As the coronavirus (Covid-19) continues to spread around the world, businesses must do what they can to prepare for absent staff and possible periods of enforced closure.

It’s vital that companies of all sizes and types draft a distinct crisis response plan, because existing disaster recovery plans or business continuity plans might not suffice.

The Centers for Disease Control (CDC) offers various resources to help businesses and employers plan responses to a pandemic of any kind, and the World Health Organization (WHO) publishes daily situation reports on the coronavirus detailing its global impact by nation.

However, crafting an effective strategy means also thinking about IT infrastructure, secure remote working and clear communication to ensure everyone is kept abreast of the latest developments. Staff must be trained, and the groundwork must be laid quickly to ensure the best chance of mitigating the impact.

As a veteran of IT consultancy, with more than two decades of experience advising companies on effective cybersecurity strategies and how to assess different technologies, I know how important it is to create a thorough plan. Here are some practical tips on drawing up your own crisis response plan.

1. Establish leadership.

The first thing you need to do is to pick a small team to be responsible for crafting your plan and keeping it up to date. You’ll want department heads to be involved alongside representatives of each aspect of your business from HR to finance. Technical questions are sure to arise, so include IT and other technical experts.

The leadership will consult with all key stakeholders in the business and work closely with information security professionals to develop policies that minimize disruption but ensure data security is maintained and regulatory requirements are observed. Depending on the nature of your business they may also need to consult contractors and other third-parties essential to the smooth running of your company. Make provision for alternates in case the leadership falls ill.

2. Plan for every eventuality.

When drawing up policies to cope with a crisis and the different levels of response that may be required, planners should consider how to keep critical company functions going. What’s considered critical may differ from business to business, but some questions are universal:

• How will people get paid?
• Where will people work?
• How will people complete their tasks?

It’s important to work out contingencies for different scenarios. If people are going to be absent for long periods and unable to work, will the government assist with paid sick leave? If people are at home, but able to work they’ll need the right equipment and secure access. Make provision to protect employees who must come in to work for critical tasks and work out what you can afford to discontinue.

Communication channels are paramount here, so establish a system to disseminate the latest information. A central web page with the latest news, regular emails and text messages, and a clear list of contacts is a solid foundation, but you may also consider a crisis management app. For customer-facing businesses social media channels are a powerful tool to keep customers informed.

3. Train and assess employees.

Understanding key personnel for every business-critical function and ensuring their usual responsibilities can be taken on by a substitute replacement is very important. This may require significant training and documentation. Having a clear plan with step-by-step instructions they can refer to in different situations is a great way to reduce stress for your employees. It’s also vital to maintain your usual cyber hygiene.

You’ll need to make time to allow employees to train up for role cover and to familiarize themselves with the procedures should the worst happen. While it’s not practical to ensure they are versed in the details of every plan, they must be clear on where to turn for instructions and real-time information.

4. Work remotely.

Thankfully, it’s relatively easy nowadays to facilitate telecommuting for many roles. Consider how to secure remote workers with VPN services or Zero Trust remote access, plan for the increased demand on bandwidth, and make sure employees have the hardware they need at home in terms of laptops, desktops, and the necessary software. Switch to video conferencing for meetings wherever possible and make sure you have tools for easy document sharing and communication online.

In setting up remote working capability where possible you should also identify the tasks that cannot be completed remotely and prioritize them, so whatever staff is available in the premises focusses on the most important things first.

5. Test and enforce rules.

No plan is truly trustworthy until you test it. Create exercises and mock incidents suitable for testing out your processes and identify any problem areas that require further thought. Build in a regular review process, so that your plan is continually updated to account for changes in personnel and business systems. Schedule refreshers and further training on a regular basis. It may also be necessary to create a process for assessing and allowing exceptions to your plan in certain circumstances.

Crises are inevitable, so planning for the worst is a sensible precaution to take to reduce the potential negative impact on your business.