7 Business Continuity Lessons Any Organization Can Learn

In “The 7 Habits of Highly Effective People,” Stephen Covey advised spending most of your time on activities that don’t appear urgent but are important (long-term strategizing, exercise and relationship building -- to name three). For large companies, business continuity planning has long been one of these critical, though seemingly non-pressing, tasks.

As the COVID-19 pandemic has reminded the world, however, preparations to maintain and quickly resume business functions in the event of a crisis may not seem urgent until suddenly it is. In an instant, the coronavirus crisis caused unprecedented disruptions and demanded changes in how companies sustain operations and manage their workforces.

As a large company with more than 9,000 employees globally, our company faced particularly acute challenges in adjusting to the new landscape. From the strict measures at the beginning of the outbreak to the cautious gradual reopening of offices now underway, we’ve seen our crisis management response put to the test. We’ve gained key learnings for handling the rest of this pandemic and, heaven forbid, future ones.

Based on our experience, here are seven habits of highly resilient organizations in a health emergency.

1. They plan. According to a Gartner report, thorough business continuity planning for a pandemic minimizes the impact on staff, service delivery and the IT infrastructure, and paves the way for a faster return to normalcy. Our company first designed a global pandemic preparedness plan in the mid-00s, not long after the SARS outbreak, and we’ve rigorously kept it updated ever since.

So after the first reports about the novel coronavirus emerged in late 2019 from China, where we have over 400 employees, we had a defined set of procedures to fall back on. For us, this reinforced that proactive planning is the only way to make sure a company isn’t playing catch-up in the event of a disruption.

2. They expect the unexpected. Because we’re a multi-location rather than a single-location company, we’ve always taken a global perspective in our planning. But the virus’s rapid spread took us by surprise -- we had anticipated several waves of closures rather than the single big one that occurred in March and sent home 95% of our global employees. (The remaining 5% were deemed essential workers needed onsite to keep systems running and support customers.)

We quickly realized we needed to immediately stress test our network in a way it never had been before to see how it would deal with the crush of so much additional traffic from remote workers. (Fortunately, it held up well.) The lesson: Despite all the planning, be prepared to make moves on the fly.

3. They adapt. Bringing back remote employees isn’t as simple as unlocking the doors -- the workplace must adjust to new realities. Beyond corporate responsibilities and employee expectations, OSHA, ADA and similar statutes mandate that employers keep workers safe. Thus, organizations have not just an ethical but also a legal obligation to proactively review and update their business continuity plans to ensure that employee safety is protected.

Employers need to evaluate new safety measures, such as temperature checks in building lobbies, mask wearing, installation of sanitization stations, contact tracing and social distancing. What previously might have been a 10-12-person conference room may now be four; a work area that used to hold 100 people may now have a quarter of that.

4. They train. Companies can’t merely assume that all returning employees will understand everything they need to about the new normal. That’s why they should implement a robust training program, ideally delivered electronically, addressing social distancing guidelines and all other changes.

5. They’re compassionate and flexible. We’ve conducted periodic surveys to gauge sentiment on how ready employees feel to return to the office. In the most recent one, more than 80% said they’re not. On top of that, many remote workers report feeling very productive. And we know that many have a lot on their plates with family obligations. The lesson for companies: Don’t rush this process.

6. They take advantage of technology. Contact tracing has been a part of our company’s pandemic response plan from the start. While installing third-party contact tracing apps on employees’ mobile devices was one option, we quickly ruled it out. These require people to permit location tracking on their phones, which creates deployment complexity and raises privacy concerns.

Instead, we’re using off-the-shelf Bluetooth Low Energy (BLE) tags that can be affixed to employee badges. If someone reports COVID-19 symptoms, the health and safety team uses contact tracing to identify who was near the person over the past 72 hours and the length of exposure. In addition, the team can determine where infected users were within the office and notify cleaning crews to focus sanitization efforts on those areas. Hot zone alerting can identify congested areas and divert people with real-time notifications.

7. They protect privacy. Location visibility in our contact tracing system is anonymous, personal information isn’t stored and access to the contact tracing functionality is strictly limited. Data privacy guidelines were developed in consultation with our corporate legal team. Employees who come into the office sign consent forms that permit location tracking and they are informed how the data will be used. The reason is simple: Organizations must balance their desire to prevent the infection’s spread with employees’ privacy and trust

COVID-19 is a historic test of companies’ resiliency. By exemplifying these seven qualities, they can overcome the challenges, keep employees safe, manage risk and come through the crisis stronger than ever.

Brad Minnis is vice president of environment, health safety, and security at Juniper Networks, where he is responsible for strategic design, implementation and management of the company’s security, safety, environment, crisis management, supply chain integrity, product security incident response and business continuity functions.