Pandemic recovery for the contact center

By

Daniel Willis

Business Development Manager, North America & Asia, Transcom

2

T a b l e o f c o n t e n t s 1. Foreword………………………………………………………………………………………………. 4 1.1 Historical context………………………………………………………………………… 4 1.2 Anticipated contemporary statistics………………………………………….. 5 1.3 Associated costing………………………………………………………………………. 6 2. Business impact analysis……………………………………………………………………. 7 2.1 Pandemic threat assessment……………………………………………………… 7 2.2 Pandemic threat monitoring……………………………………………………….. 8 2.3 Community preparedness & mutual aid…………………………………….. 9 3. Identification & preservation of essential company records……………. 10 3.1 Personnel – human resources……………………………………………………… 10 3.2 Training………………………………………………………………………………………….. 10 3.3 Accounting – payroll and accounts payable……………………………….. 11 3.4 Accounting – accounts receivable……………………………………………….. 11 3.5 Contracts & agreements………………………………………………………………. 11 4. Identification of essential services…………………………………………………….. 12 4.1 Financial providers……………………………………………………………………….. 12 4.2 Communications providers…………………………………………………………… 12 4.3 Utilities………………………………………………………………………………………….. 13 4.4 Medical/sanitary suppliers…………………………………………………………… 13 5. Identification & prioritization of essential program services…………… 14 5.1 Employee relations & labor considerations……………………………….. 15 5.1.1 Employee benefits & assistance……………………………………………… 15 5.1.2 Labor continuity………………………………………………………………………… 15 5.1.3 Incentive compensation…………………………………………………………… 15 5.1.4 Hazard compensation……………………………………………………………….. 16 6. Business continuity infrastructure………………………………………………………. 17 6.1 FCE platform………………………………………………………………………………….. 17 6.1.2 DRP/BCP considerations…………………………………………………………… 17 6.1.3 Home agents……………………………………………………………………………… 17 6.1.4 Hot/cold sites…………………………………………………………………………….. 18 6.2 Requirements for full redundancy……………………………………………….. 18 6.2.1 IT redundancy……………………………………………………………………………. 18 6.2.2 HR redundancy………………………………………………………………………….. 18 7. DRP strategy………………………………………………………………………………………… 19 7.1 Introduction………………………………………………………………………………….. 19 7.2 Pandemic action plans………………………………………………………………… 19 7.2.1 Prevention…………………………………………………………………………………. 20 7.2.2 Attendance management………………………………………………………….. 21 7.2.3 Containment……………………………………………………………………………… 21

3

7.2.4 Containment (security)…………………………………………………………….. 23 8. DRP organization…………………………………………………………………………………. 27 8.1 DRP organizational team…………………………………………………………….. 27 8.2 DRP organization roles & responsibilities………………………………….. 28 8.2.1 Operations management team………………………………………………… 28 8.2.2 Physical security team……………………………………………………………… 29 8.2.3 Administration team…………………………………………………………………. 30 8.2.4 Information technology technical team………………………………….. 31 9. DRP emergency procedures………………………………………………………………….. 33 9.1 Pandemic procedures form…………………………………………………………… 34 9.2 Operations recovery management checklist………………………………. 35 9.4 Physical security checklist…………………………………………………………… 37 9.5 Administration checklist………………………………………………………………. 39 9.6 Hardware checklist……………………………………………………………………….. 41 9.7 IT technical team checklist…………………………………………………………. 44 10. DRP training, maintenance, and testing administration………………… 46 10.1 DRP management………………………………………………………………………. 46 10.1.1 DRP distribution………………………………………………………………………. 46 10.1.2 DRP maintenance…………………………………………………………………….. 46 10.1.3 DRP training…………………………………………………………………………….. 47 10.1.4 DRP testing………………………………………………………………………………. 47 11. Return to normal business…………………………………………………………………. 48 11.1 Evaluation of effectiveness……………………………………………………….. 48 12. Appendices………………………………………………………………………………………….. 49 12.1 Software assets………………………………………………………………………….. 49 12.2 Hardware assets…………………………………………………………………………. 50 12.2.1 Vendor contacts (hardware)……………………………………………………. 51 12.2.2 Vendor Contacts (telecom)…………………………………………………….. 51 12.3 UPS & generator status……………………………………………………………… 51 12.4 IT escalation process…………………………………………………………………. 51

1. Foreword Pandemic planning is fundamentally different from other, more traditional business continuity threats, and is outside the scope of those issues generally considered by most continuity planners. Business continuity plans are typically designed to help companies respond to localized incidents or events (such as natural catastrophes or technological accidents) that cause widespread destruction, resulting in significant property damage, multiple injuries, or even deaths. You may choose to respond to these infrastructure-based threats in a Disaster Recovery Plan (a sample is included in this document). The crises addressed in that plan are focused on one location and are sudden events which may or may not have long term consequences. Once the event has occurred, it is over. While the effects may linger, recovery can begin immediately. A pandemic crisis occurs when an infectious illness (such as influenza) causes rapid, long term, multi-site absenteeism, and potential loss of external infrastructure. A pandemic is not an isolated incident. It is, by definition, a global event. Because of the ease, availability, and frequency of air travel, cities around the world could be infected almost simultaneously. Current models suggest that the next pandemic is likely to come in three waves, with each wave sweeping across the globe in a matter of weeks, lasting as long as three months. From beginning to end, a pandemic crisis may last as much as eighteen (18) months.

For this reason, pandemic planning requires a shift from traditional business continuity strategies that protect infrastructure, toward those that protect employees and the ability to conduct business during a sustained crisis. 1.1 Historical context In the last century there have been six recognized pandemics. The worst pandemic of the 20th century was the Spanish Influenza pandemic of 1918, which is known to have killed 40 million to 50 million people around the world, and is estimated to have killed as many as 100 million. Mortality rates were especially high among those people traditionally considered to be at low risk – otherwise healthy men and women between the ages of 15 and 35 – with roughly 1 out of every 4 individuals exposed becoming infected.

4

Next in severity was the Asian Influenza pandemic of 1957-1958. Due to medical advances at the time, this virus was quickly identified, with limited quantities of a vaccine made available within six months. Between 20% and 70% of people exposed became infected, but there were only 2 million deaths globally. It is believed that the pandemic may have been avian in origin, although this cannot be confirmed as the technology required to make such a determination did not exist at the time The Hong Kong Influenza pandemic of 1968-69 represents the most recent, full-scale pandemic. Although this was the mildest of the three 20th century pandemics, worldwide deaths were still estimated at over 1 million. The last know epidemic of swine flu occurred in the Fort Dix area of the USA in 1976, where infections were only detected for a brief period of a few weeks. In this case, side effects from the vaccine killed far more people than the flu itself, and no pandemic threat ever materialized.

1.2 Anticipated contemporary statistics Annual influenza epidemics are estimated to affect 5–15% of the global population. In North America, roughly 4,000 Canadians and 36,000 Americans die each year from seasonal flu, and that number can double in a severe season. Even a mild, swine related pandemic flu could result in 10 times as many deaths. Four of the six recognized pandemics during the past century were swine related. Human and swine physiologies are similar enough that influenza viruses attacking swine can easily mutate to human viruses.

5

6

The current H1N1 outbreak is thought to have originated in Mexico, and was declared a pandemic in July 2009. To date, most illnesses have been of moderate severity, with most hospitalizations and/or deaths occurring in patients with underlying conditions (i.e. asthma, diabetes, heart disease) or an otherwise weakened immune system. To prepare for a serious, global pandemic, many governments, as well as the Centers for Disease Control and Prevention (CDC) and the World Health Organization (WHO) have begun developing strategies to strengthen your capacity to prevent and respond to such an outbreak. 1.3 Associated costing The unfortunate reality of any Disaster Recovery or Business Continuity Plan is that a substantial financial investment ought to be made now to protect against business losses later. In a sense, the investment is very similar to an insurance premium – a regrettable cost in a best case scenario, but an invaluable element of forethought in a worst case scenario. Based upon the Pandemic Action Plans detailed in Section 7, anticipate the following proposed costs in this North American example:

• Cost of Flu Shot per 1000 employees * $55 per shot

$55,000

• Remote Agents for Laptops – 1000 Laptops will cost $1000 per laptop.

$1,000,000

• Cost of Transportation, Accommodation and Food to transport employees to another site. This could potentially cost us $100 per night for accommodation and additional cost for transportation.

$150 / night

• Cost of Nurses to check employees before entering into the building $50 per hour.

$50 / hour

• Cost of Masks - $500.00 for Quantity of 10,000 masks. ~$500

7

2. Business impact analysis The Business Impact Analysis (BIA) identifies the potential impact of uncontrolled, non-specific events on the critical processes. The BIA phase mainly estimates:

• What and how much is at risk by identifying critical business functions and prioritizing them;

• The maximum allowable downtime for critical business processes The BIA scope ought to be represented by all CRM facilities, IT resources, and human resources, detailed as follows:

• Systems & Applications; • Network equipment, software, and communication links; • General equipments (as telephone switching centers or power supplier systems); • Employees (both production and non-production).

In order to identify the maximum allowable downtime for critical business processes, the departments should be considered as follows:

• Information Technology • Human Resources • Operation • Administration / Accounting

Note: Outsourcers should look to Client to define its own facilities and IT resources that may have an impact upon their program, along with mutually agreed timelines. In-House Contact centres should look to “Program Managers”

2.1 Pandemic threat assessment Employee absenteeism rates are expected to be as high as nearly 50-60% for a period of 2 to 4 weeks at the height of each pandemic wave. In addition to employees who are themselves infected, others may be caring for family members, quarantined to their homes, isolated by the lack of public transportation, or fulfilling roles in the community. Still others may simply be afraid of public exposure. The SARS epidemic in Toronto demonstrated that fear of being exposed to the disease is much greater than the actual statistical odds of becoming ill. Many people will tend to overestimate the risk and won’t want to come in to work.

From a Contact centre standpoint, there is a potential for 40% of your employees to be off work for at least 3 weeks due to illness, with still others off work for the reasons identified above. With an estimated mortality rate of 2.5% to 10% among those infected, calculate how many employees you might lose across every region. It is important to remember that absenteeism rates will not only affect your employees, but the utilities (phone, electricity, gas), municipal services (sanitation), suppliers (office supplies, cleaning supplies), support services (police, fire, hospitals), Clients, and customers on which you rely. 2.2 Pandemic threat monitoring Your DRP Manager ought to be responsible for monitoring and communicating the emergence of an epidemic (local) or pandemic (global). In addition, Call Centre Managers ought to be responsible for monitoring and communicating the emergence of an epidemic in their area. This includes use of the tools and resources described below, tracking of trends and spikes in employee absenteeism, and monitoring of local news and other sources of information. Should notice of an epidemic/pandemic be made available, your DRP Organizational Team ought to be contacted. A formal announcement of an emerging epidemic or pandemic may come from any one (or a multiple) of various sources, including (but not limited to): USA

• Centers for Disease Control and Prevention http://www.cdc.gov/flu/avian/

• FEMA http://www.fema.gov/news/disasters.fema

• NEMA http://www.nemaweb.org/

• OHSA http://www.osha.gov/

• US Department of Health and Human Services http://www.hhs.gov/nvpo/influenza_vaccines.html

8

9

Canada • Health Canada

http://www.influenza.gc.ca/surv_e.html • New Brunswick Department of Health

http://www.gnb.ca/0053/influenza/index-e.asp • Ontario Ministry of Health

http://www.health.gov.on.ca/english/public/program/emu/pan_flu/pan_flu_mn.html • Pandemic Quebec

http://www.pandemicquebec.ca/en/news/news.aspx • Public Health Agency of Canada

http://www.phac-aspc.gc.ca/influenza/avian_e.html Global

• World Health Organization http://www.who.int/csr/don/en/

• International Society for Infectious Diseases http://www.promedmail.org/

2.3 Community preparedness & mutual aid In addition to monitoring community preparedness, your company ought to also keep in mind the value of teamwork. Short-term sacrifice on your part may lead to long-term gains for all. Over the coming months, you may want to discuss the possibility of establishing voluntary Mutual Aid Agreements with industry colleagues, suppliers, and vendors. These agreements are not legally binding contracts –they are general policies of cooperation and coordination that provide for the following in the event of a disaster:

• Agreement to share material and personnel resources • Agreement not to charge more than set rates for providing assistance • Sharing of ideas and resources • Communication between groups • Collaboration to purchase materials in bulk, resulting in cost savings • Reciprocal services or direct payment through specific labor and equipment rates

Such agreements may be explored at a management level, but should be negotiated and established at the Executive level. Also, part of your public relations efforts should be to identify areas where you can help the community and, in doing so, help yourselves. Idle agents could be used to man information lines, or to assist communications between emergency services. Doing so could directly result in saving employee lives, and would be a show of good faith to the community. If you, as a company, can demonstrate your willingness to help, the odds of being commandeered and ‘required’ (rather than ‘requested’) to assist is far less likely.

10

3. Identification & preservation of essential company records Depending upon the nature, impact, and scope of an event, individual sites may be operating under reduced staffing, or may be altogether unavailable or inaccessible. For this reason, identifying and safeguarding copies of all essential corporate records is absolutely critical. Essential records and documents are those considered to be vital to your operations. To recover after an emergency or disaster, or simply continue doing business, you will need access to the company’s essential records. If the information contained in those records is lost, the business may not be able, or permitted, to continue operations. 3.1 Personnel – human resources Uses an internal application as a storehouse for much of your employee information:

• Organizational hierarchy • Name and Employee # • Current position • Hire Date • Contact details • Campaigns & Language certification (past and present) • Skills, premiums, and qualifications • Etc.

In addition, ensure the personal contact information software is adapted to provide a daily visual queue for the employees to update anything that is out-of-date. Human resources documentation for staff should be stored online and available from any location. Files not online should be stored in a secure location accessible as easily as possible. 3.2 Training In order to make the most efficient use of the employees available, it is critical that you understand what training each employee possesses. Even though training may not be current, these employees will be better equipped to assist with call volume than other employees with no prior training or experience. Training documentation (course material, presentation material, case studies, tests, and administrative guides) ought to be stored online. Your trainers can be required to train in any site, and from any site, at any time, so the most current material ought to be immediately available.

11

3.3 Accounting – payroll and accounts payable The vast majority of financial documentation required on a day-to-day basis should be stored electronically and available online. Regardless of how payroll is processed, there are three departments that are essential to the process:

• IT: required to provide production hours • Payroll: required to process payroll • Executive: required to complete the process with signatures

Insurance and Benefits information is usually only available in hardcopy form, due to legal and contractual obligations and should be stored in a secure location accessible as easily as possible. 3.4 Accounting – accounts receivable All billing information (Billable Rate, Payment Terms, Billing Contact, etc.) should also be stored online for each program. It should be accessible from any remote site. Some revenue may be administered by banking personnel, and then scanned electronically to you (with hardcopies sent manually). As such, the majority of your revenue may be processed without any physical presence on-site. Some of the remaining revenue may be received in the form of checks sent directly to you. In the event of an emergency or disaster, any mail destined for Accounting may need to be rerouted to another location. 3.5 Contracts & agreements Hardcopies of all contracts and agreements and their whereabouts ought to be known by key individuals. The same is true for hardcopies of all facilities contracts and agreements (leases, deeds, etc.). In the event of an emergency or disaster, key files should be moved to an alternate secure location. For the purposes of DRP planning, you should request that the program manager provide copies of all relevant contracts and agreements that may have an impact upon their programs. Where desirable, you should be willing to discuss joint contracts and/or shared responsibility and support for key items.

12

4. Identification of essential services In the event of a pandemic, you have identified the following as being absolutely essential to ensuring your basic business continuity needs:

• Financial providers – You cannot continue to do business if you cannot generate revenue and if the employees cannot be paid

• Communications providers – If calls cannot be made/received, and connections cannot be maintained between sites, business cannot be conducted

• Utilities – A short term loss of power, natural gas, and water/sewages services would be inconvenient, but back ups and alternatives ought to be available for each. A long term loss of utilities, however, could certainly cripple your ability to continue doing business

• Medical/Sanitary supplies – Maintaining then cleanliness of sites, and being able to screen and diagnose infected individuals is key to containing the pandemic.

4.1 Financial providers While most people might not immediately think of it as an essential service, sound and healthy financial institutions are critical to business continuity. Accounts Receivable, Payroll, and Accounts Payable would all be crippled by the lack of financial services. In Canada, where large banks are well-connected, and where there is already a familiarity and dependence upon electronic banking, only a loss of infrastructure would be critical. A loss of bank staffing would be inconvenient, and would impact some areas of the business, but the need for human interaction is not as prevalent as in the US or other global locations. In the US and elsewhere, many banks are small and isolated, without a strong shared network, and there simply isn’t the reliance upon electronic banking. With so much business conducted via cash or check, a loss of bank staffing would have a much greater impact. 4.2 Communications providers Under the category of communications, there are three essential services to be considered:

• Internet/Network communications • Landline communications • Cellular phone communications

In the event that the secondary sources fail, localized alternatives would need to be considered. Once fully implemented, your disaster recovery location would provide secondary communications sources for the first two categories. In the event that the secondary sources fail, localized alternatives would need to be considered. Fortunately, there are enough cellular service providers available that you could consider national and/or regional alternatives.

13

4.3 Utilities How long your sites would be able to depend upon generator power relies upon the availability of fuel for the generators. Energy conservation would be key, regardless of the availability of fuel. Reduced staffing levels may enable you to effectively shut down and close off areas of the call centre. Should natural gas be unavailable for any period of time, alternate heating sources would only be considered where there is a definite need, based upon climate, staffing levels, and the health of the facility itself. Once again, conservation would become a key consideration. The loss of water/sewage services would potentially be the easiest to deal with, but could also create the gravest threats. Bottled water could be obtained for drinking, and waterless alcohol-based soaps could greatly reduce the need for washing. Sewage services would be an immediate problem, however. If not disposed of properly, raw sewage could create a greater health risk than the pandemic itself. Exterior portable toilets services would need to be considered. As employees may be reluctant to use even the most professional mobile solutions, it will be important to communicate what efforts you are taking to monitor and resolve the situation. 4.4 Medical/sanitary suppliers During the course a pandemic, cleaning supplies would become essential to maintaining the health of employees. While staff levels within each office are likely to be greatly reduced, the heightened need for strong hygiene practices would actually result in a greater volume and enhanced detail of cleaning services. Essential suppliers would include:

• Cleaning and Disinfecting supplies • Medical supplies • Garbage removal • Pest control

Essential suppliers could also include:

• Soap • Antibacterial hand-sanitizers • Antibacterial cleaning wipes • Paper towels and toilet paper • Thermometers • Masks and gloves

Once a pandemic begins, it will be too late to consider stockpiling. Essential supplies will be in short supply (if available at all), and may be sold at greatly inflated prices. One proposal being considered is to immediately begin incremental stockpiling of 10% per fiscal year. For example, assume your office normally purchases 5 soap dispensing packs each quarter. If you were to continue ordering on the same schedule, but increase the quantity to 6 packs each quarter, you would have a stockpile of 4 dispensers in the first year, 8 in the second year, and so on. Provided stock is used on a first-in, first-out basis (to prevent supplies from expiring), each fiscal year should see the stockpile grow.

14

5. Identification & prioritization of essential program services Depending upon the nature, impact, and scope of a pandemic, individual sites may be operating under reduced staffing or closed altogether. In addition, senior management and executives may be unavailable or incapacitated by the pandemic. It is impossible to make a blanket statement regarding which program services are to be prioritized over others. Any decision would be impacted by the following internal logistical considerations:

• The site(s) affected • The nature of the Program serviced by the affected site(s) • The number of Programs services by the affected site(s) • The number of sites servicing the affected Program • The skill sets available within the site • The level of staffing within the site • The complexity of work being performed • The level of cross-training among agents in the affected sites(s) • The duration of training required • The availability of training resources

Once the above information has been determined, the next criteria to look at would be specifically related to each Program affected:

• How much volume is coming in from the Program? • How much other support does the Program have? • How much of the volume can be handled by an IVR solution?

It is important to remember that even if you have staff available, your Program and their customers may be impacted by a pandemic, resulting in a drastic reduction in call volume. You ought to then make the determination as to what decision best serves your own business continuity needs, what the long-term impact will be upon the operations of the company, and what the impact (short-term and long-term) will be upon relations with the Program(s). Factors to be considered will include:

• What is the availability and impact of revenue? • What percentage of your overall revenue does the Program traditionally generate? • Based upon current volume, how much revenue can you expect to generate? • Is the Program able to pay (i.e. can you count on revenue generation)? • How much is the Program willing to pay (i.e. are there any financial

incentives/penalties involved in servicing or not servicing their volume)? • What is the likelihood of that work being lost forever?

Finally, short-term financial loss ought to be factored into the decision. If you choose to move agents from one program to another, who pays for that training will be an important factor in the decision. If you pay for any portion of that training, then it ought to be

15

determined how much revenue would be lost during training, and how long will it take to recover that revenue? 5.1 Employee relations & labor considerations 5.1.1 Employee benefits & assistance Provided the benefits providers remains in business and have the staff/resources required to serve their customers, all employee assistance programs ought to remain available to all employees to discuss their fears/anxiety as it relates to the threat of pandemic flu. Counselors might be asked to take part in web or phone conferencing for employees as site access will be restricted. In the event that the benefits provider is unavailable or does not have the resources available, your personnel (training and human resources) should be provided with additional training and guidance to handle employee concerns. Emphasis ought to be on employee health and well-being, rather than process. Where cost becomes an issue, as it likely will with all benefits programs, employees may be required to pay a larger portion of their premiums. Alternatively, plans and coverage may be adjusted to preserve ‘essential’ components, while temporarily suspending those that are deemed ‘non-essential’ in light of a pandemic. 5.1.2 Labor continuity Depending upon the nature, impact, and scope of a pandemic, individual sites may be operating under reduced staffing or closed altogether. In addition, senior management and executives may be unavailable or incapacitated by the pandemic. Assuming sites are open for business, and there is call volume to be handled, special attention ought to be directed to those employees who are working in the office of their own accord, as opposed to those who are required to be on-site. Decisions on incentives and hazard compensation will have to be some of the first considerations made during a pandemic. A sound business decision ought to be made and communicated to all in order to ensure that the plan outlives the loss of any key decision maker. 5.1.3 Incentive compensation During a pandemic, some employees may still choose to perform their duties from the office. They may not be comfortable working at home, especially if there are ill family members in the home, or they may lack the technological resources required to work from home (i.e. computer with high-speed internet). As the pandemic progresses and fear begins to fade, employees may also begin longing to be part of a social atmosphere once again. For some of these employees, however, the decision to work in the office or simply not to work altogether may be a difficult one. They may not be comfortable and/or able to work at home, but also reluctant to work in the office.

16

In these situations, you may need to consider some kind of incentive program. As long as call volume exceeds the staff available, these borderline (or on-the-fence) employees may be the difference in business continuity surviving through the pandemic. The concept is no different from overtime or public holiday incentives, except the incentive may need to run for a much longer duration. The nature of the incentive will be directly determined by the value the employees bring to the organization. Also, the needs of your Programs will need to be considered, and (where necessary) the cost of the incentive shared or passed along. 5.1.4 Hazard compensation Outside of those employees who chose to work in the office during a pandemic, there will also be employees required to work in the office (even if only for short periods of time). For those services deemed essential, employees will almost certainly need to be on-site at one time or another, but there will also be sudden, temporary demand for staff. Employees may also be asked to sequester themselves to continue critical business functions. For example, facilities staff will be absolutely required, as the need for cleaning and disinfecting is likely to exceed that of normal operations, even with reduced staffing. Accounting personnel may be required to process payroll or accounts receivable on-site. Also, in the event of systems failure or other hardware issues, the presence of IT staff may be required. The reality is that these employees may be extremely reluctant to work on-site, and might outright refuse. A small incentive or overtime pay may not be enough – you may need to arrange a form of hazard pay for time spent in the office. Before making such a decision, your Executive will need to weigh the impact of not having the staff available versus the value of having them in the office with hazard pay. In some cases, it may not be an option – business may not be able to continue without an on-site presence. How and when these employees are compensated will need to be determined as far in advance as possible to ensure that the same standards are applied to all situations.

17

6. Business continuity infrastructure 6.1 FCE platform Consider implementing an FCE (Flatten, Consolidate, and Extend) platform for all technologies related to production work.

• Flattening the network refers to combining the routing logic of service provider toll free services, CTI, and standalone ACDs into one layer of routing and call distribution logic – in essence, a single contact centre application.

• Consolidation benefits come from pooling telecommunications assets in to (2) primary sites, and sharing the resources across all connected sites. This will allow you to fully utilize resources for all sites.

• Extension refers to the ability to use the infrastructure to build or connect new sites to the network by extending the existing infrastructure instead of installing brand new infrastructure.

6.1.2 DRP/BCP considerations An FCE platform provides an immediate disaster recovery and business continuity solution. With one centralized queue, there is no need to reroute calls, build new queues, or involve the program manager in managing call volume. Incoming calls will continue to build in the shared queue, and will continue to be handled by the next available agent, regardless of where they are physically located. With the necessary staffing adjustments in the sites affected, the impact to the program will be minimal. In the absence of an FCE platform, it is crucial that alternate sites be identified for each of your locations. Contingency plans, along with the necessary infrastructure amendments, must be put in place to allow for work to be easily transitioned from one location to another. The longer it takes to transition the work, the greater the likelihood that your clients may choose to take the work internal, or move it to another vendor. 6.1.3 Home agents Many Fortune 500 companies are now investing heavily in a home-based solution. It is believed by the Gartner Group that approximately ten percent of all contact centres scattered throughout the United States are relying on the skills and services of "home sourced" agents for the widespread success of their business. A home sourced employee can be recruited from far outside the normal catchment (Pandemic) area than an employee that commutes and tend to be more mature, better educated and more stable than traditional contact centre agents. With less turnover more confidence and focus it is no wonder that quality scores often exceed those of their bricks and mortar counterparts. A ready source of home agents ought to be identified and engaged immediately so that you have a reliable pool available when you need it.

18

6.1.4 Hot/cold Sites Due to technology and public infrastructure constraints outside North America, the use of home-based agents may not be a viable solution for you. One possibility being considered is to always build one (1) site out, as needed, to act as a reserve or stand-by. The plan might be to start to build for an additional 500 seats. A pay-as-you-go model will allow you to build a site ahead of time and not use or pay for it until this is needed. Another possibility is to recruit and have a pool of staff on stand-by, preferably in another off-shore location, which you can call upon and enter into training on short notice. The obvious risk is that agents will not wait indefinitely, and may find other employment before you realize a need. Under this scenario, condensed training could begin within 24 hours, providing additional staffing at the off-shore rate the clients are used to. 6.2 Requirements for full redundancy 6.2.1 IT redundancy In order to provide and ensure full (100%) redundancy, you can discuss implementing additional capacity for systems and telecom by implementing the following equipment upgrades:

• Based on the peak seat requirement provided by the program manager, provision additional systems in each of your data centers, resulting in enough capacity for either data centre to handle 100% of the peak load.

• Based on the peak seat requirement provided by the program manager, provision additional trunks in each of your data centers, resulting in enough capacity for either data centre to handle 100% of the peak load.

In order to ensure full redundancy, you might also look to the program manager to provide a second link from their to your data centre(s) for the purposes of providing redundancy in call delivery and systems access. 6.2.2 HR redundancy In order to provide and ensure full (100%) redundancy, identify a number of options that may be considered to ensure the continued handling of program’ contacts in the event that the personnel within a site are unavailable due to a crisis or disaster. These options, as laid out in your Action Plans, ought to be discussed with the program manager to determine what measures are mutually acceptable to both, and precisely how, where, and when these options will be initiated. Look to the program manager to determine an acceptable physical location for agents, what degree of training will be deemed acceptable, whether a pool of logins (or a dedicated disaster login) can be provided, and what resources the program manager can provide to assist in the transition between teams. In all cases, you ought to have full-time Human Resources Managers, Business Managers, and Training & Quality Managers in each site who will be responsible for selection and preparation of redundant agents: You should dedicate Scheduling and Resource teams to be responsible for scheduling, notification, and resource management of redundant teams.

19

7. DRP strategy According to the BIA results, in this section is described a recovery strategy that concerns a list of available alternative manual procedures to implement in case of disaster or relevant service interruption. 7.1 Introduction The recovery strategy has been implemented considering a “worst-case” scenario. Prior to program launch, a dedicated Disaster Recovery Manager ought to be designated.

Primary Contact Office Mobile Home Email TBD TBD TBD TBD TBD Secondary Contact TBD TBD TBD TBD TBD

The identified key persons to contact for the alternative sites are: Region #1

Primary Contact Office Mobile Home Email TBD TBD TBD TBD TBD Secondary Contact TBD TBD TBD TBD TBD

Region #2

Primary Contact Office Mobile Home Email TBD TBD TBD TBD Secondary Contact TBD TBD TBD TBD TBD

Program Manager

Primary Contact Office Mobile Home Email TBD TBD TBD TBD TBD Secondary Contact TBD TBD TBD TBD TBD

The Operations Recovery Management Team is in charge of defining the strategy to follow after the disaster, according to the outage impact in terms of interruption length and on going business cycle. 7.2 Pandemic action plans Unlike a standard Disaster Recovery Plan, a proper Pandemic action plan ought to be designed around prevention and containment, as much as it is around business continuity.

7.2.1 Prevention Transmission of influenza can occur through contact (direct/indirect) with hands or items that have been contaminated by the sneezing and/or coughing of an infected individual. Careful and frequent hand washing, when done correctly, is the single most effective way to prevent the spread of communicable diseases. Instructions on proper hand washing techniques (with soap and warm water) are available to all employees. In the event of an impending Pandemic, or simply in preparation for flu season, existing posters will be refreshed, and additional posters will be placed in visible, high-traffic areas. The influenza virus is vulnerable to soap and water. Antibacterial hand wash products are not required, but waterless alcohol-based hand sanitizers (i.e. Purell® Instant Hand Sanitizer) may be used when soap is not readily available. Again, in the event of an impending Pandemic, or simply in preparation for flu season, existing dispensers will be restocked frequently, and additional dispensers will be placed in visible, high-traffic areas. After hand washing, respiratory hygiene and cough etiquette are the easiest and most reliable means of preventing employees with respiratory infections from transmitting their infection to others. In the event of an impending Pandemic, or simply in preparation for flu season, existing posters will be refreshed with new/clean version, and additional posters will be placed in visible, high-traffic areas. While a seasonal flu vaccination will not protect against pandemic influenza, employees with immune systems already weakened by a seasonal flu infection may be more susceptible to the pandemic influenza strain. As such, you may encourage employees to get seasonal flu vaccinations. In the event of an impending Pandemic, or simply in preparation for flu season, management in each site post details of public clinics, along with brief, education details regarding the value of the vaccinations. Finally, one of the most crucial elements of pandemic prevention is educating employees about the differences between the common cold and influenza.

20

21

The flu and the common cold are both respiratory illnesses, but they are caused by different viral infections. The common cold is just that – a reasonably mild seasonal illness with no lasting affects. The flu is generally worse than the common cold, with symptoms such as fever, muscle aches, fatigue, and cough more common and more intense. Colds generally do not result in serious health problems, such as pneumonia, bacterial infections, or hospitalizations. 7.2.2 Attendance management Regular attendance management is designed to fill seats and meet production requirements. Employees who are healthy and physically able to work are expected to attend all scheduled shifts. For those employees with valid reasons for their absenteeism, however, the process is also designed to express concern, offer assistance, and provide employees with an opportunity to communicate any challenges affecting their attendance. During the course of a pandemic, any employee demonstrating flu symptoms will be instructed NOT report to work. Employees should contact local health services immediately for direction on reporting and quarantine requirements, as required by law. During the course of a pandemic, escalated attendance management will be designed to ensure the health and safety of employees, both within the office and in the community. Minimum attendance requirements will likely be suspended or, at the very least, re-evaluated on a case-by-case basis. In addition, greater flexibility will be provided for reporting and documentation requirements. The last thing you want to do is penalize an employee who has the misfortune of suffering from the pandemic. Ill employees will be encouraged and required to remain at home, and allowances will be made for the need to care for ill family members. However, with increased absenteeism, forecasting and resource management during a pandemic will be a primary concerns. Assuming there are calls to be handled, there will be unique challenges in making use of the agents available (both at home and in the office). Upon completion of any absence, the suitability of an employee to return to the office will need to be determined. Demand on the health care system will likely make it unreasonable to expect medical documentation regarding the employee’s suitability to return – doctors and hospitals will be busy caring for the ill, and healthy employees will be advised to stay away. At a minimum, employees will need to wait ten days after last showing symptoms. Before entering the office, they will be subject to the same screening process as all other employees. 7.2.3 Containment Hand washing, respiratory hygiene, and cough etiquette will not only continue to be encouraged, but will be required. All supervisors, managers, and members of the Executive will be responsible for ensuring that these standard hygiene measures are enforced at every

opportunity. In order to protect other employees, failure to follow proper hygiene requirements may result in removal from the worksite. All workstations and equipment will be cleaned with neutral detergents, followed by a disinfectant solution (such as sodium hypochlorite, granular chlorine, and alcohol). In addition, ell employees will be required to wipe down their own workstations before and after their shift, using the surface cleaner & disinfectant wipes provided. Although workstation equipment cannot be avoided, as it is essential to the job of a CSR, employees will also be advised to become ‘touch aware’ - to avoid touching surfaces that are likely to have been touched by others (door handles, stair railings, etc). This is especially critical for employees who use public transportation to get to and from work. The availability and use of personal protective equipment (i.e. masks and gloves) will depend upon the nature of the employee’s role, the status of the site, and the likelihood of exposure to pandemic influenza. Surgical masks and gloves ought to be made available to all employees upon request. As soon as a pandemic situation is declared, the HVAC systems should be adjusted to increase the flow of outside air, and reduce the recirculation of potentially contaminated air within the office. In addition, whenever possible, the entire workplace should be ventilated, especially between shifts. Doors and windows should be opened, and fans used to increase outside air circulation. Finally, social distancing measures should be implemented to reduce exposure. Non-essential meetings, workshops, and training sessions should be cancelled or postponed, and conference calls and web-based seminars utilized where available. If a meeting is absolutely essential, it ought to take place in large room, and the duration ought to be minimized. Reduced staffing will make it possible to alternate workstations and/or workstation rows, as displayed below. Red blocks represent occupied seats, and white blocks represent empty seats. As shifts change, employees would be required to use seats that were vacant during the last shift, in order to provide for additional cleaning time.

22

Where the building design allows for it, call centre areas should be isolated, with no unnecessary cross-traffic.

X

X

7.2.4 Containment (security) Security during a pandemic will be the primary means of preventing the virus from entering the building. No employee or visitor should be permitted beyond the entrance without undergoing a thorough screening process. Staff should be stationed at all entrances to ensure that no persons enter the building without being screened, and without practicing the required hygiene standards. Refusal to be screened, refusal to complete any contact questionnaire, and/or refusal to sanitize before entering the site will all result in denial of access and immediate removal from the site.

23

Entrance to your sites should be restricted to employees, business critical visitors, and essential suppliers only.

Visitors screened for signs and/or symptoms prior to entering staff areas

Influenza signs /

symptoms

Direct visitor to Hand Sanitizer station

Admit visitor

NO

Require visitor to remain at Reception: absolutely no admittance to staff

areas

YES

Flu Manager conducts questionnaire (contact and travel history)

Notify on-site Flu Manager

Risk factors Refuse entry and direct to local medical facilitiesNO

Flu ManagerRefuses entryIsolates visitor (medical isolation)Contacts emergency services for transport to medical facilitiesAdvises Executive to notify visitor’s organization

YES

Flu Manager proceeds with contact tracing and isolation

24

Employees will be discouraged from conducting face to face meetings when other forms of communication will suffice.

Employee reports (or is reported as) feeling ill

Influenza signs /

symptomsNO

YES

Flu Manager conducts questionnaire (contact and travel history)

Risk factors Advise employee to see his/her physicianNO

YES

Allow employee to return to work

Require employee to remain at workstation & notify on-site Flu

Manager

Flu Manager provides masks to neighbouring employees

Reassure neighbouring employees

Flu Manager proceeds with contact tracing and isolation

Permit return to work ONLY upon receipt of medical documentation

Flu ManagerIsolates employee (medical isolation)Contacts emergency services for transport to medical facilities

25

In compliance with Public Health directives, compiling of personal data (phone numbers, addresses, etc.) will be performed. All persons entering the building should be provided with a standard questionnaire to remain on file for a period of thirty (30) days.

Flu Manager alerted of suspected / probable pandemic flu case

Alert all potential contacts & attempts to determine who suspect came into contact with during 14 days before

signs/symptoms

Outside workplace Within workplace

Inform all potential contacts NOT to report to work for 14 days from the last

day of contact with the suspect

Ask all potential contacts to monitor their signs/symptoms and report any

changes in their health

Ask all potential contacts to bring their personal belongings to an empty room

(other than medical isolation)YESCurrently in

office

NO

Notify management of situation

Influenza signs /

symptoms

Flu ManagerIsolates employee (medical isolation)Contacts emergency services for transport to medical facilities

YES

NO

Inform all potential contacts to leave office immediately and NOT report to work for 14 days from the last day of

contact with the suspect

Arrange for transportation (where necessary) and ensure vehicle is

disinfected after use

Permit return to work after completion of leave or medical certification

Permit return to work ONLY upon receipt of medical documentation

26

27

8. DRP organization Your DRP team should be trained to guarantee the successful implementation of your plan; each team is in charge to recover specific functions. For this reason, the DRP organization assumes a fundamental relevance and it is based on a “worst-case” disaster. In case of disaster requiring resources (staff, equipments, etc.) moving to an alternative site, all the activities ought to be coordinated according to the DRP organization. The DRP staffs, therefore, is in charge to:

• Guarantee the IT resources recovery in an efficient way; • Accomplish any decision regarding impact at Company level; • Communicate with Program Manager regarding impact at Company or program level; • Report the recovery status of each activity to Company staff.

8.1 DRP organizational team The responsibility of the DRP Team is to support the implementation of emergency plans that have been defined. In case of emergency situation, it ought to be clear for everybody involved and/or affected who’s responsible for what in the plan’s execution. Contact Centre Manager

• Head of your Program Team • Responsible for joint decisions with Operations Team • Acts as single point of contact between Program Leads and operational management

Business Manager Define adequate recovery process in accordance with Program Team Overall responsibility for administrational on-site tasks of Disaster Recovery Plan

(written correspondence, meeting minutes, etc.) Communication with operational staff Calculate productivity loss

IT Team Member

Collect information about the nature and impact of any IT related disaster as well as the estimated timeframe for retrieving partial and full capacity

Acts as single point of contact between IT Support Centre and operational management

HR Manager

Collect information about the nature and impact of any HR related disaster as well as the estimated timeframe for retrieving partial and full capacity

Acts as single point of contact between HR department and operational management In case re-allocation of staff to remote location is necessary, Human Resource

Manager is responsible for organizing transportation and accommodation of operational staff.

In the event of a service impacting event, all DRP Team members should be required to review their contact details and communicate any changes to the Communications Manager, who will be responsible for updating all contact lists. Updated lists should be prepared and

28

delivered electronically to all sites, or via courier where electronic delivery is not possible due to the crisis or emergency. 8.2 DRP organization roles & responsibilities 8.2.1 Operations Management Team The Operations Management Team is responsible to:

• Implement all the recovery activity; • Guarantee the respect of IT resources Recovery Time Objective; • Support recovery activities with decisions by leadership,

The Operations Management Team consists of:

• Operations Director

Pre-disaster DRP approval Enact the DRP maintenance Guarantee staff training about DRP DRP testing authorization

Post-disaster Declare the disaster and activate the DRP Determine the plan strategy to be implemented (action plan) Define DRP staff and related alternates Coordinate all the recovery activities DRP staff travelling & living costs authorization Expenses authorization (in accordance to the defined DRP organization chart) Provide management information regarding the DRP implementation phases Coordinate communication flow (media and press)

• DRP Manager (DRP Manager)

Pre-disaster DRP Development, maintenance and updating according to scheduled revisions Appoint DRP members and alternates as required Distribute the DRP to DRP teams and their members. DRP testing activities coordination DRP staff training on DRP implementation.

Post-disaster Obtain approval to activate the DRP and the DRP Teams. Notify all DRP team leaders or alternates about disaster declaration. Obtain an overview of the degree of outage resulting from the disaster. Coordinate and summaries damage reports from all teams. Notify the organization’s directors about the severity of the disaster. DRP teams coordination Inform the defined alternative site of imminent activation. Notify the IT Technical Team so they can request off-site system backups,

manuals, equipment, and documentation.

29

Inform Administration Team to organize DRP Team travel and accommodation Purchases authorization for equipment, equipment repairs, software,

applications, and network systems acquisitions. Inform the Operations Recovery Management Director on the DRP

implementation status. 8.2.2 Physical Security Team The Physical Security Team is in charge to guarantee all the actions related to:

• Personnel identification; • Building access management; • Coordination with emergency personnel. • Physical Security Team (Facilities)

Pre-disaster

Train employees in order to prepare them for emergencies. Obtain and update list of individuals authorized to have access to the disaster

site, the recovery site, and to electronic protected health information Know the detailed emergency contacts list Be involved in the DRP training session.

Post-disaster Assess damage to entries to the disaster site. Collaborate with emergency personnel. Provide barriers to restrict unauthorized data centre access and organize the

building security Coordinate with Facility Management the building access management Guarantee the transportation security of all the information/equipments Support and assist all the official damaged site survey.

30

8.2.3 Administration Team The DRP Administration team is in charge to guarantee all the actions related to:

• Administrative activities (procurement, housing matters, off-site storage…) • Manage limited quantity of money for emergency expenses (not for capital

equipments and salaries)

• DRP Administration Team

Pre-disaster Train employees in order to prepare them for emergencies Guarantee the maintenance of all the needed insurance contracts Maintain and assure the sufficient level of fund to be available during the

recovery period Be involved in the DRP training session Evaluate requirement for alternative communication media in case of IT

resources unavailability Post-disaster

Manage the procurement process (procurement form approval, requests deployment, new IT resources delivery)

Payment of all the recovery costs (manage the invoicing process) Manage housing and travelling tasks for the DRP teams Provide for alternative media in case of IT resources unavailability Support the DRP teams administration activities Track and maintain all the critical/sensitive documents/actions implemented

during the recovery period

31

8.2.4 Information Technology Technical Team The IT Technical Team is in charge to install and configure all the IT resources as applications on the LAN.

• IT Technical Team

Pre-disaster Collaborate with Operations Management Team to guarantee physical

security of IT resources (e.g. LAN) Employees training with the aim of prepare them for emergencies. Guarantee the backup policy respect Be involved in the DRP training session

Post-disaster Initialize new media as needed in the recovery process. Obtain backup media from the off-site location. Adapt IT resources configuration taking into account the alternative site

features. Guarantee the respect of procedures regarding the moving of the backup media

from and to the off-site storage in accordance to the off-site storage vendor. Manage the moving procedure from and to alternative site (s) Recover all the IT operations using backup media

Test all the recovered IT software systems Collaborate with Hardware and Communication teams during the

recovery phase in order to re-establish operations Guarantee monitoring of the alternative site security Organize the entire moving from the old site to the alternative site

• Hardware Team

Pre-disaster

Collaborate with Operations Management Team to decrease the risk of disaster in the data centre.

Employees training with the aim of prepare them for emergencies. Maintain current LAN and related systems configuration in off-site storage Be involved in the DRP training session

Post-disaster Plan and install new Hardware in the old site if recoverable Check the capacity of the alternative site according to the occupancy

requirements (e.g. space needed). Notify the recovery site of impending occupancy Interface with the IT Technical and Operation Teams about the space

configuration planned in the alternative site Guarantee the necessary equipment transportation to alternative site(s) Communicate to the Administration Team the equipment status and related

purchase order Manage the hardware installation in the alternative site Manage the hardware installation in the permanent site when available. Manage the moving procedure from and to the alternative site

32

• IT Telecommunications

Pre-disaster Collaborate with Operations Management Team to guarantee physical

security of IT resources/facilities Employees training with the aim of prepare them for emergencies. Maintain current network configuration in off-site storage Be involved in the DRP training session

Post-disaster Coordinate with the IT Technical and IT Operations Teams to determine

communication and network equipment needs. Coordinate with Administration Team to procure needed communication

equipment. Coordinate with Administration Team to procure needed cabling. Manage the recovery process to guarantee ICT network links recovery on the

alternative site using the current network configuration stored off-site

33

9. DRP emergency procedures These emergency procedures should be established with the aim to define the steps to follow during the recovery process to a hot/cold site, alternate site(s), or return to a quarantined site. These procedures, created to be a dynamic frame in accordance with requirements of your business, should be developed with the objective to:

• Reduce the level of confusion that a disaster generates; • Track each recovery activity; • Reduce IT resources damages and personnel injury risks; • Define a time frame for the damage and injuries communication • Supporting the recovery of all the IT resources in accordance.

In addition, it is necessary underline that:

• These procedures define the recovery process supporting the business; • Staff safety is always the top priority; • All the DRP teams ought to fully understand their roles and responsibilities in the

procedures implementation. For these reason, the emergency procedures are divided in several groups as follows:

o Pandemic Procedures Form; o Operations Management; o Physical Security; o Administration; o Hardware; o Information Technology (IT) technology; o Telecommunications; o Information Technology (IT) operations

34

9.1 Pandemic procedures form PURPOSE This form has been created to declare a pandemic and define an action plan

oriented to reduce IT resources damages and personnel injury risks. Staff safety is always the top priority – in case of personnel risk, immediately

leave the facility INFORM OFFICE MANAGERS Immediately inform the appropriate Business Manager(s)

Name Telephone Cellular In case of Business Manager being unavailable, escalate the information to his or her Call Centre Manager.

Name Telephone Cellular Initials:

Date:

Time:

INFORM OPERATIONS MANAGEMENT TEAM Immediately Inform the Operations Management Director / Manager.

Name Extension Phone Numbers Home:

Cellular: Home:

Cellular: Home:

Cellular: Home:

Cellular: Initials:

Date:

Time:

EVACUATION The building has been evacuated as emergency personnel communication: Initials:

Date:

Time:

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY

PERSONNEL GIVE PERMISSION

35

9.2 Operations recovery management checklist PURPOSE This form has been created to:

• Decide the recovery plan to apply; • Manage the DR process; • Inform user about the disaster; • Evaluate the disaster consequence in terms of IT resources outage; • Take decisions at management level.

ACTIVATION APPROVAL Obtain approval for DRP activation and the use of the alternative site, if necessary. (Obtain approval from senior manager or from appropriate executive director). Initials:

Date:

Time:

PANDEMIC NOTIFICATION Inform remaining Operations Management Team members, other Recovery Team members, and appropriate vendors of the disaster. Initials:

Date:

Time:

STATUS BRIEFING Coordinate and assemble all team representatives or members at the designated site for a briefing on the impact of the quarantine, escalation plan, and support required. The briefing with all Recovery Team members should appraise the severity of the disaster and to determine:

• Travel and hotel arrangements (from Administrative Team) • Equipment acquisitions (from Information Technology Team or Administrative Team), • Software, applications and network systems acquisitions, (from the Information

Technology Team), and • Equipment repairs (from the Hardware Installation Team).

Initials:

Date:

Time:

RECOVERY LOCATION Determine where the recovery will take place, at the home office or at the alternative site. This will be the responsibility of the Operations Director. Initials:

Date:

Time:

36

NOTIFICATION Inform the management/responsible about the disaster severity and evaluated recovery time; Initials:

Date:

Time:

MONITOR FUNCTIONS Supervise DRP teams in charge to recovery the operations at the alternative site Initials:

Date:

Time:

ASSISTANCE Support the Recovery Teams with any issue that needs management participation. Initials:

Date:

Time:

COORDINATION Coordinate and assist the Operations Management Teams during any recovery activity. This will be the responsibility of the Operations Manager, who will then report to the Operations Management Director. Initials:

Date:

Time:

PROGRAM CONTACT Manage relationships with clients impacted by the disaster. Initials:

Date:

Time:

PRESS CONTACT Manage relationships with media regarding the disaster impact and facility’s current status. Initials:

Date:

Time:

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY

PERSONNEL GIVE PERMISSION

37

9.4 Physical security checklist PURPOSE This form provides a checklist to guarantee the physical security of:

• The location impact by the disaster; • The alternative site; • All the documents/equipments in-transit to the alternative site, considered

necessary to restore the production process. • It is to be used by the Physical Security Team.

RECOVERY SITE Following the disaster communication by the Operations Recovery Management Team, a meeting is arranged at the designated site for a briefing on:

• Damages evaluation; • Definition of the escalation plan; • Identify the security support required.

Initials:

Date:

Time:

AUTHORIZED PERSONNEL List the individuals who have been authorized to have access to the building, data centre, or other types of access immediately after a disaster.

Team Authorized members Type of access

Emergency Personnel (includes law enforcement, fire department personnel, etc.)

Operations Management Team Members

Physical Security Team

Administration Team

Information Technology Team

38

Team Authorized members Type of access

PHYSICAL SECURITY Guarantee the physical security of the damaged area permitting the access only to the authorized personnel. Required Considerations in the Level of Security Yes No Is the damaged area and related access points safe? Did the disaster impact and damage only office? Is the access restriction due to the level of damage Is it necessary to protect the site from possible vandalism? Initials:

Date:

Time:

COORDINATION OF ACCESS If the building access is coordinated by a Building Management Company, the Building Management Company contact is Name: Address: 8AM to 5PM telephone

number:

24 Hour Telephone Number:

Cellular telephone number:

Email address:

Initials:

Date:

Time:

IN-TRANSIT SECURITY Guarantee physical security of all the documents/equipments in-transit to the alternative site Initials:

Date:

Time:

INVESTIGATIVE PERSONNEL Guarantee physical security of personnel who access to the building Initials:

Date:

Time:

The Physical Security Team should not release any public communication related to the disaster impact or caused damages

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY PERSONNEL GIVE PERMISSION

39

9.5 Administration Checklist PURPOSE This form is to be used to guarantee the support to all DRP teams in

administrative activities as, for example, managing the procurement process or housing and travelling organization.

RECOVERY SITE Following the disaster communication by the Operations Management Team, a meeting is arranged at the designated site for a briefing on:

• Damages evaluation; • Definition of the escalation plan; • Identify the security support required.

Initials:

Date:

Time:

PROCUREMENTS Coordinate the procurement process in order to submit all the requests made by the DRP teams to the Operations Management Team for authorization Initials:

Date:

Time:

DOCUMENTATION Inform the DRP teams about the communicated delivery dates. Maintain evidence of each request and delivery time frame. Guarantee the respect of the procurement process by suppliers/vendors/IT carriers. Initials:

Date:

Time:

TRAVEL ACCOMMODATIONS Guarantee the housing and travelling organization for the DRP teams as required by the Operations Management Team Initials:

Date:

Time:

COMMUNICATIONS According to Operations Management Team requirement, coordinate the new equipment procurement, delivery and installation process.

40

Team member Type of equipment/service

Emergency telephone number

Initials:

Date:

Time:

SUPPORTIVE SERVICES According to Operations Management Team requirement, guarantee the administrative support.

Name of support personnel

Type of service Contact information

Initials:

Date:

Time:

The Administration Team should not release any public statement related to the disaster impact or caused damages

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY PERSONNEL GIVE PERMISSION

41

9.6 Hardware Checklist PURPOSE This form is to be used by the Information Technology Team to manage all

the activities related to the hardware installation (from the action plan to the equipment test) coordinating also all the vendors/suppliers/IT carriers

RECOVERY SITE Following the disaster communication by the Operations Management Team, a meeting is arranged at the designated site for a briefing on:

• Damages evaluation; • Definition of the escalation plan; • Identify the security support required.

Initials:

Date:

Time:

RECOVERY SITE NOTIFICATION If the alternative site use is necessary, contact the alternative site management in order to check the capacity of the alternative site according to the occupancy requirements; Site contacted:

Date:

Time:

Initials:

Date:

Time:

RECOVERY SITE INSPECTION If the alternative site use is necessary, check on site the capacity of the alternative site according to the occupancy requirements Initials:

Date:

Time:

Notes: EQUIPMENT REQUIRED Consider the DRP IT resources Inventory list as a reference to define the hardware requirements Initials:

Date:

Time:

List of equipment required

42

List of equipment required SALVAGED EQUIPMENT Collaborate with Damage Assessment and Salvage Team in order to get an updated list of the restorable hardware equipments. Initials:

Date:

Time:

ADDITIONAL EQUIPMENT Collaborate with Administration Team to receive support in the procurement activities regarding additional hardware equipments needs. Initials:

Date:

Time:

List of additional equipment required

EQUIPMENT RETRIEVAL Take back the IT resources from the off-site storage vendor. Initials:

Date:

Time:

List of equipment to retrieve

43

INITIAL CONNECTIONS Provide a temporary equipments [the type and number of these is a local decision] installation in the restored site (or in the alternative site if needed) in order to re-start the production process, Initials:

Date:

Time:

INSTALLATION AND CONNECTIONS Manage the hardware installation process collaborating with DRP teams. In case of use the alternative site, coordinate the equipments installation process, also with the alternative site management. Initials:

Date:

Time:

The Information Technology Team should not release any public statement related to the disaster impact or caused damages

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY PERSONNEL GIVE PERMISSION

44

9.7 IT technical team checklist PURPOSE This form is to be used by the Communication team in order to support any

activities regarding the ICT network restoration (network design, installation, and verification).

RECOVERY SITE Following the disaster communication by the Operations Management Team, a meeting is arranged at the designated site for a briefing on:

• Damages evaluation; • Definition of the escalation plan; • Identify the security support required.

Initials:

Date:

Time:

INVENTORY Consider the DRP IT resources Inventory list as a reference to define the ICT network equipment requirements Initials:

Date:

Time:

SALVAGE AND REPAIR Collaborate with Damage Assessment and Salvage Team in order to get an updated list of the restorable ICT network equipments. Initials:

Date:

Time:

PROCUREMENT Collaborate with Administration Team to receive support in the procurement activities regarding additional ICT network equipments and connection needs. Initials:

Date:

Time:

NETWORK CABLING Collaborate with Administration Team to receive support in the procurement and installation activities regarding network cabling needs. Initials:

Date:

Time:

45

OFF-SITE STORAGE Retrieve configuration of communication links from the off-site storage area and make it available to the appropriate technicians for installation. Initials:

Date:

Time:

INSTALLATION Plan, coordinate, and install communication equipment and network cabling at the alternative site. If remaining at damage site, plan, coordinate, and install/repair communication equipment and network cabling. Initials:

Date:

Time:

The Telecommunication Team should not release any public statement related to the disaster impact or caused damages

THE TEAM SHALL NOT ENTER THE QUARANTINE AREA UNTIL EMERGENCY PERSONNEL GIVE PERMISSION

46

10. DRP training, maintenance, and testing administration The DRP is not a static document. Its effectiveness and efficiency is promoted through an administration process that is implemented to ensure continued:

• Maintenance actions; • Staff training sessions; • Testing phases.

It is fundamental to understand that the success of a DRP is based on the awareness of the present document by the management team as a whole (not just by the IT managers) and their capacity to promote the DRP content/intent to the staff. The DRP administration activities are owned by the designated DRP Manager. 10.1 DRP management The DRP Manager is a key player in the DRP organization. He/she is responsible for managing aspects related to the DR process, such as:

• Responsible for the plan administration; • Member of the Operations Management Team during the disaster.

10.1.1 DRP distribution Regarding the DRP distribution process, it is prudent that:

• The document be protected as confidential, as it contains sensitive information such as critical processes, recovery strategy and personnel details;

• The document ought to be archived in a secure location; • A copy of the document ought to be stored in an external site; • It is forbidden to create an unauthorized copy of the document; • Each DRP team member ought to have a copy of the DRP which needs to be stored

in a secure location outside the office (e.g. place of residence); • Regarding the DRP off-site copies, each individual ought to be trained to start the

recovery in case of major disaster impacting the facility. 10.1.2 DRP maintenance Document maintenance ought to be completed when the following actions take place:

• Business Impact Analysis (BIA) update - The DRP ought to be updated at every BIA review. The BIA ought to be maintained within the DRP. As IT resources are added, or other are dismissed, the Software and Hardware Asset lists, their priority, and related impact on the business in case of outage, ought to be revised annually. The business impact reduction and the success of any recovery action is based on a correct and actual BIA.

• DRP test implementation – The DRP ought to be updated with the results of each plan test.

47

10.1.3 DRP training Training sessions ought to be oriented to:

• Train the identified DRP teams members that are in charge to process the plan in case of disaster;

• Train identified key individuals (e.g. department responsible) to: o Prevent a disaster; o Be aware about DRP and, particularly, about the recovery procedure;

Training sessions will be designed in a modular fashion and delivered online. This will allow you to update and re-train individual elements on short notice, without requiring completion of the full training curriculum again. Successful completion should be tracked via certifications resulting from online testing. Certification logs should be compared against the list of required participants on a regular basis to prompt respective managers to drive their staff to completion. It ought to be clear that the training is a key activity in order to successfully apply the DRP. In addition, the DRP Manager ought to be continually supported by your key user management because:

• their availability for future training session ought to be guaranteed; • as written in the paragraph 8.1.2, all the business operations changes/expansions

ought to be communicated to the DRP Manager so that he will be able to correctly update the document, maintaining the DRP efficiency and efficacy.

Any changes to the DRP may result in the implementation of additional staff training. 10.1.4 DRP testing Annual testing ought to be oriented to evaluate the DRP capacity to recover all the critical processes. Every time significant changes to DRP are implemented, a test should occur to validate the proper function of the DRP. The DRP ought to be tested with the aim to:

• Define if the DRP implementation guarantees the complete IT operations recovery within the identified time frame;

• Evaluate the efficacy of the DRP procedures; • Assess the level of promptness and capability of DRP teams in recovery procedures

implementation; In order to minimize the impact to you and your programs, physical testing of IT resources should be conducted during non-peak hours, with prior notification and approval of the Program Manager to ensure that your efforts are aligned with their needs. Following the test, the DRP Manager is responsible for evaluating the test results:

• Understand the DRP and the test objective; • Supervise the test activity implemented by the DRP teams; • Evaluate the test results from the point staff involved point of view, documenting

findings gathered during the DRP test.

48

The DRP Test team shall gather the test results that should be discussed during the “closing activity meeting” arranged by the DRP Manager. According to the meeting outcomes, the DRP manager ought to update the DRP document.

11. Return to normal business The DRP Manager is responsible for monitoring and communicating the status of a pandemic. Once the all-clear has been received from all health authorities concerned, this ought to be contacted to the DRP Organizational Team. It will be their responsibility to declare the pandemic over and to return all your policies and practices to normal business. 11.1 Evaluation of effectiveness During the pandemic, changes will invariably be made to the overall pandemic plan. These will be captured in this document wherever possible, but there is the possibility that small changes may be overlooked amid other more immediate business continuity concerns. Within 30 days of a return to normal business, the members of the DRP Organizational Team ought to be responsible for reporting on how their individual areas of concern were impacted by the pandemic and the pandemic plan. Challenges, changes, and opportunities ought to be recorded, along with any recommendations. The experience may lead to changes in how you conduct business normally, or simply in how you will conduct business during the next crisis. In addition, a management (and possibly even an employee) survey will be conducted to discover how effective the plan was at an employee level.

12. Appendices 12.1 Software assets

Application Type Description Used By Host Server Access Team

49

50

12.2 Hardware assets #1 Data Center

Item Model # Vendor support IT lead #2 Data Center

Item Model # Vendor support IT lead

51

12.2.1 Vendor contacts (hardware) Site specific contacts for essential supplies (ex. phones, computers, etc.) and services (ex. generator maintenance, utilities, etc.) relating to site infrastructure should be documented. This will ensure that contact can be made, and repairs/replacements arranged, even in the absence of the manager responsible. 12.2.2 Vendor contacts (telecom) Site specific contacts for essential services (ex. landline, cellular, broadband, etc.) relating to telecommunications infrastructure should be documented. This will ensure that contact can be made, and repairs/replacements arranged, even in the absence of the manager responsible. 12.3 UPS & generator status In order to ensure business continuity, it is strongly recommended that you document the operating capacities of all generator and UPS units, as well as the basic operating procedures (i.e. is there a delay, is manual switching required) and the physical location of each unit. Service technicians and fuel suppliers should be documented in the Vendor Contacts section above.

12.4 IT escalation process If you have a standard escalation process documented for IT related issues and outages, it should be reproduced here. When dealing with alternate sites and failovers between sources of power, there is always the possibility that systems will fail or require manual intervention.

52

Transcom is a global outsourced service provider entirely focused on customers, the service they experience and the revenue they generate. Our customer and credit management services are designed to strengthen our clients' customer relationship and secure their revenue streams. Our broad service portfolio supports every stage of the customer lifecycle, from acquisition, through service, retention, cross and upsell, then on through early and contingent collections to legal recovery. Expert at managing both customers and debt, we make a positive contribution to our clients' profitability by helping them win customers, grow business and secure their payments. And, while our services are designed to maximize revenue, our delivery operations are built to drive efficiency. Through our global network we can provide service in any country where our clients have customers, accessing the most appropriate skills and deploying the best communication channels in the most cost-effective locations. Every day we handle over 600,000 customer contacts in 33 languages for more than 350 clients, including brand leaders in some of today's most challenging and competitive industry sectors. The experience we gain is used to constantly refine our service portfolio and processes and delivery, allowing us to respond quickly to changing market conditions and client requirements. Find out how working with Transcom could transform your customer and credit management performance. Contact us at contactus@transcom.com www.transcom.com

DISCLAIMER: This project outline is provided solely as a guide. It is only intended to be one example of requirements for a Pandemic Recovery plan. It is not our intention to suggest that it is the only way to set up a project plan.

If you are new to recovery planning, make sure that you research the subject thoroughly before embarking on a recovery project. Consider engaging a consultant (internal or external to your organization) to help you in your project planning effort. Pandemic recovery planning is not a two-month project, neither is it a project that once completed, you can forget about. An effective recovery plan is a live recovery plan. The plan ought to be maintained current and tested/exercised regularly.