-making and innovations, or a healthy, productive workforce?

At the World Economic Forum in Davos, it was highlighted that there are big changes in workforce behaviour. Employee priorities have changed, and they want a say in how and where to work.

Organisations need to be prepared to respond to pressure and uncertainty, Jota said. A skills and talent shortage, supply chain problems, geo-economic clashes, climate change, short- to long-term planning, finite resources, cost of living crisis and new tech must be taken into account.

Jota said that if companies are rolling out a remote-work solution, then people-first planning is a priority. She said to consider: Who’s already remote? What tech do they have or need? What support do they have or require? Communicate with your team what to expect, ramp up privacy and security, monitor and measure, then prepare for the rollout. They did this for their call centres during the pandemic and ran a short pilot first.  

It should only take seven days to move all service-critical personnel – such as claims processors, leadership and admin – and there should only be two or three days of mitigated service disruption.

The result will be a seamless transition for employees and members, and Jota said that steps to building organisational resilience include:

• Reviewing your foundations and harnessing technology
• Enabling agility and empowering with autonomy
• Improvising and promoting collaboration and connectivity
• Adopting a people-first approach to resilience.

Finally, she said that a robust, resilient workforce will work if you listen and respond, are a role-model, if you guide and educate, empower and protect, and retain. 

Cameron asked Jota how to deal with digital nomads. She responded that good tech and clear information is vital. Santiago added that it’s difficult to find good people in many areas currently, but that you have to service your staff, no matter where they are.

Edmund Santiago, Chairman and CEO, Redbridge Assist

Santiago posed the question: what has actually been learned from the pandemic? He said that globally we worked out how to adopt important digital technology changes. There is now a necessity to have a much better and faster IT support system, so people can work effectively remotely.

Travel and health insurance has also become a must-have in every suitcase. “New benefits were created for health and travel assistance plans – finding solutions to cover new risks. All institutions must work together and carry out awareness campaigns amongst the population about the importance of being prepared and covered for any unforeseen event.”

Preparedness – a Disaster Recovery (DR) plan

Companies should establish a data protection strategy, prioritise risks and assets, and determine the best way to recover normal operations. A business can lose millions of dollars on systems downtime.

The top causes of data centre downtime include:

• Human error
• Unexpected updates and patches
• Server room environment issues
• Power outages, fire or explosion, natural disasters such as hurricanes or earthquakes, and malicious cyber attacks.

IT Disaster Recovery (DR) plan

Santiago said that for a DR plan,it’s vital tohave a clear vision, assess the risks, know what you need to protect (hardware and software inventory), have a list of disaster recovery sites, understand procedure restoration, budget, know who has responsibility for what, and test the plan.

A clear vision will help identify what you need to protect: network equipment, hardware, software, cloud services and, most importantly, critical data.

Santiago also said it’s important to identify which threats are likely to face the business as a whole and specific assets. That to assess the risks you must ask:

• What are the threats most likely to occur?
• Is there data or history to support them?
• Are these threats specific to an asset or the whole organisation?
• What are the likely causes of disruption of service operations?

Organisations should: have a list of disaster recovery sites – what and where, plus an alternative data centre in a remote location that has all critical systems replicated or frequently backed up. Operations can be switched over to the hot site when required.

What needs to be protected? The most important aspects are: critical and sensitive data – Personally Identifiable Information (PII), credit cardholder data and Intellectual property (IP).

Organisations should think aboutMulti level Protection – ISO 27001 Certification – this guarantees the confidentiality, protection, security, integrity and continued availability of essential information and data of the company, its customers and associates. He also talked of the importance of infrastructure hosted in the cloud – Virtual Environment (Microsoft Azure leader in security) which helps with a complete migration of physical technological systems, its data and applications, as well as email capacities, conserving documents for 10 years. Santiago said that multi-layered protection is crucial as security threats multiply daily around the world.

Cloud infrastructure means a reduction in operating costs, it is flexibile, it’s targeted, secure, with training for developers and an availability of effective solutions.

It is important that businesses control the IT budget when migrating to cloud services, Santiago added. “The cost may be the reason why Microsoft Azure is so attractive for so many businesses. The payment model used allows PYMES to better manage their IT budgets, since they can buy all they need.”

Testing the plan

Santiago advises companies to conduct a drill every six months – a plan might look great on paper, but fail in a realistic scenario. Analyse staff response according to the plan, rearrange roles if needed, then update the plan at least once per year. Finally, ensure that the plan reflects the current structure and IT set-up.

Cameron asked if we managed the challenges of the pandemic by accident, and if we can ever be prepared for things like Covid-19? Santiago replied that we can never be 100 per cent prepared, but if we have a base of preparedness, it is a start. Jota added that we don’t know what we don’t know – to be OK with being flexible. Marchand said not to be reliable on just local services.

Finally, Cameron asked for the most important thing regarding disaster preparedness. Marchand said not to eliminate risks, but to be as prepared as you can. Jota said to have a good base which you can change and adapt. Santiago said to prepare to prepare.